)]}' { "log": [ { "commit": "550f98d6dc5d18e6fe44f56c395e5602cc2f2b4a", "tree": "88aeb17dcf1e54e6d9623eb026ba251ab29e07e4", "parents": [ "41294576aca94ffb4246dff6c82cadf4c2b58123" ], "author": { "name": "Youenn Fablet", "email": "youenn@apple.com", "time": "Wed Sep 09 08:57:54 2026" }, "committer": { "name": "Youenn Fablet", "email": "youennf@gmail.com", "time": "Wed Sep 09 08:57:54 2026" }, "message": "NetworkRTCUDPSocketCocoa should not filter AF_UNSPEC remote addresses\nrdar://186844205\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323600\n\nReviewed by Chris Dumez.\n\nBy providing nw_ip_options_set_version, we allow restricting to connecting to IPv4 or IPv6 addresses.\nWhen being given an adress with an unresolved name, we do not know whether it will be IPv4 or IPv6.\nIn that case, we should not call nw_ip_options_set_version.\nOtherwise, we risk resolving the address but failing to connect as the resolved address is not IPv6.\n\nBefore the PR, we would call nw_ip_options_set_version, reducing to IPv6 for both AF_INET6 and AF_UNSPEC.\nWe are now correctly restricting to IPv4 for AF_INET, to IPv6 for AF_INET6 and we do not restrict for AF_UNSPEC.\n\nThis cannot be tested right now that NetworkRTCUDPSocketCocoa only works on resolved IP addresses.\nA follow-up patch may enable this code path.\n\n* Source/WebKit/NetworkProcess/webrtc/NetworkRTCUDPSocketCocoa.mm:\n(WebKit::NetworkRTCUDPSocketCocoaConnections::configureParameters):\n(WebKit::NetworkRTCUDPSocketCocoaConnections::createNWConnection):\n* Source/WebKit/NetworkProcess/webrtc/NetworkRTCUtilitiesCocoa.h:\n* Source/WebKit/NetworkProcess/webrtc/NetworkRTCUtilitiesCocoa.mm:\n(WebKit::toNWIPVersion):\n\nCanonical link: https://commits.webkit.org/320716@main\n" }, { "commit": "41294576aca94ffb4246dff6c82cadf4c2b58123", "tree": "1b185acfa341437eb01e8810d78b428daf4c1907", "parents": [ "3511efda2e7d0177ba2ac2ba256c72393b61e55f" ], "author": { "name": "Sergey Rubanov", "email": "chi187@gmail.com", "time": "Wed Sep 09 08:39:09 2026" }, "committer": { "name": "Sergey Rubanov", "email": "chi187@gmail.com", "time": "Wed Sep 09 08:39:09 2026" }, "message": "[JSC] Atomics.isLockFree should use ToIntegerOrInfinity\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323323\n\nReviewed by Yusuke Suzuki.\n\nAtomics.isLockFree used ToInt32. A size such as 4294967297 wrapped to 1\nand returned true. The spec compares the exact ToIntegerOrInfinity\nresult to 1, 2, 4, and 8.\n\n* Source/JavaScriptCore/runtime/AtomicsObject.cpp:\n* JSTests/stress/atomics-is-lock-free-integer.js: Added.\n\nCanonical link: https://commits.webkit.org/320715@main\n" }, { "commit": "3511efda2e7d0177ba2ac2ba256c72393b61e55f", "tree": "75ccd1da7e322645ea8047788d46da9afb5d097b", "parents": [ "b5e22724aed8542385e3a8513dcb7361cd3bbfe9" ], "author": { "name": "Zak Ridouh", "email": "zakr@apple.com", "time": "Wed Sep 09 07:31:13 2026" }, "committer": { "name": "Zak Ridouh", "email": "zakr@apple.com", "time": "Wed Sep 09 07:31:13 2026" }, "message": "[Site Isolation] [iOS] File picker menu is anchored to the bottom of the screen in a cross-origin iframe\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d321139\nrdar://182136484\n\nReviewed by Alex Christensen.\n\nTapping \"Choose File\" in a cross-origin iframe showed the source menu at the bottom of the screen\ninstead of next to the button.\n\nUIKit anchors that menu to the UITargetedPreview WKFileUploadPanel returns from\n-contextMenuInteraction:configuration:highlightPreviewForItemWithIdentifier:, which the panel built\nfrom WKContentView\u0027s _positionInformation. That is hit tested in the main frame\u0027s process only, so\nover a cross-origin iframe it found the \u003ciframe\u003e element and yielded no bounds.\n\nSend the element\u0027s own rect with the open panel request instead, like the color, datalist, date/time\nand popup menus do. FileInputType::fileChooserSettings() takes it from\nFrameView::convertToRootViewAcrossIsolatedFrames(), which crosses remote frame boundaries in\nprocess, so a site-isolated frame costs no extra IPC. showPicker() can follow a style change with no\nlayout in between, so it now updates layout before reading the box.\n\nWKFileUploadPanel anchors the menu, the highlight preview, and the keyboard check in\n-repositionContextMenuIfNeeded: to that rect. An input scrolled out of view or positioned offscreen\nto hide it behind a custom upload button has no usable box, and falls back to the interaction\nlocation as before. This also fixes HTMLInputElement.showPicker(), which follows no tap and so used\na stale location.\n\nTest: Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolation.mm\n\n* Source/WebCore/html/FileInputType.cpp:\n(WebCore::FileInputType::showPicker):\n(WebCore::FileInputType::fileChooserSettings const):\n* Source/WebCore/platform/FileChooser.h:\n* Source/WebKit/Shared/WebCoreArgumentCoders.serialization.in:\n* Source/WebKit/UIProcess/API/APIOpenPanelParameters.h:\n(API::OpenPanelParameters::elementRectInMainFrameViewCoordinates const):\n* Source/WebKit/UIProcess/ios/WKContentViewInteraction.h:\n* Source/WebKit/UIProcess/ios/WKContentViewInteraction.mm:\n(-[WKContentView _createTargetedContextMenuHintPreviewForRootViewRect:]):\n* Source/WebKit/UIProcess/ios/forms/WKFileUploadPanel.mm:\n(-[WKFileUploadPanel presentWithParameters:resultListener:]):\n(-[WKFileUploadPanel contextMenuInteraction:configuration:highlightPreviewForItemWithIdentifier:]):\n(-[WKFileUploadPanel repositionContextMenuIfNeeded:]):\n(-[WKFileUploadPanel showDocumentPickerMenu]):\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolation.mm:\n(TestWebKitAPI::menuAnchorRectAfterOpeningFilePicker):\n(TestWebKitAPI::(SiteIsolation, FileUploadPanelAnchorRectInCrossOriginIframe)):\n(TestWebKitAPI::(SiteIsolation, FileUploadPanelAnchorRectInNestedCrossOriginIframes)):\n(TestWebKitAPI::(SiteIsolation, FileUploadPanelAnchorRectWithScrolledMainFrame)):\n(TestWebKitAPI::(SiteIsolation, FileUploadPanelAnchorRectInMainFrameIsNotOffset)):\n(TestWebKitAPI::(SiteIsolation, FileUploadPanelAnchorRectForHiddenInputInCrossOriginIframe)):\n\nCanonical link: https://commits.webkit.org/320714@main\n" }, { "commit": "b5e22724aed8542385e3a8513dcb7361cd3bbfe9", "tree": "2cf8a5b5499f27686030a9e1ebcd914b2ba2dbba", "parents": [ "8ff57ddb452aaa28d0d425aea6dc22b5ee3fb2e3" ], "author": { "name": "Kimmo Kinnunen", "email": "kkinnunen@apple.com", "time": "Wed Sep 09 07:03:11 2026" }, "committer": { "name": "Kimmo Kinnunen", "email": "kkinnunen@apple.com", "time": "Wed Sep 09 07:03:11 2026" }, "message": "ANGLE: Simplify memory tagging implementation\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323657\nrdar://186904939\n\nReviewed by Dan Glastonbury.\n\nSimplify the implementation, don\u0027t use has_include.\n\n* Source/ThirdParty/ANGLE/ANGLE.xcodeproj/project.pbxproj:\n* Source/ThirdParty/ANGLE/GLESv2.cmake:\n* Source/ThirdParty/ANGLE/src/common/PoolAlloc.cpp:\n(angle::PoolAllocator::Segment::~Segment):\n(angle::PoolAllocator::Segment::Allocate):\n(angle::PoolAllocator::allocateSingleObject):\n* Source/ThirdParty/ANGLE/src/common/PoolAlloc.h:\n(angle::PoolAllocator::allocate):\n* Source/ThirdParty/ANGLE/src/common/PoolAlloc_unittest.cpp:\n(angle::TEST_F(PoolAllocatorTest, ResetRecyclesMemory)):\n* Source/ThirdParty/ANGLE/src/libGLESv2.gni:\n\nCanonical link: https://commits.webkit.org/320713@main\n" }, { "commit": "8ff57ddb452aaa28d0d425aea6dc22b5ee3fb2e3", "tree": "731e25d38568f8ce34cd94a61991b6f875a41960", "parents": [ "169c737cae5df91b33f85474dd9930d433447e54" ], "author": { "name": "Kristian Monsen", "email": "k_monsen@apple.com", "time": "Wed Sep 09 06:59:02 2026" }, "committer": { "name": "Kristian Monsen", "email": "k_monsen@apple.com", "time": "Wed Sep 09 06:59:02 2026" }, "message": "ASSERTION FAILED: layer.renderer().isStickilyPositioned() with -webkit-box-reflect on a position:sticky element\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323569\nrdar://186812790\n\nReviewed by Matt Woodrow.\n\nrendererForCompositingTests() substitutes the reflected renderer for a\nRenderReplica, so requiresCompositingForPosition() can read position:sticky off\nthe reflected element while `layer` is the replica\u0027s layer. It then passes that\nlayer to isAsyncScrollableStickyLayer(), whose ASSERT is about\nlayer.renderer().isStickilyPositioned() - and a RenderReplica is statically\npositioned. In release builds the assert compiles out and the wrong layer is\nwalked, which can only produce a wrong compositing decision for the reflection.\n\nAsk about the sticky renderer\u0027s own layer instead, matching what the other two\nusers of rendererForCompositingTests() already do: requiresCompositingLayer()\nand reasonsForCompositing() both pass *renderer.layer() rather than the layer\nthey were given. For every other caller renderer.layer() \u003d\u003d \u0026layer, so there is\nno behavior change.\n\nTest: compositing/reflections/assert-on-sticky-position-with-reflection.html\n\n* LayoutTests/compositing/reflections/assert-on-sticky-position-with-reflection-expected.txt: Added.\n* LayoutTests/compositing/reflections/assert-on-sticky-position-with-reflection.html: Added.\n* Source/WebCore/rendering/RenderLayerCompositor.cpp:\n(WebCore::RenderLayerCompositor::requiresCompositingForPosition const):\n\nCanonical link: https://commits.webkit.org/320712@main\n" }, { "commit": "169c737cae5df91b33f85474dd9930d433447e54", "tree": "b52629f6c47bbd725a1fa964adc1ea95323bd51e", "parents": [ "8854738a99112e8e38814bce4f6726b24928e0fe" ], "author": { "name": "Kimmo Kinnunen", "email": "kkinnunen@apple.com", "time": "Wed Sep 09 06:01:08 2026" }, "committer": { "name": "Kimmo Kinnunen", "email": "kkinnunen@apple.com", "time": "Wed Sep 09 06:01:08 2026" }, "message": "GPUP spends time setting canvas backing store IOSurfaces as non-volatile\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323661\nrdar://186907856\n\nReviewed by Mike Wyrzykowski.\n\nCalling into IOKit setting IOSurfaces non-volatile when they are\nnon-volatile is relatively slow operation. This happens when\nsurfaces are created.\n\nFix by caching the state locally.\n\nTest: Tools/TestWebKitAPI/Tests/WebCore/cocoa/IOSurfaceTests.mm\n\n* Source/WebCore/platform/graphics/cocoa/IOSurface.h:\n* Source/WebCore/platform/graphics/cocoa/IOSurface.mm:\n(WebCore::IOSurface::state const):\n(WebCore::IOSurface::isVolatile const):\n(WebCore::IOSurface::setVolatile):\n* Tools/TestWebKitAPI/Tests/WebCore/cocoa/IOSurfaceTests.mm:\n(TestWebKitAPI::TEST(IOSurfaceTest, Volatility)):\n\nCanonical link: https://commits.webkit.org/320711@main\n" }, { "commit": "8854738a99112e8e38814bce4f6726b24928e0fe", "tree": "c0b7d0346336579fda08d4f442c3cb52fbccd54e", "parents": [ "c39e0c34e9e712b7b075cdc427b1c7a411dadf67" ], "author": { "name": "Charlie Wolfe", "email": "charliew@apple.com", "time": "Wed Sep 09 05:42:51 2026" }, "committer": { "name": "Charlie Wolfe", "email": "charliew@apple.com", "time": "Wed Sep 09 05:42:51 2026" }, "message": "Hash and compare only the used characters of a TextMeasurementCache SmallStringKey\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323724\nrdar://186973909\n\nReviewed by Gerald Squelart.\n\nSmallStringKey stores text inline in a zero-filled 64-entry char16_t array, and hashed all 128 bytes\nof it no matter how short the string was. The defaulted operator\u003d\u003d also compared the whole array on\nevery probe. Hash only the first length code units, and compare m_hashAndLength first. It packs both\nthe hash and the length, so a mismatched bucket costs one word compare and only a match compares\ncharacters. The trailing bytes were always zero, so the same strings hash and compare equal as\nbefore.\n\n* Source/WebCore/platform/graphics/TextMeasurementCache.h:\n(WebCore::TextMeasurementCache::SmallStringKey::SmallStringKey):\n(WebCore::TextMeasurementCache::SmallStringKey::operator\u003d\u003d):\n\nCanonical link: https://commits.webkit.org/320710@main\n" }, { "commit": "c39e0c34e9e712b7b075cdc427b1c7a411dadf67", "tree": "b5b939b87ead01bd904198e97b537091e4f4c66f", "parents": [ "cd543806fd1f2c16ce41fef6e2bae593079ad644" ], "author": { "name": "Charlie Wolfe", "email": "charliew@apple.com", "time": "Wed Sep 09 05:30:06 2026" }, "committer": { "name": "Charlie Wolfe", "email": "charliew@apple.com", "time": "Wed Sep 09 05:30:06 2026" }, "message": "Avoid computing canvas path bounds when the whole backing store is already dirty\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323688\nrdar://186946552\n\nReviewed by Simon Fraser.\n\nfillInternal() and strokeInternal() always computed a dirty rect, only for willUpdateContents() to\ndiscard it and invalidate with std::nullopt whenever m_dirtyRect already contained it. Take that\npath directly instead. In an animation loop that starts each frame with a full-canvas clearRect(),\nevery following fill and stroke was paying for a bounding box nobody read.\n\nThis is limited to !USE(COORDINATED_GRAPHICS), where m_dirtyRect is replaced per draw rather than\nunited, so the real rect is still needed there.\n\nThis also requires fixing isEntireBackingStoreDirty(), which tested m_dirtyRect against\nbackingStoreBounds() for equality. Accumulated rects are inflated by 1 to cover antialiasing, which\nis on by default, so the equality never held. Use contains() on the accumulating ports. No\nobservable change for the existing caller, willUpdateEntireContents(), which already ended up at the\nsame invalidation.\n\n~6-7% MotionMark Canvas Lines improvement.\n\n* Source/WebCore/html/canvas/CanvasRenderingContext2DBase.cpp:\n(WebCore::CanvasRenderingContext2DBase::fillInternal):\n(WebCore::CanvasRenderingContext2DBase::strokeInternal):\n(WebCore::CanvasRenderingContext2DBase::isEntireBackingStoreDirty const):\n\nCanonical link: https://commits.webkit.org/320709@main\n" }, { "commit": "cd543806fd1f2c16ce41fef6e2bae593079ad644", "tree": "b0845ef5bad2debb03b3c0cf3c3feeebd0cd220b", "parents": [ "4dcedad7c1b592755456c340dbb39f459207672e" ], "author": { "name": "David Kilzer", "email": "ddkilzer@apple.com", "time": "Wed Sep 09 05:22:27 2026" }, "committer": { "name": "Charlie Wolfe", "email": "charliew@apple.com", "time": "Wed Sep 09 05:22:27 2026" }, "message": "REGRESSION (320694@main): WebEventConversion.cpp fails to build: use of undeclared identifier \u0027DoublePoint\u0027\n\u003chttps://bugs.webkit.org/show_bug.cgi?id\u003d323730\u003e\n\u003crdar://186982334\u003e\n\nUnreviewed build fix.\n\nQualify the `DoublePoint` references in the `WebKit2PlatformTouchPoint`\nconstructor as `WebCore::DoublePoint`, matching the qualified use\nalready present elsewhere in the file.\n\n`WebEventConversion.cpp` is in namespace `WebKit` and has no file-scope\n`using namespace WebCore;`, so unqualified `DoublePoint` does not\nresolve. The references compiled only because a sibling source file\nearlier in the same unified-source bundle contributed a file-scope\n`using namespace WebCore;` that carried through the translation unit.\n320694@main regrouped the unified-source bundles, moving this file into\na bundle where no preceding sibling supplies that directive and\nexposing the unqualified references, which have been present since\n298383@main.\n\nNo new tests since no change in behavior.\n\n* Source/WebKit/Shared/WebEventConversion.cpp:\n(WebKit::WebKit2PlatformTouchPoint::WebKit2PlatformTouchPoint):\n\nCanonical link: https://commits.webkit.org/320708@main\n" }, { "commit": "4dcedad7c1b592755456c340dbb39f459207672e", "tree": "a2a20f26af4f1878812c1390dc4132ba672d9977", "parents": [ "3cd650b072c9dc10e2b8caf665d46ea3c7eefdea" ], "author": { "name": "Charlie Wolfe", "email": "charliew@apple.com", "time": "Wed Sep 09 04:54:40 2026" }, "committer": { "name": "Charlie Wolfe", "email": "charliew@apple.com", "time": "Wed Sep 09 04:54:40 2026" }, "message": "Make `CookieStorageSession::m_sessionID` const\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323719\nrdar://186972352\n\nReviewed by Alex Christensen.\n\n* Source/WebCore/platform/network/CookieStorageSession.h:\n\nCanonical link: https://commits.webkit.org/320707@main\n" }, { "commit": "3cd650b072c9dc10e2b8caf665d46ea3c7eefdea", "tree": "8c160af51a8397accbe64115d158de937d3b12c5", "parents": [ "3821585ac8da30aeb03e57e6436cfb546050bc8f" ], "author": { "name": "Ahmad Saleem", "email": "ahmad.saleem792+github@gmail.com", "time": "Wed Sep 09 04:51:48 2026" }, "committer": { "name": "Ahmad Saleem", "email": "ahmad.saleem792@gmail.com", "time": "Wed Sep 09 04:51:48 2026" }, "message": "PrivateClickMeasurement destination secret token errors are logged with the wrong \"source\" label\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323286\nrdar://186539945\n\nReviewed by Alex Christensen.\n\ncalculateAndUpdateDestinationSecretToken() passed \"source\" as the\ncontextForLogMessage argument to calculateAndUpdateSecretToken(), so every\nerror string produced for a destination secret-token failure (\"Did not find\na source unlinkable token waiting token.\", \"Could not decode source response\ndata.\", etc.) misidentified its context as \"source\" instead of \"destination\".\n\nPass \"destination\" to match the sibling\ncalculateAndUpdateDestinationUnlinkableToken().\n\n* Source/WebCore/loader/cocoa/PrivateClickMeasurementCocoa.mm:\n(WebCore::PrivateClickMeasurement::calculateAndUpdateDestinationSecretToken):\n\nCanonical link: https://commits.webkit.org/320706@main\n" }, { "commit": "3821585ac8da30aeb03e57e6436cfb546050bc8f", "tree": "9f77dca37236c8773c88f3c95998e747d097ab8b", "parents": [ "79d7541f8363bb66866367c2bba1cb1bfd2040aa" ], "author": { "name": "Richard Robinson", "email": "richard_robinson2@apple.com", "time": "Wed Sep 09 03:46:35 2026" }, "committer": { "name": "Richard Robinson", "email": "richard_robinson2@apple.com", "time": "Wed Sep 09 03:46:35 2026" }, "message": "Upstream the `ENABLE_SCREEN_TIME` compile-time feature flag\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d318047\nrdar://180832504\n\nReviewed by Abrar Rahman Protyasha.\n\n* Source/WTF/wtf/PlatformEnableCocoa.h:\n\nCanonical link: https://commits.webkit.org/320705@main\n" }, { "commit": "79d7541f8363bb66866367c2bba1cb1bfd2040aa", "tree": "d9818bfc2c217c5ef8d95094a41eba0d3d619762", "parents": [ "6f1389789211dc9bd677c8ef2fe152f12584b335" ], "author": { "name": "Pascoe", "email": "pascoe@apple.com", "time": "Wed Sep 09 03:23:57 2026" }, "committer": { "name": "Pascoe", "email": "pascoe@apple.com", "time": "Wed Sep 09 03:23:57 2026" }, "message": "Cherry-pick 7fdaeaab71b9. rdar://175673904\n\n [WebCore] cross-container iterator dereference in AuthenticationExtensionsClientOutputs::fromCBOR\n https://bugs.webkit.org/show_bug.cgi?id\u003d313452\n rdar://175673904\n\n Reviewed by Aditya Keerthi.\n\n fromCBOR() reuses a single `it` variable across the outer decoded map and the\n credProps sub-map. After reassigning `it` to the result of find(\"rk\") on the\n sub-map, the guard compares it against decodedMap.end() — a different container\u0027s\n sentinel, so the check always passes. When \"rk\" is absent, this dereferences\n the sub-map\u0027s end iterator.\n\n Use a separate credPropsIt variable and compare against credPropsMap.end(), same\n pattern already used for largeBlob below.\n\n Test: Tools/TestWebKitAPI/Tests/WebCore/CBORReaderTest.cpp\n\n * Source/WebCore/Modules/webauthn/AuthenticationExtensionsClientOutputs.cpp:\n (WebCore::AuthenticationExtensionsClientOutputs::fromCBOR):\n * Tools/TestWebKitAPI/Tests/WebCore/CBORReaderTest.cpp:\n (TestWebKitAPI::TEST(CBORReaderTest, AuthExtensionsFromCBOR_CredPropsWithoutRk)):\n\n Identifier: 305413.800@safari-7624-branch\n\nOriginally-landed-as: 305413.1120@safari-7624.5-branch (ce11a67281da). rdar://185368000\nCanonical link: https://commits.webkit.org/320704@main\n" }, { "commit": "6f1389789211dc9bd677c8ef2fe152f12584b335", "tree": "d119b4c1a4b59472744d2c613a1db9106d7cbf20", "parents": [ "7468b6444dc1bb6669a9cd4476073d54ad1b52be" ], "author": { "name": "Chris Dumez", "email": "cdumez@apple.com", "time": "Wed Sep 09 02:53:42 2026" }, "committer": { "name": "Chris Dumez", "email": "cdumez@apple.com", "time": "Wed Sep 09 02:53:42 2026" }, "message": "Annotate Range\u0027s boundary points as owner-thread state\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323647\n\nReviewed by Geoffrey Garen.\n\nRange::m_start and m_end are mutated on the main thread under m_boundaryPointLock and read\non the GC threads by visitNodesInGCThread(), which locks. That reader is reached through\nJSRange::visitAdditionalChildrenInGCThread(), so unlike isReachableFromOpaqueRoots() and\nhasPendingActivity() it runs concurrently with the main thread rather than with the world\npaused, and the lock it takes is load-bearing. The eleven mutation sites already took the\nlock; nothing enforced that they did.\n\nGuard both members with WTF_GUARDED_BY_LOCK() and assert on the main thread\u0027s unlocked read\npaths. Most of those reads are not in Range.cpp but in the five inline accessors\nstartContainer(), startOffset(), endContainer(), endOffset() and collapsed(), which is\nwhere the bulk of WebCore reaches the boundary points; annotating them is what makes the\nguard hold for their callers. setStart() and setEnd() each read the opposite boundary point\nto decide whether the range collapses before entering their critical section, so they are\nthe assert-then-lock case and call releaseOwnerThreadAssertion() before the Locker; they\nare its first users. compareBoundaryPoints() reads a second Range\u0027s boundary points, and\nshared access to one instance\u0027s lock grants nothing for another\u0027s, so it asserts on\nsourceRange as well.\n\nAlso add WTF_DECLARE_OWNER_THREAD_ASSERTIONS(), which declares assertIsOwnerThread() and\nreleaseOwnerThreadAssertion() members for a class, so call sites name neither the lock nor\nthe owner thread and the choice of owner is stated once. Being members is what lets\ncompareBoundaryPoints() write sourceRange.assertIsOwnerThread() to grant access to that\nobject\u0027s lock. An RAII form was considered instead of the explicit release. It is worse\nhere: it does nothing for the common case of a function that only reads, and for\nsetStart()/setEnd() it forces the result variable out of its initializer and into an extra\nscope, since leaving the assertion live to the end of the enclosing scope still reports the\nLocker as acquiring a lock that is already held. Omitting the release is a build failure,\nnot a silent bug, so there is nothing for RAII to make safe.\n\nNo behaviour change is intended.\n\n* Source/WTF/wtf/ThreadAssertions.h:\n* Source/WebCore/dom/Range.cpp:\n(WebCore::Range::setStart):\n(WebCore::Range::setEnd):\n(WebCore::Range::compareNode const):\n(WebCore::Range::compareBoundaryPoints const):\n(WebCore::Range::processContents):\n(WebCore::Range::cloneRange const):\n(WebCore::Range::debugDescription const):\n(WebCore::Range::parentlessNodeMovedToNewDocumentAffectsRange):\n* Source/WebCore/dom/Range.h:\n\nCanonical link: https://commits.webkit.org/320703@main\n" }, { "commit": "7468b6444dc1bb6669a9cd4476073d54ad1b52be", "tree": "1cc54e524659cfb6d145fb4fbae4cea2f9eb7a72", "parents": [ "2319f25265a74ba4ed725137bad8fc1169bde761" ], "author": { "name": "Tyler Wilcock", "email": "tyler_w@apple.com", "time": "Wed Sep 09 02:49:35 2026" }, "committer": { "name": "Tyler Wilcock", "email": "tyler_w@apple.com", "time": "Wed Sep 09 02:49:35 2026" }, "message": "AX: setting-attributes-is-asynchronous.html fails in isolated tree mode because takeFocus() waits\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323535\nrdar://186773197\n\nReviewed by Chris Fleizach and Dominic Mazzoni.\n\nThe test asserts that setting an accessibility attribute doesn\u0027t block the caller, by focusing a text\nfield and checking that the line printed after takeFocus() comes before the one its onfocus handler\nprints. It got them the other way around in isolated tree mode.\n\ntakeFocus() went through setAttributeValue(), which dispatches with executeOnAXThreadAndWait() and\nspins the main run loop until the accessibility thread is done. Focus was therefore taken, and the\nhandler had run, before takeFocus() returned.\n\nChange AccessibilityUIElementMac::takeFocus to dispatch without waiting, similar to how every\nother non-AXSync prefixed action works.\n\n* LayoutTests/accessibility-isolated-tree/TestExpectations:\n* LayoutTests/accessibility/isolated-tree/mac/setting-attributes-is-asynchronous-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/setting-attributes-is-asynchronous.html: Added.\n* Tools/WebKitTestRunner/InjectedBundle/mac/AccessibilityUIElementMac.mm:\n(WTR::AccessibilityUIElementMac::takeFocus):\n\nCanonical link: https://commits.webkit.org/320702@main\n" }, { "commit": "2319f25265a74ba4ed725137bad8fc1169bde761", "tree": "c4bbb6be648e075b71318273d9e1dd174ea0e7ac", "parents": [ "99d900fc04e1dcdff781731e938f56ee64458308" ], "author": { "name": "Dominic Mazzoni", "email": "dm_mazzoni@apple.com", "time": "Wed Sep 09 02:17:34 2026" }, "committer": { "name": "Dominic Mazzoni", "email": "dm_mazzoni@apple.com", "time": "Wed Sep 09 02:17:34 2026" }, "message": "REGRESSION(312765@main): [macOS Release] http/tests/site-isolation/accessibility/client/simple-iframe.html is a constant TIMEOUT\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d315398\nrdar://177751156\n\nReviewed by Tyler Wilcock.\n\nThe underlying bugs have been fixed, this no longer times out.\n\n* LayoutTests/platform/mac-wk2/TestExpectations:\n\nCanonical link: https://commits.webkit.org/320701@main\n" }, { "commit": "99d900fc04e1dcdff781731e938f56ee64458308", "tree": "b2018e7b101e6918441f7d7d931dc946b09bb588", "parents": [ "5d4382e4857f79a827b4fe1538ccd2d0baac70b7" ], "author": { "name": "Richard Robinson", "email": "richard_robinson2@apple.com", "time": "Wed Sep 09 02:08:37 2026" }, "committer": { "name": "Richard Robinson", "email": "richard_robinson2@apple.com", "time": "Wed Sep 09 02:08:37 2026" }, "message": "[Swift in WebKit] Address some Swift compiler diagnostic warnings\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323233\nrdar://186484704\n\nReviewed by Abrar Rahman Protyasha and Wenson Hsieh.\n\nTest: Tools/TestWebKitAPI/Tests/WebKit/WebPage/WebPageTests.swift\n\n* Source/WebKit/UIProcess/API/Cocoa/_WKTextExtractionInternal.h:\n* Source/WebKit/UIProcess/Cocoa/TextExtraction/WKWebView+TextExtraction.swift:\n* Source/WebKit/UIProcess/WebBackForwardList.swift:\n(Direction.pageClosed):\n(Direction.currentItem):\n(Direction.backItem):\n(Direction.forwardItem):\n(Direction.itemAtDeltaFromCurrentIndex(_:allowSkipping:)):\n(Direction.itemAtIndexWithoutSkipping(_:index:)):\n(Direction.rawBackListEntryCount):\n(Direction.rawForwardListEntryCount):\n(MakeAPIArray.backListWithLimitInternal(_:makeAPIArray:array:)):\n(MakeAPIArray.forwardListWithLimitInternal(_:makeAPIArray:array:)):\n(MakeAPIArray.backForwardListState(_:)):\n(MakeAPIArray.backForwardUpdateItem(_:frameState:)):\n(Direction.backListCountForAPI):\n(Direction.forwardListCountForAPI):\n(Direction.backListAsAPIArrayWithLimit(_:)):\n(Direction.forwardListAsAPIArrayWithLimit(_:)):\n(Direction.backListWithLimitInternal(_:makeAPIArray:array:)):\n(Direction.forwardListWithLimitInternal(_:makeAPIArray:array:)):\n(Direction.backForwardListState(_:)):\n(Direction.goBackItemSkippingItemsWithoutUserGesture):\n(Direction.goForwardItemSkippingItemsWithoutUserGesture):\n(Direction.backForwardUpdateItem(_:frameState:)):\n(MakeAPIArray.backListCountForAPI): Deleted.\n(MakeAPIArray.forwardListCountForAPI): Deleted.\n(MakeAPIArray.rawCounts): Deleted.\n(MakeAPIArray.backListAsAPIArrayWithLimit(_:)): Deleted.\n(MakeAPIArray.forwardListAsAPIArrayWithLimit(_:)): Deleted.\n(MakeAPIArray.removeAllItems): Deleted.\n(MakeAPIArray.clear): Deleted.\n(MakeAPIArray.restoreFromState(_:)): Deleted.\n(MakeAPIArray.setItemsAsRestoredFromSession): Deleted.\n(MakeAPIArray.setItemsAsRestoredFromSessionIf(_:)): Deleted.\n(MakeAPIArray.didRemoveItem(_:)): Deleted.\n(MakeAPIArray.goBackItemSkippingItemsWithoutUserGesture): Deleted.\n(MakeAPIArray.goForwardItemSkippingItemsWithoutUserGesture): Deleted.\n(MakeAPIArray.loggingString): Deleted.\n(MakeAPIArray.addChildItem(_:frameState:)): Deleted.\n(MakeAPIArray.setBackForwardItemIdentifier(_:itemID:)): Deleted.\n(MakeAPIArray.completeFrameStateForNavigation(_:)): Deleted.\n(MakeAPIArray.messageCheckItemURLs(_:process:)): Deleted.\n(MakeAPIArray.setHandlingProvisionalMessage(_:)): Deleted.\n(MakeAPIArray.backForwardAddItem(_:navigatedFrameState:)): Deleted.\n(MakeAPIArray.backForwardClearChildren(_:frameItemID:)): Deleted.\n(MakeAPIArray.updateFrameIdentifier(_:newFrameID:)): Deleted.\n(MakeAPIArray.backForwardGoToItem(_:)): Deleted.\n(MakeAPIArray.backForwardGoToItemShared(_:)): Deleted.\n(MakeAPIArray.frameStates): Deleted.\n* Source/WebKit/UIProcess/mac/WKTextSelectionController.h:\n* Tools/TestWebKitAPI/Helpers/cocoa/TestPDFDocument.h:\n* Tools/TestWebKitAPI/Tests/WebKit/WebPage/WebPageTests.swift:\n(WebPageTests.qualifiedServerTrust):\n\nCanonical link: https://commits.webkit.org/320700@main\n" }, { "commit": "5d4382e4857f79a827b4fe1538ccd2d0baac70b7", "tree": "6f5ad7eda9a476f550d9f988f670c32b8a8cef02", "parents": [ "6156a0940859c71c1c3a9278024908aecf9760f7" ], "author": { "name": "Alex Christensen", "email": "achristensen@apple.com", "time": "Wed Sep 09 02:07:53 2026" }, "committer": { "name": "Alex Christensen", "email": "achristensen@apple.com", "time": "Wed Sep 09 02:07:53 2026" }, "message": "Remove WebTransport crash test expectations\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323686\nrdar://186945995\n\nReviewed by Tim Nguyen.\n\nThese tests pass by not crashing. The expectations file is old and unused, and the expectations can be removed.\n\n* LayoutTests/TestExpectations:\n* LayoutTests/imported/w3c/web-platform-tests/webtransport/bidirectional-cancel-crash.https-expected.txt: Removed.\n\nCanonical link: https://commits.webkit.org/320699@main\n" }, { "commit": "6156a0940859c71c1c3a9278024908aecf9760f7", "tree": "6cbc87937f60852a99d6dc09f5dd08995fcb637b", "parents": [ "6d963be7219adf39702f65263029f1b0bf09782d" ], "author": { "name": "Sihui Liu", "email": "sihui_liu@apple.com", "time": "Wed Sep 09 01:57:39 2026" }, "committer": { "name": "Sihui Liu", "email": "sihui_liu@apple.com", "time": "Wed Sep 09 01:57:39 2026" }, "message": "[Site Isolation] Remove process model validation in SiteIsolation.MultiProcessBFCacheSameSiteWithDifferentCrossSiteIframes\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323700\nrdar://186956421\n\nReviewed by Per Arne Vollan.