)]}'
{
  "log": [
    {
      "commit": "c3aca8ab0133d23a5dab22681ac48710c149b947",
      "tree": "5c5edbee009c9425341cc152bf37cc0098287f41",
      "parents": [
        "6fd2e01a5273642242a6a11bc3345348eb2b7319"
      ],
      "author": {
        "name": "Nikolas Zimmermann",
        "email": "nzimmermann@igalia.com",
        "time": "Sat Jun 13 10:46:53 2026"
      },
      "committer": {
        "name": "Nikolas Zimmermann",
        "email": "zimmermann@kde.org",
        "time": "Sat Jun 13 10:46:53 2026"
      },
      "message": "[LBSE] Hit-test SVG text per glyph in its SVG coordinate system\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d317072\n\nReviewed by Rob Buis.\n\nRenderSVGText::nodeAtPoint forwarded locationInContainer and accumulatedOffset\nstraight to RenderBlock. That works for the hitTestChildrenInDOMOrderForSVG\npath, which queries only in the Foreground phase with the point already in\nSVG space. But a (force-created) text layer is hit-tested via RenderObject\u0027s\nhitTest(): the point arrives in the layer\u0027s own space with a zero offset, and\nthe Float and ChildBlockBackgrounds phases run too. Since the\ninline text fragments use absolute positions in the element\u0027s SVG coordinate\nsystem, the unshifted point missed every glyph -\u003e on-glyph clicks only appeared\nto work because those extra phases fell back to RenderBlock and hit the text\u0027s\nblock box, which also wrongly claimed off-glyph points inside the box....\n\nThe fix mirrors RenderSVGShape::nodeAtPoint. It bails out unless hitTestAction\nis Foreground, so the block-box phases never run, and expresses the query in\nthe SVG coordinate system by shifting both the location (rect-preserving, so\neventSender rect-based tests keep their tolerance) and the offset by\ncoordinateSystemOriginTranslation (\u003d nominalSVGLayoutLocation -\nadjustedLocation). The forwarded offset becomes nominal - location(), matching\nthe hitTestChildrenInDOMOrderForSVG path.\n\nUnchanged test results in the conditional layer creation mode (not upstream yet),\nand fixes all svg/hittest/text-* + svg/custom/pointer-events-text-css-transform\nwhen forcing layer creation.\n\n* Source/WebCore/rendering/svg/RenderSVGText.cpp:\n(WebCore::RenderSVGText::nodeAtPoint):\n\nCanonical link: https://commits.webkit.org/315172@main\n"
    },
    {
      "commit": "6fd2e01a5273642242a6a11bc3345348eb2b7319",
      "tree": "be4682fb74f6e27c88063d4fc6258dc79db50e00",
      "parents": [
        "21b46f50939e307338b866ac8548e02d98f6a73f"
      ],
      "author": {
        "name": "Nikolas Zimmermann",
        "email": "nzimmermann@igalia.com",
        "time": "Sat Jun 13 09:57:57 2026"
      },
      "committer": {
        "name": "Nikolas Zimmermann",
        "email": "zimmermann@kde.org",
        "time": "Sat Jun 13 09:57:57 2026"
      },
      "message": "[LBSE] Include descendant transforms in SVG visual overflow\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d317071\n\nReviewed by Rob Buis.\n\nThe SVG visual overflow rect ignored the transforms of non-layer\ndescendants. Such a descendant paints directly into its container, so its\ntransformed bounds belong to the container\u0027s overflow. Ignoring them\nunder-sized the box and clipped content whose painted position is shifted by\na nested transformed \u003cg\u003e or nested \u003csvg\u003e with viewBox.\n\nThe fix stops computeVisualOverflowRect from passing IgnoreTransformations so\ndescendant transforms are included, while objectBoundingBoxWithoutTransformations\nkeeps its flattened convention.\n\nBecause computeAccumulatedTransform stops at the parent of stopAtRenderer, it\nbaked that renderer\u0027s own transform into the result - this is necessary for\ngetCTM()/getScreenCTM() but double-counts in the bounding-box recursion once\nthe container is mapped by its parent, so a new StopAtRendererTransform enum\n(default Include) lets that recursion pass Exclude.\n\nFinally, the viewport-container overflow clip is now requested at origin (0,0)\nso it lands in the box\u0027s local space fixing overflow clipping both under\nconditional and forced layer creation.\n\n* Source/WebCore/rendering/svg/SVGBoundingBoxComputation.cpp:\n(WebCore::SVGBoundingBoxComputation::handleRootOrContainer const):\n(WebCore::SVGBoundingBoxComputation::computeVisualOverflowRect):\n* Source/WebCore/rendering/svg/SVGTransformComputation.h:\n(WebCore::SVGTransformComputation::computeAccumulatedTransform const):\n\nCanonical link: https://commits.webkit.org/315171@main\n"
    },
    {
      "commit": "21b46f50939e307338b866ac8548e02d98f6a73f",
      "tree": "0eb2311d82d1546faa4c6d6f92b51b3bc16fc34a",
      "parents": [
        "eff90f74db57d243c062b7ced375361f06da78c0"
      ],
      "author": {