\n\nThe test asserted the per-process frame tree topology via checkFrameTreesInProcesses(), which reports one tree per web\nprocess. That count is a property of the process model, not of the behavior the test is about: with\nSiteIsolationSharedProcessEnabled the b.com and c.com iframes are placed in the same shared process, so the expected\nthree trees collapse into two and the test fails.\n\nNothing about the test\u0027s subject depends on where the frames live. It covers same-site back/forward cache with a\ncross-site iframe: a1 (a.com with a b.com iframe) is cached and replaced by a2 (a.com with a c.com iframe), and going\nback must restore a1 together with its b.com iframe from the cache rather than reloading them. Rewrite it to assert\nexactly that, using JavaScript markers set in the main frame and in the iframe before the navigation away — a reload\nwould produce a fresh global object without them, and reading the iframe-scope marker round-trips to whichever process\nhosts the iframe. Reattachment of the iframe subtree happens after the main frame commits, so wait for the child frame\nto become b.com again rather than assuming it is there when the navigation finishes.\n\nThe test now passes with SiteIsolationSharedProcessEnabled both on and off, without opting out of the shared process and\nwithout a separate variant.\n\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolation.mm:\n(TestWebKitAPI::(SiteIsolation, MultiProcessBFCacheSameSiteWithDifferentCrossSiteIframes)):\n\nCanonical link: https://commits.webkit.org/320698@main\n" }, { "commit": "6d963be7219adf39702f65263029f1b0bf09782d", "tree": "2442e4b55fed259aae2ef24f7b29f4e38803e970", "parents": [ "1db10e376c49da11723241900fdd87f53605aad8" ], "author": { "name": "Mike Wyrzykowski", "email": "mwyrzykowski@apple.com", "time": "Wed Sep 09 01:55:09 2026" }, "committer": { "name": "Mike Wyrzykowski", "email": "mwyrzykowski@apple.com", "time": "Wed Sep 09 01:55:09 2026" }, "message": "[WebGPU][WGSL] Three or more inlined calls to one function over a 256-byte struct silently miscompile on iOS\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323560\nrdar://186804865\n\nReviewed by Dan Glastonbury.\n\nInstead of using always_inline which causes miscompilations on Apple9 devices,\nallow the compiler to decide whether or not to perform the inlining.\n\nTests: Tools/TestWebKitAPI/Tests/WGSL/MetalCompilationTests.mm\n Tools/TestWebKitAPI/Tests/WGSL/TestWGSLAPI.h\n\n* Source/WebGPU/WGSL/Metal/MetalFunctionWriter.cpp:\n(WGSL::Metal::FunctionDefinitionWriter::shouldForceInlining const):\n(WGSL::Metal::FunctionDefinitionWriter::visit):\n* Tools/TestWebKitAPI/Tests/WGSL/MetalCompilationTests.mm:\n(TestWGSLAPI::testCompilationForAppleGPUFamily):\n(TestWGSLAPI::TEST_F(WGSLMetalCompilationTests, InlineLargeAggregateReturns)):\n* Tools/TestWebKitAPI/Tests/WGSL/TestWGSLAPI.h:\n(TestWGSLAPI::generate):\n\nCanonical link: https://commits.webkit.org/320697@main\n" }, { "commit": "1db10e376c49da11723241900fdd87f53605aad8", "tree": "789ff2a4914d7958b3bb92caa9cee312324bd936", "parents": [ "3856a285807d08daf91e57de733118285a74501b" ], "author": { "name": "Jetzel Espinal", "email": "jespinal23@apple.com", "time": "Wed Sep 09 01:41:28 2026" }, "committer": { "name": "Jetzel Espinal", "email": "jespinal23@apple.com", "time": "Wed Sep 09 01:41:28 2026" }, "message": "[GARDENING][iOS] TestWebKitAPI.WKNavigation.PreferredHTTPSPolicyAutomaticHTTPFallbackAfterTerminateProcess (api-test) is a flaky Timeout.\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323715\nrdar://186970049\n\nUnreviewed test gardening.\n\n* TestExpectations/apitests:\n\nCanonical link: https://commits.webkit.org/320696@main\n" }, { "commit": "3856a285807d08daf91e57de733118285a74501b", "tree": "68f0716af67c7d6d4fbdcf04cca5f4f6e3f384ae", "parents": [ "920227936f2c39c78f62fe0360bf4666d3cf4c86" ], "author": { "name": "Ian Grunert", "email": "ian.grunert@gmail.com", "time": "Wed Sep 09 01:31:13 2026" }, "committer": { "name": "Ian Grunert", "email": "ian.grunert@gmail.com", "time": "Wed Sep 09 01:31:13 2026" }, "message": "[Win] memoryFootprint() crashes under WINE\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323559\n\nReviewed by Don Olmstead.\n\nWine does not implement the working set list query: QueryWorkingSet fails\nwith ERROR_INVALID_PARAMETER without writing the buffer, so\nmemoryFootprint() sized its retry buffer from uninitialized stack memory\nand the huge allocation crashed every WebKit process ~30s after launch.\n\nCompute the private working set with QueryWorkingSetEx instead, walking\ncommitted regions with VirtualQuery and querying page attributes in fixed\nsize batches: bounded memory, no retry loop, and it works under Wine. The\nQueryWorkingSet path is kept as a hardened fallback (NumberOfEntries only\nread after ERROR_BAD_LENGTH, capped retries, tryMalloc).\n\nVerified under Wine: dirtying 64MB of private pages moves the reported\nfootprint by exactly 64MB, and the browser benchmarks run to completion.\n\n* Source/WTF/wtf/win/MemoryFootprintWin.cpp:\n(WTF::memoryFootprintFromWorkingSetEx): Added.\n(WTF::memoryFootprintFromWorkingSetList): Renamed from memoryFootprint.\n(WTF::memoryFootprint):\n\nCanonical link: https://commits.webkit.org/320695@main\n" }, { "commit": "920227936f2c39c78f62fe0360bf4666d3cf4c86", "tree": "ca79c43a422a8ea74e443aaaa8ea3a5f16ea7574", "parents": [ "268a7c104514da6b0cffbe15b29677b01bb142d8" ], "author": { "name": "Charlie Wolfe", "email": "charliew@apple.com", "time": "Wed Sep 09 01:26:41 2026" }, "committer": { "name": "Charlie Wolfe", "email": "charliew@apple.com", "time": "Wed Sep 09 01:26:41 2026" }, "message": "Move NetworkStorageSession from WebCore to WebKit\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d322552\nrdar://185843114\n\nReviewed by Alex Christensen.\n\nTracking prevention state, storage-access grants, third-party cookie blocking mode, opt-in cookie\npartitioning and client-side cookie age caps are all network-process policy, but they were in\nWebCore\u0027s platform/network layer. None of it is used by WebKitLegacy, so we can move it into WebKit\nwithout changing WebKitLegacy\u0027s behavior.\n\nSplit NetworkStorageSession into two classes:\n- WebCore::CookieStorageSession keeps only the parts that are not cookie policy: the CFNetwork\n storage session, cookie storage and CredentialStorage. Each cookie member takes any policy that\n affects its result as an explicit argument (blocking decision, partition, capped lifetime), so\n there is no policy-free cookie API to call by mistake.\n- WebKit::NetworkStorageSession derives from it and owns all of the policy.\n\nAlso extract several enums and static functions from the old monolithic NetworkStorageSession.h.\n\nNo change in behavior.\n\n* Source/WebCore/Configurations/AllowedSPI-legacy.toml:\n* Source/WebCore/Headers.cmake:\n* Source/WebCore/PlatformCocoa.cmake:\n* Source/WebCore/Sources.txt:\n* Source/WebCore/SourcesCocoa.txt:\n* Source/WebCore/WebCore.xcodeproj/project.pbxproj:\n* Source/WebCore/dom/DocumentStorageAccess.cpp:\n* Source/WebCore/loader/CookieJar.cpp:\n(WebCore::CookieJar::cookies const):\n(WebCore::CookieJar::setCookies):\n(WebCore::CookieJar::cookiesEnabled):\n(WebCore::CookieJar::cookieRequestHeaderFieldValue const):\n(WebCore::CookieJar::cookieRequestHeaderFieldValueDigest const):\n(WebCore::CookieJar::getRawCookies const):\n(WebCore::CookieJar::deleteCookie):\n(WebCore::shouldRelaxThirdPartyCookieBlocking): Deleted.\n* Source/WebCore/loader/CookieJar.h:\n* Source/WebCore/loader/DocumentLoader.cpp:\n(WebCore::DocumentLoader::responseReceived):\n* Source/WebCore/loader/EmptyClients.cpp:\n* Source/WebCore/page/Quirks.cpp:\n* Source/WebCore/platform/Curl.cmake:\n* Source/WebCore/platform/SourcesSoup.txt:\n* Source/WebCore/platform/gtk/po/POTFILES.in:\n* Source/WebCore/platform/network/CacheValidation.cpp:\n* Source/WebCore/platform/network/CacheValidation.h:\n* Source/WebCore/platform/network/CookieChangeObserver.h: Copied from Source/WebKitLegacy/WebCoreSupport/NetworkStorageSessionMap.h.\n(WebCore::CookieChangeObserver::~CookieChangeObserver):\n(WebCore::CookiesEnabledStateObserver::~CookiesEnabledStateObserver):\n* Source/WebCore/platform/network/CookieStorageSession.cpp: Copied from Source/WebCore/platform/network/curl/CookieStorageCurl.cpp.\n(WebCore::CookieStorageSession::processMayUseCookieAPI):\n(WebCore::CookieStorageSession::permitProcessToUseCookieAPI):\n(WebCore::CookieStorageSession::cookiePartitionIdentifier):\n(WebCore::CookieStorageSession::CookieStorageSession):\n* Source/WebCore/platform/network/CookieStorageSession.h: Added.\n(WebCore::CookieStorageSession::sessionID const):\n(WebCore::CookieStorageSession::platformSession const):\n(WebCore::CookieStorageSession::isInMemoryCookieStore const):\n* Source/WebCore/platform/network/CredentialStorage.cpp:\n* Source/WebCore/platform/network/NetworkStorageSession.h: Removed.\n* Source/WebCore/platform/network/NetworkingContext.h:\n* Source/WebCore/platform/network/StorageAccessQuirks.cpp: Added.\n(WebCore::updatableStorageAccessPromptQuirks):\n(WebCore::storageAccessQuirks):\n(WebCore::updateStorageAccessPromptQuirks):\n(WebCore::loginDomainMatchesRequestingDomain):\n(WebCore::canRequestStorageAccessForLoginOrCompatibilityPurposesWithoutPriorUserInteraction):\n(WebCore::subResourceDomainsInNeedOfStorageAccessForFirstParty):\n(WebCore::findAdditionalLoginDomain):\n(WebCore::storageAccessQuirkForTopFrameDomain):\n(WebCore::storageAccessQuirkForDomainPair):\n* Source/WebCore/platform/network/StorageAccessQuirks.h: Added.\n* Source/WebCore/platform/network/StorageSessionProvider.h:\n* Source/WebCore/platform/network/ThirdPartyCookieBlockingMode.h: Copied from Source/WebCore/platform/network/StorageSessionProvider.h.\n* Source/WebCore/platform/network/TrackingPreventionTypes.h: Copied from Source/WebCore/platform/network/StorageSessionProvider.h.\n* Source/WebCore/platform/network/cf/CookieStorageSessionCFNet.cpp: Renamed from Source/WebCore/platform/network/cf/NetworkStorageSessionCFNet.cpp.\n(WebCore::CookieStorageSession::createCFStorageSessionForIdentifier):\n(WebCore::CookieStorageSession::CookieStorageSession):\n(WebCore::CookieStorageSession::cookieStorage const):\n* Source/WebCore/platform/network/cocoa/CookieStorageSessionCocoa.mm: Added.\n(WebCore::CookieStorageSession::nsCookieStorage const):\n(WebCore::createPrivateStorageSession):\n(WebCore::CookieStorageSession::deleteHTTPCookie const):\n(WebCore::CookieStorageSession::policyProperties):\n(WebCore::CookieStorageSession::cookiesForURLFromStorage):\n(WebCore::CookieStorageSession::setHTTPCookiesForURL const):\n(WebCore::CookieStorageSession::httpCookiesForURL const):\n(WebCore::CookieStorageSession::capExpiryOfPersistentCookie):\n(WebCore::CookieStorageSession::setCookiePartition):\n(WebCore::CookieStorageSession::cookiesForURL const):\n(WebCore::CookieStorageSession::cookiesForSession const):\n(WebCore::CookieStorageSession::cookiesForDOM const):\n(WebCore::CookieStorageSession::cookieRequestHeaderFieldValue const):\n(WebCore::CookieStorageSession::adjustScriptWrittenCookie):\n(WebCore::CookieStorageSession::parseDOMCookie):\n(WebCore::CookieStorageSession::setCookiesFromDOM const):\n(WebCore::CookieStorageSession::setCookie):\n(WebCore::CookieStorageSession::getRawCookies const):\n(WebCore::CookieStorageSession::deleteCookie const):\n(WebCore::CookieStorageSession::deleteAllCookies):\n* Source/WebCore/platform/network/cocoa/ResourceHandleCocoa.mm:\n* Source/WebCore/platform/network/curl/CookieJarDB.h:\n* Source/WebCore/platform/network/curl/CurlContext.h:\n* Source/WebKit/Configurations/AllowedSPI-legacy.toml:\n* Source/WebKit/NetworkProcess/Classifier/ResourceLoadStatisticsStore.cpp:\n(WebKit::ResourceLoadStatisticsStore::grantStorageAccess):\n* Source/WebKit/NetworkProcess/Classifier/WebResourceLoadStatisticsStore.cpp:\n(WebKit::WebResourceLoadStatisticsStore::hasStorageAccess):\n(WebKit::WebResourceLoadStatisticsStore::requestStorageAccess):\n(WebKit::WebResourceLoadStatisticsStore::requestStorageAccessUnderOpener):\n(WebKit::WebResourceLoadStatisticsStore::callUpdatePrevalentDomainsToBlockCookiesForHandler):\n* Source/WebKit/NetworkProcess/Classifier/WebResourceLoadStatisticsStore.h:\n* Source/WebKit/NetworkProcess/Cookies/CookieStorage.h: Copied from Source/WebCore/platform/network/CookieStorage.h.\n* Source/WebKit/NetworkProcess/Cookies/WebCookieManager.cpp:\n(WebKit::WebCookieManager::startObservingCookieChanges):\n(WebKit::WebCookieManager::stopObservingCookieChanges):\n* Source/WebKit/NetworkProcess/Cookies/cocoa/CookieStorageCocoa.mm: Renamed from Source/WebCore/platform/network/cocoa/CookieStorageCocoa.mm.\n(WebKit::startObservingCookieChanges):\n(WebKit::stopObservingCookieChanges):\n* Source/WebKit/NetworkProcess/Cookies/cocoa/CookieStorageObserver.h: Renamed from Source/WebCore/platform/network/cocoa/CookieStorageObserver.h.\n* Source/WebKit/NetworkProcess/Cookies/cocoa/CookieStorageObserver.mm: Renamed from Source/WebCore/platform/network/cocoa/CookieStorageObserver.mm.\n(-[WebCookieObserverAdapter initWithObserver:]):\n(-[WebCookieObserverAdapter cookiesChangedNotificationHandler:]):\n(WebKit::CookieStorageObserver::CookieStorageObserver):\n(WebKit::CookieStorageObserver::~CookieStorageObserver):\n(WebKit::CookieStorageObserver::startObserving):\n(WebKit::CookieStorageObserver::registerInternalsForNotifications):\n(WebKit::CookieStorageObserver::stopObserving):\n(WebKit::CookieStorageObserver::cookiesDidChange):\n* Source/WebKit/NetworkProcess/Cookies/curl/CookieStorageCurl.cpp: Renamed from Source/WebCore/platform/network/curl/CookieStorageCurl.cpp.\n(WebKit::startObservingCookieChanges):\n(WebKit::stopObservingCookieChanges):\n* Source/WebKit/NetworkProcess/Cookies/curl/WebCookieManagerCurl.cpp:\n* Source/WebKit/NetworkProcess/Cookies/mac/WebCookieManagerMac.mm:\n* Source/WebKit/NetworkProcess/Cookies/soup/CookieStorageSoup.cpp: Renamed from Source/WebCore/platform/network/soup/CookieStorageSoup.cpp.\n(WebKit::startObservingCookieChanges):\n(WebKit::stopObservingCookieChanges):\n* Source/WebKit/NetworkProcess/Cookies/soup/WebCookieManagerSoup.cpp:\n* Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.cpp:\n(WebKit::NetworkConnectionToWebProcess::storageAccessQuirkForTopFrameDomain):\n* Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.h:\n* Source/WebKit/NetworkProcess/NetworkProcess.cpp:\n(WebKit::NetworkProcess::initializeNetworkProcess):\n(WebKit::NetworkProcess::addStorageSession):\n(WebKit::NetworkProcess::newTestingSession):\n(WebKit::NetworkProcess::storageSession const):\n(WebKit::NetworkProcess::forEachNetworkStorageSession):\n(WebKit::NetworkProcess::updateStorageAccessPromptQuirks):\n* Source/WebKit/NetworkProcess/NetworkProcess.h:\n* Source/WebKit/NetworkProcess/NetworkResourceLoader.cpp:\n(WebKit::logBlockedCookieInformation):\n(WebKit::logCookieInformationInternal):\n* Source/WebKit/NetworkProcess/NetworkResourceLoader.h:\n* Source/WebKit/NetworkProcess/NetworkSession.h:\n* Source/WebKit/NetworkProcess/NetworkSessionCreationParameters.h:\n* Source/WebKit/NetworkProcess/cache/NetworkCache.cpp:\n(WebKit::NetworkCache::makeUseDecision):\n(WebKit::NetworkCache::Cache::retrieve):\n(WebKit::NetworkCache::Cache::makeEntry):\n(WebKit::NetworkCache::Cache::makeRedirectEntry):\n(WebKit::NetworkCache::Cache::update):\n* Source/WebKit/NetworkProcess/cache/NetworkCacheSpeculativeLoad.cpp:\n* Source/WebKit/NetworkProcess/cache/NetworkCacheValidation.cpp: Added.\n(WebKit::NetworkCache::cookieRequestHeaderFieldValue):\n(WebKit::NetworkCache::headerValueForVary):\n(WebKit::NetworkCache::collectVaryingRequestHeaders):\n(WebKit::NetworkCache::verifyVaryingRequestHeaders):\n* Source/WebKit/NetworkProcess/cache/NetworkCacheValidation.h: Renamed from Source/WebCore/platform/network/CookieStorage.h.\n* Source/WebKit/NetworkProcess/cocoa/NetworkDataTaskCocoa.mm:\n(WebKit::NetworkDataTaskCocoa::NetworkDataTaskCocoa):\n(WebKit::NetworkDataTaskCocoa::resume):\n* Source/WebKit/NetworkProcess/cocoa/NetworkProcessCocoa.mm:\n* Source/WebKit/NetworkProcess/cocoa/NetworkSessionCocoa.mm:\n* Source/WebKit/NetworkProcess/cocoa/NetworkStorageSessionCocoa.mm: Renamed from Source/WebCore/platform/network/cocoa/NetworkStorageSessionCocoa.mm.\n(WebKit::NetworkStorageSession::~NetworkStorageSession):\n(WebKit::NetworkStorageSession::setCookie):\n(WebKit::NetworkStorageSession::setCookies):\n(WebKit::NetworkStorageSession::deleteCookie):\n(WebKit::nsCookiesToCookieVector):\n(WebKit::NetworkStorageSession::getAllCookies):\n(WebKit::NetworkStorageSession::getCookies):\n(WebKit::NetworkStorageSession::hasCookies const):\n(WebKit::NetworkStorageSession::setAllCookiesToSameSiteStrict):\n(WebKit::NetworkStorageSession::cookieStorageObserver const):\n(WebKit::NetworkStorageSession::httpCookies const):\n(WebKit::NetworkStorageSession::cookiePartitionIdentifierIfEnabled const):\n(WebKit::NetworkStorageSession::cookiesForURL const):\n(WebKit::NetworkStorageSession::cookiesForSession const):\n(WebKit::NetworkStorageSession::cookiesForSessionAsVector const):\n(WebKit::NetworkStorageSession::cookiesForDOM const):\n(WebKit::NetworkStorageSession::cookiesForDOMAsVector const):\n(WebKit::NetworkStorageSession::cookieRequestHeaderFieldValue const):\n(WebKit::NetworkStorageSession::setCookiesFromDOM const):\n(WebKit::NetworkStorageSession::setCookieFromDOM const):\n(WebKit::httpCookieAcceptPolicy):\n(WebKit::NetworkStorageSession::cookieAcceptPolicy const):\n(WebKit::NetworkStorageSession::getRawCookies const):\n(WebKit::NetworkStorageSession::deleteCookie const):\n(WebKit::NetworkStorageSession::getHostnamesWithCookies):\n(WebKit::NetworkStorageSession::deleteCookiesMatching):\n(WebKit::NetworkStorageSession::deleteCookies):\n(WebKit::NetworkStorageSession::deleteCookiesForHostnames):\n(WebKit::NetworkStorageSession::deleteAllCookiesModifiedSince):\n(WebKit::NetworkStorageSession::domCookiesForHost):\n(WebKit::NetworkStorageSession::setOptInCookiePartitioningEnabled):\n(WebKit::NetworkStorageSession::registerCookieChangeListenersIfNecessary):\n(WebKit::NetworkStorageSession::unregisterCookieChangeListenersIfNecessary):\n(WebKit::NetworkStorageSession::startListeningForCookieChangeNotifications):\n(WebKit::NetworkStorageSession::stopListeningForCookieChangeNotifications):\n* Source/WebKit/NetworkProcess/cocoa/NetworkTaskCocoa.mm:\n(WebKit::cookiesByCappingExpiry):\n(WebKit::cookiesBySettingPartition):\n* Source/WebKit/NetworkProcess/cocoa/WebSocketTaskCocoa.mm:\n(WebKit::WebSocketTask::WebSocketTask):\n* Source/WebKit/NetworkProcess/curl/NetworkDataTaskCurl.cpp:\n* Source/WebKit/NetworkProcess/curl/NetworkProcessCurl.cpp:\n* Source/WebKit/NetworkProcess/curl/NetworkSessionCurl.cpp:\n* Source/WebKit/NetworkProcess/curl/NetworkStorageSessionCurl.cpp: Renamed from Source/WebCore/platform/network/curl/NetworkStorageSessionCurl.cpp.\n(WebKit::defaultCookieJarPath):\n(WebKit::alternativeServicesStorageFile):\n(WebKit::cookiesForSession):\n(WebKit::NetworkStorageSession::NetworkStorageSession):\n(WebKit::NetworkStorageSession::~NetworkStorageSession):\n(WebKit::NetworkStorageSession::setCookieDatabase):\n(WebKit::NetworkStorageSession::cookieDatabase const):\n(WebKit::NetworkStorageSession::setCookiesFromDOM const):\n(WebKit::NetworkStorageSession::setCookieFromDOM const):\n(WebKit::NetworkStorageSession::setCookiesFromHTTPResponse const):\n(WebKit::NetworkStorageSession::setCookieAcceptPolicy const):\n(WebKit::NetworkStorageSession::cookieAcceptPolicy const):\n(WebKit::NetworkStorageSession::cookiesForDOM const):\n(WebKit::NetworkStorageSession::cookiesForDOMAsVector const):\n(WebKit::NetworkStorageSession::setCookies):\n(WebKit::NetworkStorageSession::setCookie):\n(WebKit::NetworkStorageSession::deleteCookie):\n(WebKit::NetworkStorageSession::deleteCookie const):\n(WebKit::NetworkStorageSession::deleteAllCookies):\n(WebKit::NetworkStorageSession::deleteAllCookiesModifiedSince):\n(WebKit::NetworkStorageSession::deleteCookiesForHostnames):\n(WebKit::NetworkStorageSession::getAllCookies):\n(WebKit::NetworkStorageSession::getHostnamesWithCookies):\n(WebKit::NetworkStorageSession::getCookies):\n(WebKit::NetworkStorageSession::hasCookies const):\n(WebKit::NetworkStorageSession::getRawCookies const):\n(WebKit::NetworkStorageSession::cookieRequestHeaderFieldValue const):\n(WebKit::NetworkStorageSession::setProxySettings):\n(WebKit::NetworkStorageSession::clearAlternativeServices):\n* Source/WebKit/NetworkProcess/soup/NetworkDataTaskSoup.cpp:\n* Source/WebKit/NetworkProcess/soup/NetworkProcessMainSoup.cpp:\n* Source/WebKit/NetworkProcess/soup/NetworkProcessSoup.cpp:\n* Source/WebKit/NetworkProcess/soup/NetworkSessionSoup.cpp:\n* Source/WebKit/NetworkProcess/soup/NetworkStorageSessionSoup.cpp: Renamed from Source/WebCore/platform/network/soup/NetworkStorageSessionSoup.cpp.\n(WebKit::Deleter::operator()):\n(WebKit::NetworkStorageSession::NetworkStorageSession):\n(WebKit::NetworkStorageSession::~NetworkStorageSession):\n(WebKit::NetworkStorageSession::notifyCookie):\n(WebKit::NetworkStorageSession::notifyCookieAdded):\n(WebKit::NetworkStorageSession::notifyCookieDeleted):\n(WebKit::NetworkStorageSession::cookiesDidChange):\n(WebKit::NetworkStorageSession::setCookieStorage):\n(WebKit::NetworkStorageSession::setCookieObserverHandler):\n(WebKit::schemeFromProtectionSpaceServerType):\n(WebKit::authTypeFromProtectionSpaceAuthenticationScheme):\n(WebKit::SecretServiceSearchData::SecretServiceSearchData):\n(WebKit::NetworkStorageSession::getCredentialFromPersistentStorage):\n(WebKit::NetworkStorageSession::saveCredentialToPersistentStorage):\n(WebKit::NetworkStorageSession::setCookieAcceptPolicy):\n(WebKit::NetworkStorageSession::cookieAcceptPolicy const):\n(WebKit::NetworkStorageSession::setTrackingPreventionEnabled):\n(WebKit::httpOnlyCookieExists):\n(WebKit::NetworkStorageSession::setCookiesFromDOM const):\n(WebKit::NetworkStorageSession::setCookieFromDOM const):\n(WebKit::NetworkStorageSession::setCookies):\n(WebKit::NetworkStorageSession::setCookie):\n(WebKit::NetworkStorageSession::replaceCookies):\n(WebKit::NetworkStorageSession::deleteCookie):\n(WebKit::NetworkStorageSession::deleteCookie const):\n(WebKit::NetworkStorageSession::deleteAllCookies):\n(WebKit::NetworkStorageSession::deleteAllCookiesModifiedSince):\n(WebKit::NetworkStorageSession::deleteCookiesForHostnames):\n(WebKit::NetworkStorageSession::getHostnamesWithCookies):\n(WebKit::NetworkStorageSession::getAllCookies):\n(WebKit::NetworkStorageSession::getCookies):\n(WebKit::NetworkStorageSession::hasCookies const):\n(WebKit::lookupCookies):\n(WebKit::lookupCookiesHeaders):\n(WebKit::NetworkStorageSession::getRawCookies const):\n(WebKit::NetworkStorageSession::domCookiesForHost):\n(WebKit::NetworkStorageSession::cookiesForDOM const):\n(WebKit::NetworkStorageSession::cookiesForDOMAsVector const):\n(WebKit::NetworkStorageSession::cookieRequestHeaderFieldValue const):\n(WebKit::NetworkStorageSession::startListeningForCookieChangeNotifications):\n(WebKit::NetworkStorageSession::stopListeningForCookieChangeNotifications):\n* Source/WebKit/Platform/Curl.cmake:\n* Source/WebKit/Platform/cocoa/WebPrivacyHelpers.mm:\n* Source/WebKit/PlatformCocoa.cmake:\n* Source/WebKit/Scripts/webkit/messages.py:\n(headers_for_type):\n* Source/WebKit/Shared/NetworkStorageSession.cpp: Renamed from Source/WebCore/platform/network/NetworkStorageSession.cpp.\n(WebKit::NetworkStorageSession::domCookiesForHost):\n(WebKit::NetworkStorageSession::setTrackingPreventionEnabled):\n(WebKit::NetworkStorageSession::trackingPreventionEnabled const):\n(WebKit::NetworkStorageSession::setTrackingPreventionDebugLoggingEnabled):\n(WebKit::NetworkStorageSession::shouldBlockThirdPartyCookies const):\n(WebKit::NetworkStorageSession::shouldBlockThirdPartyCookiesButKeepFirstPartyCookiesFor const):\n(WebKit::NetworkStorageSession::setCookie):\n(WebKit::NetworkStorageSession::setAllCookiesToSameSiteStrict):\n(WebKit::NetworkStorageSession::hasHadUserInteractionAsFirstParty const):\n(WebKit::NetworkStorageSession::thirdPartyCookieBlockingDecisionForRequest const):\n(WebKit::NetworkStorageSession::shouldBlockCookies const):\n(WebKit::NetworkStorageSession::shouldBlockCookies):\n(WebKit::NetworkStorageSession::shouldExemptDomainPairFromThirdPartyCookieBlocking const):\n(WebKit::NetworkStorageSession::cookiePartitionIdentifier):\n(WebKit::NetworkStorageSession::maxAgeCacheCap):\n(WebKit::NetworkStorageSession::setAgeCapForClientSideCookies):\n(WebKit::NetworkStorageSession::setPrevalentDomainsToBlockAndDeleteCookiesFor):\n(WebKit::NetworkStorageSession::setPrevalentDomainsToBlockButKeepCookiesFor):\n(WebKit::NetworkStorageSession::setDomainsWithUserInteractionAsFirstParty):\n(WebKit::NetworkStorageSession::setDomainsWithCrossPageStorageAccess):\n(WebKit::NetworkStorageSession::grantCrossPageStorageAccess):\n(WebKit::NetworkStorageSession::hasStorageAccess const):\n(WebKit::NetworkStorageSession::getAllStorageAccessEntries const):\n(WebKit::NetworkStorageSession::grantStorageAccess):\n(WebKit::NetworkStorageSession::removeStorageAccessForFrame):\n(WebKit::NetworkStorageSession::clearPageSpecificDataForResourceLoadStatistics):\n(WebKit::NetworkStorageSession::removeAllStorageAccess):\n(WebKit::NetworkStorageSession::setCacheMaxAgeCapForPrevalentResources):\n(WebKit::NetworkStorageSession::resetCacheMaxAgeCapForPrevalentResources):\n(WebKit::NetworkStorageSession::didCommitCrossSiteLoadWithDataTransferFromPrevalentResource):\n(WebKit::NetworkStorageSession::resetCrossSiteLoadsWithLinkDecorationForTesting):\n(WebKit::NetworkStorageSession::setThirdPartyCookieBlockingMode):\n(WebKit::NetworkStorageSession::setOptInCookiePartitioningEnabled):\n(WebKit::NetworkStorageSession::setAppBoundDomains):\n(WebKit::NetworkStorageSession::resetAppBoundDomains):\n(WebKit::NetworkStorageSession::setManagedDomains):\n(WebKit::NetworkStorageSession::resetManagedDomains):\n(WebKit::NetworkStorageSession::clientSideCookieCap const):\n(WebKit::NetworkStorageSession::deleteCookiesForHostnames):\n(WebKit::NetworkStorageSession::deleteCookies):\n(WebKit::NetworkStorageSession::cookiesEnabled const):\n(WebKit::NetworkStorageSession::addCookiesEnabledStateObserver):\n(WebKit::NetworkStorageSession::removeCookiesEnabledStateObserver):\n(WebKit::NetworkStorageSession::cookieEnabledStateMayHaveChanged):\n(WebKit::NetworkStorageSession::setCookiesVersion):\n(WebKit::NetworkStorageSession::addCookiesVersionChangeCallback):\n(WebKit::NetworkStorageSession::clearCookiesVersionChangeCallbacks):\n* Source/WebKit/Shared/NetworkStorageSession.h: Added.\n(WebKit::NetworkStorageSession::NetworkStorageSession):\n(WebKit::NetworkStorageSession::cookieStorage const):\n(WebKit::NetworkStorageSession::trackingPreventionDebugLoggingEnabled const):\n(WebKit::NetworkStorageSession::isOptInCookiePartitioningEnabled const):\n(WebKit::NetworkStorageSession::cookiesVersion const):\n* Source/WebKit/Shared/ResourceLoadStatisticsParameters.h:\n* Source/WebKit/Shared/ResourceLoadStatisticsParameters.serialization.in:\n* Source/WebKit/Shared/WebCoreArgumentCoders.serialization.in:\n* Source/WebKit/Shared/WebProcessDataStoreParameters.h:\n* Source/WebKit/Sources.txt:\n* Source/WebKit/SourcesCocoa.txt:\n* Source/WebKit/SourcesGTK.txt:\n* Source/WebKit/SourcesWPE.txt:\n* Source/WebKit/UIProcess/Cocoa/UIDelegate.mm:\n(WebKit::UIDelegate::UIClient::requestStorageAccessConfirm):\n* Source/WebKit/UIProcess/Cocoa/WKStorageAccessAlert.mm:\n* Source/WebKit/UIProcess/Cocoa/WebProcessPoolCocoa.mm:\n* Source/WebKit/UIProcess/WebProcessPool.cpp:\n(WebKit::m_ipcTester):\n* Source/WebKit/UIProcess/WebsiteData/Cocoa/WebsiteDataStoreCocoa.mm:\n* Source/WebKit/UIProcess/WebsiteData/WebsiteDataStore.cpp:\n* Source/WebKit/UIProcess/WebsiteData/WebsiteDataStore.h:\n* Source/WebKit/WebKit.xcodeproj/project.pbxproj:\n* Source/WebKit/WebKitUIProcessPrefix.h:\n* Source/WebKit/WebProcess/Plugins/PluginView.cpp:\n* Source/WebKit/WebProcess/WebCoreSupport/WebPlatformStrategies.cpp:\n* Source/WebKit/WebProcess/WebCoreSupport/WebResourceLoadObserver.cpp:\n(WebKit::WebResourceLoadObserver::setDomainsWithCrossPageStorageAccess):\n* Source/WebKit/WebProcess/WebCoreSupport/cocoa/WebFrameNetworkingContext.h:\n* Source/WebKit/WebProcess/WebCoreSupport/cocoa/WebFrameNetworkingContext.mm:\n* Source/WebKit/WebProcess/WebCoreSupport/curl/WebFrameNetworkingContext.cpp:\n* Source/WebKit/WebProcess/WebCoreSupport/curl/WebFrameNetworkingContext.h:\n* Source/WebKit/WebProcess/WebCoreSupport/soup/WebFrameNetworkingContext.cpp:\n* Source/WebKit/WebProcess/WebCoreSupport/soup/WebFrameNetworkingContext.h:\n* Source/WebKit/WebProcess/WebPage/Cocoa/WebCookieCacheCocoa.mm:\n* Source/WebKit/WebProcess/WebPage/WebCookieCache.h:\n* Source/WebKit/WebProcess/WebPage/WebCookieJar.cpp:\n* Source/WebKit/WebProcess/WebPage/WebPage.cpp:\n(WebKit::WebPage::addDomainWithPageLevelStorageAccess):\n* Source/WebKit/WebProcess/WebPage/mac/WebPageMac.mm:\n* Source/WebKit/WebProcess/WebPage/soup/WebCookieCacheSoup.cpp:\n* Source/WebKit/WebProcess/WebProcess.cpp:\n* Source/WebKit/WebProcess/WebProcess.h:\n* Source/WebKitLegacy/WebCoreSupport/NetworkStorageSessionMap.cpp:\n(defaultNetworkStorageSession):\n(globalSessionMap):\n(NetworkStorageSessionMap::storageSession):\n(NetworkStorageSessionMap::defaultStorageSession):\n(NetworkStorageSessionMap::switchToNewTestingSession):\n(NetworkStorageSessionMap::ensureSession):\n* Source/WebKitLegacy/WebCoreSupport/NetworkStorageSessionMap.h:\n* Source/WebKitLegacy/WebCoreSupport/PageStorageSessionProvider.h:\n* Source/WebKitLegacy/WebCoreSupport/SocketStreamHandleImpl.cpp:\n(WebCore::cookieDataForHandshake):\n* Source/WebKitLegacy/WebCoreSupport/SocketStreamHandleImplCFNet.cpp:\n* Source/WebKitLegacy/mac/Misc/WebCache.mm:\n(): Deleted.\n* Source/WebKitLegacy/mac/Misc/WebDownload.mm:\n* Source/WebKitLegacy/mac/WebCoreSupport/WebFrameNetworkingContext.h:\n* Source/WebKitLegacy/mac/WebCoreSupport/WebFrameNetworkingContext.mm:\n(WebFrameNetworkingContext::ensurePrivateBrowsingSession):\n(WebFrameNetworkingContext::storageSession const):\n* Source/WebKitLegacy/mac/WebCoreSupport/WebPlatformStrategies.mm:\n* Source/WebKitLegacy/mac/WebView/WebPreferences.mm:\n* Source/WebKitLegacy/mac/WebView/WebView.mm:\n(+[WebView initialize]):\n* Tools/DumpRenderTree/mac/DumpRenderTree.mm:\n(DumpRenderTreeMain):\n* Tools/WebKitTestRunner/InjectedBundle/TestRunner.cpp:\n\nCanonical link: https://commits.webkit.org/320694@main\n" }, { "commit": "268a7c104514da6b0cffbe15b29677b01bb142d8", "tree": "c719cd80d50bb8d23a1d54d56d09ae2669d40dc9", "parents": [ "259eb3eed9c4618c62b1cba4006fb0694f33ada9" ], "author": { "name": "Fady Farag", "email": "com.webkit.iidmsa@gmail.com", "time": "Wed Sep 09 01:03:11 2026" }, "committer": { "name": "Fady Farag", "email": "com.webkit.iidmsa@gmail.com", "time": "Wed Sep 09 01:03:11 2026" }, "message": "Pass `TextCheckingResult` by const reference so `handleAcceptedCandidateWithSoftSpaces()` can be `NODELETE`\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323655\nrdar://186903443\n\nReviewed by Chris Dumez.\n\nInitially, `TextCheckingResult` was passed by value to `EditorClient::handleAcceptedCandidateWithSoftSpaces()`\nwhich triggered `NoDeleteChecker`\u0027s parameter rule where it counts a by-value parameter with a\nnon-trivially-destructible member against the callee. This now passes `TextCheckingResult` by\nconst reference instead, since the struct owns a `Vector\u003cGrammarDetail\u003e` and a `String` and no\noverride mutates it.\n\n* Source/WebCore/SaferCPPExpectations/NoDeleteCheckerExpectations:\n* Source/WebCore/loader/EmptyClients.cpp:\n* Source/WebCore/page/EditorClient.h:\n* Source/WebKitLegacy/mac/WebCoreSupport/WebEditorClient.h:\n* Source/WebKitLegacy/mac/WebCoreSupport/WebEditorClient.mm:\n(WebEditorClient::handleAcceptedCandidateWithSoftSpaces):\n\nCanonical link: https://commits.webkit.org/320693@main\n" }, { "commit": "259eb3eed9c4618c62b1cba4006fb0694f33ada9", "tree": "c434eb9d08bc7646fe362918ab339647395d17c1", "parents": [ "f303b6336664944609a9c67ece9d74da9dadc5fb" ], "author": { "name": "Alan Baradlay", "email": "zalan@apple.com", "time": "Wed Sep 09 00:32:42 2026" }, "committer": { "name": "Alan Baradlay", "email": "zalan@apple.com", "time": "Wed Sep 09 00:32:42 2026" }, "message": "[cleanup] Have RenderListOutsideMarker ask listMarkerSynthesizesGlyph() and a new shared listMarkerHasContent() instead of repeating both checks\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323551\nrdar://problem/186795659\n\nReviewed by Antti Koivisto.\n\n* Source/WebCore/layout/integration/LayoutIntegrationBoxTreeUpdater.cpp:\n(WebCore::LayoutIntegration::markerTextSynthesizesGlyph):\n* Source/WebCore/rendering/RenderListItem.cpp:\n(WebCore::RenderListItem::updateMarkerContent):\n(WebCore::RenderListItem::markerText const):\n* Source/WebCore/rendering/RenderListOutsideMarker.cpp:\n(WebCore::RenderListOutsideMarker::hasContentProperty const):\n(WebCore::listMarkerHasContent):\n(WebCore::listMarkerSynthesizesGlyph):\n(WebCore::RenderListOutsideMarker::synthesizesGlyph const):\n* Source/WebCore/rendering/RenderListOutsideMarker.h:\n* Source/WebCore/rendering/updating/RenderTreeBuilderList.cpp:\n(WebCore::RenderTreeBuilder::List::updateItemMarker):\n\nCanonical link: https://commits.webkit.org/320692@main\n" }, { "commit": "f303b6336664944609a9c67ece9d74da9dadc5fb", "tree": "2f160a1f5ac88fc7c80a1281c4170d381a9049ab", "parents": [ "5f7bc716873fa5f84176a2d38ff00567f49c40c7" ], "author": { "name": "Mike Wyrzykowski", "email": "mwyrzykowski@apple.com", "time": "Wed Sep 09 00:13:59 2026" }, "committer": { "name": "Mike Wyrzykowski", "email": "mwyrzykowski@apple.com", "time": "Wed Sep 09 00:13:59 2026" }, "message": "WebGPU primitive points uncaptured error\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323681\nrdar://186690340\n\nReviewed by Dan Glastonbury.\n\nprimitive_id requires device.supportsShaderBarycentricCoordinates to\nreturn true so check for that prior to reporting feature availability.\n\n* Source/WebGPU/WebGPU/HardwareCapabilities.mm:\n(WebGPU::baseFeatures):\n\nCanonical link: https://commits.webkit.org/320691@main\n" }, { "commit": "5f7bc716873fa5f84176a2d38ff00567f49c40c7", "tree": "20d69bf4253f14677a468efe969e756181b61b3c", "parents": [ "f02f2b97e6b0211562e02b35cde442ccbda6563b" ], "author": { "name": "Mike Wyrzykowski", "email": "mwyrzykowski@apple.com", "time": "Wed Sep 09 00:08:41 2026" }, "committer": { "name": "Mike Wyrzykowski", "email": "mwyrzykowski@apple.com", "time": "Wed Sep 09 00:08:41 2026" }, "message": "[WebGPU][WGSL] Array value constructor named through a type alias emits invalid MSL, silently producing wrong compute results\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323543\nrdar://186803296\n\nReviewed by Dan Glastonbury.\n\nEnsure arrays via type aliases are correctly handled to\navoid miscompilations.\n\nTests: Tools/TestWebKitAPI/Tests/WGSL/shaders/array-alias-constructor.wgsl\n Tools/TestWebKitAPI/Tests/WGSL/shaders/array-vec3.wgsl\n\n* Source/WebGPU/WGSL/GlobalVariableRewriter.cpp:\n(WGSL::RewriteGlobalVariables::packArrayResource):\n* Source/WebGPU/WGSL/Metal/MetalFunctionWriter.cpp:\n(WGSL::Metal::FunctionDefinitionWriter::visit):\n* Tools/TestWebKitAPI/Tests/WGSL/shaders/array-alias-constructor.wgsl:\n* Tools/TestWebKitAPI/Tests/WGSL/shaders/array-vec3.wgsl:\n\nCanonical link: https://commits.webkit.org/320690@main\n" }, { "commit": "f02f2b97e6b0211562e02b35cde442ccbda6563b", "tree": "b4e8c5f08692875e0fd05d834ad2abcc1bb80469", "parents": [ "25984471060980f62bfebb858ea251568c0e78fd" ], "author": { "name": "Mike Wyrzykowski", "email": "mwyrzykowski@apple.com", "time": "Wed Sep 09 00:07:27 2026" }, "committer": { "name": "Mike Wyrzykowski", "email": "mwyrzykowski@apple.com", "time": "Wed Sep 09 00:07:27 2026" }, "message": "[Apple5] WebGPU Renderbundles Device Destroyed ‘Device lost\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323684\nrdar://186688781\n\nReviewed by Dan Glastonbury.\n\nApple5 doesn\u0027t support Tier2 so fallback to record + replay there.\n\n* Source/WebGPU/WebGPU/Device.h:\n(WebGPU::Device::supportsIndirectCommandBuffersInArgumentBuffers const):\n* Source/WebGPU/WebGPU/RenderBundleEncoder.mm:\n(WebGPU::RenderBundleEncoder::RenderBundleEncoder):\n\nCanonical link: https://commits.webkit.org/320689@main\n" }, { "commit": "25984471060980f62bfebb858ea251568c0e78fd", "tree": "5b593ed41855f1b87e0c3e827cad4740c19cfca7", "parents": [ "4fa7b55ae4c6485fcdef946f98b692bff1a2fcc6" ], "author": { "name": "Cole Carley", "email": "ccarley2@apple.com", "time": "Wed Sep 09 00:05:23 2026" }, "committer": { "name": "Cole Carley", "email": "ccarley2@apple.com", "time": "Wed Sep 09 00:05:23 2026" }, "message": "[Quirks] Introduce the QuirkBehavior struct\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323482\nrdar://186709805\n\nReviewed by Brent Fulgham.\n\nThis patch introduces the QuirkBehavior struct. A Quirk is the composition\nof matching conditions and the QuirkBehavior to run when the matching\nconditions have been met.\n\nThe QuirkBehavior common case represents a flag that turns on some Quirking behavior\nat runtime. Some QuirkBehaviors need to hold more than just a flag, like a script,\nwhich is why we can no longer represent QuirkBehaviors with an enum.\n\nThis patch renamed the SiteSpecificQuirk enum to the more appropriate QuirkBehaviorID,\nsince it no longer represents the entire Quirk.\n\nTest: Tools/TestWebKitAPI/Tests/WebCore/Quirks.cpp\n\n* Source/WebCore/Headers.cmake:\n* Source/WebCore/WebCore.xcodeproj/project.pbxproj:\n* Source/WebCore/page/QuirkBehaviors.h: Added.\n* Source/WebCore/page/QuirkNames.h: Removed.\n* Source/WebCore/page/QuirkTable.cpp:\n(WebCore::SiteSpecificQuirks::shouldEmit):\n(WebCore::SiteSpecificQuirks::prunedTable):\n(WebCore::Quirk::apply const):\n(WebCore::SiteSpecificQuirks::isAvailable): Deleted.\n(WebCore::SiteSpecificQuirks::computeUnavailableQuirks): Deleted.\n(WebCore::SiteSpecificQuirks::maskedQuirk): Deleted.\n* Source/WebCore/page/QuirkTable.h:\n(WebCore::QuirkBehaviors::QuirkBehaviors):\n(WebCore::QuirkBehaviors::removeUnavailable):\n(WebCore::QuirkBehaviors::exclude): Deleted.\n* Source/WebCore/page/Quirks.cpp:\n* Source/WebCore/page/Quirks.h:\n(WebCore::Quirks::shouldAllowPopupFromMicrosoftOfficeToOneDrive const):\n(WebCore::Quirks::quirkIsEnabledAfterProbing const):\n* Source/WebCore/page/QuirksData.h:\n(WebCore::QuirksData::quirkIsEnabled const):\n(WebCore::QuirksData::enableQuirks):\n(WebCore::QuirksData::enableQuirk):\n(WebCore::QuirksData::setQuirkState):\n* Tools/TestWebKitAPI/Tests/WebCore/Quirks.cpp:\n(TestWebKitAPI::TEST_F(QuirksTest, EmbeddedQuirksResolveFromTheDocumentURL)):\n(TestWebKitAPI::TEST_F(QuirksTest, SiteSpecificQuirksResolveWithoutADocument)):\n(TestWebKitAPI::TEST_F(QuirksTest, IsMicrosoftTeamsRedirectURL)):\n\nCanonical link: https://commits.webkit.org/320688@main\n" }, { "commit": "4fa7b55ae4c6485fcdef946f98b692bff1a2fcc6", "tree": "5bdac4854ab39dddbd6933dfb5e921f646d3756f", "parents": [ "d995884fd85bb07b7c1be713ec235bd1491b312a" ], "author": { "name": "Yusuke Suzuki", "email": "ysuzuki@apple.com", "time": "Tue Sep 08 23:51:40 2026" }, "committer": { "name": "Yusuke Suzuki", "email": "ysuzuki@apple.com", "time": "Tue Sep 08 23:51:40 2026" }, "message": "[JSC] eval call should recognize tail-position\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323597\nrdar://186840477\n\nReviewed by Sosuke Suzuki.\n\nThis patch fixes TCO for function call named \"eval\".\nWe follow to the pattern used in spread call case: performing CallDirectEval\nonly when the function is actually eval function. Otherwise, do a tail-call.\n\nDoing so uncovered a separate bug in how we decide what a tail position is.\nGenerator, async function, and async generator bodies hold no tail positions\nat all (IsInTailPosition steps 4 to 7), but BytecodeGenerator enabled TCO in\nthem anyway. An async generator awaits the value its body returns, so\nop_tail_call jumped over that await and resolved the iterator result with the\npromise itself; the other body modes dropped a frame that has to stay on the\nstack. This is not specific to the new eval path, an ordinary call hits it too:\n\n async function* g() { \"use strict\"; return Promise.resolve(42); }\n g().next() // resolved with { value: \u003cpromise\u003e, done: true }\n\nSo exclude those parse modes when computing m_allowTailCallOptimization.\n\nTests: JSTests/stress/no-tail-call-in-generator-and-async-function-bodies.js\n JSTests/stress/tail-call-eval-identifier-resolving-to-non-eval-function.js\n\n* JSTests/stress/no-tail-call-in-generator-and-async-function-bodies.js: Added.\n(shouldBe):\n(drain):\n(asyncGeneratorAwaitsReturnedCall.f):\n(asyncGeneratorAwaitsReturnedCall.async plainCall):\n(asyncGeneratorAwaitsReturnedCall.async memberCall):\n(asyncGeneratorAwaitsReturnedCall.async spreadCall):\n(asyncGeneratorAwaitsReturnedCall.async applyCall):\n(asyncGeneratorAwaitsReturnedCall):\n(bodiesKeepTheirFrame.callerName):\n(bodiesKeepTheirFrame.generatorBody):\n(bodiesKeepTheirFrame.async asyncFunctionBody):\n(bodiesKeepTheirFrame.async asyncGeneratorBody):\n(bodiesKeepTheirFrame.ordinaryStrictFunction):\n(bodiesKeepTheirFrame):\n* JSTests/stress/tail-call-eval-identifier-resolving-to-non-eval-function.js: Added.\n(shouldBe):\n(functionScope.f):\n(functionScopeDynamic.f):\n(functionScopeDynamic):\n(withScope.with.f):\n(withScope):\n(spreadArguments.f):\n(spreadArguments):\n(realDirectEvalInTailPosition.f):\n(realDirectEvalInTailPosition):\n(asyncGeneratorScope.eval):\n(asyncGeneratorScope.async g):\n(asyncGeneratorScope):\n(globalF):\n* JSTests/test262/expectations-linux.yaml:\n* JSTests/test262/expectations.yaml:\n* Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp:\n(JSC::BytecodeGenerator::BytecodeGenerator):\n* Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h:\n(JSC::BytecodeGenerator::allowsTailCallOptimization const):\n* Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp:\n(JSC::EvalFunctionCallNode::emitBytecode):\n\nCanonical link: https://commits.webkit.org/320687@main\n" }, { "commit": "d995884fd85bb07b7c1be713ec235bd1491b312a", "tree": "0cadc97133a0f743f3c1e8e6a81646935301c1f0", "parents": [ "d04ea1c3b83737ffbc07af07944064f271ec3bb4" ], "author": { "name": "Yury Semikhatsky", "email": "yurys@chromium.org", "time": "Tue Sep 08 23:41:14 2026" }, "committer": { "name": "Yury Semikhatsky", "email": "yurys@chromium.org", "time": "Tue Sep 08 23:41:14 2026" }, "message": "NEW TEST(319401@main): [macOS Debug] TestWebKitAPI.ContextMenuTests.MenuTrackingCancelledWhenPageCloses is flaky\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323373\n\nReviewed by Devin Rousso.\n\nWebPageProxy::close() dismissed the active context menu with -[NSMenu cancelTracking],\nwhich fades the menu out inside AppKit\u0027s nested tracking run loop. The fade lasts about\n240 ms, and the test polled that run loop every 250 ms to detect a menu that stayed open,\nso on slow Debug bots the poll occasionally fired once more before tracking ended and\nthe test wrongly reported the menu as still open. Closing the page also sent\nDidDismissContextMenu to a WebPage that had already been closed, which the web process\nlogged as an unhandled message.\n\nDismiss the menu with -[NSMenu cancelTrackingWithoutAnimation] instead, since there is\nnothing to animate for a page that is going away, and only send DidDismissContextMenu\nwhen the page still has a running process.\n\nPopup menus for \u003cselect\u003e elements run the same kind of nested tracking loop and are\ncancelled from close() the same way, so dismiss them without animation too. Add a\ncounterpart test that opens a popup menu and closes the page while it is tracking.\n\nMake the context menu test stop polling once it has closed the page and instead arm a\none-shot watchdog timer in the tracking run loop mode. The watchdog can only fire if the\nmenu is still tracking two seconds after the page closed, in which case it records the\nfailure and dismisses the menu itself so the test fails instead of hanging. The new popup\nmenu test uses the same approach.\n\nTests: Tools/TestWebKitAPI/Tests/WebKit/WKWebView/mac/ContextMenuTests.mm\n Tools/TestWebKitAPI/Tests/WebKit/WKWebView/mac/PopupMenuTests.mm\n\n* Source/WebKit/UIProcess/WebPageProxy.cpp:\n(WebKit::WebPageProxy::didDismissContextMenu):\n* Source/WebKit/UIProcess/mac/WebContextMenuProxyMac.mm:\n(WebKit::WebContextMenuProxyMac::cancelTracking):\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/mac/ContextMenuTests.mm:\n(TestWebKitAPI::TEST(ContextMenuTests, MenuTrackingCancelledWhenPageCloses)):\n* Source/WebKit/UIProcess/mac/WebPopupMenuProxyMac.mm:\n(WebKit::WebPopupMenuProxyMac::cancelTracking):\n* Tools/TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/mac/PopupMenuTests.mm: Added.\n(TestWebKitAPI::TEST(PopupMenuTests, MenuTrackingCancelledWhenPageCloses)):\n\nCanonical link: https://commits.webkit.org/320686@main\n" }, { "commit": "d04ea1c3b83737ffbc07af07944064f271ec3bb4", "tree": "c20ea43097c2c5907f1fe6c9e5a3e1e3779bab73", "parents": [ "111d7edcecd19a77402355eb24e46dc53866de55" ], "author": { "name": "Brady Eidson", "email": "beidson@apple.com", "time": "Tue Sep 08 23:37:44 2026" }, "committer": { "name": "WebKit Opensource Integration", "email": "webkit-opensource-integration@apple.com", "time": "Tue Sep 08 23:37:44 2026" }, "message": "(305413.959@safari-7624-branch) Embedded image is not load as image in mail app\nrdar://179999480\n\nReviewed by Ben Nham.\n\nThe addition of custom scheme CORS checks broke apps that load the main HTML via\nfile URL and then mix in custom schemes.\n\nIt\u0027s totally find to relax the checks for that case.\n\nTest: Tools/TestWebKitAPI/Tests/WebKitCocoa/WKURLSchemeHandler-1.mm\n\n* Source/WebCore/loader/cache/CachedResourceLoader.cpp:\n(WebCore::CachedResourceLoader::isNoCorsCrossOriginRequestToURLSchemeHandler const):\n* Tools/TestWebKitAPI/Tests/WebKitCocoa/WKURLSchemeHandler-1.mm:\n((URLSchemeHandler, LoadFileURLNoCorsSubresourceAllowed)):\n\nOriginally-landed-as: 305413.1023@safari-7624.5-branch (111cc2819a4d). rdar://184744849\nCanonical link: https://commits.webkit.org/320685@main\n" }, { "commit": "111d7edcecd19a77402355eb24e46dc53866de55", "tree": "d7d0e5668c99a53c4768433e83497a2d2830b58c", "parents": [ "1a29b8cfcf8d065176502b18ca611443e3a1b615" ], "author": { "name": "Sosuke Suzuki", "email": "sosuke@bun.sh", "time": "Tue Sep 08 23:37:08 2026" }, "committer": { "name": "Sosuke Suzuki", "email": "sosuke@bun.com", "time": "Tue Sep 08 23:37:08 2026" }, "message": "[JSC] `RegExpTestInline` crashes when `deleteAllCode()` runs during a DFG/FTL compilation\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323583\n\nReviewed by Yusuke Suzuki.\n\nDFGStrengthReductionPhase converts RegExpTest to RegExpTestInline after\nchecking regExp-\u003egetRegExpJITCodeBlock() on the compiler thread, but records\nonly the frozen RegExp* in the node. Code generation calls\ngetRegExpJITCodeBlock() again, and it returns nullptr once the RegExp has\nleft the JITCode state. The main thread can reset that state at any point\nduring the compilation: VM::deleteAllCode() clears every cached RegExp\nbefore completing the in-flight JIT plans. When this lands between strength\nreduction and code generation, the compiler thread crashes on the null\nYarrCodeBlock. The race has existed since 244149@main introduced\nRegExpTestInline.\n\nMake code generation read the YarrCodeBlock through a new\ngetRegExpJITCodeBlockConcurrently() that does not consult the compilation\nstate. This is safe because deleteCode() only clears the compiled code refs:\nit never resets m_regExpJITCode once allocated, and YarrCodeBlock::clear()\nkeeps the InlineStats. Code generation reads only stackSize() and\nneedsTemp2() from the stats, which are functions of the pattern alone\n(unlike canInline() and codeSize(), which depend on the subject string\nsampled for the Boyer-Moore lookahead), and it regenerates the matcher from\nthe pattern source via jitCompileInlinedTest, so the emitted code is correct\nwhatever the compilation state is.\n\nTest: JSTests/stress/regexp-test-inline-delete-all-code-race.js\n\n* JSTests/stress/regexp-test-inline-delete-all-code-race.js: Added.\n(tick):\n(let.hot):\n(ftlTick):\n* Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp:\n(JSC::DFG::SpeculativeJIT::compileRegExpTestInline):\n* Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:\n(JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):\n* Source/JavaScriptCore/runtime/RegExp.h:\n\nCanonical link: https://commits.webkit.org/320684@main\n" }, { "commit": "1a29b8cfcf8d065176502b18ca611443e3a1b615", "tree": "e20bac3eb5b069b4a52115be2c7285f449908225", "parents": [ "b44e00d2f037003c48d578eced64caddf9036dfa" ], "author": { "name": "Sosuke Suzuki", "email": "sosuke@bun.sh", "time": "Tue Sep 08 23:35:08 2026" }, "committer": { "name": "Sosuke Suzuki", "email": "sosuke@bun.com", "time": "Tue Sep 08 23:35:08 2026" }, "message": "[YARR] `\\-` following a class set operand in a `/v` class throws a SyntaxError\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323496\n\nReviewed by Yusuke Suzuki.\n\nIn the AfterSetOperand state, atomPatternCharacter() rejected every\nhyphen, so /[[a]\\-]/v and /[\\q{ab}\\-]/v threw SyntaxError even though\n\\- is a valid ClassSetReservedPunctuator escape. The other states\nadded in 320216@main accept an escaped hyphen by checking\nprocessingEscape; this state did not.\n\nChecking processingEscape here also requires clearing\nm_processingEscape when a set operand ends without reaching\natomPatternCharacter(): a nested class or a \\q{} string disjunction\nleaves the flag set by its last escape, so an unescaped hyphen right\nafter it, as in /[[\\d]-c]/v or /[\\q{ab}-c]/v, would have been treated\nas escaped. nestedClassEnd() and afterSetOperand() now reset it.\n\nTest: JSTests/stress/regexp-v-flag-escaped-hyphen-after-set-operand.js\n\n* JSTests/stress/regexp-v-flag-escaped-hyphen-after-set-operand.js: Added.\n(shouldBe):\n* Source/JavaScriptCore/yarr/YarrParser.h:\n(JSC::Yarr::Parser::ClassSetParserDelegate::nestedClassEnd):\n(JSC::Yarr::Parser::ClassSetParserDelegate::afterSetOperand):\n(JSC::Yarr::Parser::ClassSetParserDelegate::atomPatternCharacter):\n\nCanonical link: https://commits.webkit.org/320683@main\n" }, { "commit": "b44e00d2f037003c48d578eced64caddf9036dfa", "tree": "5207e27744c8d512c0ede870559c93dc22300695", "parents": [ "4577b17ad891b294d77e670a4f8670f920976d44" ], "author": { "name": "Sosuke Suzuki", "email": "sosuke@bun.sh", "time": "Tue Sep 08 23:33:21 2026" }, "committer": { "name": "Sosuke Suzuki", "email": "sosuke@bun.com", "time": "Tue Sep 08 23:33:21 2026" }, "message": "[JSC] `RegExp.escape` should not narrow supplementary code points to 16 bits\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323642\n\nReviewed by Yusuke Suzuki.\n\nregExpConstructorEscape reads a whole code point with U16_NEXT but then\nclassifies it through StringView::contains(char16_t) and isStrWhiteSpace,\nwhich truncate it to its low 16 bits. A supplementary code point whose low\n16 bits spell a syntax character, a punctuator, a control character or\nwhitespace is escaped even though the spec leaves it alone: U+2002A (low 16\nbits \"*\") becomes \"\\\" followed by U+2002A, and U+20009 (low 16 bits \"\\t\")\nbecomes \"\\ud840\\udc09\". With the u or v flag the escaped string then never\nmatches the input. 56 low-16-bit values in each of the 16 supplementary\nplanes are affected.\n\nRun the punctuator checks only for ASCII code points and the whitespace and\nsurrogate checks only for BMP code points, so that a supplementary code\npoint passes through unchanged. The branch that emitted a surrogate pair\nescape is dead after this: nothing in the escape set is supplementary.\n\nTests: JSTests/stress/regexp-escape-supplementary.js\n\n* JSTests/stress/regexp-escape-supplementary.js: Added.\n(shouldBe):\n* Source/JavaScriptCore/runtime/RegExpConstructor.cpp:\n(JSC::JSC_DEFINE_HOST_FUNCTION):\n\nCanonical link: https://commits.webkit.org/320682@main\n" }, { "commit": "4577b17ad891b294d77e670a4f8670f920976d44", "tree": "5734a3081d875a4ae89174fcf064c62698a81b3b", "parents": [ "4915846795d27e8bbe468afda1ff1f38affd6047" ], "author": { "name": "Yusuke Suzuki", "email": "ysuzuki@apple.com", "time": "Tue Sep 08 23:09:31 2026" }, "committer": { "name": "Yusuke Suzuki", "email": "ysuzuki@apple.com", "time": "Tue Sep 08 23:09:31 2026" }, "message": "[JSC] Remove Heap::isPagedOut\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323689\nrdar://186946846\n\nReviewed by Keith Miller.\n\nRemoving Heap::isPagedOut given that we found that this was never\ninvoked because of a bug. The percentage number etc. needs to be tuned\nwith fresh benchmarks and metrics, so as it is dead code now, just\nremoving it. We can have similar or revised version of this later.\n\n* Source/JavaScriptCore/heap/BlockDirectory.cpp:\n(JSC::BlockDirectory::updatePercentageOfPagedOutPages): Deleted.\n* Source/JavaScriptCore/heap/BlockDirectory.h:\n* Source/JavaScriptCore/heap/FullGCActivityCallback.cpp:\n(JSC::FullGCActivityCallback::doCollection):\n* Source/JavaScriptCore/heap/Heap.cpp:\n(JSC::Heap::isPagedOut): Deleted.\n* Source/JavaScriptCore/heap/Heap.h:\n* Source/JavaScriptCore/heap/MarkedSpace.cpp:\n(JSC::MarkedSpace::isPagedOut): Deleted.\n* Source/JavaScriptCore/heap/MarkedSpace.h:\n* Source/JavaScriptCore/runtime/OptionsList.h:\n\nCanonical link: https://commits.webkit.org/320681@main\n" }, { "commit": "4915846795d27e8bbe468afda1ff1f38affd6047", "tree": "847eb6973441b617c45c39f2174dfc7139496ea9", "parents": [ "a09eb789c913720a2c19ef4bb516a0b7d6641729" ], "author": { "name": "Marta Darbinyan", "email": "darbinyan@apple.com", "time": "Tue Sep 08 23:01:06 2026" }, "committer": { "name": "Marta Darbinyan", "email": "darbinyan@apple.com", "time": "Tue Sep 08 23:01:06 2026" }, "message": "[Gardening]: NEW TEST(319873@main): [iOS] TestWebKitAPI.IndexedDB.TransactionOfSuspendedProcessIsNotAbortedByItsOwnQueuedTransaction\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323702\nrdar://186958391\n\nUnreviewed test gardening\n\n* TestExpectations/apitests:\n\nCanonical link: https://commits.webkit.org/320680@main\n" }, { "commit": "a09eb789c913720a2c19ef4bb516a0b7d6641729", "tree": "26eda223e331c7e4115acc0b3772800a1080d91b", "parents": [ "78b8d6207c611acc57ae97d633591782a90ab460" ], "author": { "name": "Tyler Wilcock", "email": "tyler_w@apple.com", "time": "Tue Sep 08 22:55:52 2026" }, "committer": { "name": "Tyler Wilcock", "email": "tyler_w@apple.com", "time": "Tue Sep 08 22:55:52 2026" }, "message": "AX: Add a layout test for accessibility text state across undo and redo\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323532\nrdar://186771075\n\nReviewed by Chris Fleizach.\n\nUndo and redo change a text control\u0027s value without any script touching it -- the edit is unapplied\nby EditCommandComposition, not by an assignment the page makes. Editor::unappliedEditing() and\nEditor::reappliedEditing() both end in respondToChangedContents(), which posts AXValueChanged via\nAXObjectCache::onEditableTextValueChanged(). No accessibility test covered either command.\n\nThis test verifies that accessibility\u0027s notion of the field value, character count, and cursor\nposition is correct after undo and redo.\n\n* LayoutTests/accessibility/isolated-tree/mac/undo-redo-text-state-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/undo-redo-text-state.html: Added.\n* LayoutTests/accessibility/mac/undo-redo-text-state-expected.txt: Added.\n* LayoutTests/accessibility/mac/undo-redo-text-state.html: Added.\n\nCanonical link: https://commits.webkit.org/320679@main\n" }, { "commit": "78b8d6207c611acc57ae97d633591782a90ab460", "tree": "f875e26d7e4bc077531df9d9d27fe01ccf08e448", "parents": [ "67c93bbc4bcdca8b1b17ec0df73d1708b46deab8" ], "author": { "name": "Justin Michaud", "email": "jmichaud@igalia.com", "time": "Tue Sep 08 22:52:30 2026" }, "committer": { "name": "Justin Michaud", "email": "jmichaud@igalia.com", "time": "Tue Sep 08 22:52:30 2026" }, "message": "[non-cocoa][fuzz] Integer underflow OpenType findFeature\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d321755\n\nReviewed by Claudio Saavedra.\n\nInclude some extra tests for a fix landed upstream. Fix an underflow\nwhile we are at it.\n\nCanonical link: https://commits.webkit.org/320678@main\n" }, { "commit": "67c93bbc4bcdca8b1b17ec0df73d1708b46deab8", "tree": "4df429fcc222c80224a82a0b4871f65f08076946", "parents": [ "f0e9cecd4bb5cc9e457e8acf85a25c04b695c939" ], "author": { "name": "Justin Michaud", "email": "jmichaud@igalia.com", "time": "Tue Sep 08 22:40:56 2026" }, "committer": { "name": "Adrian Perez de Castro", "email": "aperez@igalia.com", "time": "Tue Sep 08 22:40:56 2026" }, "message": "[WPE] REGRESSION(320333@main): 2048 new failures on JSC tests\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323268\n\nReviewed by Carlos Alberto Lopez Perez and Adrian Perez de Castro.\n\nLet\u0027s revert this change on linux for now.\n\nCanonical link: https://commits.webkit.org/320677@main\n" }, { "commit": "f0e9cecd4bb5cc9e457e8acf85a25c04b695c939", "tree": "1e8223e90571f54dc45ebdd34c3c7e6eb8d9fc6a", "parents": [ "1bd170d46e5b9db173c4dd7f73c0b2863f8eeaf4" ], "author": { "name": "Sihui Liu", "email": "sihui_liu@apple.com", "time": "Tue Sep 08 21:44:59 2026" }, "committer": { "name": "Sihui Liu", "email": "sihui_liu@apple.com", "time": "Tue Sep 08 21:44:59 2026" }, "message": "[Site Isolation] Removing sandbox attribute does not clear frame\u0027s sandbox flags on a same-process navigation\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323635\nrdar://186867877\n\nReviewed by Per Arne Vollan.\n\nWhen a navigation stays in the process the frame is already in, the frame\u0027s sandbox flags are delivered by\nLoadParameters and WebPage::loadRequest applies them only when the set is non-empty. Removing the sandbox attribute\nproduces an empty set, which is indistinguishable from \"this load carries no sandbox information\", so the update is\nskipped: the reused LocalFrame keeps its old flags and the newly committed Document inherits them.\n\nMade LoadParameters::effectiveSandboxFlags a std::optional so that \"clear the flags\" and \"no flags were set\" are\ndistinguishable, and apply it whenever it is engaged. Only the two Site Isolation navigation-continuation paths in\nWebPageProxy populate it; every other sender leaves it std::nullopt and keeps skipping the update, as the previous\ndefault-constructed empty set already did.\n\nTests: SiteIsolation.SandboxFlagsRemovedBeforeSameSiteNavigation\n\n* Source/WebKit/Shared/LoadParameters.h:\n* Source/WebKit/Shared/LoadParameters.serialization.in:\n* Source/WebKit/WebProcess/WebPage/WebPage.cpp:\n(WebKit::WebPage::loadRequest):\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolation.mm:\n(TestWebKitAPI::TEST(SiteIsolation, SandboxFlagsRemovedBeforeSameSiteNavigation)):\n\nCanonical link: https://commits.webkit.org/320676@main\n" }, { "commit": "1bd170d46e5b9db173c4dd7f73c0b2863f8eeaf4", "tree": "5890ed50470806d3a9a24b4c3745c61b5233f1c5", "parents": [ "03c6c950449526f3b8d8740bed1fb6a92083dade" ], "author": { "name": "Nikolas Zimmermann", "email": "nzimmermann@igalia.com", "time": "Tue Sep 08 21:19:37 2026" }, "committer": { "name": "Nikolas Zimmermann", "email": "zimmermann@kde.org", "time": "Tue Sep 08 21:19:37 2026" }, "message": "[GTK][WPE] Gardening of tests - 2026-09-08\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323669\n\nUnreviewed gardening.\n\n* LayoutTests/platform/glib/TestExpectations:\n* LayoutTests/platform/gtk/TestExpectations:\n* LayoutTests/platform/wpe/TestExpectations:\n\nCanonical link: https://commits.webkit.org/320675@main\n" }, { "commit": "03c6c950449526f3b8d8740bed1fb6a92083dade", "tree": "b99b45e55be10e5a7eb6dcfd9c2f14657e7fae5e", "parents": [ "ca3a9f205bcecd15c9d2ed0680acc25b56785109" ], "author": { "name": "Yusuke Suzuki", "email": "ysuzuki@apple.com", "time": "Tue Sep 08 21:08:42 2026" }, "committer": { "name": "Yusuke Suzuki", "email": "ysuzuki@apple.com", "time": "Tue Sep 08 21:08:42 2026" }, "message": "[JSC] Move BlockDirectory for-stealing list to AlignedMemoryAllocator\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323680\nrdar://186935769\n\nReviewed by Marcus Plutowski.\n\nHolding BlockDirectory cursor for each subspace is meaningless. Let\u0027s\njust move it to AlignedMemoryAllocator and query to that to find\nsteal-able MarkedBlock instead.