        "name": "Sosuke Suzuki",
        "email": "sosuke@bun.sh",
        "time": "Sat Jun 13 07:31:07 2026"
      },
      "committer": {
        "name": "Sosuke Suzuki",
        "email": "sosuke@bun.com",
        "time": "Sat Jun 13 07:31:07 2026"
      },
      "message": "[JSC] DFG `RegExpSearch` constant folding drops `TypeError` for non-writable lastIndex\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d316496\n\nReviewed by Yusuke Suzuki.\n\nRegExp.prototype[@@search] writes lastIndex (it sets it to 0 and restores it\nafterwards), so it throws a TypeError when lastIndex is not writable. The\nRegExpSearch DFG node speculates on this, but constant folding in\nDFGStrengthReductionPhase dropped that speculation: after tier-up, making\nlastIndex non-writable returned a result instead of throwing. Reachable via\nboth String.prototype.search and RegExp.prototype[Symbol.search].\n\nFix this with a new watchpoint set on JSGlobalObject, fired by\nRegExpObject::defineOwnProperty when a lastIndex is made non-writable. The\nfold just registers the watchpoint, so the generated code is exactly the\nsame as before this change. If the watchpoint has already been invalidated,\nthe fold instead emits a runtime guard that stores lastIndex back to itself,\nwhich exits when lastIndex is not writable.\n\nTests: JSTests/stress/regexp-search-strength-reduction-lastIndex-frozen-mid-execution.js\n       JSTests/stress/regexp-search-strength-reduction-lastIndex-not-writable.js\n\n* JSTests/stress/regexp-search-strength-reduction-lastIndex-frozen-mid-execution.js: Added.\n(shouldBe):\n(shouldThrow):\n(search):\n(benign):\n(shouldThrow.search):\n* JSTests/stress/regexp-search-strength-reduction-lastIndex-not-writable.js: Added.\n(shouldBe):\n(shouldThrow):\n(stringSearch):\n(symbolSearch):\n(lateSearch):\n(nonThrowingSearch):\n* Source/JavaScriptCore/dfg/DFGStrengthReductionPhase.cpp:\n(JSC::DFG::StrengthReductionPhase::handleNode):\n* Source/JavaScriptCore/runtime/JSGlobalObject.cpp:\n(JSC::JSGlobalObject::JSGlobalObject):\n* Source/JavaScriptCore/runtime/JSGlobalObject.h:\n(JSC::JSGlobalObject::regExpLastIndexWritableWatchpointSet):\n* Source/JavaScriptCore/runtime/RegExpObject.cpp:\n(JSC::RegExpObject::defineOwnProperty):\n\nCanonical link: https://commits.webkit.org/315170@main\n"
    },
    {
      "commit": "eff90f74db57d243c062b7ced375361f06da78c0",
      "tree": "aef30408ae21fcfdaa38c4945161acc319faa034",
      "parents": [
        "b1f2174caabb523dc409920affacad770d003514"
      ],
      "author": {
        "name": "Sosuke Suzuki",
        "email": "sosuke@bun.sh",
        "time": "Sat Jun 13 07:20:22 2026"
      },
      "committer": {
        "name": "Sosuke Suzuki",
        "email": "sosuke@bun.com",
        "time": "Sat Jun 13 07:20:22 2026"
      },
      "message": "[JSC] `String#replace`, `String#replaceAll` and `String#split` RegExp paths miss observable side effects\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d316627\n\nReviewed by Yusuke Suzuki.\n\nThis fixes three problems:\n\n1. stringProtoFuncReplace never rechecked isSymbolReplaceFastAndNonObservable()\n   after ToString(this), so its side effects (e.g. overriding\n   RegExp.prototype.exec) were ignored. Recheck, the same way String#search\n   does, via regExpReplaceGeneric extracted from regExpProtoFuncReplace.\n\n2. stringProtoFuncReplaceAll had the same problem. Apply the same fix.\n\n3. The no-@@split fallback in operationStringSplitRegExp evaluated\n   ToString(separator) before ToUint32(limit). The spec evaluates the limit\n   first.\n\nTests: JSTests/stress/dfg-string-split-regexp-no-split-fallback-evaluation-order.js\n       JSTests/stress/string-replace-regexp-fast-path-tostring-side-effects.js\n       JSTests/stress/string-replaceall-regexp-fast-path-tostring-side-effects.js\n\n* JSTests/stress/dfg-string-split-regexp-no-split-fallback-evaluation-order.js: Added.\n(shouldBe):\n(valueOf):\n(re.toString):\n(let.limit.valueOf):\n* JSTests/stress/string-replace-regexp-fast-path-tostring-side-effects.js: Added.\n(shouldBe):\n(throw.new.Error.let.obj.toString.RegExp.prototype.exec):\n(throw.new.Error):\n(shouldBe.RegExp.prototype.exec):\n* JSTests/stress/string-replaceall-regexp-fast-path-tostring-side-effects.js: Added.\n(shouldBe):\n(throw.new.Error):\n(shouldBe.let.obj.toString.RegExp.prototype.exec):\n* Source/JavaScriptCore/dfg/DFGOperations.cpp:\n(JSC::DFG::JSC_DEFINE_JIT_OPERATION):\n* Source/JavaScriptCore/runtime/StringPrototype.cpp:\n(JSC::JSC_DEFINE_HOST_FUNCTION):\n\nCanonical link: https://commits.webkit.org/315169@main\n"
    },
    {
      "commit": "b1f2174caabb523dc409920affacad770d003514",
      "tree": "98f42b32a979a1eb6e6d3fbe4d0d886ec1bf2bb3",
      "parents": [
        "48ce85bc3d81de0f933ccbc2cf280efe67621b6b"