\n\n* Source/JavaScriptCore/heap/AlignedMemoryAllocator.cpp:\n(JSC::AlignedMemoryAllocator::registerDirectory):\n(JSC::AlignedMemoryAllocator::prepareForAllocation):\n(JSC::AlignedMemoryAllocator::findEmptyBlockToSteal):\n(JSC::AlignedMemoryAllocator::registerSubspace): Deleted.\n* Source/JavaScriptCore/heap/AlignedMemoryAllocator.h:\n* Source/JavaScriptCore/heap/CompleteSubspace.cpp:\n(JSC::CompleteSubspace::allocatorForSlow):\n* Source/JavaScriptCore/heap/IsoSubspace.cpp:\n(JSC::IsoSubspace::IsoSubspace):\n* Source/JavaScriptCore/heap/LocalAllocator.cpp:\n(JSC::LocalAllocator::tryAllocateWithoutCollecting):\n* Source/JavaScriptCore/heap/Subspace.cpp:\n(JSC::Subspace::initialize):\n(JSC::Subspace::prepareForAllocation):\n(JSC::Subspace::findEmptyBlockToSteal): Deleted.\n* Source/JavaScriptCore/heap/Subspace.h:\n(JSC::Subspace::didCreateFirstDirectory): Deleted.\n(JSC::Subspace::nextSubspaceInAlignedMemoryAllocator const): Deleted.\n(JSC::Subspace::setNextSubspaceInAlignedMemoryAllocator): Deleted.\n\nCanonical link: https://commits.webkit.org/320674@main\n" }, { "commit": "ca3a9f205bcecd15c9d2ed0680acc25b56785109", "tree": "66e3da3dd16ffeb93fc1ea5c83b99260f9a820eb", "parents": [ "3f39fb99f98226f668f7e04a1287564a606a1a5a" ], "author": { "name": "Nikolas Zimmermann", "email": "nzimmermann@igalia.com", "time": "Tue Sep 08 20:49:32 2026" }, "committer": { "name": "Nikolas Zimmermann", "email": "zimmermann@kde.org", "time": "Tue Sep 08 20:49:32 2026" }, "message": "[GTK][WPE] Pixel tests using testRunner.dontForceRepaint() are flaky\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323607\n\nReviewed by Carlos Garcia Campos.\n\nWKPageForceRepaint() forces a repaint and then waits for the next presentation\nupdate. On the coordinated graphics ports that wait is the only synchronization\nbetween the rendering update in the web process and the snapshot taken by\nWebKitTestRunner. Tests calling testRunner.dontForceRepaint() skipped the call\nentirely, dropping the synchronization together with the repaint, and captured\nwhichever frame the UI process last received - fix that behavior by an\nexplicit wait.\n\nCovered by existing tests, such as the recently added\ncss3/filters/filter-repaint-blur-nested-pixel-moving-filter.html on\nGTK/WPE.\n\n* Tools/WebKitTestRunner/TestInvocation.cpp:\n(WTR::TestInvocation::presentationUpdateDoneCallback):\n(WTR::TestInvocation::waitForPresentationUpdate):\n(WTR::TestInvocation::dumpResults):\n* Tools/WebKitTestRunner/TestInvocation.h:\n\nCanonical link: https://commits.webkit.org/320673@main\n" }, { "commit": "3f39fb99f98226f668f7e04a1287564a606a1a5a", "tree": "93915cdb0c10995725c01b7a83081098149f29ad", "parents": [ "681c0a0ad8ad1cdcc78ee7d0ceded7bcc624ea86" ], "author": { "name": "Alan Baradlay", "email": "zalan@apple.com", "time": "Tue Sep 08 20:45:26 2026" }, "committer": { "name": "Alan Baradlay", "email": "zalan@apple.com", "time": "Tue Sep 08 20:45:26 2026" }, "message": "[cleanup] Drop RenderListOutsideMarker::m_image, the marker box\u0027s copy of the list-style-image its style already holds\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323549\nrdar://problem/186794793\n\nReviewed by Antti Koivisto.\n\nThe member held what style().listStyleImage() holds. Ask style for it: whether the marker shows an image, and\nwhich image it resolves the size from, now go through listMarkerImage(), which is the name the two open-coded\ncopies of \"a list-style-image that loaded\" get. The marker is still the image\u0027s client so that it hears about\nthe image loading and about it failing to load, and that registration diffs the old style against the new one\nthe way RenderElement::updateFillImages does. It reads the style image unfiltered, since a marker whose image\nfailed has to hear about it to become a text marker.\n\n* Source/WebCore/rendering/RenderListItem.cpp:\n(WebCore::RenderListItem::markerText const):\n* Source/WebCore/rendering/RenderListOutsideMarker.cpp:\n(WebCore::RenderListOutsideMarker::willBeDestroyed):\n(WebCore::RenderListOutsideMarker::styleDidChange):\n(WebCore::RenderListOutsideMarker::isImage const):\n(WebCore::RenderListOutsideMarker::imageChanged):\n(WebCore::RenderListOutsideMarker::updateContent):\n(WebCore::listMarkerImage):\n(WebCore::listMarkerSynthesizesGlyph):\n(WebCore::listMarkerShowsImage): Deleted.\n* Source/WebCore/rendering/RenderListOutsideMarker.h:\n\nCanonical link: https://commits.webkit.org/320672@main\n" }, { "commit": "681c0a0ad8ad1cdcc78ee7d0ceded7bcc624ea86", "tree": "73b7bff19b05aa16970a892baf1897b8606cd80b", "parents": [ "9b0f01ca9e14c8cf7b5485dadeaaeed687e2a851" ], "author": { "name": "Alan Baradlay", "email": "zalan@apple.com", "time": "Tue Sep 08 20:44:17 2026" }, "committer": { "name": "Alan Baradlay", "email": "zalan@apple.com", "time": "Tue Sep 08 20:44:17 2026" }, "message": "Tab character renders too narrow when tab-size is small (proportional fonts)\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323466\n\u003crdar://problem/186698040\u003e\n\nReviewed by Antti Koivisto.\n\n \u003cdiv style\u003d\"font: 32px serif; white-space: pre; tab-size: 0.4ch\"\u003e\u0026#9;\u0026#9;\u0026#9;\u003c/div\u003e\n\nEach tab should advance to the second tab stop, making the run 2.4ch wide. Instead it advanced to the first one and the run was 1.2ch.\n\nA tab is not a glyph but a shift to the next tab stop, and a shift too short to read as a tab takes the subsequent stop instead.\nThe spec measures \"too short\" against 0.5ch, half the advance of the \"0\" glyph, while we measured it against the space character.\nIn a proportional font the space is a lot narrower than the \"0\" (2.2px vs 4px in 16px Times)\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/white-space/reference/tab-stop-threshold-007-ref.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/white-space/tab-stop-threshold-007-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/white-space/tab-stop-threshold-007.html: Added.\n* Source/WebCore/platform/graphics/FontCascadeInlines.h:\n(WebCore::FontCascade::tabWidth):\n\nCanonical link: https://commits.webkit.org/320671@main\n" }, { "commit": "9b0f01ca9e14c8cf7b5485dadeaaeed687e2a851", "tree": "1a667da744595c78ea3d9ba5e29239a65a5da0e7", "parents": [ "df4d161570c606716592422d307db97e9bc9eda5" ], "author": { "name": "Sam Weinig", "email": "sam@webkit.org", "time": "Tue Sep 08 19:56:14 2026" }, "committer": { "name": "Sam Weinig", "email": "sam@webkit.org", "time": "Tue Sep 08 19:56:14 2026" }, "message": "Replace references to ComputedStyle\u0027s \"lineHeight\" with \"textAutosizingAdjustedLineHeight\" and \"computedLineHeight\" with \"usedLineHeight\"\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323631\n\nReviewed by Darin Adler.\n\nPart 1 of https://bugs.webkit.org/show_bug.cgi?id\u003d323630\n\nStyle::ComputedStyle currently has three different line height accessors:\n - lineHeight()\n - specifiedLineHeight()\n - computedLineHeight()\n\nNone of these are clear and none of the prefixes align with their counterpart\nCSS concept. Rather, what they actually represent is:\n\n - lineHeight() -\u003e text autosizing adjusted computed style\n - specifiedLineHeight() -\u003e computed style\n - computedLineHeight() -\u003e zoom, percentage and keyword evaluated transform of\n the \"text autosizing adjusted computed style\".\n\nAs an initial step to fixing these names, we make the following renames:\n\n - lineHeight() -\u003e textAutosizingAdjustedLineHeight()\n - computedLineHeight() -\u003e usedLineHeight()\n\nWhether we need to keep textAutosizingAdjustedLineHeight() long term is unclear.\nIt depends on whether the caching the transformation is necessary to maintain\nperformance, so that is something to handle at another time.\n\nspecifiedLineHeight() will be handled in a part 2.\n\n* Source/WebCore/css/CSSProperties.json:\n* Source/WebCore/html/HTMLInputElement.cpp:\n* Source/WebCore/layout/formattingContexts/inline/InlineFormattingUtils.cpp:\n* Source/WebCore/layout/formattingContexts/inline/InlineLevelBoxInlines.h:\n* Source/WebCore/layout/formattingContexts/inline/InlineLineBuilder.cpp:\n* Source/WebCore/layout/formattingContexts/inline/InlineQuirks.cpp:\n* Source/WebCore/layout/integration/inline/LayoutIntegrationLineLayout.cpp:\n* Source/WebCore/page/PrintContext.cpp:\n* Source/WebCore/rendering/CaretRectComputation.cpp:\n* Source/WebCore/rendering/RenderBlockFlow.cpp:\n* Source/WebCore/rendering/RenderBox.cpp:\n* Source/WebCore/rendering/RenderInline.cpp:\n* Source/WebCore/rendering/RenderLayoutState.cpp:\n* Source/WebCore/rendering/RenderListOutsideMarker.cpp:\n* Source/WebCore/rendering/RenderTextControl.cpp:\n* Source/WebCore/rendering/RenderTheme.cpp:\n* Source/WebCore/rendering/TextAutoSizing.cpp:\n* Source/WebCore/rendering/adwaita/RenderThemeAdwaita.cpp:\n* Source/WebCore/rendering/cocoa/RenderThemeCocoa.mm:\n* Source/WebCore/rendering/ios/RenderThemeIOS.mm:\n* Source/WebCore/rendering/line/LineInlineHeaders.h:\n* Source/WebCore/rendering/mac/RenderThemeMac.mm:\n* Source/WebCore/rendering/updating/RenderTreeBuilderFirstLetter.cpp:\n* Source/WebCore/style/StyleAdjuster.cpp:\n* Source/WebCore/style/StyleBuilderCustom.h:\n* Source/WebCore/style/StyleDifference.cpp:\n* Source/WebCore/style/StyleExtractorCustom.h:\n* Source/WebCore/style/StyleTreeResolver.cpp:\n* Source/WebCore/style/computed/StyleComputedStyle+InitialInlines.h:\n* Source/WebCore/style/computed/StyleComputedStyle.cpp:\n* Source/WebCore/style/computed/StyleComputedStyle.h:\n* Source/WebCore/style/computed/StyleComputedStyleBase.cpp:\n* Source/WebCore/style/computed/StyleComputedStyleBase.h:\n* Source/WebCore/style/computed/data/StyleInheritedData.cpp:\n* Source/WebCore/style/computed/data/StyleInheritedData.h:\n* Source/WebKit/WebProcess/WebPage/Cocoa/PositionInformationForWebPage.mm:\n* Source/WebKitLegacy/mac/DOM/DOMUIKitExtensions.mm:\n* Source/WebKitLegacy/mac/WebView/WebFrame.mm:\n\nCanonical link: https://commits.webkit.org/320670@main\n" }, { "commit": "df4d161570c606716592422d307db97e9bc9eda5", "tree": "cfea15ff3b61c8cee868a151c06c29150ccddf0d", "parents": [ "4b78955e0ded5c80d5ebaa43277434c8c44f2cdf" ], "author": { "name": "Richard Robinson", "email": "richard_robinson2@apple.com", "time": "Tue Sep 08 19:24:59 2026" }, "committer": { "name": "Richard Robinson", "email": "richard_robinson2@apple.com", "time": "Tue Sep 08 19:24:59 2026" }, "message": "[NewCodable] Add the ability to decode legacy Decodable types and Data\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323538\nrdar://186776446\n\nReviewed by Abrar Rahman Protyasha.\n\nTest: Tools/TestWebKitAPI/Tests/WebKit/WebPage/JavaScriptEvaluationTests.swift\n\n* Source/WebKit/Shared/JavaScriptEvaluationGraphDecoder.swift:\n(bytes):\n* Tools/TestWebKitAPI/Tests/WebKit/WebPage/JavaScriptEvaluationTests.swift:\n(CommonDecodableAdaptor.decode(from:)):\n(JavaScriptEvaluationTests.decodingData):\n(JavaScriptEvaluationTests.decodingStandardDecodable):\n\nCanonical link: https://commits.webkit.org/320669@main\n" }, { "commit": "4b78955e0ded5c80d5ebaa43277434c8c44f2cdf", "tree": "73038a495fba5961cca33734c657bd684fd27121", "parents": [ "7f183f2619480cc54dd1c430229ea6a6edfd9170" ], "author": { "name": "Jamie Murphy", "email": "jmurphy@igalia.com", "time": "Tue Sep 08 19:14:21 2026" }, "committer": { "name": "Patrick Griffis", "email": "pgriffis@igalia.com", "time": "Tue Sep 08 19:14:21 2026" }, "message": "[GTK] Support Background Web View in WebKitWebExtensionContext\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d321729\n\nReviewed by Michael Catanzaro and Patrick Griffis.\n\nIncludes support for spawning background web views in WebKitGTK\u0027s extension context.\nAt the moment, there is no support for interacting with these web views,\nbut the messaging code is technically enabled and could be adjusted to work in a future\nPR.\n\nFixes a temporary issue from https://commits.webkit.org/318862@main.\n\nTest: Tools/TestWebKitAPI/Tests/WebKit/WKWebView/glib/TestWebKitWebExtensionContext.cpp\n\n* Source/WTF/wtf/glib/GRefPtr.h:\n* Source/WebKit/UIProcess/API/glib/WebKitNavigationAction.cpp:\n(webkitNavigationActionGetAction):\n* Source/WebKit/UIProcess/API/glib/WebKitNavigationActionPrivate.h:\n* Source/WebKit/UIProcess/API/glib/WebKitWebExtensionContext.cpp:\n(webkitWebExtensionContextToImpl):\n(webkit_web_extension_context_load_background_content):\n(webkit_web_extension_context_load_background_content_finish):\n* Source/WebKit/UIProcess/API/glib/WebKitWebExtensionContext.h.in:\n* Source/WebKit/UIProcess/API/glib/WebKitWebExtensionContextPrivate.h: Copied from Source/WebKit/UIProcess/Extensions/glib/WebExtensionContextGLib.cpp.\n* Source/WebKit/UIProcess/API/glib/WebKitWebExtensionMatchPatternPrivate.h:\n* Source/WebKit/UIProcess/API/glib/WebKitWebView.cpp:\n(webkitWebViewGetWebExtensionContext):\n(webkitWebViewCreatePageConfiguration):\n(webkitWebViewConstructed):\n(webkitWebViewSetProperty):\n(webkitWebViewGetProperty):\n(webkit_web_view_class_init):\n(webkitWebViewCreateNewPage):\n* Source/WebKit/UIProcess/API/glib/WebKitWebViewPrivate.h:\n* Source/WebKit/UIProcess/Extensions/Cocoa/WebExtensionContextCocoa.mm:\n(-[_WKWebExtensionContextDelegate _webView:navigationDidFinishDocumentLoad:]):\n(-[_WKWebExtensionContextDelegate webView:didFailNavigation:withError:]):\n(WebKit::WebExtensionContext::isNotRunningInTestRunner):\n(WebKit::WebExtensionContext::didFinishDocumentLoad):\n(WebKit::WebExtensionContext::didFailNavigation):\n(WebKit::isNotRunningInTestRunner): Deleted.\n(WebKit::WebExtensionContext::scheduleBackgroundContentToUnload): Deleted.\n* Source/WebKit/UIProcess/Extensions/WebExtensionContext.cpp:\n(WebKit::WebExtensionContext::stateFilePath const):\n(WebKit::WebExtensionContext::removeExpired):\n(WebKit::WebExtensionContext::scheduleBackgroundContentToUnload):\n* Source/WebKit/UIProcess/Extensions/WebExtensionContext.h:\n(WebKit::WebExtensionContext::stateFileName):\n(WebKit::WebExtensionContext::backgroundWebView const):\n(WebKit::WebExtensionContext::isOffscreenWebView const):\n(WebKit::WebExtensionContext::plistFileName):\n* Source/WebKit/UIProcess/Extensions/WebExtensionContext.messages.in:\n* Source/WebKit/UIProcess/Extensions/WebExtensionController.cpp:\n(WebKit::WebExtensionController::stateFilePath const):\n* Source/WebKit/UIProcess/Extensions/glib/WebExtensionContextGLib.cpp:\n(onDecidePolicy):\n(onDidFinishDocumentLoad):\n(onDidFailNavigation):\n(onWebProcessTerminated):\n(WebKit::WebExtensionContext::~WebExtensionContext):\n(WebKit::WebExtensionContext::recordError):\n(WebKit::WebExtensionContext::clearError):\n(WebKit::WebExtensionContext::currentState const):\n(WebKit::WebExtensionContext::readStateFromPath):\n(WebKit::WebExtensionContext::readLastBaseURLFromState):\n(WebKit::WebExtensionContext::readDisplayNameFromState):\n(WebKit::WebExtensionContext::readStateFromStorage):\n(WebKit::WebExtensionContext::writeStateToStorage const):\n(WebKit::WebExtensionContext::enumerateExtensionPages):\n(WebKit::WebExtensionContext::relatedWebView):\n(WebKit::WebExtensionContext::webViewConfiguration):\n(WebKit::WebExtensionContext::backgroundContentIsLoaded const):\n(WebKit::WebExtensionContext::loadBackgroundWebViewIfNeeded):\n(WebKit::WebExtensionContext::loadBackgroundWebView):\n(WebKit::WebExtensionContext::setBackgroundWebViewInspectionName):\n(WebKit::WebExtensionContext::unloadBackgroundContentIfPossible):\n(WebKit::WebExtensionContext::unloadBackgroundWebView):\n(WebKit::WebExtensionContext::loadBackgroundPageListenersFromStorage):\n(WebKit::WebExtensionContext::saveBackgroundPageListenersToStorage):\n(WebKit::WebExtensionContext::performTasksAfterBackgroundContentLoads):\n(WebKit::WebExtensionContext::decidePolicyForNavigationAction):\n(WebKit::WebExtensionContext::didFinishDocumentLoad):\n(WebKit::WebExtensionContext::didFailNavigation):\n(WebKit::WebExtensionContext::webViewWebContentProcessDidTerminate):\n(WebKit::WebExtensionContext::isNotRunningInTestRunner):\n* Source/WebKit/UIProcess/WebPageProxy.h:\n* Source/WebKit/UIProcess/WebPageProxyInternals.h:\n* Source/WebKit/UIProcess/glib/WebPageProxyGLib.cpp:\n(WebKit::WebPageProxy::platformView):\n(WebKit::WebPageProxy::setPlatformView):\n* Source/WebKit/WebProcess/Extensions/API/WebExtensionAPIAlarms.cpp:\n(WebKit::WebExtensionAPIAlarms::createAlarm):\n(WebKit::WebExtensionAPIAlarms::get):\n(WebKit::WebExtensionAPIAlarms::getAll):\n(WebKit::WebExtensionAPIAlarms::clear):\n(WebKit::WebExtensionAPIAlarms::clearAll):\n* Source/cmake/OptionsGTK.cmake:\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/glib/TestWebKitWebExtensionContext.cpp:\n(testURIOverridesParsing):\n(testLoadBackgroundContentWithoutController):\n(beforeAll):\n\nCanonical link: https://commits.webkit.org/320668@main\n" }, { "commit": "7f183f2619480cc54dd1c430229ea6a6edfd9170", "tree": "6e0f6e96f4e6ad472a7689f4fbdbf7820eb51c03", "parents": [ "f9ebc1a62a0e50f77013cb69ae9c0b15160981b1" ], "author": { "name": "Brady Eidson", "email": "beidson@apple.com", "time": "Tue Sep 08 19:06:03 2026" }, "committer": { "name": "Brady Eidson", "email": "beidson@apple.com", "time": "Tue Sep 08 19:06:03 2026" }, "message": "Incomplete fix of WebKit bug 315528 (Message check file urls in back/forward list messages)\nrdar://177953315\n\nReviewed by Chris Dumez.\n\nApply the message check to sub-items in the history item tree, and other validations of the tree.\n\nTest: Tools/TestWebKitAPI/Tests/WebKit/WKBackForwardListTests.mm\n\n* Source/WebKit/UIProcess/WebBackForwardList.cpp:\n(WebKit::messageCheckItemURLs):\n* Tools/TestWebKitAPI/Tests/WebKit/WKBackForwardListTests.mm:\n((WKBackForwardList, MessageCheckRejectsNestedFileURLChild)):\n((WKBackForwardList, MessageCheckRejectsDeeplyNestedFileURLChild)):\n((WKBackForwardList, MessageCheckRejectsExcessiveChildDepth)):\n((WKBackForwardList, MessageCheckAcceptsBenignNestedChildren)):\n\nOriginally-landed-as: 305413.993@safari-7624.5-branch (ce08c270d322). rdar://185366596\nCanonical link: https://commits.webkit.org/320667@main\n" }, { "commit": "f9ebc1a62a0e50f77013cb69ae9c0b15160981b1", "tree": "ed4344ba26b90ac486f80f621c2f97c693ba60e3", "parents": [ "3077fc7befd476203eccd6352d7931e3eb9a042b" ], "author": { "name": "Richard Robinson", "email": "richard_robinson2@apple.com", "time": "Tue Sep 08 18:53:51 2026" }, "committer": { "name": "Richard Robinson", "email": "richard_robinson2@apple.com", "time": "Tue Sep 08 18:53:51 2026" }, "message": "[Swift Testing] Add more affordances to make it easier to use Swift Testing\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323645\nrdar://186880308\n\nReviewed by Zak Ridouh and Aditya Keerthi.\n\nAdd some helper functions and some fixes to make it easier to use WKWebView with Swift Testing.\n\n* Tools/TestWebKitAPI/Helpers/cocoa/HTTPServer.swift:\n(HTTPServer.totalRequests):\n* Tools/TestWebKitAPI/Helpers/cocoa/NetworkConnection.mm:\n(TestWebKitAPI::Connection::terminate):\n\nConnection::terminate asserted that cancelling produces no error, but the\nerror reported there describes the connection, not the cancellation: a\nconnection that failed its TLS handshake still reports \"bad certificate\"\nonce cancelled, and nw_connection_cancel cannot itself fail. This only\nsurfaced now because the Swift HTTPServer wrapper cancels at the end of\nrun(), while the C++ HTTPServer has no destructor and never tore\nconnections down.\n\n* Tools/TestWebKitAPI/Helpers/cocoa/PDFTestHelpers.h:\n* Tools/TestWebKitAPI/Helpers/cocoa/PDFTestHelpers.mm:\n(TestWebKitAPI::testPDFDataWithLink):\n(TestWebKitAPI::appendPDFBytes): Deleted.\n* Tools/TestWebKitAPI/Helpers/cocoa/PDFTestHelpers.swift: Added.\n(TestPDFBuilder.pdfDataWithLink):\n\nDeclare TestPDFBuilder and annotate nullability.\n\n* Tools/TestWebKitAPI/Helpers/cocoa/SafeBrowsingTestUtilities.h:\n* Tools/TestWebKitAPI/Helpers/cocoa/SafeBrowsingTestUtilities.mm:\n(+[DelayedLookupContext delayDuration]):\n(+[DelayedLookupContext setDelayDuration:]):\n(-[DelayedLookupContext lookUpURL:completionHandler:]):\n(testSSBLookupContextClass):\n* Tools/TestWebKitAPI/Helpers/cocoa/SafeBrowsingTestUtilities.swift: Added.\n\nDrop the C++ guard, replacing the sole use of WTF::Seconds with NSTimeInterval,\nand declare testSSBLookupContextClass.\n\n* Tools/TestWebKitAPI/Helpers/cocoa/ScreenTimeExtras.h:\n* Tools/TestWebKitAPI/Helpers/cocoa/ScreenTimeExtras.mm: Copied from Tools/TestWebKitAPI/Helpers/cocoa/ScreenTimeExtras.h.\n(testSTScreenTimeConfigurationClass):\n\nDeclare testSTScreenTimeConfigurationClass, and make the STWebpageController category\nnamed so Swift sees the setter.\n\n* Tools/TestWebKitAPI/Helpers/cocoa/TestNavigationDelegate.h:\n* Tools/TestWebKitAPI/Helpers/cocoa/TestNavigationDelegate.mm:\n(-[TestNavigationDelegate waitForDidFinishNavigationWithCompletionHandler:]):\n(-[WKWebView _test_waitForNextDidFinishNavigationWithCompletionHandler:]):\n* Tools/TestWebKitAPI/Helpers/cocoa/TestWKWebView.h:\n* Tools/TestWebKitAPI/Helpers/cocoa/TextExtractionTestingSPI.h: Copied from Tools/TestWebKitAPI/Helpers/cocoa/ScreenTimeExtras.h.\n* Tools/TestWebKitAPI/Helpers/cocoa/WKWebView+Extras.swift: Added.\n(UnexpectedJavaScriptResult.description):\n(WKWebView.load(_:baseURL:)):\n(WKWebView.loadAndWait(_:)):\n(WKWebView.load(testPageNamed:)):\n(WKWebView.callJavaScript(_:)):\n(WKWebView.elementMidpoint(_:)):\n(WKWebView.nextPresentationUpdate):\n* Tools/TestWebKitAPI/SourcesCocoa.txt:\n* Tools/TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:\n\nAdd supporting infrastructure for Swift async.\n\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SafeBrowsing.mm:\n(TEST(SafeBrowsing, HangTimeout)):\n(TEST(SafeBrowsing, PostResponse)):\n(TEST(SafeBrowsing, PostResponseIframe)):\n(TEST(SafeBrowsing, PostResponseServerSideRedirect)):\n(TEST(SafeBrowsing, PostResponseInjectedBundleSkipsDecidePolicyForResponse)):\n(TEST(SafeBrowsing, WarningShownAfterCOOPProcessSwapWithSkippedResponse)):\n(TEST(SafeBrowsing, WarningShownAfterCOOPProcessSwapWithSkippedResponseSlowLookup)):\n(TEST(SafeBrowsing, WarningShownAfterCOOPProcessSwap)):\n(TEST(SafeBrowsing, WarningShownAfterCOOPProcessSwapSlowLookup)):\n(TEST(SafeBrowsing, WarningShownWhenLookupCompletesBeforeResponse)):\n(TEST(SafeBrowsing, WarningShownAfterRedirectWithLateResult)):\n(TEST(SafeBrowsing, PostTimeout)):\n(TEST(SafeBrowsing, ModalDeferredDuringCheck)):\n(TEST(SafeBrowsing, DeferredModalShownWhenProceedingThroughWarning)):\n(TEST(SafeBrowsing, DeferredModalSuppressedWhenGoingBack)):\n(TEST(SafeBrowsing, MultipleDeferredModalsShownInOrder)):\n(TEST(SafeBrowsing, DeferredModalsClearedOnNavigation)):\n(TEST(SafeBrowsing, AllModalTypesProperlyDeferred)):\n(TEST(SafeBrowsing, DownloadDeferredAndBlockedBySafeBrowsing)):\n(TEST(SafeBrowsing, DownloadDeferredAndBlockedBySafeBrowsingPostTimeout)):\n(TEST(SafeBrowsing, CleanDownloadProceedsAfterSafeBrowsingCheck)):\n(TEST(SafeBrowsing, SubframeDownloadBlockedBySafeBrowsing)):\n(TEST(SafeBrowsing, NavigationActionDownloadDeferredBySafeBrowsing)):\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/TextExtractionTests.mm:\n(TestWebKitAPI::(TextExtractionTests, DelayedSafeBrowsingWarningBlocksTextExtraction)):\n\nUpdate some tests accordingly.\n\nCanonical link: https://commits.webkit.org/320666@main\n" }, { "commit": "3077fc7befd476203eccd6352d7931e3eb9a042b", "tree": "f18c2570f20345690c087e8da4bb466568662ea3", "parents": [ "3d00c2c0cf8bdb33dc83e63c1b2f386890c6e397" ], "author": { "name": "Tim Horton", "email": "thorton@apple.com", "time": "Tue Sep 08 18:15:56 2026" }, "committer": { "name": "Tim Horton", "email": "thorton@apple.com", "time": "Tue Sep 08 18:15:56 2026" }, "message": "[AppKit Gestures] Very short (or coalesced) trackpad flick doesn\u0027t result in momentum scrolling\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323472\nrdar://185580451\n\nReviewed by Abrar Rahman Protyasha.\n\nBecause of how AppKit\u0027s velocity filter is hooked up, it reports zero velocity\nif no \"changed\" events are ever seen, which can happen if you flick impossibly\nquickly, or (more likely) if events are coalesced. Keep track of enough information\nto compute the velocity ourselves in this case.\n\nTest: Tools/TestWebKitAPI/Tests/WebKit/WebPage/AppKit Gesture Tests/BasicAppKitGesturesTests.swift\n\n* Source/WebKit/UIProcess/mac/AppKitGestures/WKAppKitGestureController.h:\n* Source/WebKit/UIProcess/mac/AppKitGestures/WKAppKitGestureController.mm:\n(-[WKAppKitGestureController startMomentumIfNeededForGesture:]):\n(velocityInView): Deleted.\n* Source/WebKit/UIProcess/mac/AppKitGestures/WKAppKitGestureController.swift:\n(WKPanGestureRecognizer.gestureStartTime):\n(WKPanGestureRecognizer.gestureStartLocationInWindow):\n(WKPanGestureRecognizer.lastMovementTime):\n(WKPanGestureRecognizer.lastMovementLocationInWindow):\n(WKPanGestureRecognizer.reset):\n(WKPanGestureRecognizer.wk_velocity(in:)):\n(WKAppKitGestureController.panVelocity(in:)):\nCompute the velocity from two points if we never saw a \"changed\" event; otherwise, trust the one we\u0027re given.\nAlso, mimic AppKit\u0027s 200ms timeout and bail from momentum if the two events are far apart in time.\n\n(WKAppKitGestureController.loggingDescription(for:)):\nDrive-by fix to stop logging the (static) class and log the gesture recognizer instead.\n\n* Tools/TestWebKitAPI/Tests/WebKit/WebPage/AppKit Gesture Tests/BasicAppKitGesturesTests.swift:\nAdd tests both for the named bug, and also that we don\u0027t fling if there\u0027s too much time between the two events.\n\nCanonical link: https://commits.webkit.org/320665@main\n" }, { "commit": "3d00c2c0cf8bdb33dc83e63c1b2f386890c6e397", "tree": "680137d200fc7f342dea7bd5ea25d8d601d022b8", "parents": [ "cc225e03495c4d68e29e030dec300eb53b3b2586" ], "author": { "name": "Ian Gower", "email": "i_gower@apple.com", "time": "Tue Sep 08 18:02:37 2026" }, "committer": { "name": "Ian Gower", "email": "i_gower@apple.com", "time": "Tue Sep 08 18:02:37 2026" }, "message": "Resync web-platform-tests/fetch/local-network-access\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323475\nrdar://186702160\n\nReviewed by Tim Nguyen.\n\nUpstream commit: https://github.com/web-platform-tests/wpt/commit/a1e944e7a879854494e1a041a8ad1e4a8ae28ab1\n\nThe iframe.tentative variants record failures tracked by https://bugs.webkit.org/show_bug.cgi?id\u003d323474.\n\n* LayoutTests/imported/w3c/web-platform-tests/fetch/local-network-access/resources/w3c-import.log:\n* LayoutTests/imported/w3c/web-platform-tests/fetch/local-network-access/service-worker-background-fetch.tentative.https-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/fetch/local-network-access/w3c-import.log:\n\nCanonical link: https://commits.webkit.org/320664@main\n" }, { "commit": "cc225e03495c4d68e29e030dec300eb53b3b2586", "tree": "2aab926dcf53b6bf81a7ffe49d8f3d54b58005b9", "parents": [ "70e05bc9fbbf66f5dbf746ee1706b0158c994ed1" ], "author": { "name": "Sammy Gill", "email": "sammy.gill@apple.com", "time": "Tue Sep 08 17:54:04 2026" }, "committer": { "name": "Sammy Gill", "email": "sgill26@apple.com", "time": "Tue Sep 08 17:54:04 2026" }, "message": "[Grid][Cleanup] Separate out stretching logic in a their own functions.\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323473\nrdar://problem/186701341\n\nReviewed by Taher Ali.\n\napplyStretchAlignmentToGridItemIfNeeded() is a somewhat large function that contains\nlogic for stretching a grid item in both directions. In preparation for some Grid Lanes\nchanges related to stretch alignment let\u0027s separate out the two major pieces of code that\nperform the stretching into their own set of functions.\n\nCanonical link: https://commits.webkit.org/320663@main\n" }, { "commit": "70e05bc9fbbf66f5dbf746ee1706b0158c994ed1", "tree": "9708e51e9826e93ad95890a36f5439c0f55a716a", "parents": [ "30a1975ef0617171b518755e7bcc188c744fde6c" ], "author": { "name": "Ruthvik Konda", "email": "rkonda2@apple.com", "time": "Tue Sep 08 17:50:22 2026" }, "committer": { "name": "Ruthvik Konda", "email": "rkonda2@apple.com", "time": "Tue Sep 08 17:50:22 2026" }, "message": "[WebGPU] ~CommandBuffer can run on Metal completion thread, racing non-atomic CommandEncoder refcount and Device::m_commandEncoderMap\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d315794\nrdar://176483048\n\nReviewed by Mike Wyrzykowski.\n\nCommandBuffer::makeInvalidDueToCommit registers an addCompletedHandler block whose body\nbounces cleanup work to the WebGPU work queue via Queue::scheduleWork. The inner lambda\ncaptures a strong Ref\u003cCommandBuffer\u003e. During RemoteGPU teardown, StreamConnectionWorkQueue::dispatch\nsilently drops the lambda when m_shouldQuit is set; the dropped lambda\u0027s Ref\u003cCommandBuffer\u003e\nis destroyed on com.Metal.CompletionQueueDispatch. If that is the last ref, ~CommandBuffer\nruns on the Metal thread and (a) non-atomically derefs m_commandEncoder (CommandEncoder is\nRefCountedAndCanMakeWeakPtr), racing the work-queue thread\u0027s deref via ObjectHeap::clear()\n-\u003e torn refcount -\u003e UAF; and (b) ~CommandEncoder mutates the unlocked Device::m_commandEncoderMap,\nracing the work-queue thread\u0027s concurrent removeCommandEncoder.\n\nAdditionally, every WebGPU addCompletedHandler/addScheduledHandler that calls\nQueue::scheduleWork creates a temporary RefPtr\u003cInstance\u003e via m_instance.get() on the Metal\nthread; if that temp outlives the work-queue\u0027s wgpuInstanceRelease deref, ~Instance runs on\nthe Metal thread and destroys whatever Ref\u003cDevice\u003e/Ref\u003cCommandBuffer\u003e Instance owns there.\n\nFix:\n\n1. Anchor each committed CommandBuffer in Instance::m_retainedCommandBufferInstances so the\n Metal-thread block\u0027s deref is never the last. The anchor is keyed by a\n WeakObjCPtr\u003cid\u003cMTLCommandBuffer\u003e\u003e and lazily pruned when that pointer goes nil; nil\n implies MTLCommandBuffer dealloc, which only happens after Metal\u0027s\n didCompleteWithStartTime: has Block_release()d every completion handler, so the outer\n block\u0027s Ref\u003cCommandBuffer\u003e is already gone by the time the anchor is dropped.\n\n2. Drain all retained MTLCommandBuffers (waitUntilCompleted) in wgpuInstanceRelease before\n deref(), so the C-API ref is alive while completion handlers run -\u003e no Metal-thread\n RefPtr\u003cInstance\u003e temporary can be the last -\u003e ~Instance and the anchors are released on\n the work-queue thread.\n\n3. Change the inner lambda to capture ThreadSafeWeakPtr\u003cCommandBuffer\u003e. This is load-bearing,\n not just defense-in-depth: Instance::scheduleWork wraps the inner lambda in an ObjC block\n via makeBlockPtr().get(), and that wrapper is autoreleased on the Metal thread. Its pool\n drains at _dispatch_last_resort_autorelease_pool_pop, which is after waitUntilCompleted\n returns (after _completedCallbacksDone). With a strong inner capture, the autoreleased\n block copy holds a Ref\u003cCommandBuffer\u003e past the anchor\u0027s lifetime, and ~CommandBuffer runs\n on the Metal thread when the pool drains. With a weak capture, the autoreleased copy\n holds nothing that destructs cross-thread.\n\nretainCommandBuffer, retainDevice, and waitForCommandBufferCompletions all run on the\nsingle per-Instance StreamConnectionWorkQueue thread (Instance is per-RemoteGPU, not\nper-process), so the m_lock acquire around the retention containers is unnecessary; drop it\nalong with the WTF_GUARDED_BY_LOCK annotations. m_lock continues to guard m_pendingWork for\nthe unused defaultScheduleWork/processEvents fallback.\n\nRegressed in 288538@main.\n\nTests: ipc/webgpu-command-encoder-cross-thread-destruction-race.html\n ipc/webgpu-instance-cross-thread-destruction-race.html\n\n* LayoutTests/ipc/webgpu-command-encoder-cross-thread-destruction-race-expected.txt: Added.\n* LayoutTests/ipc/webgpu-command-encoder-cross-thread-destruction-race.html: Added.\n* LayoutTests/ipc/webgpu-instance-cross-thread-destruction-race-expected.txt: Added.\n* LayoutTests/ipc/webgpu-instance-cross-thread-destruction-race.html: Added.\n* Source/WebGPU/WebGPU/CommandBuffer.mm:\n(WebGPU::CommandBuffer::makeInvalidDueToCommit):\n* Source/WebGPU/WebGPU/Instance.h:\n* Source/WebGPU/WebGPU/Instance.mm:\n(WebGPU::Instance::waitForCommandBufferCompletions):\n(WebGPU::Instance::retainDevice):\n(WebGPU::Instance::retainCommandBuffer):\n(wgpuInstanceRelease):\n\nOriginally-landed-as: c1b3074a6202. rdar://185367024\nCanonical link: https://commits.webkit.org/320662@main\n" }, { "commit": "30a1975ef0617171b518755e7bcc188c744fde6c", "tree": "9846dcdcba46c8d273c86eb7b6edfacaa0e7dfc6", "parents": [ "13834c3c5a1c959e632403168043680baa667003" ], "author": { "name": "Tyler Wilcock", "email": "tyler_w@apple.com", "time": "Tue Sep 08 17:47:31 2026" }, "committer": { "name": "Tyler Wilcock", "email": "tyler_w@apple.com", "time": "Tue Sep 08 17:47:31 2026" }, "message": "AX: Each inserted child re-walks the same ancestor chain to compute is-ignored-from-parent data\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323523\nrdar://186765474\n\nReviewed by Dominic Mazzoni.\n\nsetIsIgnoredFromParentDataForChild() has two paths. When the parent\u0027s own\nm_isIgnoredFromParentData is set it derives the child\u0027s from it in constant time.\nWhen it isn\u0027t, the child walks its entire ancestor chain instead.\n\nThis commit implements an optimization where we compute the parent\u0027s data once\nright before adding children, rather than having each child unnecessarily do a full ancestor walk.\n\nA profile of Speedometer 3.1 with VoiceOver enabled attributes 203 samples to\nsetIsIgnoredFromParentDataForChild() across 140 call sites.\n\n* Source/WebCore/accessibility/AccessibilityObject.cpp:\n(WebCore::AccessibilityObject::updateChildrenIfNecessary):\n(WebCore::AccessibilityObject::computeIsIgnoredFromParentData):\n(WebCore::AccessibilityObject::setIsIgnoredFromParentDataForChild):\n* Source/WebCore/accessibility/AccessibilityObject.h:\n(WebCore::AccessibilityObject::setIsIgnoredFromParentData):\n\nCanonical link: https://commits.webkit.org/320661@main\n" }, { "commit": "13834c3c5a1c959e632403168043680baa667003", "tree": "f0371b12e02059ec83ea757e7e24c3677029474e", "parents": [ "32b085d39b37d9d45bc931b16076168ba5c466e9" ], "author": { "name": "Tyler Wilcock", "email": "tyler_w@apple.com", "time": "Tue Sep 08 17:45:14 2026" }, "committer": { "name": "Tyler Wilcock", "email": "tyler_w@apple.com", "time": "Tue Sep 08 17:45:14 2026" }, "message": "AX: Add a layout test for imperative slot assignment in the accessibility tree\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323531\nrdar://186770569\n\nReviewed by Dominic Mazzoni.\n\nNo existing test verified that the accessibility tree is correct after a\n`slotAssignment: \"manual\"`, HTMLSlotElement::assign() slot re-assignment.\n\n* LayoutTests/accessibility/isolated-tree/slot-manual-assignment-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/slot-manual-assignment.html: Added.\n* LayoutTests/accessibility/slot-manual-assignment-expected.txt: Added.\n* LayoutTests/accessibility/slot-manual-assignment.html: Added.\n\nCanonical link: https://commits.webkit.org/320660@main\n" }, { "commit": "32b085d39b37d9d45bc931b16076168ba5c466e9", "tree": "2f0cf9fe3e71d3b4afd4d569a8435f3c92600da3", "parents": [ "2b001c8573b2c63a1341c7d58ee0d0e07c6d1d62" ], "author": { "name": "Tyler Wilcock", "email": "tyler_w@apple.com", "time": "Tue Sep 08 17:42:48 2026" }, "committer": { "name": "Tyler Wilcock", "email": "tyler_w@apple.com", "time": "Tue Sep 08 17:42:48 2026" }, "message": "AX: A disabled base-appearance select posts no AXPressDidFail\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323529\nrdar://186769876\n\nReviewed by Dominic Mazzoni.\n\nPressing a disabled \u003cselect\u003e is refused, and an assistive technology learns that from the\nAXPressDidFail notification. AccessibilityMenuList::press() posts it, so the legacy menu-list\nappearance is covered -- accessibility/mac/press-not-work-for-disabled-menu-list.html presses three\ndisabled selects and expects a notification each time.\n\nA base-appearance select (appearance: base-select) is not an AccessibilityMenuList, though. It is served by\nAccessibilityRenderObject::press(), which bails on isDisabledFormControl() with a bare\n\"return false\" and posts nothing.\n\nPost AXPressDidFail from that branch, matching what the menu-list override already does.\n\n* LayoutTests/accessibility/isolated-tree/mac/press-did-fail-notification-base-select-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/press-did-fail-notification-base-select.html: Added.\n* LayoutTests/accessibility/mac/press-did-fail-notification-base-select-expected.txt: Added.\n* LayoutTests/accessibility/mac/press-did-fail-notification-base-select.html: Added.\n* Source/WebCore/accessibility/AccessibilityRenderObject.cpp:\n(WebCore::AccessibilityRenderObject::press):\n\nCanonical link: https://commits.webkit.org/320659@main\n" }, { "commit": "2b001c8573b2c63a1341c7d58ee0d0e07c6d1d62", "tree": "44407f93331541f19d44b92fe7ce4b56707f4512", "parents": [ "ac7790c134a756f5d6779fba0f9f9e0b387b2236" ], "author": { "name": "Sihui Liu", "email": "sihui_liu@apple.com", "time": "Tue Sep 08 17:35:07 2026" }, "committer": { "name": "Sihui Liu", "email": "sihui_liu@apple.com", "time": "Tue Sep 08 17:35:07 2026" }, "message": "[Site Isolation] Adopt the root compositing layer when swapping drawing areas\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323633\nrdar://186864659\n\nReviewed by Per Arne Vollan.\n\n320565@main addressed a cross-origin iframe not rendering after a back navigation. On a multi-process back/forward cache\nrestore, committing the provisional page recreates the page\u0027s DrawingAreaProxy, RemotePageProxy::setDrawingArea()\nre-sends CreateWebPage to each iframe process, and WebPage::reinitializeWebPage() swaps in a new drawing area. That\nchange froze the layer tree during the restore, on the premise that doing so defers the root compositing layer\nattachment until the new drawing area is in place.\n\nHowever, the premise does not hold. The freeze gates the drawing area\u0027s rendering update, not WebCore\u0027s compositing\nupdate, and the attachment happens during the latter: the restore runs a compositing update, ensureRootLayer() attaches,\nand the root layer lands on the outgoing drawing area. setIsInWindow() then bails out while m_rootLayerAttachment is\nset, so the new drawing area never receives it. The layers are registered in the new context but unreachable from its\nroot layer, and recursiveBuildTransaction() walks down from the root, so nothing is committed.\n\nThe test added in 320565@main did not catch this because its iframe was a bare link. With nothing to composite,\nusesCompositing() stays false, setIsInWindow() returns at its first gate, and the attachment is deferred past the swap.\nGive that iframe a composited layer and it will always fail. Its assertion needs replacing as well: \"(layer bounds\"\nappears for every layer in the dump, so it passed on the main frame\u0027s layers whether or not the iframe contributed\nanything.\n\nRather than trying to keep the compositing update and the attachment from happening before the swap, make the attachment\ntransferable. adoptLayersFromDrawingArea() now takes the content layer and view overlay layer over from the outgoing\ndrawing area; a detach and re-attach would only add the rootLayerAttachmentChanged() side effects, since nothing about\nthe attachment has changed from WebCore\u0027s point of view. It also carries the root layer\u0027s size over, which comes from\nmainFrameContentSizeChanged() and need not be produced again by a restore, and triggers a rendering update the way\nsetRootCompositingLayer() does after the same updateRootLayers().\n\nThe layer tree freeze from 320565@main is left in place even though it has no bearing on the attachment. Removing it\nbelongs in a separate change: a rare rAF-assertion failure in this test were only ever seen with the freeze removed, but\nat roughly 2 in 100 runs against none in 80 the comparison is not conclusive either way. That looks like an unrelated\nrendering-update scheduling problem and deserves its own investigation.\n\nTest: Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolation.mm\n\n* Source/WebKit/WebProcess/WebPage/RemoteLayerTree/RemoteLayerTreeDrawingArea.mm:\n(WebKit::RemoteLayerTreeDrawingArea::adoptLayersFromDrawingArea):\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolation.mm:\n(TestWebKitAPI::(SiteIsolation, MultiProcessBFCacheIframeRendersAfterBackNavigation)):\n\nCanonical link: https://commits.webkit.org/320658@main\n" }, { "commit": "ac7790c134a756f5d6779fba0f9f9e0b387b2236", "tree": "92ba92c7f689a018f5c6f98c5b0e637d91053871", "parents": [ "893cb75bec40fc7ef8e4ea2d63a81b9b1de137e4" ], "author": { "name": "Richard Robinson", "email": "richard_robinson2@apple.com", "time": "Tue Sep 08 17:28:33 2026" }, "committer": { "name": "Richard Robinson", "email": "richard_robinson2@apple.com", "time": "Tue Sep 08 17:28:33 2026" }, "message": "[AppKit Gestures] For some tests, if they timeout, they may hang the entire test process if TestWebKitAPI is invoked directly\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323542\nrdar://186784001\n\nReviewed by Abrar Rahman Protyasha.\n\nMake `Future` support task cancellation so that timeouts work properly.\n\n* Tools/TestWebKitAPI/Helpers/cocoa/Foundation+Extras.swift:\n(Storage.signal):\n(signal):\n(wait):\n(State.signal): Deleted.\n(State.wait): Deleted.\n\nCanonical link: https://commits.webkit.org/320657@main\n" }, { "commit": "893cb75bec40fc7ef8e4ea2d63a81b9b1de137e4", "tree": "71786b01e864c98d1ae951d75d44ee0536f463a7", "parents": [ "fe81aba198368580bf72b0dbcb54dddfa28858c5" ], "author": { "name": "Kimmo Kinnunen", "email": "kkinnunen@apple.com", "time": "Tue Sep 08 16:43:39 2026" }, "committer": { "name": "Kimmo Kinnunen", "email": "kkinnunen@apple.com", "time": "Tue Sep 08 16:43:39 2026" }, "message": "Add PixelFormat::RGBX to support opaque RGB pixel data\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323331\nrdar://186573422\n\nReviewed by Gerald Squelart and Sam Weinig.\n\nMakes it possible to represent currently transferred pixel data with\nPixelFormat instead of using platform specific types such as\nCGBitmapInfo.\n\nNow PixelBufferFormat can fully define the pixel format, with RGBX\nmarking \"skip alpha\" for RGB pixel data. Visible in\nNativeImage::create(Ref\u003cPixelBuffer\u003e\u0026\u0026) constructor which does not need\nredundant hasAlpha parameter.\n\nIn this commit, used in\nGraphicsContextGLANGLE::readPixelsForPaintResults to capture\nalpha\u003dfalse WebGL context drawing/compositing buffer to NativeImage\non Skia platform.\n\nSimplify PixelBufferConversion.cpp implementation to not have errorprone\ntemplate table generation + compiler workarounds. ACCELERATE path\ndoes not need templates at all, since there is no innerloop to optimize.\nAll function call variants end up if\u0027ed similarly as when templates\nremoved. Unaccelerated path uses simple linear 16-way switch instead of\n64 cell compiletime template table that contained duplicate entries and\nerror cases (zeroing).\n\nTo simplify the \"can use\" conditions for Accelerate, implement\nopaque -\u003e non-opaque 8888 transfer via the specialized function that\nsets the alpha to 255. This way there\u0027s no need to convoluted ifs\nabout source opaque needing to go to AnyToAny + comments explaining\nthis. This is appropriate for now added RGBX as well as before BGRX.\n\nTests: Tools/TestWebKitAPI/Tests/WebCore/NativeImageTests.cpp\n Tools/TestWebKitAPI/Tests/WebCore/PixelBufferConversionTests.cpp\n\n* Source/WebCore/platform/graphics/ArrayPixelBuffer.cpp:\n(WebCore::ArrayPixelBuffer::tryCreate):\n* Source/WebCore/platform/graphics/NativeImage.h:\n* Source/WebCore/platform/graphics/PixelBuffer.cpp:\n(WebCore::PixelBuffer::supportedPixelFormat):\n* Source/WebCore/platform/graphics/PixelBufferConversion.cpp:\n(WebCore::canCopyPixelsBetweenFormats):\n(WebCore::copyImagePixels):\n(WebCore::makeVImageCGImageFormat):\n(WebCore::convertImagePixelsAcceleratedDifferentFormats):\n(WebCore::ConvertImagePixelsAcceleratedFunctions::selectFunction):\n(WebCore::isSupportedConversionFormat):\n(WebCore::convertImagePixels):\n(WebCore::convertImagePixelsAcceleratedMatchingSize):\n(WebCore::platformConvertImagePixels):\n(WebCore::convertImagePixelsUnacceleratedFunction):\n(WebCore::convertImagePixelsUnacceleratedSelectAlphaFormats):\n(WebCore::hasEnoughBytesForConversion):\n(WebCore::canCopyPixels):\n(WebCore::CountPackedEnums::static_assert): Deleted.\n(WebCore::ConvertImagePixelsFunctionTable::ConvertImagePixelsFunctionTable): Deleted.\n(WebCore::ConvertImagePixelsFunctionTable::invoke const): Deleted.\n(WebCore::ConvertImagePixelsFunctionTable::selectTableFunction): Deleted.\n(WebCore::ConvertImagePixelsFunctionTable::createTableDepth4): Deleted.\n(WebCore::ConvertImagePixelsFunctionTable::createTableDepth3): Deleted.\n(WebCore::ConvertImagePixelsFunctionTable::createTableDepth2): Deleted.\n(WebCore::ConvertImagePixelsFunctionTable::createTableDepth1): Deleted.\n(WebCore::ConvertImagePixelsFunctionTable::createTable): Deleted.\n(WebCore::convertImagePixelsAccelerated): Deleted.\n(WebCore::ConvertImagePixelsUnacceleratedFunctions::selectFunction): Deleted.\n(WebCore::convertImagePixelsUnaccelerated): Deleted.\n* Source/WebCore/platform/graphics/PixelFormat.cpp:\n(WebCore::operator\u003c\u003c):\n* Source/WebCore/platform/graphics/PixelFormat.h:\n(WebCore::convertToContentsFormat):\n(WebCore::pixelFormatIsOpaque):\n(WebCore::allowExtendedColorSpace):\n* Source/WebCore/platform/graphics/TypedArrayPixelBuffer.cpp:\n* Source/WebCore/platform/graphics/TypedArrayPixelBuffer.h:\n* Source/WebCore/platform/graphics/angle/GraphicsContextGLANGLE.cpp:\n(WebCore::GraphicsContextGLANGLE::readPixelsForPaintResults):\n(WebCore::flipPixelBufferRows):\n(WebCore::GraphicsContextGLANGLE::copyNativeImage):\n* Source/WebCore/platform/graphics/cairo/NativeImageCairo.cpp:\n(WebCore::NativeImage::create):\n* Source/WebCore/platform/graphics/cg/NativeImageCG.cpp:\n(WebCore::alphaInfoForAlphaLast):\n(WebCore::alphaInfoForAlphaFirst):\n(WebCore::NativeImage::create):\n* Source/WebCore/platform/graphics/cocoa/IOSurface.h:\n(WebCore::convertToIOSurfaceFormat):\n* Source/WebCore/platform/graphics/gstreamer/VideoFrameGStreamer.cpp:\n(WebCore::VideoFrameGStreamer::createFromPixelBuffer):\n* Source/WebCore/platform/graphics/skia/NativeImageSkia.cpp:\n(WebCore::NativeImage::create):\n* Source/WebKit/Shared/WebCoreArgumentCoders.serialization.in:\n* Tools/TestWebKitAPI/Tests/WebCore/NativeImageTests.cpp:\n(TestWebKitAPI::isSupportedImagePixelFormat):\n(TestWebKitAPI::fillTestPattern):\n(TestWebKitAPI::AnyPixelBufferFormatTest::hasAlpha const):\n(TestWebKitAPI::AnyPixelBufferFormatTest::alphaFormat const):\n(TestWebKitAPI::AnyPixelBufferFormatTest::createTestPatternPixelBuffer const):\n(TestWebKitAPI::TEST_P):\n(TestWebKitAPI::anyPixelBufferFormatTestName):\n(TestWebKitAPI::testedPixelFormats):\n(TestWebKitAPI::AnyPixelBufferFormatTest::alphaMode const): Deleted.\n* Tools/TestWebKitAPI/Tests/WebCore/PixelBufferConversionTests.cpp:\n(TestWebKitAPI::TEST(PixelBufferConversionTests, convertImagePixels)):\n(TestWebKitAPI::TEST(PixelBufferConversionTests, convertImagePixels2)):\n(TestWebKitAPI::TEST(PixelBufferConversionTests, convertImagePixelsFloat16ToAndFromByte)):\n* LayoutTests/ipc/create-image-buffer-crash.html:\n* Source/WebCore/platform/graphics/ImageBuffer.cpp:\n(WebCore::ImageBuffer::supportedPixelBufferFormats):\n(WebCore::ImageBuffer::getPixelBuffer const):\n* Source/WebCore/platform/graphics/ImageBuffer.h:\n* Source/WebKit/GPUProcess/graphics/RemoteImageBuffer.cpp:\n(WebKit::RemoteImageBuffer::getPixelBuffer):\n\nCanonical link: https://commits.webkit.org/320656@main\n" }, { "commit": "fe81aba198368580bf72b0dbcb54dddfa28858c5", "tree": "a660b13947afb2d12475073d949c5097090a74ee", "parents": [ "18ee7938b4934990e26fa6f6e7fdc08e1840942c" ], "author": { "name": "Yusuke Suzuki", "email": "ysuzuki@apple.com", "time": "Tue Sep 08 16:32:23 2026" }, "committer": { "name": "Yusuke Suzuki", "email": "ysuzuki@apple.com", "time": "Tue Sep 08 16:32:23 2026" }, "message": "[JSC] Unify allocators\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323629\nrdar://186860590\n\nReviewed by Marcus Plutowski.\n\nPreviously each Subspace is having its own allocator. But this is\nwasteful so this patch unifies them into one. So we can unlock\nexchanging MarkedBlock between them.\nBut we intentionally do not exchange MarkedBlock when it is\ndestructible. This is because MarkedBlock::sweep becomes costly, and it\nputs sudden cost to the unrelated place when some non destructible cell\nuses MarkedBlock coming from destructible cell.\n\n* Source/JavaScriptCore/heap/BlockDirectory.cpp:\n(JSC::BlockDirectory::findEmptyBlockToSteal):\n* Source/JavaScriptCore/heap/IsoSubspace.cpp:\n(JSC::IsoSubspace::IsoSubspace):\n\nCanonical link: https://commits.webkit.org/320655@main\n" }, { "commit": "18ee7938b4934990e26fa6f6e7fdc08e1840942c", "tree": "306d1612246bf37777895b3e127c7875744eb195", "parents": [ "d843c238e992864a057149c5a14c0c191629b4b6" ], "author": { "name": "Kimmo Kinnunen", "email": "kkinnunen@apple.com", "time": "Tue Sep 08 16:03:18 2026" }, "committer": { "name": "Kimmo Kinnunen", "email": "kkinnunen@apple.com", "time": "Tue Sep 08 16:03:18 2026" }, "message": "ipc/networksindexeddb-close-connection-during-version-change.html times out\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323283\nrdar://186538167\n\nReviewed by Sihui Liu.\n\nUse the proper origin when making db request.\n\n* LayoutTests/ipc/networksindexeddb-close-connection-during-version-change.html:\n\nCanonical link: https://commits.webkit.org/320654@main\n" }, { "commit": "d843c238e992864a057149c5a14c0c191629b4b6", "tree": "08ae0bc87732dc1d9d872afd3326a52ac851bbd2", "parents": [ "5f14e32e576011c24bb941454bbd6463caf12533" ], "author": { "name": "Chinh Tran", "email": "mail@chinhtran.de", "time": "Tue Sep 08 14:46:51 2026" }, "committer": { "name": "Tyler Wilcock", "email": "tyler_w@apple.com", "time": "Tue Sep 08 14:46:51 2026" }, "message": "AXBoundsForRange returns incorrect bounds after inline boundaries in stitched accessibility text\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323121\nrdar://186383833\n\nReviewed by Tyler Wilcock.\n\nWith Accessibility Text Stitching enabled, a line of inline text is merged into\none AXStaticText (the stitch-group representative), whose value is the\nconcatenation of all its members. AXBoundsForRange returned correct bounds only\nfor offsets inside the first run: any range past the first inline boundary\ncollapsed to a ~2px sliver at the end of that run. This misplaced marks that an\nassistive technology draws over text ranges, such as spell-check underlines.\n\nThe offset was being scoped to the representative\u0027s own node instead of the full\nstitched value. Fix both accessibility paths:\n\nMain thread: for a representative, resolve the offsets against simpleRange()\n(the whole stitched text) instead of visiblePositionForIndex, which clamps the\noffset to the representative\u0027s own node.\n\nIsolated tree: let the NSRange-to-marker walk cross every member by stopping\npast the block-flow ancestor (a stitch group never crosses its block flow), and\nclamp the offsets to the stitched length so the walk cannot escape into content\nafter the group. When turning a marker range into a rect, take a\nrepresentative\u0027s own run width from localRect rather than its union frame. Also\nstart the multi-object accumulation loop at the object after the start object, so\nthe bounds do not incorrectly include text before the requested start offset.\n\n* Source/WebCore/accessibility/AXTextMarker.cpp:\n(viewportRelativeFrameFromRuns):\n(WebCore::AXTextMarkerRange::viewportRelativeFrame const):\n* Source/WebCore/accessibility/cocoa/AXCoreObjectCocoa.mm:\n(WebCore::Accessibility::markerRangeFrom):\n* Source/WebCore/accessibility/mac/WebAccessibilityObjectWrapperMac.mm:\n(-[WebAccessibilityObjectWrapper computeTextBoundsForRange:backingObject:]):\n* LayoutTests/accessibility/mac/bounds-for-range-on-stitched-text.html: Added.\n* LayoutTests/accessibility/mac/bounds-for-range-on-stitched-text-expected.txt: Added.\n\nCanonical link: https://commits.webkit.org/320653@main\n" }, { "commit": "5f14e32e576011c24bb941454bbd6463caf12533", "tree": "95bbd2eb6d11705f7c27c7e37a04459d23fef62c", "parents": [ "7d262597e8a319def4d2fbb7c00c7d804c16f6fa" ], "author": { "name": "Chris Dumez", "email": "cdumez@apple.com", "time": "Tue Sep 08 13:17:38 2026" }, "committer": { "name": "Chris Dumez", "email": "cdumez@apple.com", "time": "Tue Sep 08 13:17:38 2026" }, "message": "Introduce CStringWithEncoding so that a CString can remember its encoding\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323408\n\nReviewed by Darin Adler.\n\nCString is a ref-counted, null-terminated, copy-on-write char buffer, and as its own\nheader comment says, it \"does not know its encoding\". In practice its bytes are almost\nalways UTF-8 (String::utf8()) or Latin-1 (String::latin1()), but the distinction is lost\nat construction: CString(std::span\u003cconst char8_t\u003e) and CString(std::span\u003cconst\nLatin1Character\u003e) both byteCast into the same char storage.\n\nThat is not just a documentation problem. StringConcatenate.h auto-adapts any class with\na span() member into a StringTypeAdapter, keyed on the span\u0027s element type: a\nspan\u003cconst char8_t\u003e is decoded as real UTF-8 via Unicode::checkUTF8, while any other\none-byte type is reinterpreted as Latin-1. Because CString::span() returns\nspan\u003cconst char\u003e, makeString(string.utf8()) silently mojibakes every non-ASCII string.\n\nThis adds CStringWithEncoding\u003cCharacterType\u003e, which carries the encoding in the type, and\nthree aliases following the existing WTF convention that the byte type is the encoding:\n\n using UTF8CString \u003d CStringWithEncoding\u003cchar8_t\u003e;\n using Latin1CString \u003d CStringWithEncoding\u003cLatin1Character\u003e;\n using ASCIICString \u003d CStringWithEncoding\u003cchar\u003e;\n\nchar spells ASCII here to match ASCIILiteral, whose characters() returns const char* and\nwhose span() returns span\u003cconst char\u003e.\n\nCStringWithEncoding derives publicly from CString, so that adoption can be incremental:\na typed string decays implicitly to const CString\u0026, which keeps safePrintfType,\nprintInternal, TextStream, the IPC and persistence coders, the generated CString log\nsignatures in LogMessages.in, and every existing const CString\u0026 parameter working\nunchanged as producers are migrated one at a time. Slicing erases the encoding back to\n\"unknown\", which is a widening to CString\u0027s documented semantics rather than a loss of\ncorrectness. The derived class is final, adds no members and has no vtable, so sizeof is\nunchanged. It is built entirely on CString\u0027s public API; the only change to CString\nitself is dropping the final specifier.\n\ndata(), span() and mutableSpan() are hidden with tightly typed versions so the encoding\nsurvives into the pointer and span types. characters() is the escape hatch that returns\nconst char* for external C functions and printf-style formatting.\n\nComparing Latin-1 bytes against UTF-8 bytes is meaningless, so those combinations are\ndeleted. The deleted overloads are exact matches and therefore beat the CString\ncomparison, which would need a derived-to-base conversion. ASCII is a subset of both, so\nthose combinations deliberately fall through to the byte comparison on CString.\nComparison against a plain CString stays available: CString means \"unknown encoding\", so\nit is the deliberate escape hatch.\n\nThe following conversions are migrated in this patch:\n\n String::ascii() -\u003e ASCIICString\n String::latin1() -\u003e Latin1CString\n String::tryGetUTF8() -\u003e std::expected\u003cUTF8CString, ...\u003e\n StringView::tryGetUTF8() -\u003e std::expected\u003cUTF8CString, ...\u003e\n StringImpl::tryGetUTF8() -\u003e std::expected\u003cUTF8CString, ...\u003e\n StringImpl::utf8ForCharacters() -\u003e std::expected\u003cUTF8CString, ...\u003e\n convertToASCIILowercase/Uppercase() -\u003e UTF8CString\n\nutf8() on String, StringView and StringImpl still returns CString and is left with a\nFIXME; retyping it means touching roughly 2900 call sites, most of which pass\nutf8().data() to a %s and would need characters() instead. FIXMEs are also left on\nCString\u0027s span\u003cconst char8_t\u003e and span\u003cconst Latin1Character\u003e constructors, which are the\nexact ambiguity this type exists to remove, and on TextStream::operator\u003c\u003c(const CString\u0026),\nwhich appends bytes as Latin-1 and so will mis-render a sliced UTF8CString.\n\nThis patch is types only; there is no behavior change. Nothing in the tree feeds a\ntryGetUTF8() result into makeString or StringBuilder::append, which is the only place the\nnew char8_t span typing would switch Latin-1 reinterpretation to real UTF-8 decoding.\n\nAlso update to call `URL::string().utf8()` instead of `URL::string().latin1()` for logging.\nURLs are only guaranteed to be ASCII when they are valid. When parsing fails, URL::string()\nmay return an invalid URL string which may not be ASCII (or even latin1).\n\nTest: Tools/TestWebKitAPI/Tests/WTF/CString.cpp\n\n* Source/JavaScriptCore/jsc.cpp:\n(fillBufferWithContentsOfFile):\n(toCString):\n(dumpException):\n(fetchModuleFromLocalFileSystem):\n* Source/WTF/wtf/Forward.h:\n* Source/WTF/wtf/PrintStream.cpp:\n(WTF::printExpectedCStringHelper):\n* Source/WTF/wtf/text/CString.cpp:\n(WTF::convertASCIICase):\n(WTF::convertToASCIILowercase):\n(WTF::convertToASCIIUppercase):\n* Source/WTF/wtf/text/CString.h:\n(WTF::operator\u003d\u003d):\n(WTF::operator\u003c):\n(WTF::CStringWithEncodingHash::hash):\n(WTF::CStringWithEncodingHash::equal):\n* Source/WTF/wtf/text/StringImpl.cpp:\n(WTF::StringImpl::utf8ForCharacters):\n(WTF::StringImpl::tryGetUTF8 const):\n* Source/WTF/wtf/text/StringImpl.h:\n* Source/WTF/wtf/text/StringView.cpp:\n(WTF::StringView::tryGetUTF8 const):\n* Source/WTF/wtf/text/StringView.h:\n* Source/WTF/wtf/text/TextStream.h:\n* Source/WTF/wtf/text/WTFString.cpp:\n(WTF::String::ascii const):\n(WTF::String::latin1 const):\n(WTF::String::tryGetUTF8 const):\n(WTF::String::utf8 const):\n* Source/WTF/wtf/text/WTFString.h:\n* Source/WebCore/loader/SubresourceLoader.cpp:\n(WebCore::SubresourceLoader::didFinishLoading):\n(WebCore::SubresourceLoader::didFail):\n(WebCore::SubresourceLoader::willCancel):\n* Source/WebCore/loader/cache/CachedResource.cpp:\n(WebCore::CachedResource::failBeforeStarting):\n* Source/WebCore/loader/cache/CachedResourceLoader.cpp:\n(WebCore::CachedResourceLoader::requestResource):\n(WebCore::CachedResourceLoader::loadResource):\n* Source/WebCore/loader/cache/MemoryCache.cpp:\n(WebCore::MemoryCache::add):\n(WebCore::MemoryCache::remove):\n* Source/WebCore/page/MemoryRelease.cpp:\n(WebCore::logMemoryStatistics):\n* Source/WebCore/platform/network/curl/CurlContext.cpp:\n(WebCore::CurlHandle::setURL):\n* Source/WebCore/platform/network/curl/CurlContext.h:\n(WebCore::CurlSList::append):\n* Source/WebCore/platform/sql/SQLiteDatabase.cpp:\n(WebCore::SQLiteDatabase::open):\n* Source/WebCore/rendering/adwaita/RenderThemeAdwaita.cpp:\n(WebCore::RenderThemeAdwaita::mediaControlsImageDataForIconNameAndType):\n(WebCore::RenderThemeAdwaita::mediaControlsBase64StringForIconNameAndType):\n* Source/WebCore/xml/parser/XMLDocumentParserLibxml2.cpp:\n(WebCore::xmlDocPtrForString):\n* Source/WebDriver/glib/SessionHostGlib.cpp:\n(WebDriver::SessionHost::launchBrowser):\n* Source/WebKit/NetworkProcess/cache/NetworkCache.cpp:\n(WebKit::NetworkCache::Cache::store):\n(WebKit::NetworkCache::Cache::storeRedirect):\n(WebKit::NetworkCache::Cache::update):\n* Source/WebKit/NetworkProcess/webtransport/cocoa/NetworkTransportSessionCocoa.mm:\n(WebKit::createParameters):\n* Source/WebKit/WebProcess/Network/WebLoaderStrategy.cpp:\n(WebKit::WebLoaderStrategy::scheduleLoadFromNetworkProcess):\n* Source/WebKit/WebProcess/Network/WebResourceLoader.cpp:\n(WebKit::WebResourceLoader::willSendRequest):\n(WebKit::WebResourceLoader::didReceiveResponse):\n(WebKit::WebResourceLoader::didReceiveData):\n(WebKit::WebResourceLoader::didFinishResourceLoad):\n(WebKit::WebResourceLoader::didFailResourceLoad):\n(WebKit::WebResourceLoader::didBlockAuthenticationChallenge):\n(WebKit::WebResourceLoader::stopLoadingAfterXFrameOptionsOrContentSecurityPolicyDenied):\n(WebKit::WebResourceLoader::didReceiveResource):\n* Source/WebKit/WebProcess/cocoa/WebProcessCocoa.mm:\n(WebKit::WebProcess::accessibilityFocusedUIElement):\n* Tools/TestWebKitAPI/Helpers/GraphicsTestUtilities.cpp:\n(TestWebKitAPI::imageBufferPixelIs):\n* Tools/TestWebKitAPI/Tests/WTF/CString.cpp:\n(requires):\n(TEST(WTF, CStringWithEncodingConstruction)):\n(TEST(WTF, CStringWithEncodingNewUninitialized)):\n(TEST(WTF, CStringWithEncodingComparison)):\n(TEST(WTF, CStringWithEncodingHashing)):\n(TEST(WTF, CStringWithEncodingMakeString)):\n* Tools/WebKitTestRunner/InjectedBundle/InjectedBundle.cpp:\n(WTR::InjectedBundle::outputText):\n* Source/WTF/wtf/FileSystem.h:\n(WTF::FileSystemImpl::statFile):\n* Source/WTF/wtf/posix/FileSystemPOSIX.cpp:\n(WTF::FileSystemImpl::statFile):\n(WTF::FileSystemImpl::fileCreationTime):\n(WTF::FileSystemImpl::getFileDeviceId):\n* Source/WebKit/NetworkProcess/cache/NetworkCacheFileSystem.cpp:\n(WebKit::NetworkCache::fileTimes):\n\nCanonical link: https://commits.webkit.org/320652@main\n" }, { "commit": "7d262597e8a319def4d2fbb7c00c7d804c16f6fa", "tree": "0f1ddfdbdb670007503199401d62ba8b9cb2430c", "parents": [ "3e12766ced21f82a68008cfaf3114e0dd57c8e2c" ], "author": { "name": "Youenn Fablet", "email": "youenn@apple.com", "time": "Tue Sep 08 12:40:06 2026" }, "committer": { "name": "Youenn Fablet", "email": "youennf@gmail.com", "time": "Tue Sep 08 12:40:06 2026" }, "message": "LibWebRTCNetwork::SignalReadPacket should take a SocketAddress\nrdar://186844957\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323602\n\nReviewed by Chris Dumez.