      ],
      "author": {
        "name": "Ben Nham",
        "email": "nham@apple.com",
        "time": "Sat Jun 13 06:45:30 2026"
      },
      "committer": {
        "name": "Ben Nham",
        "email": "nham@apple.com",
        "time": "Sat Jun 13 06:45:30 2026"
      },
      "message": "WKJSHandle keeps documents alive after navigation\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d316933\nrdar://170087117\n\nReviewed by Ryosuke Niwa.\n\nWKJSHandle extends the lifetime of the document it is associated with. This is not intended and can\nlead to unwanted memory accumulation. For instance:\n\n1. WKJSHandle wraps a DOM node, which keeps the DOM node alive forever (due to the strong handle map)\n2. JSNode holds a strong reference to the underlying C++ Node\n3. Node keeps Document alive (through incrementReferencingNodeCount)\n4. Document never dies for the lifetime of WKJSHandle in the UIProcess\n\nInstead, the handle should only live for as long as its associated document. To do this, each\nJSDOMGlobalObject now keeps track of associated handles and adds it to the GC set in its\nvisitChildren.\n\nTests: Tools/TestWebKitAPI/Tests/WebKit/WKWebView/JSHandle.mm\n\n* Source/WebCore/bindings/js/JSDOMGlobalObject.cpp:\n(WebCore::JSDOMGlobalObject::visitChildrenImpl):\n(WebCore::JSDOMGlobalObject::addJSHandle):\n(WebCore::JSDOMGlobalObject::refJSHandle):\n(WebCore::JSDOMGlobalObject::derefJSHandle):\n* Source/WebCore/bindings/js/JSDOMGlobalObject.h:\n* Source/WebCore/page/WebKitJSHandle.cpp:\n(WebCore::handleToGlobalMap):\n(WebCore::globalObjectForIdentifier):\n(WebCore::WebKitJSHandle::jsHandleSentToAnotherProcess):\n(WebCore::WebKitJSHandle::jsHandleDestroyed):\n(WebCore::WebKitJSHandle::objectForIdentifier):\n(WebCore::WebKitJSHandle::WebKitJSHandle):\n(WebCore::handleMap): Deleted.\n* Source/WebCore/page/WebKitJSHandle.h:\n* Source/WebKit/UIProcess/API/Cocoa/WKPreferences.mm:\n(-[WKPreferences _setUsesPageCache:]):\n(-[WKPreferences _usesPageCache]):\n* Source/WebKit/UIProcess/API/Cocoa/WKPreferencesPrivate.h:\n* Source/WebKit/UIProcess/API/Cocoa/WKWebViewPrivateForTesting.h:\n* Source/WebKit/UIProcess/API/Cocoa/WKWebViewTesting.mm:\n(-[WKWebView _numberOfLiveDocumentsForTesting:]):\n* Source/WebKit/UIProcess/WebPageProxyTesting.cpp:\n(WebKit::WebPageProxyTesting::numberOfLiveDocuments):\n* Source/WebKit/UIProcess/WebPageProxyTesting.h:\n* Source/WebKit/WebProcess/WebPage/WebFrame.cpp:\n(WebKit::nodeFromJSHandleIdentifier):\n* Source/WebKit/WebProcess/WebPage/WebPageTesting.cpp:\n(WebKit::WebPageTesting::numberOfLiveDocuments):\n* Source/WebKit/WebProcess/WebPage/WebPageTesting.h:\n* Source/WebKit/WebProcess/WebPage/WebPageTesting.messages.in:\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/JSHandle.mm:\n(TestWebKitAPI::TEST(JSHandle, Basic)):\n(TestWebKitAPI::TEST(JSHandle, HandleDoesNotKeepDocumentAliveAfterNavigation)):\n\nCanonical link: https://commits.webkit.org/315168@main\n"
    },
    {
      "commit": "48ce85bc3d81de0f933ccbc2cf280efe67621b6b",
      "tree": "8e4bb228d5614ea1ffc7105128e3ecefdff1a661",
      "parents": [
        "82b8665ef1c3c2c4ec385d1cab7132e3e71056e6"
      ],
      "author": {
        "name": "Claudio Saavedra",
        "email": "csaavedra@igalia.com",
        "time": "Sat Jun 13 06:30:31 2026"
      },
      "committer": {
        "name": "Claudio Saavedra",
        "email": "csaavedra@igalia.com",
        "time": "Sat Jun 13 06:30:31 2026"
      },
      "message": "Non-unified build fixes for June 13th, 2026\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d317066\n\nUnreviewed build fixes.\n\n* Source/WebCore/html/FallbackPopupMenu.cpp:\n\nCanonical link: https://commits.webkit.org/315167@main\n"
    },
    {
      "commit": "82b8665ef1c3c2c4ec385d1cab7132e3e71056e6",
      "tree": "87033eb5bc8c29c01aa04e3c1f8bbbb08baa634b",
      "parents": [
        "ef55119cddcbf08cf5e71d11d79edd6c7d5bbfbd"
      ],
      "author": {
        "name": "Yusuke Suzuki",
        "email": "ysuzuki@apple.com",
        "time": "Sat Jun 13 04:42:12 2026"
      },
      "committer": {
        "name": "Yusuke Suzuki",
        "email": "ysuzuki@apple.com",
        "time": "Sat Jun 13 04:42:12 2026"
      },