\n\nBefore the PR, on signal read packet, we send back a socket address to libwebrtc from an IP address and a port given by network process.\nThis IP address and port are coming from a socket address given by web process at connection time.\n\nThis all works well except if the socket address contains a host and not an IP address.\nIn that case, libwebrtc is not getting the socket address it expects and is dropping packets.\n\nWe simplify this by sending via IPC the SocketAddress instead of IP address + port.\nThis also simplifies a bit the handling in both web and networking process.\n\n* Source/WebKit/NetworkProcess/webrtc/NetworkRTCTCPSocketCocoa.mm:\n(WebKit::NetworkRTCTCPSocketCocoa::NetworkRTCTCPSocketCocoa):\n* Source/WebKit/NetworkProcess/webrtc/NetworkRTCUDPSocketCocoa.mm:\n(WebKit::NetworkRTCUDPSocketCocoaConnections::setupNWConnection):\n* Source/WebKit/WebProcess/Network/webrtc/LibWebRTCNetwork.cpp:\n(WebKit::LibWebRTCNetwork::signalReadPacket):\n* Source/WebKit/WebProcess/Network/webrtc/LibWebRTCNetwork.h:\n* Source/WebKit/WebProcess/Network/webrtc/LibWebRTCNetwork.messages.in:\n\nCanonical link: https://commits.webkit.org/320651@main\n" }, { "commit": "3e12766ced21f82a68008cfaf3114e0dd57c8e2c", "tree": "1f5190b719cd2f2984d28763d4739c549a44d1d0", "parents": [ "2391a5cb885b9c0fc12ec81e5dff91fc049ac6b3" ], "author": { "name": "Kimmo Kinnunen", "email": "kkinnunen@apple.com", "time": "Tue Sep 08 10:45:36 2026" }, "committer": { "name": "Kimmo Kinnunen", "email": "kkinnunen@apple.com", "time": "Tue Sep 08 10:45:36 2026" }, "message": "WebGL: premultipliedAlpha\u003dfalse is composited incorrectly\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d200026\nrdar://53509398\n\nReviewed by Dan Glastonbury.\n\nImplement unpremultiplied compositing by tagging the IOSurface\nwith the unpremultiplied contents tag.\n\n* Source/WTF/wtf/spi/cocoa/IOSurfaceSPI.h:\n* Source/WebCore/Configurations/AllowedSPI.toml:\n* Source/WebCore/platform/graphics/cocoa/GraphicsContextGLCocoa.mm:\n(WebCore::GraphicsContextGLCocoa::createDrawingBuffer):\n* Source/WebCore/platform/graphics/cocoa/IOSurface.h:\n* Source/WebCore/platform/graphics/cocoa/IOSurface.mm:\n(WebCore::IOSurface::create):\n(WebCore::alphaChannelModeValue):\n(WebCore::IOSurface::IOSurface):\n(WebCore::m_name):\n(WebCore::IOSurface::setContentsAlphaPremultiplication):\n\nCanonical link: https://commits.webkit.org/320650@main\n" }, { "commit": "2391a5cb885b9c0fc12ec81e5dff91fc049ac6b3", "tree": "f5ed22d35b89031b8224cfde467a819b08420ff2", "parents": [ "fde5ce9f125e1b8e53c44cada125160e96622093" ], "author": { "name": "Anne van Kesteren", "email": "annevk@annevk.nl", "time": "Tue Sep 08 10:22:00 2026" }, "committer": { "name": "Anne van Kesteren", "email": "annevk@annevk.nl", "time": "Tue Sep 08 10:22:00 2026" }, "message": "Reject unknown keys in UnifiedWebPreferences.yaml and drop what nothing reads\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323649\n\nReviewed by Chris Dumez.\n\nGeneratePreferences.rb now rejects any key it does not know, so a typo, or a\nkey no generator reads, fails the build rather than being ignored without a\nword. That subsumes the two \"no longer used\" checks for webcoreBinding and\nexposed.\n\n\"webcoreType\" was the first thing it caught. A FIXME records what was intended\nthere originally.\n\n63 of the 84 \"webKitLegacyExposed: false\" entries sat on preferences already\nexcluded from WebKitLegacy. Those go, and declaring it while WebKitLegacy is\nexcluded is now an error.\n\nNo behavior change: generating every derived file for all six generator\ninvocations before and after produces 23 byte-identical files.\n\nCanonical link: https://commits.webkit.org/320649@main\n" }, { "commit": "fde5ce9f125e1b8e53c44cada125160e96622093", "tree": "aedd81d77d0073482ef4c5701b31084fbd53761b", "parents": [ "1508d59b56eb3107cd6fa41c726cc3c3d0a48b94" ], "author": { "name": "Richard Robinson", "email": "richard_robinson2@apple.com", "time": "Tue Sep 08 10:00:37 2026" }, "committer": { "name": "Richard Robinson", "email": "richard_robinson2@apple.com", "time": "Tue Sep 08 10:00:37 2026" }, "message": "[CMake] Fix the build after 320632@main\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323653\nrdar://186899123\n\nUnreviewed build fix.\n\n* Source/WebCore/style/values/images/StyleGradient.cpp:\n(WebCore::Style::LinearGradientAdapter::normalizeStopsAndEndpointsOutsideRange):\n(WebCore::Style::RadialGradientAdapter::normalizeStopsAndEndpointsOutsideRange):\n(WebCore::Style::ConicGradientAdapter::normalizeStopsAndEndpointsOutsideRange):\n\nCanonical link: https://commits.webkit.org/320648@main\n" }, { "commit": "1508d59b56eb3107cd6fa41c726cc3c3d0a48b94", "tree": "f484e9d387538e1f9bc9f09c0b1ea48bec371ca6", "parents": [ "5ef1ab98e7e262083d0b47714e4c64ab3c23194c" ], "author": { "name": "Vitaly Dyachkov", "email": "vitaly@igalia.com", "time": "Tue Sep 08 09:43:06 2026" }, "committer": { "name": "Vitaly Dyachkov", "email": "vitaly@igalia.com", "time": "Tue Sep 08 09:43:06 2026" }, "message": "[Web Animations] Fully accelerated animations unnecessarily invalidate style while a non-accelerated animation is running\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323436\n\nReviewed by Antoine Quint.\n\nWhen a page has at least one animation that cannot run on the\ncompositor, that animation forces the page to process animation updates\non every frame. While this happens, other animations on the same page\nthat are otherwise running entirely on the compositor have their style\nneedlessly recalculated on every update too, and in some cases this can\nforce layout.\n\n`KeyframeEffect::animationDidTick()` unconditionally invalidated the\ntarget\u0027s style on every tick, even for effects that were fully\naccelerated and confirmed running on the compositor, whenever some other\nanimation on the shared timeline forced that tick.\n\nSkip `invalidate()` when the effect is completely accelerated, confirmed\nrunning accelerated, and its phase hasn\u0027t changed since it was last\napplied.\n\nProgress-based (scroll/view) timeline effects are excluded from this\nfast path, since their current time is driven by input rather than\ntracked autonomously by the compositor, and can change within the same\nphase.\n\nTest: webanimations/accelerated-animation-not-invalidated-by-sibling-timeline-ticks.html\n\n* Source/WebCore/animation/KeyframeEffect.cpp:\n(WebCore::KeyframeEffect::animationDidTick):\n* LayoutTests/webanimations/accelerated-animation-not-invalidated-by-sibling-timeline-ticks-expected.txt: Added.\n* LayoutTests/webanimations/accelerated-animation-not-invalidated-by-sibling-timeline-ticks.html: Added.\n\nCanonical link: https://commits.webkit.org/320647@main\n" }, { "commit": "5ef1ab98e7e262083d0b47714e4c64ab3c23194c", "tree": "c37c68d2570153e8366af1addf801fd2abca150f", "parents": [ "f2535d35a033d8a1d80b0ff0b1b713941dd98675" ], "author": { "name": "Helmut Januschka", "email": "helmut@januschka.com", "time": "Tue Sep 08 09:32:08 2026" }, "committer": { "name": "Ahmad Saleem", "email": "ahmad.saleem792@gmail.com", "time": "Tue Sep 08 09:32:08 2026" }, "message": "Sync template-for tests from WPT\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d318869\n\nReviewed by Anne van Kesteren.\n\nImport processing-instruction pseudo-attribute and declarative\nout-of-order streaming tests.\n\nUpstream commit: https://github.com/web-platform-tests/wpt/commit/b89af32bc8f42d678f444eb0703bca015ddcf240\n\n* LayoutTests/imported/w3c/web-platform-tests/dom/nodes/processing-instruction-attributes-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/dom/nodes/processing-instruction-attributes.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-template-element/reflect-html-for-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-template-element/reflect-html-for.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-template-element/template-for/template-for-append-element-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-template-element/template-for/template-for-append-element.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-template-element/template-for/template-for-append-text-and-element-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-template-element/template-for/template-for-append-text-and-element.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-template-element/template-for/template-for-append-to-head-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-template-element/template-for/template-for-append-to-head.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-template-element/template-for/template-for-case-sensitive-dom-inserted-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-template-element/template-for/template-for-case-sensitive-dom-inserted.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-template-element/template-for/template-for-case-sensitive-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-template-element/template-for/template-for-case-sensitive.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-template-element/template-for/template-for-empty-hash-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-template-element/template-for/template-for-empty-hash.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-template-element/template-for/template-for-foster-parenting-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-template-element/template-for/template-for-foster-parenting.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-template-element/template-for/template-for-gradual-append-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-template-element/template-for/template-for-gradual-append.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-template-element/template-for/template-for-html-setters-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-template-element/template-for/template-for-html-setters.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-template-element/template-for/template-for-innerHTML-ambiguous-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-template-element/template-for/template-for-innerHTML-ambiguous.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-template-element/template-for/template-for-innerHTML-outside-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-template-element/template-for/template-for-innerHTML-outside.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-template-element/template-for/template-for-innerHTML-within-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-template-element/template-for/template-for-innerHTML-within.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-template-element/template-for/template-for-invalid-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-template-element/template-for/template-for-invalid.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-template-element/template-for/template-for-invokes-pagehide-with-end-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-template-element/template-for/template-for-invokes-pagehide-with-end.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-template-element/template-for/template-for-invokes-pagehide-without-end-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-template-element/template-for/template-for-invokes-pagehide-without-end.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-template-element/template-for/template-for-move-cross-document-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-template-element/template-for/template-for-move-cross-document.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-template-element/template-for/template-for-move-end-while-appending-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-template-element/template-for/template-for-move-end-while-appending.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-template-element/template-for/template-for-move-marker-while-appending-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-template-element/template-for/template-for-move-marker-while-appending.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-template-element/template-for/template-for-move-start-while-appending-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-template-element/template-for/template-for-move-start-while-appending.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-template-element/template-for/template-for-move-while-appending-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-template-element/template-for/template-for-move-while-appending.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-template-element/template-for/template-for-multiple-cases-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-template-element/template-for/template-for-multiple-cases.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-template-element/template-for/template-for-multiple-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-template-element/template-for/template-for-multiple.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-template-element/template-for/template-for-mutation-records-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-template-element/template-for/template-for-mutation-records.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-template-element/template-for/template-for-nested-patch-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-template-element/template-for/template-for-nested-patch.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-template-element/template-for/template-for-only-html-001-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-template-element/template-for/template-for-only-html-001.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-template-element/template-for/template-for-parsing-only-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-template-element/template-for/template-for-parsing-only.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-template-element/template-for/template-for-prepend-element-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-template-element/template-for/template-for-prepend-element.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-template-element/template-for/template-for-prepend-text-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-template-element/template-for/template-for-prepend-text.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-template-element/template-for/template-for-replace-children-with-element-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-template-element/template-for/template-for-replace-children-with-element.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-template-element/template-for/template-for-replace-children-with-text-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-template-element/template-for/template-for-replace-children-with-text.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-template-element/template-for/template-for-replace-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-template-element/template-for/template-for-replace.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-template-element/template-for/template-for-reverse-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-template-element/template-for/template-for-reverse.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-template-element/template-for/template-for-sanitization-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-template-element/template-for/template-for-sanitization.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-template-element/template-for/template-for-script-children-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-template-element/template-for/template-for-script-children.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-template-element/template-for/template-for-script-eval-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-template-element/template-for/template-for-script-eval.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-template-element/template-for/template-for-script-replace-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-template-element/template-for/template-for-script-replace.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-template-element/template-for/template-for-scripting-nested-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-template-element/template-for/template-for-scripting-nested.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-template-element/template-for/template-for-shadow-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-template-element/template-for/template-for-shadow-nested-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-template-element/template-for/template-for-shadow-nested.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-template-element/template-for/template-for-shadow-root-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-template-element/template-for/template-for-shadow-root.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-template-element/template-for/template-for-shadow.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-template-element/template-for/template-for-style-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-template-element/template-for/template-for-style-in-head-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-template-element/template-for/template-for-style-in-head.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-template-element/template-for/template-for-style.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-template-element/template-for/template-for-superseded-by-shadowrootmode-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-template-element/template-for/template-for-superseded-by-shadowrootmode.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-template-element/template-for/template-for-supersedes-invalid-shadowrootmode-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-template-element/template-for/template-for-supersedes-invalid-shadowrootmode.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-template-element/template-for/template-for-title-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-template-element/template-for/template-for-title.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-template-element/template-for/template-for-unclosed-content-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-template-element/template-for/template-for-unclosed-content.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-template-element/template-for/w3c-import.log: Added.\n\nCanonical link: https://commits.webkit.org/320646@main\n" }, { "commit": "f2535d35a033d8a1d80b0ff0b1b713941dd98675", "tree": "df0359c8218ce7f550b8b1ade964b6f0a54f2048", "parents": [ "566279d48d565d6de872cf4d624c759879c7ab74" ], "author": { "name": "Chris Dumez", "email": "cdumez@apple.com", "time": "Tue Sep 08 09:28:27 2026" }, "committer": { "name": "Chris Dumez", "email": "cdumez@apple.com", "time": "Tue Sep 08 09:28:27 2026" }, "message": "Add missing thread-safety annotations and address potential issues they uncovered\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323492\n\nReviewed by Keith Miller and Darin Adler.\n\nAudited data members of type Lock across Source/ and annotated the state\neach one actually protects with WTF_GUARDED_BY_LOCK, so that -Wthread-safety\nenforces the locking discipline at compile time instead of leaving it to\ncomments and runtime assertions.\n\nA member was only annotated where accessing it without the lock would be a bug,\ni.e. where it is genuinely reached from more than one thread (parallel GC\nmarkers, concurrent JIT/Wasm compiler threads, audio render vs. capture threads,\nIPC and media work queues, the scrolling and accessibility threads, worker and\nstorage threads). Members that merely happen to be touched inside a critical\nsection that exists for a different member were deliberately left alone; for\nexample AudioBufferSourceNode::m_wasBufferSet is only used on the main thread in\nsetBufferForBindings(), and just happens to sit inside the m_processLock region\nthat synchronizes m_buffer with the audio thread.\n\nEnforcing the annotations exposed several pre-existing bugs, fixed here:\n\n- Event::initEvent() cleared m_target without holding m_targetLock, racing the\n locked read in Event::visitInGCThread() on the GC thread. Every other write\n goes through setTarget(), which does lock.\n\n- ImageDecoderAVFObjC::readTrackMetadata() replaced m_imageRotationSession on\n the main thread with no lock, while createFrameImageAtIndex() dereferences it\n on the org.webkit.ImageDecoder work queue under m_sampleGeneratorLock.\n\n- LibWebRTCCodecs::failedDecoding() set Decoder::hasError on the work queue\n without m_connectionLock, which flushDecoder() and decodeFrameInternal() hold\n when reading it. Taken in a scope that closes before decodedImageCallbackLock\n is acquired, since the two locks are nowhere else nested.\n\n- SharedVideoFrameWriter::m_isDisabled was a plain bool written by disable()\n from another thread and read by wait(). disable() is intentionally called\n without m_encodersConnectionLock (a writer blocked in wait() holds that lock,\n so locking here would deadlock), so it is now accessed with\n WTF::atomicLoad/atomicStore. It stays a plain bool rather than becoming a\n std::atomic so that SharedVideoFrameWriter remains assignable from a\n default-constructed temporary, which two call sites rely on to reset it.\n\n- WebAudioSourceProviderCocoa::setNeedsFlush() mutated m_readCount and\n m_underflowed from the work queue without m_lock, racing provideInputInternal()\n on the audio render thread. The render thread is unaffected because\n provideInput() uses tryLock().\n\n- MediaStreamTrackAudioSourceProviderCocoa::m_writeCount was written unlocked on\n the capture thread and read under m_lock on the render thread. Made atomic\n rather than locked, because prepare() already takes m_lock and is called from\n audioSamplesAvailable(), so locking the callback would self-deadlock.\n\n- WebServiceWorkerFetchTaskClient::convertFetchToDownload() set m_isDownload\n without m_connectionLock, which the five reads hold. Taken in a scope that\n closes before continueDidReceiveResponse() re-acquires the same lock.\n\n- StorageAreaSync::m_syncCloseDatabase was set on the main thread and cleared on\n the sync thread with no synchronization. Made atomic. Note the set/clear\n interleaving is unchanged and still pre-existing: a close request landing\n exactly as the sync thread clears the flag can be dropped.\n\n- MockRealtimeVideoSource::m_isTakingPhoto was cleared on m_runLoop\u0027s thread and\n read on the caller\u0027s thread. Made atomic, matching its sibling\n m_captureWasInterrupted, which already was for that same thread pair.\n\n- StorageTracker::finishedImportingOriginIdentifiers() guarded m_client with\n m_databaseMutex, while the five other m_client accesses use m_clientMutex.\n\nTwo analysis escape hatches were replaced with real enforcement:\nRealtimeIncomingVideoSourceCocoa::pixelBufferPool() was marked\nWTF_IGNORES_THREAD_SAFETY_ANALYSIS and is now WTF_REQUIRES_LOCK, and the\nASSERT(!mutex.tryLock()) contracts in StorageTracker became WTF_REQUIRES_LOCK.\nTwo of those assertions were dropped rather than converted, because they\nasserted a caller context rather than a requirement of the function\u0027s own\naccesses: trackerDatabasePath() only reads m_storageDirectoryPath, which is set\nin the constructor and never reassigned (now const), and canDeleteOrigin()\nacquires m_originSetMutex itself and never touches m_database.\n\nWhere the lock is provably held but the analyzer cannot see it -- inside a lambda\nbody, or through an opaque AbstractLocker\u0026 witness parameter -- assertIsHeld()\nrecords the invariant rather than suppressing the check.\n\n* Source/JavaScriptCore/assembler/PerfLog.h:\n* Source/JavaScriptCore/ftl/FTLThunks.h:\n* Source/JavaScriptCore/heap/Heap.h:\n* Source/JavaScriptCore/heap/HeapSnapshotBuilder.h:\n* Source/JavaScriptCore/heap/ParallelSourceAdapter.h:\n* Source/JavaScriptCore/heap/SlotVisitor.cpp:\n(JSC::SlotVisitor::drainFromShared):\n* Source/JavaScriptCore/inspector/remote/RemoteConnectionToTarget.h:\n(Inspector::RemoteConnectionToTarget::queueMutex):\n(Inspector::RemoteConnectionToTarget::queue const):\n* Source/JavaScriptCore/jit/ExecutableAllocator.cpp:\n* Source/JavaScriptCore/jit/GdbJIT.h:\n* Source/JavaScriptCore/profiler/ProfilerDatabase.h:\n* Source/JavaScriptCore/runtime/JSRunLoopTimer.h:\n* Source/JavaScriptCore/runtime/NumberPredictionFuzzerAgent.h:\n* Source/JavaScriptCore/runtime/ProfilerSupport.h:\n* Source/JavaScriptCore/runtime/RandomizingFuzzerAgent.h:\n* Source/JavaScriptCore/runtime/RegExpCache.h:\n* Source/JavaScriptCore/wasm/WasmCalleeGroup.h:\n* Source/JavaScriptCore/wasm/WasmPlan.h:\n* Source/JavaScriptCore/wasm/WasmStreamingCompiler.h:\n* Source/JavaScriptCore/wasm/WasmThunks.cpp:\n(JSC::Wasm::Thunks::stub):\n* Source/JavaScriptCore/wasm/WasmThunks.h:\n* Source/WTF/wtf/ConcurrentPtrHashSet.h:\n* Source/WTF/wtf/CryptographicallyRandomNumber.cpp:\n* Source/WTF/wtf/RunLoop.h:\n* Source/WTF/wtf/darwin/OSLogPrintStream.h:\n* Source/WebCore/Modules/webaudio/AudioBufferSourceNode.h:\n* Source/WebCore/Modules/webaudio/AudioWorkletNode.h:\n* Source/WebCore/Modules/webdatabase/DatabaseTracker.cpp:\n(WebCore::notificationQueue):\n* Source/WebCore/dom/Event.cpp:\n(WebCore::Event::initEvent):\n* Source/WebCore/page/scrolling/ScrollingTreeLatchingController.cpp:\n(WebCore::ScrollingTreeLatchingController::nodeDidHandleEvent):\n* Source/WebCore/page/scrolling/ScrollingTreeLatchingController.h:\n* Source/WebCore/platform/graphics/avfoundation/objc/CDMSessionAVContentKeySession.h:\n* Source/WebCore/platform/graphics/avfoundation/objc/ImageDecoderAVFObjC.mm:\n(WebCore::ImageDecoderAVFObjC::readTrackMetadata):\n* Source/WebCore/platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.h:\n* Source/WebCore/platform/libwebrtc/LibWebRTCVPXVideoDecoder.cpp:\n* Source/WebCore/platform/mediastream/cocoa/MediaStreamTrackAudioSourceProviderCocoa.h:\n* Source/WebCore/platform/mediastream/cocoa/RealtimeIncomingVideoSourceCocoa.h:\n* Source/WebCore/platform/mediastream/cocoa/RealtimeIncomingVideoSourceCocoa.mm:\n(WebCore::RealtimeIncomingVideoSourceCocoa::pixelBufferPool):\n* Source/WebCore/platform/mediastream/cocoa/WebAudioSourceProviderCocoa.h:\n* Source/WebCore/platform/mediastream/cocoa/WebAudioSourceProviderCocoa.mm:\n(WebCore::WebAudioSourceProviderCocoa::setNeedsFlush):\n* Source/WebCore/platform/mock/MockRealtimeVideoSource.h:\n* Source/WebKit/UIProcess/DisplayLinkProcessProxyClient.h:\n* Source/WebKit/UIProcess/RemoteLayerTree/mac/RemoteLayerTreeEventDispatcher.h:\n* Source/WebKit/WebProcess/GPU/webrtc/LibWebRTCCodecs.cpp:\n(WebKit::LibWebRTCCodecs::failedDecoding):\n* Source/WebKit/WebProcess/GPU/webrtc/LibWebRTCCodecs.h:\n* Source/WebKit/WebProcess/GPU/webrtc/SharedVideoFrame.cpp:\n(WebKit::SharedVideoFrameWriter::wait):\n(WebKit::SharedVideoFrameWriter::disable):\n* Source/WebKit/WebProcess/GPU/webrtc/SharedVideoFrame.h:\n* Source/WebKit/WebProcess/Storage/WebServiceWorkerFetchTaskClient.cpp:\n(WebKit::WebServiceWorkerFetchTaskClient::convertFetchToDownload):\n* Source/WebKit/WebProcess/Storage/WebServiceWorkerFetchTaskClient.h:\n* Source/WebKit/WebProcess/WebPage/mac/WKAccessibilityWebPageObjectBase.h:\n* Source/WebKitLegacy/Storage/StorageAreaSync.h:\n* Source/WebKitLegacy/Storage/StorageTracker.cpp:\n(WebKit::StorageTracker::trackerDatabasePath):\n(WebKit::StorageTracker::openTrackerDatabase):\n(WebKit::StorageTracker::finishedImportingOriginIdentifiers):\n(WebKit::StorageTracker::willDeleteAllOrigins):\n(WebKit::StorageTracker::willDeleteOrigin):\n(WebKit::StorageTracker::canDeleteOrigin):\n(WebKit::StorageTracker::databasePathForOrigin):\n* Source/WebKitLegacy/Storage/StorageTracker.h:\n\nCanonical link: https://commits.webkit.org/320645@main\n" }, { "commit": "566279d48d565d6de872cf4d624c759879c7ab74", "tree": "6cd06c1c67bae72245cbcee7a7f4490d3bafdab6", "parents": [ "e3fd423207b7044c4c2a238a3dc9c89170e32a87" ], "author": { "name": "Yusuke Suzuki", "email": "ysuzuki@apple.com", "time": "Tue Sep 08 09:04:09 2026" }, "committer": { "name": "Yusuke Suzuki", "email": "ysuzuki@apple.com", "time": "Tue Sep 08 09:04:09 2026" }, "message": "[JSC] C++ code should use truncateDoubleToInt64 for toInt32 too in x64\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323591\nrdar://186836512\n\nReviewed by Sosuke Suzuki.\n\n320602@main applied optimization in JIT for x64. But the same\noptimization can be done in C++ as well. This patch applies it. Also we\nclean up the code since sensible-conversion is only enabled on x64. Thus,\n\n1. Remove sensible-conversion flag from toIntImpl.\n2. Define specific function, toInt32AfterFailedTruncation\n3. Use truncateDoubleToInt64 and toInt32AfterFailedTruncation in toInt32\n implementation in x64.\n4. Clean up sensible-conversion code in DFG and FTL.\n\nTest: JSTests/stress/to-int32-out-of-int32-range-doubles-no-jit.js\n\n* JSTests/stress/to-int32-out-of-int32-range-doubles-no-jit.js: Added.\n(shouldBe):\n* Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:\n(JSC::DFG::SpeculativeJIT::emitDoubleToInt32):\n* Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:\n(JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):\n* Source/JavaScriptCore/runtime/MathCommon.cpp:\n(JSC::JSC_DEFINE_NOEXCEPT_JIT_OPERATION):\n* Source/JavaScriptCore/runtime/MathCommon.h:\n(JSC::toIntImpl):\n(JSC::toInt32AfterFailedTruncation):\n(JSC::toInt32):\n\nCanonical link: https://commits.webkit.org/320644@main\n" }, { "commit": "e3fd423207b7044c4c2a238a3dc9c89170e32a87", "tree": "5eac006e64a5288ebe916aafe72b70f4207196bd", "parents": [ "00af7a4b15fa54b9bbb20689f0fc8dc822474331" ], "author": { "name": "Anne van Kesteren", "email": "annevk@annevk.nl", "time": "Tue Sep 08 08:12:04 2026" }, "committer": { "name": "Anne van Kesteren", "email": "annevk@annevk.nl", "time": "Tue Sep 08 08:12:04 2026" }, "message": "Foster parenting should use the table\u0027s current parent\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323086\nrdar://186340113\n\nReviewed by Chris Dumez.\n\nThe appropriate place for inserting a node is computed for every insertion, and with\nfoster parenting enabled it is derived from the on-stack table\u0027s current parent. We\ncomputed it when queueing the task instead, so script running from an earlier task in\nthe same flush could move the table and leave a later task holding a parent and a\nreference child that no longer belong together.\n\nProcessing a single \"nobr\" start tag reaches this. It foster parents once while\nreconstructing the active formatting elements, and again after the adoption agency\nalgorithm finds no furthest block and pops the stack of open elements back to the \"tr\".\nWhen script has made a script element the table\u0027s parent, that element is the foster\nparent, so the first of those insertions runs it.\n\n319453@main stopped the resulting tree corruption by dropping the later insertion on the\nfloor. That is safe but is not what the standard asks for. Split the computation\ninstead: recordFosterSite() keeps the parts derived from the stack of open elements, and\nresolveFosterSite() derives the parent from the table when the task runs. This also\ncovers the table having no parent by then, where the foster parent is the element\nimmediately above it in the stack of open elements.\n\nThe reference child check has to happen before the template element branch, because the\nparent it resolves to can be a template element, and insertions then have to be\nredirected into its template contents. Without that ordering the case asserts in\nContainerNode::parserInsertBefore().\n\ninsertTextNode() runs its tasks inline rather than queueing them and reads the parent\nfirst, so it resolves the foster site itself.\n\nTests: imported/w3c/web-platform-tests/html/syntax/parsing/foster-parenting-moved-table.window.html\n\nTests upstream: https://github.com/web-platform-tests/wpt/pull/62346\n\nCanonical link: https://commits.webkit.org/320643@main\n" }, { "commit": "00af7a4b15fa54b9bbb20689f0fc8dc822474331", "tree": "16477fcdb4ee53944d0d95e9a7dd346871a1acfa", "parents": [ "f5e2e9f7b9b48ddbce2b32173e4fb2f92614d526" ], "author": { "name": "Anne van Kesteren", "email": "annevk@annevk.nl", "time": "Tue Sep 08 07:14:32 2026" }, "committer": { "name": "Anne van Kesteren", "email": "annevk@annevk.nl", "time": "Tue Sep 08 07:14:32 2026" }, "message": "SVG image with a height of 0 and no width is sized as if it had no natural dimensions\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323310\n\nReviewed by Alan Baradlay.\n\nFor an \u003cimg\u003e whose SVG has height\u003d\"0\", a viewBox, and no width, layout\nsized the box as if the image had no natural dimensions at all, filling\nthe containing block, instead of deriving a natural width of 0 from the\nnatural height of 0 and the natural aspect ratio. RenderReplaced\nrespects a specified 0 width but cannot tell a specified 0 height from\nan absent one, while SVGImage::resolvedIntrinsicSize does derive it,\nwhich is why naturalWidth and naturalHeight report 0x0 for the same\nimage. Chrome and Firefox report 0 as well.\n\n299085@main added shouldRespectZeroIntrinsicWidth without a height\ncounterpart, so that a degenerate aspect ratio from a 0 block size falls\nback to the viewBox ratio relative to an inline size, per\nhttps://github.com/w3c/csswg-drafts/issues/6286#issuecomment-866986544.\nThat is correct when there is a natural width to derive the height from,\nas in css/css-grid/alignment/grid-item-aspect-ratio-stretch-4.html.\nWithout one there is nothing to derive from and the natural height of 0\nstands, so only respect it when there is no natural width.\n\nThis also explains an intermittent failure of the imported\nnaturalWidth-naturalHeight-width-height.html, whose three \"SVG image,\nwith natural height of 0, and aspect ratio from viewBox\" subtests\nreported a width of 720 rather than 0 on some runs. With the SVG not yet\nparsed when the box was laid out there was no aspect ratio yet and the\nbox came out 0x0; a warm memory cache made the image available up front\nand produced 720. Nothing recomputed the width once the image arrived,\nso whichever value the first layout produced stuck.\n\nTest: imported/w3c/web-platform-tests/html/semantics/embedded-content/the-img-element/svg-img-zero-height-with-viewbox.html\n\nTest upstream: https://github.com/web-platform-tests/wpt/pull/62512\n\nCanonical link: https://commits.webkit.org/320642@main\n" }, { "commit": "f5e2e9f7b9b48ddbce2b32173e4fb2f92614d526", "tree": "97ccb9bf214be38f0cc3115abe1661f53c633ea8", "parents": [ "194d557d4fa67bcc2a3e9c929d142b8035067209" ], "author": { "name": "Anne van Kesteren", "email": "annevk@annevk.nl", "time": "Tue Sep 08 06:16:18 2026" }, "committer": { "name": "Anne van Kesteren", "email": "annevk@annevk.nl", "time": "Tue Sep 08 06:16:18 2026" }, "message": "Ignore the form element pointer when fragment parsing with a \u003ctemplate\u003e context element\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323586\n\nReviewed by Chris Dumez.\n\nThe form element pointer is meant to be ignored inside template contents, but\nisParsingTemplateContents() only consulted the stack of open elements. A fragment\nparse whose context element is a template element produces template contents\nwithout ever pushing a template element onto that stack, so setting innerHTML on\na template element used the pointer anyway. Given\n\n \u003cform\u003e\u003ctemplate id\u003dt\u003e\u003c/template\u003e\u003c/form\u003e\n\nthen t.innerHTML \u003d \"\u003cdiv\u003e\u003cform\u003e\u003c/div\u003e\u003cinput\u003e\u003c/form\u003e\" dropped the nested \u003cform\u003e,\nbecause the pointer had been seeded from the template\u0027s form ancestor.\n\nTwo more cases went wrong without any form ancestor, because a \u003cform\u003e in the\nmarkup set the pointer. t.innerHTML \u003d \"\u003cform\u003e\u003cform\u003e\" dropped the second \u003cform\u003e,\nand t.innerHTML \u003d \"\u003cbr\u003eBC\u003cform\u003eD\u003cdiv\u003eE\u003c/form\u003eF\u003c/div\u003eG\" took the pointer-based\n\u003c/form\u003e branch, which removes the form element from the stack of open elements\nand leaves the \u003cdiv\u003e open, rather than the branch used for template contents,\nwhich pops through it. The same markup written inside \u003ctemplate\u003e in a document\nproduced a different tree as a result.\n\nExtend isParsingTemplateContents() to also cover a template context element, and\npass the result into insertHTMLFormElement() instead of having it re-derive the\nnarrower condition from the stack of open elements, so the \"in body\" and \"in\ntable\" \u003cform\u003e start tags agree with it.\n\nMatches https://github.com/whatwg/html/pull/12911.\n\nTests: imported/w3c/web-platform-tests/html/syntax/parsing-html-fragments/fragment-parse-form-in-template-001.html\n imported/w3c/web-platform-tests/html/syntax/parsing-html-fragments/fragment-parse-form-in-template-002.html\n imported/w3c/web-platform-tests/html/syntax/parsing-html-fragments/fragment-parse-form-owner-001.html\n imported/w3c/web-platform-tests/html/syntax/parsing/form-element-pointer-in-template.html\n\nTests upstream: https://github.com/web-platform-tests/wpt/pull/62488\n\nCanonical link: https://commits.webkit.org/320641@main\n" }, { "commit": "194d557d4fa67bcc2a3e9c929d142b8035067209", "tree": "4e41d96d42844d8f8d4722fccf58ce945e441dc0", "parents": [ "173261c80c9adef54161b4f821af8404ccdcc827" ], "author": { "name": "Anne van Kesteren", "email": "annevk@annevk.nl", "time": "Tue Sep 08 06:13:12 2026" }, "committer": { "name": "Anne van Kesteren", "email": "annevk@annevk.nl", "time": "Tue Sep 08 06:13:12 2026" }, "message": "Retire webcoreBinding and exposed from UnifiedWebPreferences.yaml\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323609\n\nReviewed by Chris Dumez.\n\n93 \"webcoreBinding: none\" and 2 \"webcoreBinding: custom\" entries were\nredundant. Being excluded from WebCore already says there is no binding. The\n14 that remain say \"webcoreDeprecatedGlobalSettings: true\", the only choice\nthe key ever made that generated anything.\n\nForceEnhancedSecurity and SWVPDecodersAlwaysEnabled had to be excluded from\nWebCore first: both said \"webcoreBinding: none\" while claiming to be in\nWebCore, so the derivation finds 673 preferences bound to Settings where\n\"!webcoreBinding\" found 671. SWVPDecodersAlwaysEnabled\u0027s WebCore default\nvalue, which nothing read, is also removed.\n\n\"exposed\" becomes \"webKitLegacyExposed: false\", because WebKit1 is the only\nfrontend that ever read it: GeneratePreferences.rb is never run with\n--frontend WebCore and GenerateSettings.rb ignores the key, and no preference\nis in WebKit without being exposed there. 84 of the 85 lists said nothing but\n\"not part of the WebKit1 API\"; the one naming only WebKitLegacy is dropped,\nsince exposed is the default.\n\nNo behavior change: generating every derived file for all six generator\ninvocations before and after produces 23 byte-identical files.\n\nCanonical link: https://commits.webkit.org/320640@main\n" }, { "commit": "173261c80c9adef54161b4f821af8404ccdcc827", "tree": "697ab139427e1905e04c842e42d5ffcc388a5bb3", "parents": [ "587e3a7c563e482a45c3b186d9d5f093aadfb4a8" ], "author": { "name": "Chris Dumez", "email": "cdumez@apple.com", "time": "Tue Sep 08 05:05:50 2026" }, "committer": { "name": "Chris Dumez", "email": "cdumez@apple.com", "time": "Tue Sep 08 05:05:50 2026" }, "message": "Validate transient user activation in UIProcess for async clipboard reads\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d314886\nrdar://177152667\n\nReviewed by Ryosuke Niwa.\n\nFollow-up to 305413.908@safari-7624-branch, which added a WebCore-side\ntransient activation check to navigator.clipboard.readText() / read(). That\ncheck is bypassable by a compromised WebContent process that calls the\nRequestDOMPasteAccess IPC directly with a fabricated activation claim.\n\nMirror the spec\u0027s transient activation tracking\n(LocalDOMWindow::notifyActivated, LocalDOMWindow::hasTransientActivation) in\nthe UIProcess so the UIProcess can independently verify that the requesting\nframe really is activated:\n\n - WebFrameProxy gains m_lastActivationTimestamp, notifyActivated(), and\n hasTransientActivation(). notifyActivated() propagates the timestamp to\n ancestor frames (any origin) and same-origin descendant frames, matching\n the HTML spec\u0027s activation notification algorithm.\n\n - The four input-event entry points in WebPageProxy\n (sendMouseEvent / sendKeyEvent / sendPreventableTouchEvent /\n sendUnpreventableTouchEvent) now call WebFrameProxy::notifyActivated for\n activation-triggering events on the target frame. The pre-existing\n page-level lastActivationTimestamp updates remain; they serve a different\n heuristic.\n\n - WebPageProxy::requestDOMPasteAccess rejects with DeniedForGesture if the\n requesting WebFrameProxy does not have transient activation. A compromised\n WebContent process can no longer get past this gate.\n\n - WebFrameProxy::didCommitLoad resets m_lastActivationTimestamp so a new\n document does not inherit activation from the previous one (matches\n LocalDOMWindow::consumeLastActivationIfNecessary semantics).\n\n* Source/WebKit/UIProcess/WebFrameProxy.cpp:\n(WebKit::WebFrameProxy::didCommitLoad):\n(WebKit::WebFrameProxy::notifyActivated):\n(WebKit::WebFrameProxy::propagateActivationToSameOriginDescendants):\n(WebKit::WebFrameProxy::hasTransientActivation const):\n(WebKit::WebFrameProxy::securityOrigin const):\n* Source/WebKit/UIProcess/WebFrameProxy.h:\n* Source/WebKit/UIProcess/WebPageProxy.cpp:\n(WebKit::WebPageProxy::sendMouseEvent):\n(WebKit::WebPageProxy::sendKeyEvent):\n(WebKit::WebPageProxy::sendPreventableTouchEvent):\n(WebKit::WebPageProxy::sendUnpreventableTouchEvent):\n(WebKit::WebPageProxy::requestDOMPasteAccess):\n\nOriginally-landed-as: 305413.928@safari-7624-branch (6e4e21af9c2e). rdar://184744416\nCanonical link: https://commits.webkit.org/320639@main\n" }, { "commit": "587e3a7c563e482a45c3b186d9d5f093aadfb4a8", "tree": "3b1f3908043e58cc5798b6b2940a38f46c220bc9", "parents": [ "b982ebd3147d60c781c65bff005b603999b57100" ], "author": { "name": "Gerald Squelart", "email": "g_squelart@apple.com", "time": "Tue Sep 08 04:23:25 2026" }, "committer": { "name": "Gerald Squelart", "email": "g_squelart@apple.com", "time": "Tue Sep 08 04:23:25 2026" }, "message": "getImageData should return the requested color space even for fingerprinters\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323637\nrdar://183595301\n\nReviewed by Mike Wyrzykowski.\n\nThe anti privacy tracking branch of getImageData() was always returning\nan sRGB ImageData, which is against specs and therefore could be used as\na fingerprint datapoint.\nFixed by hoisting the existing ImageData::computeColorSpace() calculation\nabove the noise-injection branch and using it for the noise path\u0027s\nPixelBufferFormat, matching what the normal (non-noise) path already\ndoes.\n\n* Source/WebCore/html/canvas/CanvasRenderingContext2DBase.cpp:\n(WebCore::CanvasRenderingContext2DBase::getImageData const):\n* Tools/TestWebKitAPI/Resources/cocoa/canvas-fingerprinting.js:\n(getImageDataColorSpace):\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/ScriptTrackingPrivacyTests.mm:\n(TestWebKitAPI::(ScriptTrackingPrivacyTests, Canvas2DColorSpace)):\n\nCanonical link: https://commits.webkit.org/320638@main\n" }, { "commit": "b982ebd3147d60c781c65bff005b603999b57100", "tree": "e7a262a8893813b93dbb3bf68a428c3a2563a47e", "parents": [ "19cfe1ed983a6e886e86ff307e9fc9ee3053e525" ], "author": { "name": "Chris Dumez", "email": "cdumez@apple.com", "time": "Tue Sep 08 02:25:11 2026" }, "committer": { "name": "Chris Dumez", "email": "cdumez@apple.com", "time": "Tue Sep 08 02:25:11 2026" }, "message": "Allow annotating state that is read without locking on its owner thread\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323596\n\nReviewed by Geoffrey Garen.\n\nA recurring pattern could not be expressed with WTF_GUARDED_BY_LOCK() at all, and so\nwent entirely unchecked: state that is mutated on a single owner thread while holding\na lock, read on that same thread without locking because locking every read would be\ntoo expensive, and read by one other thread -- usually the garbage collector -- which\ndoes take the lock. Several such members already had a lock named for the purpose\n(m_elementLockForGC, m_opaqueRootLockForGC, m_trackLockForGC) or a comment describing\nthe arrangement, but nothing enforced it.\n\nClang\u0027s guarded_by attribute distinguishes access modes: a write requires the\ncapability exclusively, while a read accepts it shared. That maps onto this pattern\nexactly. assertIsOwnerThread(lock, owner) grants shared, read-only access and asserts\nat run time that this really is the owner thread; taking the lock grants exclusive\naccess as before. Annotating these members therefore makes direct writes and\nforeign-thread reads compiler-checked, and turns the owner-thread fast reads into\nsomething self-documenting and checked at run time, which is better than the nothing\nthey had before.\n\nNote that the capability is granted unconditionally by calling assertIsOwnerThread();\nthe run-time condition only catches a caller that had no business taking the unlocked\npath. The assertion also marks the lock as held for the remainder of the scope, so a\nfunction that asserts and then takes the lock would report the Locker as acquiring a\nlock that is already held. releaseOwnerThreadAssertion() hands the shared access back\nfor that case; it generates no code and only moves the analysis state. Where the\nunlocked read merely sat just outside an existing critical section it was simpler to\nmove it inside: the ASSERT()s in Attr::detachFromElementWithValue(),\nAttr::attachToElement() and HTMLCollection::setNamedItemCache(), and the return value\nof TreeWalker::setCurrent().\n\nAdopted for Attr::m_element, TreeWalker::m_current, CSSStyleSheet::m_ownerNode,\nXSLStyleSheet::m_ownerNode, HTMLCollection::m_namedElementCache and\nTextTrackCue::m_track. All six are owned by the main thread, which for these classes\nis the same as the context thread, since Document::isContextThread() is isMainThread().\n\nTextTrackCue needed one adaptation. JSTextTrackCueOwner::isReachableFromOpaqueRoots()\nread m_track twice without m_trackLockForGC. Those reads were not racy:\nisReachableFromOpaqueRoots() and hasPendingActivity() run with the main thread paused,\nwhich is why they may read without locking, whereas visitChildren() and\nvisitAdditionalChildren() do not and therefore already lock. An owner-thread assertion\ncannot express \"safe because the world is stopped\", and the two reads could disagree\nwith each other, so TextTrackCue now exposes containsTrackAsOpaqueRootInGCThread(),\nwhich holds the lock across a single test, as visitAdditionalChildrenInGCThread()\nalready did for the same member.\n\nNo behaviour change is intended: this patch fixes no bugs, it only makes existing\ninvariants checkable.\n\n* Source/WTF/wtf/ThreadAssertions.h:\n(WTF::assertIsOwnerThread):\n(WTF::releaseOwnerThreadAssertion):\n* Source/WebCore/bindings/js/JSTextTrackCueCustom.cpp:\n(WebCore::JSTextTrackCueOwner::isReachableFromOpaqueRoots):\n* Source/WebCore/css/CSSStyleSheet.cpp:\n(WebCore::CSSStyleSheet::ownerNode const):\n(WebCore::CSSStyleSheet::isDetached const):\n* Source/WebCore/css/CSSStyleSheet.h:\n* Source/WebCore/dom/Attr.cpp:\n(WebCore::Attr::setValue):\n(WebCore::Attr::style):\n(WebCore::Attr::value const):\n(WebCore::Attr::detachFromElementWithValue):\n(WebCore::Attr::attachToElement):\n* Source/WebCore/dom/Attr.h:\n(WebCore::Attr::ownerElement const):\n* Source/WebCore/dom/TreeWalker.cpp:\n(WebCore::TreeWalker::setCurrent):\n(WebCore::TreeWalker::parentNode):\n(WebCore::TreeWalker::firstChild):\n(WebCore::TreeWalker::lastChild):\n(WebCore::TreeWalker::traverseSiblings):\n(WebCore::TreeWalker::previousNode):\n(WebCore::TreeWalker::nextNode):\n* Source/WebCore/dom/TreeWalker.h:\n(WebCore::TreeWalker::currentNode):\n* Source/WebCore/html/HTMLCollection.cpp:\n(WebCore::HTMLCollection::namedItemSlow const):\n(WebCore::HTMLCollection::supportedPropertyNames):\n(WebCore::HTMLCollection::isSupportedPropertyName):\n(WebCore::HTMLCollection::namedItems const):\n* Source/WebCore/html/HTMLCollection.h:\n* Source/WebCore/html/HTMLCollectionInlines.h:\n(WebCore::HTMLCollection::hasNamedElementCache const):\n(WebCore::HTMLCollection::setNamedItemCache const):\n(WebCore::HTMLCollection::namedItemCaches const):\n* Source/WebCore/html/track/TextTrackCue.cpp:\n(WebCore::TextTrackCue::track const):\n(WebCore::TextTrackCue::containsTrackAsOpaqueRootInGCThread const):\n* Source/WebCore/html/track/TextTrackCue.h:\n* Source/WebCore/xml/XSLStyleSheet.h:\n(WebCore::XSLStyleSheet::ownerNode const):\n\nCanonical link: https://commits.webkit.org/320637@main\n" }, { "commit": "19cfe1ed983a6e886e86ff307e9fc9ee3053e525", "tree": "d59d7b6b2e49320c1a174b7f12faa8e606b896e2", "parents": [ "63354f38775d8c190b479ad7f7710ee23c8c5204" ], "author": { "name": "Chris Dumez", "email": "cdumez@apple.com", "time": "Tue Sep 08 00:26:17 2026" }, "committer": { "name": "Chris Dumez", "email": "cdumez@apple.com", "time": "Tue Sep 08 00:26:17 2026" }, "message": "Use RELEASE_ASSERT in assertIsCurrent(const RunLoop\u0026) for extra thread safety\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323572\n\nReviewed by Darin Adler.\n\nUse RELEASE_ASSERT in assertIsCurrent(const RunLoop\u0026) for extra thread safety.\nThis tested as performance neutral on the benchmarks we track.\n\n* Source/WTF/wtf/RunLoop.h:\n(WTF::WTF_ASSERTS_ACQUIRED_CAPABILITY):\n* Source/WTF/wtf/cf/RunLoopCF.cpp:\n(WTF::RunLoop::TimerBase::stop):\n* Source/WTF/wtf/generic/RunLoopGeneric.cpp:\n(WTF::RunLoop::TimerBase::~TimerBase):\n(WTF::RunLoop::TimerBase::stop):\n* Source/WTF/wtf/glib/RunLoopGLib.cpp:\n(WTF::RunLoop::TimerBase::~TimerBase):\n(WTF::RunLoop::TimerBase::stop):\n* Source/WTF/wtf/win/RunLoopWin.cpp:\n(WTF::RunLoop::TimerBase::stop):\n\nCanonical link: https://commits.webkit.org/320636@main\n" }, { "commit": "63354f38775d8c190b479ad7f7710ee23c8c5204", "tree": "b5cd1266e86a331fb4293bfdc566506383ed4a7d", "parents": [ "56c34b19052f1b17a93edb6d8decbbaaef1df934" ], "author": { "name": "Chris Dumez", "email": "cdumez@apple.com", "time": "Tue Sep 08 00:23:07 2026" }, "committer": { "name": "Chris Dumez", "email": "cdumez@apple.com", "time": "Tue Sep 08 00:23:07 2026" }, "message": "[Safer CPP] Drop some suppression macros that are no longer required\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323396\n\nReviewed by Darin Adler.\n\n* Source/WebCore/page/scrolling/mac/ScrollerMac.mm:\n(-[WebScrollerImpDelegateMac effectiveAppearanceForScrollerImp:]):\n* Source/WebCore/page/writing-tools/WritingToolsController.mm:\n(WebCore::attributedStringApplyingBodyTextColorIfNecessary):\n* Source/WebKit/NetworkProcess/cocoa/NetworkSessionCocoa.mm:\n(WebKit::NetworkSessionCocoa::createWebSocketTask):\n* Source/WebKit/WebProcess/WebPage/mac/WKAccessibilityWebPageObjectBase.mm:\n(-[WKAccessibilityWebPageObjectBase accessibilityPluginObject]):\n\nCanonical link: https://commits.webkit.org/320635@main\n" }, { "commit": "56c34b19052f1b17a93edb6d8decbbaaef1df934", "tree": "1c8bb19014ad4a8643bbc9814d621605d4b3dc1a", "parents": [ "b36f7a6cf350bc0d696ff32df642f58fba711556" ], "author": { "name": "Fujii Hironori", "email": "fujii@igalia.com", "time": "Mon Sep 07 23:58:13 2026" }, "committer": { "name": "Fujii Hironori", "email": "fujii@igalia.com", "time": "Mon Sep 07 23:58:13 2026" }, "message": "RenderLayer::backgroundIsKnownToBeOpaqueInRect should account for clip-path and mask\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d322885\n\nReviewed by Simon Fraser.\n\nA layer with clip-path or mask can render a non-rectangular area even\nwhen its children fully cover the layer\u0027s bounds, so it should not be\ntreated as opaque based solely on its children\u0027s opacity.\n\n* LayoutTests/compositing/masks/clip-path-with-opaque-child-background-expected.html: Added.\n* LayoutTests/compositing/masks/clip-path-with-opaque-child-background.html: Added.\n* Source/WebCore/rendering/RenderLayer.cpp:\n(WebCore::RenderLayer::backgroundIsKnownToBeOpaqueInRect):\n(WebCore::RenderLayer::calculateClipRects const):\n\nCanonical link: https://commits.webkit.org/320634@main\n" }, { "commit": "b36f7a6cf350bc0d696ff32df642f58fba711556", "tree": "5997276a8e7aee65c0682c813b490d68f07cb7c5", "parents": [ "ab7189f839e98f29866d934975a03e87b8f85d16" ], "author": { "name": "Simon Fraser", "email": "simon.fraser@apple.com", "time": "Mon Sep 07 23:44:33 2026" }, "committer": { "name": "Simon Fraser", "email": "simon.fraser@apple.com", "time": "Mon Sep 07 23:44:33 2026" }, "message": "[corner-shape] Add some more shape-outside/corner-shape tests\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323566\nrdar://186809547\n\nReviewed by Dan Glastonbury.\n\nAdd more shape-outside/corner-shape tests (which test the code landed in 320552@main).\n\nBased on work by Lilly Le (@cupidsity).\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-borders/corner-shape/corner-shape-outside-content-box-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-borders/corner-shape/corner-shape-outside-content-box.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-borders/corner-shape/corner-shape-outside-corners-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-borders/corner-shape/corner-shape-outside-corners.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-borders/corner-shape/corner-shape-outside-margin-box-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-borders/corner-shape/corner-shape-outside-margin-box.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-borders/corner-shape/corner-shape-outside-padding-box-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-borders/corner-shape/corner-shape-outside-padding-box.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-borders/corner-shape/corner-shape-outside-shape-margin-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-borders/corner-shape/corner-shape-outside-shape-margin.html: Added.\n\nCanonical link: https://commits.webkit.org/320633@main\n" }, { "commit": "ab7189f839e98f29866d934975a03e87b8f85d16", "tree": "d248eaedd626cfc3e6eb9df2f7a8d65dd4aa94de", "parents": [ "edc74c3eeb037f604eee3be75ceb20f88ab62629" ], "author": { "name": "Sam Weinig", "email": "sam@webkit.org", "time": "Mon Sep 07 23:33:56 2026" }, "committer": { "name": "Sam Weinig", "email": "sam@webkit.org", "time": "Mon Sep 07 23:33:56 2026" }, "message": "Add support for the palette-mix() function\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d322450\n\nReviewed by Antti Koivisto.\n\nAdds parsing and model support for the palette-mix() function\nbehind new preference CSSFontPaletteMixFunctionEnabled.\n\nAlso adds a strong type for ColorInterpolationMethod to allow\nits serialization to be shared.\n\nNot yet used by any font backends.\n\nhttps://drafts.csswg.org/css-fonts-4/#funcdef-palette-mix\n\nTests: imported/w3c/web-platform-tests/css/css-fonts/parsing/palette-mix-computed.html\n imported/w3c/web-platform-tests/css/css-fonts/parsing/palette-mix-invalid.html\n imported/w3c/web-platform-tests/css/css-fonts/parsing/palette-mix-valid.html\n* LayoutTests/imported/w3c/web-platform-tests/css/css-fonts/animations/font-palette-interpolation-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-fonts/palette-mix-computed-expected.txt: Removed.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-fonts/palette-mix-computed.html: Removed.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-fonts/parsing/palette-mix-computed-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-fonts/parsing/palette-mix-computed.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-fonts/parsing/palette-mix-invalid-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-fonts/parsing/palette-mix-invalid.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-fonts/parsing/palette-mix-valid-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-fonts/parsing/palette-mix-valid.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-values/tree-counting/sibling-index-keyframe-palette-mix-dynamic-expected.txt:\n* Source/WTF/Scripts/Preferences/UnifiedWebPreferences.yaml:\n* Source/WebCore/Headers.cmake:\n* Source/WebCore/Sources.txt:\n* Source/WebCore/WebCore.xcodeproj/project.pbxproj:\n* Source/WebCore/css/CSSFontPaletteValue.cpp: Added.\n* Source/WebCore/css/CSSFontPaletteValue.h: Added.\n* Source/WebCore/css/CSSFontSelector.cpp:\n* Source/WebCore/css/CSSProperties.json:\n* Source/WebCore/css/CSSValue.cpp:\n* Source/WebCore/css/CSSValue.h:\n* Source/WebCore/css/CSSValueKeywords.in:\n* Source/WebCore/css/parser/CSSParserContext.cpp:\n* Source/WebCore/css/parser/CSSParserContext.h:\n* Source/WebCore/css/parser/CSSPropertyParserConsumer+Color.cpp:\n* Source/WebCore/css/parser/CSSPropertyParserConsumer+ColorInterpolationMethod.cpp:\n* Source/WebCore/css/parser/CSSPropertyParserConsumer+ColorInterpolationMethod.h:\n* Source/WebCore/css/parser/CSSPropertyParserConsumer+Font.cpp:\n* Source/WebCore/css/parser/CSSPropertyParserConsumer+Font.h:\n* Source/WebCore/css/parser/CSSPropertyParserConsumer+Image.cpp:\n* Source/WebCore/css/typedom/CSSStyleValueFactory.cpp:\n* Source/WebCore/css/values/color/CSSColorInterpolationMethod.cpp: Added.\n* Source/WebCore/css/values/color/CSSColorInterpolationMethod.h: Added.\n* Source/WebCore/css/values/color/CSSColorMix.cpp:\n* Source/WebCore/css/values/color/CSSColorMix.h:\n* Source/WebCore/css/values/color/CSSColorMixResolver.cpp:\n* Source/WebCore/css/values/color/CSSColorMixResolver.h:\n* Source/WebCore/css/values/fonts/CSSFontPalette.cpp: Added.\n* Source/WebCore/css/values/fonts/CSSFontPalette.h: Added.\n* Source/WebCore/css/values/fonts/CSSFontPaletteMix.cpp: Added.\n* Source/WebCore/css/values/fonts/CSSFontPaletteMix.h: Added.\n* Source/WebCore/css/values/images/CSSGradient.cpp:\n* Source/WebCore/css/values/images/CSSGradient.h:\n* Source/WebCore/platform/graphics/FontCascadeCache.h:\n* Source/WebCore/platform/graphics/FontDescription.cpp:\n* Source/WebCore/platform/graphics/FontPalette.cpp: Added.\n* Source/WebCore/platform/graphics/FontPalette.h:\n* Source/WebCore/platform/graphics/FontPaletteMix.cpp: Added.\n* Source/WebCore/platform/graphics/FontPaletteMix.h: Added.\n* Source/WebCore/platform/graphics/cocoa/UnrealizedCoreTextFont.cpp:\n* Source/WebCore/style/StyleExtractorCustom.h:\n* Source/WebCore/style/StyleInterpolationFunctions.h:\n* Source/WebCore/style/values/color/StyleColorInterpolationMethod.h: Added.\n* Source/WebCore/style/values/color/StyleColorMix.cpp:\n* Source/WebCore/style/values/color/StyleColorMix.h:\n* Source/WebCore/style/values/fonts/StyleFontPalette.cpp:\n* Source/WebCore/style/values/fonts/StyleFontPalette.h:\n* Source/WebCore/style/values/fonts/StyleFontPaletteInlines.h: Added.\n* Source/WebCore/style/values/fonts/StyleFontPaletteMix.cpp: Added.\n* Source/WebCore/style/values/fonts/StyleFontPaletteMix.h: Added.