      "message": "[JSC] Use UCAL_TZ_TRANSITION_PREVIOUS_INCLUSIVE in getNamedTimeZoneEpochNanoseconds\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d317058\nrdar://179540818\n\nReviewed by Yijia Huang.\n\nWhen you ask Temporal to resolve a wall-clock datetime in a named time zone,\nJSC asks ICU what UTC instant that local time corresponds to. ICU does this\nthrough a calendar object: set the wall fields, read back ucal_getMillis.\nCompute the offset at that instant. If icuEpochMs + offset \u003d\u003d localMs, the\nlocal time is valid (single candidate, normal case). If they don\u0027t match,\nthe local time does not exist, so it falls in a DST spring-forward gap\n(so that time does not exist in the world!!!), and the spec says we need to\nrecord the two bracket offsets (pre-gap beforeNs, post-gap afterNs) so\ndisambiguation later can pick which side to land on.\n\nTo obtain beforeNs, we need the offset of the era immediately before this gap.\nThe current code\u0027s strategy:\n\n1. ucal_setMillis(cal, icuEpochMs) - point the calendar at the gap.\n2. ucal_getTimeZoneTransitionDate(cal, UCAL_TZ_TRANSITION_PREVIOUS, ...) - find the transition that opened this gap.\n3. Read the offset 1ms earlier (transitionMs - 1.0) — that\u0027s the pre-gap offset.\n\nBut UCAL_TZ_TRANSITION_PREVIOUS is strictly less than the calendar\u0027s current millis.\nSo if the current time is exact point of this boundary, we will not get\nthat time point.\n\nThis patch fixes a bug with UCAL_TZ_TRANSITION_PREVIOUS_INCLUSIVE.\n\nTest: JSTests/stress/temporal-zdt-apia-dateline-gap.js\n\n* JSTests/stress/temporal-zdt-apia-dateline-gap.js: Added.\n(shouldBe):\n(shouldThrowRangeError):\n* Source/JavaScriptCore/runtime/temporal/core/TimeZoneICUBridge.cpp:\n(JSC::TemporalCore::getNamedTimeZoneEpochNanoseconds):\n\nCanonical link: https://commits.webkit.org/315166@main\n"
    },
    {
      "commit": "ef55119cddcbf08cf5e71d11d79edd6c7d5bbfbd",
      "tree": "31c5bdd1ec4804993c3a3ed7033d659c3be64a1c",
      "parents": [
        "eb5b87025b457ab132440561374b8e2508f0ae03"
      ],
      "author": {
        "name": "Marta Darbinyan",
        "email": "darbinyan@apple.com",
        "time": "Sat Jun 13 04:10:00 2026"
      },
      "committer": {
        "name": "Marta Darbinyan",
        "email": "darbinyan@apple.com",
        "time": "Sat Jun 13 04:10:00 2026"
      },
      "message": "[Gardening]: [macOS x86_64] imported/w3c/web-platform-tests/css/css-images tests are image diff failures\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d317061\nrdar://179543881\n\nUnreviewed test gardening\n\n* LayoutTests/platform/mac-wk2/TestExpectations:\n\nCanonical link: https://commits.webkit.org/315165@main\n"
    },
    {
      "commit": "eb5b87025b457ab132440561374b8e2508f0ae03",
      "tree": "b124cfb57aa446cda98094ea9d06fea1702b5d51",
      "parents": [
        "a9810613686c552010aa8877434aae64943f4a1d"
      ],
      "author": {
        "name": "Sihui Liu",
        "email": "sihui_liu@apple.com",
        "time": "Sat Jun 13 04:06:41 2026"
      },
      "committer": {
        "name": "Sihui Liu",
        "email": "sihui_liu@apple.com",
        "time": "Sat Jun 13 04:06:41 2026"
      },
      "message": "Remove dumpResourceResponseMIMETypes from InjectedBundle/TestRunner.h\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d317032\nrdar://179518087\n\nReviewed by Per Arne Vollan.\n\n`dumpResourceResponseMIMETypes` was removed from TestRunner.idl when `dumpResourceResponseMIMETypes` became a\nwebkit-test-runner directive instead of a JS testRunner API for Site Isolation support (314790@main); and\nthe `dumpResourceResponseMIMETypes` functions in TestRunner.h have become dead code.\n\n* Tools/WebKitTestRunner/InjectedBundle/TestRunner.h:\n(WTR::TestRunner::dumpProgressFinishedCallback):\n(WTR::TestRunner::shouldDumpProgressFinishedCallback const):\n(WTR::TestRunner::dumpResourceResponseMIMETypes): Deleted.\n(WTR::TestRunner::resourceResponseMIMETypesToDump const): Deleted.\n\nCanonical link: https://commits.webkit.org/315164@main\n"
    },
    {
      "commit": "a9810613686c552010aa8877434aae64943f4a1d",
      "tree": "ca1238856fbe6f734d45d1de5d6e7ad329f85b5b",
      "parents": [
        "df9b96dca12de3103a34bee078f72a562c95a041"
      ],
      "author": {
        "name": "Sihui Liu",
        "email": "sihui_liu@apple.com",
        "time": "Sat Jun 13 04:04:54 2026"
      },
      "committer": {
        "name": "Sihui Liu",
        "email": "sihui_liu@apple.com",
        "time": "Sat Jun 13 04:04:54 2026"
      },
      "message": "Use requesting origin instead of active origin for DeviceOrientation permission request\nrdar://168597925\n\nReviewed by Chris Dumez.\n\nThe current implementation uses active origin (origin being navigating to) instead of requesting origin in permission\nprompt, and this might lead to permission being granted to a wrong origin.