\n* Source/WebCore/style/values/images/StyleGradient.cpp:\n\nCanonical link: https://commits.webkit.org/320632@main\n" }, { "commit": "edc74c3eeb037f604eee3be75ceb20f88ab62629", "tree": "0559f3286af677eed1a46e2f271872cac656ac9c", "parents": [ "fa7a14d6070a68460b7203f520a518b843114af0" ], "author": { "name": "Antti Koivisto", "email": "antti@apple.com", "time": "Mon Sep 07 21:26:24 2026" }, "committer": { "name": "Antti Koivisto", "email": "koivisto@iki.fi", "time": "Mon Sep 07 21:26:24 2026" }, "message": "[css-values-5 calc-size()] Parsing and serialization\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323433\nrdar://186659563\n\nReviewed by Sam Weinig and Alan Baradlay.\n\nhttps://drafts.csswg.org/css-values-5/#funcdef-calc-size\n\nThis patch implements parsing and serialization behind a feature flag.\n\n* Source/WTF/Scripts/Preferences/UnifiedWebPreferences.yaml:\n* Source/WebCore/css/CSSValueKeywords.in:\n\nAdd `calc-size` and `any`.\n\n* Source/WebCore/css/CSSProperties.json:\n\nAdd a \u003ccalc-size\u003e shared grammar rule using grammar-function, referenced from\n\u003cwidth-or-height\u003e, \u003cmax-width-or-height\u003e and \u003c\u0027flex-basis\u0027\u003e.\n\n* Source/WebCore/css/values/sizing/CSSCalcSizeFunction.h: Added.\n* Source/WebCore/css/values/sizing/CSSCalcSizeFunction.cpp: Added.\n\nCSS::CalcSizeParameters plus FunctionNotation. The basis keywords are CSS::Keyword types,\neach \u003ccalc-sum\u003e is a CSSCalc::Tree and a nested calc-size() basis is a UniqueRef to the type\nwrapper so it can be forward declared.\n\n(WebCore::CSS::CalcSize::collectComputedStyleDependencies):\n* Source/WebCore/css/CSSCalcSizeValue.h: Added.\n* Source/WebCore/css/CSSCalcSizeValue.cpp: Added.\n\nCSSValue wrapper for CSS::CalcSize.\n\n* Source/WebCore/css/parser/CSSPropertyParserConsumer+CalcSize.h: Added.\n* Source/WebCore/css/parser/CSSPropertyParserConsumer+CalcSize.cpp: Added.\n(WebCore::CSSPropertyParserHelpers::isValidBasisKeyword):\n\nThe basis accepts the sizing keywords the property itself accepts.\n\n(WebCore::CSSPropertyParserHelpers::consumeCalcSum):\n(WebCore::CSSPropertyParserHelpers::consumeCalcSizeBasis):\n(WebCore::CSSPropertyParserHelpers::consumeCalcSizeFunction):\n(WebCore::CSSPropertyParserHelpers::consumeCalcSize):\n\n* Source/WebCore/css/calc/CSSCalcTree+Parser.h:\n* Source/WebCore/css/calc/CSSCalcTree+Parser.cpp:\n(WebCore::CSSCalc::parseAndSimplifyCalcSum):\n\nThe arguments are \u003ccalc-sum\u003e productions, not \u003clength-percentage\u003e values, so\nthey need an entry point that does not expect an enclosing math function.\n\n* Source/WebCore/css/calc/CSSCalcTree+Serialization.h:\n* Source/WebCore/css/calc/CSSCalcTree+Serialization.cpp:\n(WebCore::CSSCalc::serializationForCSSAsFunctionArgument):\n\nA \u003ccalc-sum\u003e in argument position drops the grouping parentheses, per\nserialize-a-math-function step 4. Takes the Tree so the stage is carried through.\n\n* Source/WebCore/style/values/primitives/StylePrimitiveNumericOrKeyword+CSSValueConversion.h:\n(WebCore::Style::convertKeywordIDForCSSValueConversion):\n(WebCore::Style::convertCalcSizeForCSSValueConversion):\n* Source/WebCore/css/CSSValue.h:\n* Source/WebCore/css/CSSValue.cpp:\n(WebCore::CSSValue::collectComputedStyleDependencies):\n* Source/WebCore/CMakeLists.txt:\n* Source/WebCore/Headers.cmake:\n* Source/WebCore/Sources.txt:\n* Source/WebCore/WebCore.xcodeproj/project.pbxproj:\n* Source/WebCore/css/parser/CSSParserContext.h:\n* Source/WebCore/css/parser/CSSParserContext.cpp:\n* Source/WebCore/css/parser/CSSPropertyParserCustom.h:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-values/calc-size/*-expected.txt: Rebaselined.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-tables/fixed-layout-2-expected.txt: Rebaselined.\n\nCanonical link: https://commits.webkit.org/320631@main\n" }, { "commit": "fa7a14d6070a68460b7203f520a518b843114af0", "tree": "7e161769a58f6d89049af879320d05d44ec9f97a", "parents": [ "92b2fb9f20fd5f3d4f83f36c472915ccb11dc03f" ], "author": { "name": "Alan Baradlay", "email": "zalan@apple.com", "time": "Mon Sep 07 20:44:39 2026" }, "committer": { "name": "Alan Baradlay", "email": "zalan@apple.com", "time": "Mon Sep 07 20:44:39 2026" }, "message": "[cleanup] Drop RenderListOutsideMarker::m_textContent, the marker box\u0027s copy of text the list item already computes\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323547\nrdar://problem/186792207\n\nReviewed by Antti Koivisto.\n\nThe marker box kept the text it shows in a member, which the renderers holding that text have since become the\nplace for. Everything that read it goes through RenderListItem::markerText now, which computes the same text\nfrom style, and answers for the inline marker shape too. It grew the one rule the member carried: a marker\nshowing an image says nothing. That rule was written out twice, so give it a name.\n\n* Source/WebCore/accessibility/AccessibilityNodeObject.cpp:\n(WebCore::AccessibilityNodeObject::stitchGroups const):\n* Source/WebCore/accessibility/AccessibilityRenderObject.cpp:\n(WebCore::AccessibilityRenderObject::textUnderElement const):\n(WebCore::AccessibilityRenderObject::stringValue const):\n(WebCore::AccessibilityRenderObject::listMarkerText const):\n* Source/WebCore/rendering/RenderListItem.cpp:\n(WebCore::RenderListItem::markerText const):\n* Source/WebCore/rendering/RenderListOutsideMarker.cpp:\n(WebCore::RenderListOutsideMarker::layoutContentContainer):\n(WebCore::RenderListOutsideMarker::updateContent):\n(WebCore::RenderListOutsideMarker::updateContentContainerText):\n(WebCore::listMarkerShowsImage):\n(WebCore::listMarkerSynthesizesGlyph):\n(WebCore::RenderListOutsideMarker::textContent const): Deleted.\n* Source/WebCore/rendering/RenderListOutsideMarker.h:\n* Source/WebCore/rendering/RenderTreeAsText.cpp:\n(WebCore::RenderTreeAsText::writeRenderObject):\n(WebCore::markerTextForListItem):\n\nCanonical link: https://commits.webkit.org/320630@main\n" }, { "commit": "92b2fb9f20fd5f3d4f83f36c472915ccb11dc03f", "tree": "0db70e54ac25705b45edf79d0f39cdb85658a73f", "parents": [ "ae38411fb04ec7370d4c9eae4fa77699f7858339" ], "author": { "name": "Antoine Quint", "email": "graouts@webkit.org", "time": "Mon Sep 07 20:19:38 2026" }, "committer": { "name": "Antoine Quint", "email": "graouts@webkit.org", "time": "Mon Sep 07 20:19:38 2026" }, "message": "[scroll-animations] WPT test `scroll-animations/css/animation-timeline-none.html` has a failure\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323616\nrdar://186856274\n\nReviewed by Simon Fraser.\n\nMore fallout from the spec change to make style-originated timelines match globally [0].\n\nWe must make sure in `StyleOriginatedTimelinesController::attachAnimation()` to always\nyield an inactive style-originated timelines if we can\u0027t find the provided name set by\nthe `animation-timeline` property regardless of whether we have an element with a\n`timeline-scope` property matching this name in the animation target\u0027s hierarchy.\n\nThis change caused a regression in the \u0027A timline scope in the ancestor chain\u0027 (sic)\ntest in `scroll-animations/css/timeline-scope.html` which prompted the change in\n`StyleOriginatedTimelinesController::updateNamedTimelineMapForTimelineScope()`\nto update the timeline relationship for any animation associated with a timeline\nwhich has a name that was contained in a `timeline-scope` property newly set to `none`.\n\nNote that the regression in `scroll-animations/css/scroll-timeline-in-container-query.html`\nis only temporary, this test has yet to be updated for the spec change in question [1].\n\n[0] https://github.com/w3c/csswg-drafts/pull/13624\n[1] https://github.com/web-platform-tests/wpt/pull/62200\n\n* LayoutTests/imported/w3c/web-platform-tests/scroll-animations/css/animation-timeline-named-scroll-progress-timeline.tentative-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/scroll-animations/css/animation-timeline-none-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/scroll-animations/css/scroll-timeline-dynamic.tentative-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/scroll-animations/css/scroll-timeline-in-container-query-expected.txt:\n* Source/WebCore/animation/StyleOriginatedTimelinesController.cpp:\n(WebCore::StyleOriginatedTimelinesController::attachAnimation):\n(WebCore::StyleOriginatedTimelinesController::updateNamedTimelineMapForTimelineScope):\n\nCanonical link: https://commits.webkit.org/320629@main\n" }, { "commit": "ae38411fb04ec7370d4c9eae4fa77699f7858339", "tree": "d66a68e6bcdc5b90a9f5d01d50521af248c53d83", "parents": [ "dd17e2aedb59e69bd9cae2d369226d1934689436" ], "author": { "name": "Kimmo Kinnunen", "email": "kkinnunen@apple.com", "time": "Mon Sep 07 19:58:58 2026" }, "committer": { "name": "Kimmo Kinnunen", "email": "kkinnunen@apple.com", "time": "Mon Sep 07 19:58:58 2026" }, "message": "IOSurfacePool does not try to take surfaces that were previously in use\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323620\nrdar://186857165\n\nReviewed by Matt Woodrow.\n\nFrequent 2D context self drawing allocates intermediate buffers. These\ndo not clear CGIOSurfaceQueue immediately. During such loops, the\nIOSurface IsInUse will flip for the earlier intermediate buffers\nfaster than IOSurfacePool in use surface collect callback runs.\n\nIf pool lookup fails, go through the in use list. The pool has quite\nmodest amount of entries anyway, in use or not, since the memory use\nis 256mb.\n\nTest: Tools/TestWebKitAPI/Tests/WebCore/cocoa/IOSurfacePoolTests.cpp\n\n* Source/WebCore/platform/graphics/cg/IOSurfacePool.cpp:\n(WebCore::IOSurfacePool::takeSurface):\n* Source/WebCore/platform/graphics/cg/IOSurfacePool.h:\n* Tools/TestWebKitAPI/PlatformCocoa.cmake:\n* Tools/TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:\n* Tools/TestWebKitAPI/Tests/WebCore/cocoa/IOSurfacePoolTests.cpp: Added.\n(TestWebKitAPI::TEST(IOSurfacePoolTest, TakeSurfaceFindsSurfaceThatIsNoLongerInUse)):\n\nCanonical link: https://commits.webkit.org/320628@main\n" }, { "commit": "dd17e2aedb59e69bd9cae2d369226d1934689436", "tree": "a535187acee6428b4ba9f29e9821f6d7c2b6a46f", "parents": [ "c0a49688cb186d90984cc82b3b45259088e1cf77" ], "author": { "name": "Alicia Boya Garcia", "email": "aboya@igalia.com", "time": "Mon Sep 07 18:31:51 2026" }, "committer": { "name": "Alicia Boya Garcia", "email": "aboya@igalia.com", "time": "Mon Sep 07 18:31:51 2026" }, "message": "[glib] Unreviewed test gardening\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323627\n\nUnreviewed.\n\n* LayoutTests/platform/wpe/TestExpectations:\n* LayoutTests/platform/wpe/fast/html/details-add-summary-1-expected.txt:\n* LayoutTests/platform/wpe/fast/html/details-add-summary-10-and-click-expected.txt:\n* LayoutTests/platform/wpe/fast/html/details-add-summary-2-expected.txt:\n* LayoutTests/platform/wpe/fast/html/details-add-summary-3-expected.txt:\n* LayoutTests/platform/wpe/fast/html/details-add-summary-4-expected.txt:\n* LayoutTests/platform/wpe/fast/html/details-add-summary-5-expected.txt:\n* LayoutTests/platform/wpe/fast/html/details-add-summary-6-and-click-expected.txt:\n* LayoutTests/platform/wpe/fast/html/details-add-summary-7-and-click-expected.txt:\n* LayoutTests/platform/wpe/fast/html/details-add-summary-8-and-click-expected.txt:\n* LayoutTests/platform/wpe/fast/html/details-add-summary-9-and-click-expected.txt:\n* LayoutTests/platform/wpe/fast/html/details-no-summary1-expected.txt:\n* LayoutTests/platform/wpe/fast/html/details-no-summary3-expected.txt:\n* LayoutTests/platform/wpe/fast/html/details-no-summary4-expected.txt:\n* LayoutTests/platform/wpe/fast/html/details-open-javascript-expected.txt:\n* LayoutTests/platform/wpe/fast/html/details-open1-expected.txt:\n* LayoutTests/platform/wpe/fast/html/details-open2-expected.txt:\n* LayoutTests/platform/wpe/fast/html/details-open3-expected.txt:\n* LayoutTests/platform/wpe/fast/html/details-open4-expected.txt:\n* LayoutTests/platform/wpe/fast/html/details-open5-expected.txt:\n* LayoutTests/platform/wpe/fast/html/details-position-expected.txt:\n* LayoutTests/platform/wpe/fast/html/details-remove-summary-1-expected.txt:\n* LayoutTests/platform/wpe/fast/html/details-remove-summary-2-expected.txt:\n* LayoutTests/platform/wpe/fast/html/details-remove-summary-3-expected.txt:\n* LayoutTests/platform/wpe/fast/html/details-remove-summary-4-and-click-expected.txt:\n* LayoutTests/platform/wpe/fast/html/details-remove-summary-5-and-click-expected.txt:\n* LayoutTests/platform/wpe/fast/html/details-remove-summary-6-and-click-expected.txt:\n* LayoutTests/platform/wpe/fast/html/details-replace-summary-child-expected.txt:\n* LayoutTests/platform/wpe/fast/html/details-replace-text-expected.txt:\n* LayoutTests/platform/wpe/tables/mozilla/bugs/bug30692-expected.png:\n* LayoutTests/platform/wpe/tables/mozilla/bugs/bug30692-expected.txt:\n* Tools/TestWebKitAPI/glib/TestExpectations.json:\n\nCanonical link: https://commits.webkit.org/320627@main\n" }, { "commit": "c0a49688cb186d90984cc82b3b45259088e1cf77", "tree": "3d91efa93c6e0e4a1b5e718f45cc03a40c7be16f", "parents": [ "f33e68826cd74dab8ad670f66b75cd0ffc68b97a" ], "author": { "name": "Alan Baradlay", "email": "zalan@apple.com", "time": "Mon Sep 07 18:14:22 2026" }, "committer": { "name": "Alan Baradlay", "email": "zalan@apple.com", "time": "Mon Sep 07 18:14:22 2026" }, "message": "[list-marker] Give every outside list marker its content as renderers instead of hand-drawing the text and the image\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323502\nrdar://problem/186741639\n\nReviewed by Antti Koivisto.\n\nThe outside marker already held its content as renderers when the ::marker had a content property, right to left\ntext or a synthesized glyph. Build them for the rest too, so one path measures, lays out and paints every marker.\n\nThe render tree dump leaves the marker\u0027s renderers out: its own line already carries the text.\n\n* LayoutTests/TestExpectations:\n* LayoutTests/platform/glib/fast/lists/008-expected.txt:\n* LayoutTests/platform/glib/fast/lists/008-vertical-expected.txt:\n* LayoutTests/platform/ios/fast/lists/008-expected.txt:\n* LayoutTests/platform/ios/fast/lists/008-vertical-expected.txt:\n* LayoutTests/platform/mac/fast/lists/008-expected.txt:\n* LayoutTests/platform/mac/fast/lists/008-vertical-expected.txt:\n* Source/WebCore/layout/formattingContexts/inline/InlineLineBoxBuilder.cpp:\n(WebCore::Layout::LineBoxBuilder::constructInlineLevelBoxes):\n* Source/WebCore/layout/integration/LayoutIntegrationBoxTreeUpdater.cpp:\n(WebCore::LayoutIntegration::isListMarkerImage):\n(WebCore::LayoutIntegration::BoxTreeUpdater::createLayoutBox):\n(WebCore::LayoutIntegration::BoxTreeUpdater::updateStyle):\n(WebCore::LayoutIntegration::calculateListMarkerAttribute): Deleted.\n* Source/WebCore/layout/layouttree/LayoutElementBox.cpp:\n(WebCore::Layout::ElementBox::ElementBox):\n* Source/WebCore/layout/layouttree/LayoutElementBox.h:\n(WebCore::Layout::ElementBox::setIsListMarkerImage):\n(WebCore::Layout::ElementBox::isListMarkerImage const):\n(WebCore::Layout::ElementBox::setListMarkerAttributes): Deleted.\n* Source/WebCore/rendering/RenderListOutsideMarker.cpp:\n(WebCore::RenderListOutsideMarker::paint):\n(WebCore::RenderListOutsideMarker::layout):\n(WebCore::RenderListOutsideMarker::layoutContentContainer):\n(WebCore::RenderListOutsideMarker::updateContent):\n(WebCore::RenderListOutsideMarker::setContentContainerImageSize):\n(WebCore::RenderListOutsideMarker::computeIntrinsicLogicalWidthContributions):\n(WebCore::RenderListOutsideMarker::updateInlineMargins):\n(WebCore::symbolsContainStrongDirectionalityText): Deleted.\n(WebCore::counterStyleChainHasStrongDirectionalitySymbols): Deleted.\n(WebCore::RenderListOutsideMarker::textNeedsBidiResolution): Deleted.\n(WebCore::RenderListOutsideMarker::needsContentContainer): Deleted.\n(WebCore::textRunForContent): Deleted.\n(WebCore::RenderListOutsideMarker::relativeMarkerRect): Deleted.\n(WebCore::RenderListOutsideMarker::counterStyle): Deleted.\n* Source/WebCore/rendering/RenderListOutsideMarker.h:\n* Source/WebCore/rendering/RenderTreeAsText.cpp:\n(WebCore::write):\n* Source/WebCore/rendering/updating/RenderTreeBuilderList.cpp:\n(WebCore::RenderTreeBuilder::List::updateItemMarker):\n(WebCore::RenderTreeBuilder::List::buildMarkerContentRenderers):\n\nCanonical link: https://commits.webkit.org/320626@main\n" }, { "commit": "f33e68826cd74dab8ad670f66b75cd0ffc68b97a", "tree": "9bc57649279852d6add6b6abc48c5006e43c6388", "parents": [ "221348147d70038b32775a76ce4a7ba964126503" ], "author": { "name": "Tyler Wilcock", "email": "tyler_w@apple.com", "time": "Mon Sep 07 16:36:05 2026" }, "committer": { "name": "Tyler Wilcock", "email": "tyler_w@apple.com", "time": "Mon Sep 07 16:36:05 2026" }, "message": "AX: Add a layout test for the bounds of a slider\u0027s accessibility value indicator\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323553\nrdar://186798750\n\nReviewed by Chris Fleizach.\n\nNo existing test verified the bounding box of the slider thumb. The new\ntest does that, and verifies it stays correct after a dynamic value\nchange (which moves the thumb).\n\n* LayoutTests/accessibility/isolated-tree/mac/slider-value-indicator-bounds-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/slider-value-indicator-bounds.html: Added.\n* LayoutTests/accessibility/mac/slider-value-indicator-bounds-expected.txt: Added.\n* LayoutTests/accessibility/mac/slider-value-indicator-bounds.html: Added.\n\nCanonical link: https://commits.webkit.org/320625@main\n" }, { "commit": "221348147d70038b32775a76ce4a7ba964126503", "tree": "76229ec8d931f6e4bf8fbb7120576e9467536201", "parents": [ "6d631db91774a727f4b75cfa594b4ff809adeb6c" ], "author": { "name": "Alan Baradlay", "email": "zalan@apple.com", "time": "Mon Sep 07 16:01:40 2026" }, "committer": { "name": "Alan Baradlay", "email": "zalan@apple.com", "time": "Mon Sep 07 16:01:40 2026" }, "message": "[list-marker] The outside list marker resolves its content during layout instead of when it changes\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323530\nrdar://problem/186770171\n\nReviewed by Antti Koivisto.\n\nThe marker resolved what it shows -- its text, and the size it measures its image at -- off the preferred\nwidth dirty bit, so it ran\nduring layout and during the preferred width pass. Both are the wrong time: setting the text there marks the\nrenderers holding it dirty from inside layout, and the width pass leaves whatever it marks for someone else\nto lay out. Everything that changes what the marker shows already tells the marker about it\n(RenderTreeBuilder::updateListMarkerContents, RenderListItem::updateValueAndMarkerContent), so resolve it\nthere, and add the one caller that was missing: an image that reports a size once it decodes.\n\n* Source/WebCore/rendering/RenderListOutsideMarker.cpp:\n(WebCore::RenderListOutsideMarker::layout):\n(WebCore::RenderListOutsideMarker::imageChanged):\n(WebCore::RenderListOutsideMarker::updateInlineMarginsAndContent):\n(WebCore::RenderListOutsideMarker::computeIntrinsicLogicalWidthContributions):\n\nCanonical link: https://commits.webkit.org/320624@main\n" }, { "commit": "6d631db91774a727f4b75cfa594b4ff809adeb6c", "tree": "2efc7cd6659990f1faf0be64564aa1c25269f74d", "parents": [ "23f1d29063a8db18bcd50ef9cfab2c40df25c3f0" ], "author": { "name": "Kimmo Kinnunen", "email": "kkinnunen@apple.com", "time": "Mon Sep 07 15:55:05 2026" }, "committer": { "name": "Kimmo Kinnunen", "email": "kkinnunen@apple.com", "time": "Mon Sep 07 15:55:05 2026" }, "message": "DisplayList::RecorderImpl depends on initial state\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323301\nrdar://186549951\n\nReviewed by Taher Ali and Matt Woodrow.\n\nGeneral purpose display list recording was not useful, because the\nthe RecorderImpl had an initial GraphicsContextState and the state\nsetters would elide updates to properties that matched the state.\nThus command like recorder.setFillColor(Color::transparentBlack) would\nnot produce an item because the initial state had black fill color.\n\nFix by adding a property list for unknown properties to\nGraphicsContextState and checking that per property update.\n\nTest: Tools/TestWebKitAPI/Tests/WebCore/DisplayListRecorderTests.cpp\n\n* Source/WebCore/platform/graphics/GraphicsContextState.cpp:\n(WebCore::GraphicsContextState::repurpose):\n(WebCore::GraphicsContextState::mergeLastChanges):\n(WebCore::GraphicsContextState::mergeAllChanges):\n(WebCore::GraphicsContextState::filterLastChangesForMatching):\n(WebCore::GraphicsContextState::propertiesEqualIgnoring const):\n(WebCore::GraphicsContextState::propertiesEqual const): Deleted.\n* Source/WebCore/platform/graphics/GraphicsContextState.h:\n(WebCore::GraphicsContextState::initialIndeterminate):\n(WebCore::GraphicsContextState::indeterminateProperties const):\n(WebCore::GraphicsContextState::markDeterminate):\n(WebCore::GraphicsContextState::setProperty):\n* Source/WebCore/platform/graphics/displaylists/DisplayListRecorder.cpp:\n(WebCore::DisplayList::Recorder::updateStateForRestore):\n(WebCore::DisplayList::Recorder::commitStateChanges):\n(WebCore::DisplayList::Recorder::updateStateForEndTransparencyLayer):\n* Source/WebCore/platform/graphics/displaylists/DisplayListRecorderImpl.h:\n(WebCore::DisplayList::RecorderImpl::RecorderImpl):\n* Tools/TestWebKitAPI/Tests/WebCore/DisplayListRecorderTests.cpp:\n\nCanonical link: https://commits.webkit.org/320623@main\n" }, { "commit": "23f1d29063a8db18bcd50ef9cfab2c40df25c3f0", "tree": "30076362078dabda183fbc1d1baea4a70d9aecf4", "parents": [ "216196ccaf1920f4d83b91b52c54ea5d52901f1d" ], "author": { "name": "Nikolas Zimmermann", "email": "nzimmermann@igalia.com", "time": "Mon Sep 07 14:50:39 2026" }, "committer": { "name": "Nikolas Zimmermann", "email": "zimmermann@kde.org", "time": "Mon Sep 07 14:50:39 2026" }, "message": "SkiaCompositingLayer: layers with filters are always damaged\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d322563\n\nReviewed by Carlos Garcia Campos.\n\nSkiaCompositingLayer::paintWithFilterAndMask added damage in every frame, even\nwhen nothing in the filtered subtree had changed. Only add damage if any\ndescendant of the subtree was damaged, and compute the overlap region only in\nthat case - instead of in every collecting walk.\n\nIf the filter of a static layer changes, its indicated by setFilters(),\nwhich marks the group as changed: collectGroupDamage() is then able to\npick up the change. Animated filters are applied on the compositor side\nby syncAnimations(), which added no damage at all, so add damage there\nwhen the applied filter changes. This also handles the end of an animation,\nwhere the value goes back to the pre-animation state of the layer.\n\nTests: platform/glib/damage/animations-drop-shadow-color.html\n platform/glib/damage/layer-blur-filter.html\n platform/glib/damage/layer-blur-filter-child-change.html\n\n* LayoutTests/platform/glib/damage/animations-drop-shadow-color-expected.txt: Added.\n* LayoutTests/platform/glib/damage/animations-drop-shadow-color.html: Added.\n* LayoutTests/platform/glib/damage/layer-blur-filter-child-change-expected.txt: Added.\n* LayoutTests/platform/glib/damage/layer-blur-filter-child-change.html: Added.\n* LayoutTests/platform/glib/damage/layer-blur-filter-expected.txt: Added.\n* LayoutTests/platform/glib/damage/layer-blur-filter.html: Added.\n* Source/WebCore/platform/graphics/skia/SkiaCompositingLayer.cpp:\n(WebCore::expandByOutsets):\n(WebCore::SkiaCompositingLayer::unclippedFilterOutsets const):\n(WebCore::SkiaCompositingLayer::paintedLayerRect const):\n(WebCore::SkiaCompositingLayer::syncAnimations):\n(WebCore::SkiaCompositingLayer::hasGroupPropertyDamage const):\n(WebCore::SkiaCompositingLayer::hasDamageInSubtree const):\n(WebCore::SkiaCompositingLayer::collectGroupDamage):\n(WebCore::SkiaCompositingLayer::paintWithFilterAndMask):\n(WebCore::SkiaCompositingLayer::computeOverlapRegions):\n* Source/WebCore/platform/graphics/skia/SkiaCompositingLayer.h:\n\nCanonical link: https://commits.webkit.org/320622@main\n" }, { "commit": "216196ccaf1920f4d83b91b52c54ea5d52901f1d", "tree": "7a48029c7f72c4cbdce0501cd6ad5c8342173619", "parents": [ "1517ece5d3861d16062f382f9a84008f9d758de3" ], "author": { "name": "Claudio Saavedra", "email": "csaavedra@igalia.com", "time": "Mon Sep 07 13:38:44 2026" }, "committer": { "name": "Claudio Saavedra", "email": "csaavedra@igalia.com", "time": "Mon Sep 07 13:38:44 2026" }, "message": "[Glib][WebDriver] Step webdriver-test has been running for more than 12 hours\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323599\n\nReviewed by Carlos Alberto Lopez Perez.\n\nA run-webdriver-tests whose asyncio loop has wedged keeps logging the websockets\nkeepalive ping/pong every 20 seconds at DEBUG level, which --verbose enables.\nThat output resets buildbot\u0027s inactivity timeout, so the step ran for 79 hours\non builder 2018 until the container was stopped by hand. Give the step a hard\nlimit like the EWS test steps have.\n\n* Tools/CISupport/build-webkit-org/steps.py:\n(RunWebDriverTests.__init__):\n* Tools/CISupport/build-webkit-org/steps_unittest.py:\n\nCanonical link: https://commits.webkit.org/320621@main\n" }, { "commit": "1517ece5d3861d16062f382f9a84008f9d758de3", "tree": "d8c4f775927ec4d0d2ece2f7488531d13f2a94a5", "parents": [ "b4275c9dce6788211a77414528f990405406fba7" ], "author": { "name": "Alan Baradlay", "email": "zalan@apple.com", "time": "Mon Sep 07 13:10:04 2026" }, "committer": { "name": "Alan Baradlay", "email": "zalan@apple.com", "time": "Mon Sep 07 13:10:04 2026" }, "message": "[css-content] A gradient in the content property paints blank\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323503\nrdar://problem/186742805\n\nReviewed by Sam Weinig.\n\nRenderImage only painted when it had a CachedImage behind it, so a generated image (gradient, cross-fade,\ncanvas) drew the missing image state instead.\n\nTests: imported/w3c/web-platform-tests/css/css-content/pseudo-element-gradient-ref.html\n imported/w3c/web-platform-tests/css/css-content/pseudo-element-gradient.html\n imported/w3c/web-platform-tests/css/css-content/pseudo-element-image-set-ref.html\n imported/w3c/web-platform-tests/css/css-content/pseudo-element-image-set.html\n\n* LayoutTests/TestExpectations:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-content/pseudo-element-gradient-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-content/pseudo-element-gradient-ref.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-content/pseudo-element-gradient.html: Added.\n* Source/WebCore/rendering/RenderImage.cpp:\n(WebCore::RenderImage::isShowingMissingOrImageError const):\n(WebCore::RenderImage::paintReplaced):\n(WebCore::RenderImage::paintIntoRect):\n* Source/WebCore/rendering/RenderImageResource.h:\n(WebCore::RenderImageResource::hasStyleImage const):\n* LayoutTests/imported/w3c/web-platform-tests/css/css-content/pseudo-element-image-set-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-content/pseudo-element-image-set-ref.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-content/pseudo-element-image-set.html: Added.\n\nCanonical link: https://commits.webkit.org/320620@main\n" }, { "commit": "b4275c9dce6788211a77414528f990405406fba7", "tree": "bc0f43827c5ca677fc0de16c5fd513e1bbb3fdb2", "parents": [ "10d4d20f5b6c1db2127d5fb7fd0fae533a092b57" ], "author": { "name": "Kimmo Kinnunen", "email": "kkinnunen@apple.com", "time": "Mon Sep 07 13:02:04 2026" }, "committer": { "name": "Kimmo Kinnunen", "email": "kkinnunen@apple.com", "time": "Mon Sep 07 13:02:04 2026" }, "message": "Remove ipc/invalid-message-to-addTrackBuffer.html\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323296\nrdar://186545140\n\nReviewed by Jean-Yves Avenard.\n\nThe underlying feature was removed in 315963@main.\n\n* LayoutTests/TestExpectations:\n* LayoutTests/ipc/invalid-message-to-addTrackBuffer-expected.txt: Removed.\n* LayoutTests/ipc/invalid-message-to-addTrackBuffer.html: Removed.\n* LayoutTests/platform/mac/TestExpectations:\n\nCanonical link: https://commits.webkit.org/320619@main\n" }, { "commit": "10d4d20f5b6c1db2127d5fb7fd0fae533a092b57", "tree": "c4fc1044d0d0f5f64c160d7bd152f0c7e11bd249", "parents": [ "c51d679f5b96cd35033b1faafd8c0cb8736d0f26" ], "author": { "name": "Sosuke Suzuki", "email": "sosuke@bun.sh", "time": "Mon Sep 07 12:58:33 2026" }, "committer": { "name": "Sosuke Suzuki", "email": "sosuke@bun.com", "time": "Mon Sep 07 12:58:33 2026" }, "message": "[JSC] Folding `Shl` into `WasmAddress` index form can use a locked value\u0027s `Tmp`\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323582\n\nReviewed by Keith Miller.\n\nSince 320441@main the WasmAddress case of effectiveAddr() folds a\npointer-width Shl into the index scale, but unlike the sibling Add and Shl\ncases it does not check m_locked. Blocks are lowered in pre-order, so a Shl\nsitting in an earlier block than the memory access is lowered first, and on\nARM64 a Shl whose child is a single-use BitAnd or ZExt32(Trunc) commits that\nchild internally into a UBFIZ. The fold then asks tmp() for the locked child\nand gets a Tmp no instruction defines, so the access runs on base plus an\nundefined index register while the bounds check still tests the correct\npointer.\n\nSkip the fold when the Shl\u0027s child is locked, matching the Add case; the\naddress then falls back to the Shl\u0027s own Tmp with scale 1.\n\nTests: Source/JavaScriptCore/b3/testb3_1.cpp\n Source/JavaScriptCore/b3/testb3_7.cpp\n\n* Source/JavaScriptCore/b3/B3LowerToAir.cpp:\n* Source/JavaScriptCore/b3/testb3.h:\n* Source/JavaScriptCore/b3/testb3_1.cpp:\n(run):\n* Source/JavaScriptCore/b3/testb3_7.cpp:\n(testWasmAddressScaledIndexWithLockedShlChild):\n\nCanonical link: https://commits.webkit.org/320618@main\n" }, { "commit": "c51d679f5b96cd35033b1faafd8c0cb8736d0f26", "tree": "71551acb0e3b1f1d5e85ced93236d386e2812cf9", "parents": [ "74a82e44aa5d0babaa092c89e93d19d33411186b" ], "author": { "name": "Pawel Lampe", "email": "plampe@igalia.com", "time": "Mon Sep 07 12:15:56 2026" }, "committer": { "name": "Pawel Lampe", "email": "plampe@igalia.com", "time": "Mon Sep 07 12:15:56 2026" }, "message": "[WPE][GTK] transferToImageBitmap broken when offscreen WebGL used with GPUProcess\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323594\n\nReviewed by Carlos Garcia Campos.\n\nThis change marks RemoteGraphicsContextGLProxyGBM::prepareForDisplay()\nexecution properly so that RemoteGraphicsContextGLProxy::copyNativeImage()\nwon\u0027t bail out early.\n\nCanonical link: https://commits.webkit.org/320617@main\n" } ], "next": "74a82e44aa5d0babaa092c89e93d19d33411186b" }