\n\nAPI test: DeviceOrientation.PermissionOriginDuringPendingNavigation\n\n* Source/WebCore/page/Frame.cpp:\n* Source/WebKit/Shared/FrameInfoData.cpp:\n(WebKit::legacyEmptyFrameInfo):\n* Source/WebKit/Shared/FrameInfoData.h:\n* Source/WebKit/Shared/FrameInfoData.serialization.in:\n* Source/WebKit/UIProcess/Cocoa/UIDelegate.mm:\n(WebKit::UIDelegate::UIClient::shouldAllowDeviceOrientationAndMotionAccess):\n* Source/WebKit/UIProcess/ProvisionalPageProxy.cpp:\n(WebKit::ProvisionalPageProxy::cancel):\n* Source/WebKit/UIProcess/WebsiteData/WebDeviceOrientationAndMotionAccessController.cpp:\n(WebKit::WebDeviceOrientationAndMotionAccessController::shouldAllowAccess):\n* Source/WebKit/WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp:\n(WebKit::WebFrameLoaderClient::navigationActionData const):\n* Source/WebKit/WebProcess/WebPage/WebFrame.cpp:\n(WebKit::WebFrame::info const):\n* Source/WebKit/WebProcess/WebPage/WebPage.cpp:\n(WebKit::WebPage::getFrameTreeForBackForwardCacheEntry):\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/DeviceOrientation.mm:\n((DeviceOrientation, PermissionOriginDuringPendingNavigation)):\n\nOriginally-landed-as: 305413.367@rapid/safari-7624.2.5.110-branch (322ddc5). rdar://176067147\nCanonical link: https://commits.webkit.org/315163@main\n"
    },
    {
      "commit": "df9b96dca12de3103a34bee078f72a562c95a041",
      "tree": "bde821af144b968cfad74033586108114f7fceb0",
      "parents": [
        "56a333e3cbe184825524ba8566a737c31caef31f"
      ],
      "author": {
        "name": "Charlie Wolfe",
        "email": "charliew@apple.com",
        "time": "Sat Jun 13 03:24:23 2026"
      },
      "committer": {
        "name": "Charlie Wolfe",
        "email": "charliew@apple.com",
        "time": "Sat Jun 13 03:24:23 2026"
      },
      "message": "Possible null dereference in `CredentialsContainer::preventSilentAccess`\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d317045\nrdar://179526084\n\nReviewed by Aditya Keerthi.\n\n* Source/WebCore/Modules/credentialmanagement/CredentialsContainer.cpp:\n(WebCore::CredentialsContainer::preventSilentAccess const):\n\nCanonical link: https://commits.webkit.org/315162@main\n"
    },
    {
      "commit": "56a333e3cbe184825524ba8566a737c31caef31f",
      "tree": "a2bebf84a19e8304224a9e3b97bdfe0e10fa9f85",
      "parents": [
        "f2a866573ce590d22793c2a16af29b27558743e0"
      ],
      "author": {
        "name": "Marta Darbinyan",
        "email": "darbinyan@apple.com",
        "time": "Sat Jun 13 03:03:25 2026"
      },
      "committer": {
        "name": "Marta Darbinyan",
        "email": "darbinyan@apple.com",
        "time": "Sat Jun 13 03:03:25 2026"
      },
      "message": "[gardening]: [macOS release] imported/w3c/web-platform-tests/web-locks/acquire.https.any.sharedworker.html is flaky crash\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d317031\nrdar://179515644\n\nUnreviewed test gardening\n\n* LayoutTests/platform/mac-wk2/TestExpectations:\n\nCanonical link: https://commits.webkit.org/315161@main\n"
    },
    {
      "commit": "f2a866573ce590d22793c2a16af29b27558743e0",
      "tree": "71695e57c09dcbe182e4a89113b5d92eeb8913c2",
      "parents": [
        "5ec3ee11b4e748352b0d658bf9e98113a91ed172"
      ],
      "author": {
        "name": "Geoffrey Garen",
        "email": "ggaren@apple.com",
        "time": "Sat Jun 13 02:23:04 2026"
      },
      "committer": {
        "name": "Geoffrey Garen",
        "email": "ggaren@apple.com",
        "time": "Sat Jun 13 02:23:04 2026"
      },
      "message": "[Build Speed] Header hygiene: Include What You Use\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d317035\nrdar://179518779\n\nReviewed by Mike Wyrzykowski and Brandon Stewart.\n\nThis prevents surprising build failures when adding / move files, or when the\nCMake adaptive unified build decides to build in \"no bundle\" mode.\n\nCanonical link: https://commits.webkit.org/315160@main\n"
    },
    {
      "commit": "5ec3ee11b4e748352b0d658bf9e98113a91ed172",
      "tree": "d1db9abb049b3ca82e76dfe0ff59b191ab6e4df4",
      "parents": [
        "a484a181f9e1dbb3ff49ace9819f4d7f8756c97d"
      ],
      "author": {
        "name": "Per Arne Vollan",
        "email": "pvollan@apple.com",
        "time": "Sat Jun 13 01:48:36 2026"
      },
      "committer": {
        "name": "Per Arne Vollan",
        "email": "pvollan@apple.com",
        "time": "Sat Jun 13 01:48:36 2026"
      },
      "message": "Move sandbox extension check related to local file loads from the WebContent process to the Networking process\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d309315\nrdar://171855309\n\nReviewed by Sihui Liu and Darin Adler.\n\nThis patch moves the check from the WebContent process to the Networking process, since the check\nin the WebContent process can be circumvented.\n\nTests: Tools/TestWebKitAPI/Tests/WebKit/WKPage/cocoa/FetchLocalFile.mm\n\n* Source/WTF/wtf/FileSystem.cpp:\n(WTF::FileSystemImpl::removeTrailingSlash):\n(WTF::FileSystemImpl::isAncestor):\n* Source/WTF/wtf/FileSystem.h:\n* Source/WTF/wtf/PlatformEnableCocoa.h:\n* Source/WebKit/NetworkProcess/NetworkProcess.h:\n* Source/WebKit/NetworkProcess/NetworkProcessCreationParameters.h:\n* Source/WebKit/NetworkProcess/NetworkProcessCreationParameters.serialization.in:\n* Source/WebKit/NetworkProcess/NetworkResourceLoadParameters.cpp:\n(WebKit::NetworkResourceLoadParameters::createSandboxExtensionHandlesIfNecessary):\n(WebKit::networkProcessHasAccessViaSandboxExtension): Deleted.\n* Source/WebKit/NetworkProcess/NetworkResourceLoadParameters.h:\n* Source/WebKit/NetworkProcess/NetworkResourceLoader.cpp:\n(WebKit::NetworkResourceLoader::isLocalFileLoadAllowedWithoutSandboxExtension):\n(WebKit::NetworkResourceLoader::startNetworkLoad):\n* Source/WebKit/NetworkProcess/NetworkResourceLoader.h:\n* Source/WebKit/NetworkProcess/cocoa/NetworkProcessCocoa.mm:\n(WebKit::NetworkProcess::platformInitializeNetworkProcessCocoa):\n* Source/WebKit/Shared/WebProcessCreationParameters.h:\n* Source/WebKit/Shared/WebProcessCreationParameters.serialization.in:\n* Source/WebKit/UIProcess/Cocoa/WebProcessPoolCocoa.mm:\n(WebKit::WebProcessPool::platformInitializeWebProcess):\n* Source/WebKit/UIProcess/Network/NetworkProcessProxy.cpp:\n(WebKit::NetworkProcessProxy::sendCreationParametersToNewProcess):\n* Source/WebKit/WebProcess/Network/WebLoaderStrategy.cpp:\n(WebKit::WebLoaderStrategy::scheduleLoadFromNetworkProcess):\n* Source/WebKit/WebProcess/WebProcess.h:\n* Source/WebKit/WebProcess/cocoa/WebProcessCocoa.mm:\n(WebKit::WebProcess::accessibilityFocusedUIElement):\n* Tools/TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:\n* Tools/TestWebKitAPI/Tests/WebKit/WKPage/cocoa/FetchLocalFile.mm:\n(TEST(WebKit, FetchLocalFile)):\n(TEST(WebKit, FetchLocalFileFromTempDirectory)):\n\nCanonical link: https://commits.webkit.org/315159@main\n"
    },
    {
      "commit": "a484a181f9e1dbb3ff49ace9819f4d7f8756c97d",
      "tree": "556a92acc6033ee097a53b73450adb44978741b5",
      "parents": [
        "720fc1082286802ee65af48d21b4a5dbac84ef5b"
      ],
      "author": {
        "name": "Justin Michaud",
        "email": "jmichaud@igalia.com",
        "time": "Sat Jun 13 01:34:16 2026"
      },
      "committer": {
        "name": "Justin Michaud",
        "email": "jmichaud@igalia.com",
        "time": "Sat Jun 13 01:34:16 2026"
      },
      "message": "Support pleiades on linux\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d316861\n\nReviewed by Yusuke Suzuki.\n\nThis is a small workaround to get pleiades working on linux.\n\nCanonical link: https://commits.webkit.org/315158@main\n"
    },
    {
      "commit": "720fc1082286802ee65af48d21b4a5dbac84ef5b",
      "tree": "f149ed55e73b18c87b58ec115906d87b9164c80b",
      "parents": [
        "a0e66562a406842faba3ce1ef40acc671cf0a1f7"
      ],
      "author": {
        "name": "Ahmad Saleem",
        "email": "ahmad.saleem792+github@gmail.com",
        "time": "Sat Jun 13 01:27:46 2026"
      },
      "committer": {
        "name": "Ahmad Saleem",
        "email": "ahmad.saleem792@gmail.com",
        "time": "Sat Jun 13 01:27:46 2026"
      },
      "message": "Synthetic bold adds advance width to zero-advance glyphs\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d316951\nrdar://179418570\n\nReviewed by Darin Adler and Brent Fulgham.\n\nThis patch aligns WebKit with Gecko / Firefox and Blink / Chromium.\n\nSynthetic bold padded every glyph\u0027s advance by syntheticBoldOffset()\n(fontSize / 36), including glyphs whose real advance is 0 (combining\nmarks, zero-width spaces, empty/zero-width fonts). A run of such glyphs\nmeasured N * fontSize / 36 wide instead of 0, e.g. a bold heading in a\nzero-advance font reserved a visible gap not present in other engines.\n\nA zero-advance glyph draws in place and must not advance the pen.\nLetter-spacing already guards this with `if (advance.width())`; apply the\nsame guard to synthetic bold in both text paths. The simplified-measuring\npath asserts no synthetic bold, so it needs no change.\n\nTest: css/css-fonts/synthetic-bold-zero-advance-glyph.html\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-fonts/synthetic-bold-zero-advance-glyph-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-fonts/synthetic-bold-zero-advance-glyph.html: Added.\n(WebCore::ComplexTextController::enclosingGlyphBoundsForTextRun):\n* Source/WebCore/platform/graphics/WidthIterator.cpp:\n(WebCore::WidthIterator::applyCSSVisibilityRules):\n\nCanonical link: https://commits.webkit.org/315157@main\n"
    },
    {
      "commit": "a0e66562a406842faba3ce1ef40acc671cf0a1f7",
      "tree": "c6190490927967b4eb4323bb044b7201fe947e45",
      "parents": [
        "3a451b677717137eaa41e5831f6372862213d766"
      ],
      "author": {
        "name": "Sammy Gill",
        "email": "sammy.gill@apple.com",
        "time": "Sat Jun 13 01:02:16 2026"
      },
      "committer": {
        "name": "Sammy Gill",
        "email": "sgill26@apple.com",
        "time": "Sat Jun 13 01:02:16 2026"
      },
      "message": "[GFC] Layout out-of-flow descendants in the modern grid path\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d316727\nrdar://179129558\n\nReviewed by Alan Baradlay.\n\nOne of the things that we currently bail on when deciding whether or not\nwe can run layout via GFC is if any of the children of the grid are out\nof flow. If we find such a box then we decide that we cannot run GFC.\nOne scenario we currently fail to take into consideration is when some\nout of flow descendant ends up having the grid as the containing block.\nUnfortunately, this results in that box not running layout which means a\ncrash in debug builds due to a dirty render tree at the end of layout\nand blank content in release.\n\nTo fix this we can call back into the old layoutOutOfFlowBoxes API on\nRenderGrid during integration. In order to properly due so we need to\nmake sure the renderer has its columns and rows positions set correctly\nso that it can map any positions the OOF box may have to the correct\nlocation in the grid.\n\nAlso fix the grid container height not being set for the definite block-axis case in\nupdateFormattingContextRootRenderer, which caused positioned descendants to compute\nincorrect containing block sizes since they relied on the renderer\u0027s\nheight. We already did this in the case where the grid had an\nindefinite/intrinsic height but did not when it was fixed.\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-grid/abspos/positioned-grid-descendant-containing-block-001-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-grid/abspos/positioned-grid-descendant-containing-block-001.html: Added.\nOne explicit row and column. Descendant has auto row and column\nplacement with fixed width and height.\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-grid/abspos/positioned-grid-descendant-containing-block-002-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-grid/abspos/positioned-grid-descendant-containing-block-002.html: Added.\nSame as 001 but the descendant is a bit more nested.\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-grid/abspos/positioned-grid-descendant-containing-block-003-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-grid/abspos/positioned-grid-descendant-containing-block-003.html: Added.\nOne explicit row and column. Descendant has auto row and column\nplacement along with percent width and height.\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-grid/abspos/positioned-grid-descendant-containing-block-004-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-grid/abspos/positioned-grid-descendant-containing-block-004.html: Added.\nTwo explicit rows and columns. Descendant has auto row and column\nplacement along with auto width and height. It also has 0 for the top\nand left insets and 100px for the right and bottom insets.\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-grid/abspos/positioned-grid-descendant-containing-block-005-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-grid/abspos/positioned-grid-descendant-containing-block-005.html: Added.\nSame as 004 but 0 for all the insets.\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-grid/abspos/positioned-grid-descendant-containing-block-006-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-grid/abspos/positioned-grid-descendant-containing-block-006.html: Added.\nTwo explicit columns and one explicit row. Descendant has auto row\nplacement with column placement specified as span 2 / span 3. According\nto the spec this should be treated as auto. Also has percent width and\nheight.\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-grid/abspos/positioned-grid-descendant-containing-block-007-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-grid/abspos/positioned-grid-descendant-containing-block-007.html: Added.\nTwo explicit columns and one explicit row. Descendant has auto row\nplacement along with column placement that spans outside the grid which\nshould be treated as auto according to the spec. Also has percent width\nand height.\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-grid/abspos/positioned-grid-descendant-containing-block-008-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-grid/abspos/positioned-grid-descendant-containing-block-008.html: Added.\nOne explicit column and row along with padding on the grid. Descendant\nhas auto row and column placement with percent width and height.\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-grid/abspos/positioned-grid-descendant-containing-block-009-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-grid/abspos/positioned-grid-descendant-containing-block-009.html: Added.\nOne explicit column and row along with padding on the grid. Descendant\nhas explicit row and column placement with percent width and height.\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-grid/abspos/positioned-grid-descendant-containing-block-010-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-grid/abspos/positioned-grid-descendant-containing-block-010.html: Added.\nTwo explicit columns and rows along with padding on the grid. Descendant\nhas explicit placement in the first row and column along with percent\nwidth and height.\n\nTests 011-013 exercise similar to the above but with auto height on the\ngrid.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-grid/abspos/positioned-grid-descendant-containing-block-011-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-grid/abspos/positioned-grid-descendant-containing-block-011.html: Added.\nOne fixed column and row. Descendant has auto rows and columns along\nwith percent width and height.\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-grid/abspos/positioned-grid-descendant-containing-block-012-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-grid/abspos/positioned-grid-descendant-containing-block-012.html: Added.\nOne fixed column and row and padding on the grid. Desendant has auto\nrow and columns with percent width and height.\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-grid/abspos/positioned-grid-descendant-containing-block-013-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-grid/abspos/positioned-grid-descendant-containing-block-013.html: Added.\nTwo fixed rows and columns along with padding. Descendant has explicit\nrow and column position in the first row and column. Also has percent\nwidth and height.\n\nTests 014-016 are similar to above but are testing items that span\nmultiple rows/columns.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-grid/abspos/positioned-grid-descendant-containing-block-014.html: Added.\nTwo fixed row and columns. Descendant is placed in two columns and one\nrow.\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-grid/abspos/positioned-grid-descendant-containing-block-015.html: Added.\nTwo fixed rows and columns. Descendant is placed in one column and two\nrows.\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-grid/abspos/positioned-grid-descendant-containing-block-016.html: Added.\nTwo fixed rows and columns. Descendant is placed in both rows and\ncolumns.\n\nCanonical link: https://commits.webkit.org/315156@main\n"
    },
    {
      "commit": "3a451b677717137eaa41e5831f6372862213d766",
      "tree": "76e2f1dd3a1e82e87fabb5255fd244e7cc639dff",
      "parents": [
        "623c0e15657a220517d692c021c36f39f2ae74a5"
      ],
      "author": {
        "name": "Mike Wyrzykowski",
        "email": "mwyrzykowski@apple.com",
        "time": "Sat Jun 13 00:58:25 2026"
      },
      "committer": {
        "name": "Mike Wyrzykowski",
        "email": "mwyrzykowski@apple.com",
        "time": "Sat Jun 13 00:58:25 2026"
      },
      "message": "Transforming the camera instead of the model leads to undesirable lighting effects\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d317040\nrdar://179522538\n\nUnreviewed, revert of 312407@main\n\n* Source/WebKit/GPUProcess/graphics/Model/ModelRenderer.swift:\n(ImplicitFragmentInPlace.setBackgroundColor(_:)):\n(ImplicitFragmentInPlace.setCameraTransformForModelTransform(_:)): Deleted.\n* Source/WebKit/GPUProcess/graphics/Model/USDModel.swift:\n(WKBridgeReceiver.meshTransforms):\n(WKBridgeReceiver.modelTransform):\n(render(with:commandBuffer:)):\n(updateMesh(_:)):\n(setTransform(_:)):\n\nCanonical link: https://commits.webkit.org/315155@main\n"
    },
    {
      "commit": "623c0e15657a220517d692c021c36f39f2ae74a5",
      "tree": "0533298952a735bde1c5543cb2b631ee9cb002c3",
      "parents": [
        "c9fd2061194516867d04c3219d9dfe078ecdd1cc"
      ],
      "author": {
        "name": "Fady Farag",
        "email": "com.webkit.iidmsa@gmail.com",
        "time": "Sat Jun 13 00:22:05 2026"
      },
      "committer": {
        "name": "Fady Farag",
        "email": "com.webkit.iidmsa@gmail.com",
        "time": "Sat Jun 13 00:22:05 2026"
      },
      "message": "Add WebKit logo on `perf.webkit.org`\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d315816\nrdar://178203077\n\nReviewed by Dewei Zhu.\n\nAdopt the refreshed WebKit logo design into the website.\n\n* Websites/perf.webkit.org/public/apple-touch-icon.png: Added.\n* Websites/perf.webkit.org/public/favicon.ico: Added.\n* Websites/perf.webkit.org/public/favicon.png: Added.\n* Websites/perf.webkit.org/public/index.html:\n* Websites/perf.webkit.org/public/v2/index.html:\n* Websites/perf.webkit.org/public/v3/index.html:\n\nCanonical link: https://commits.webkit.org/315154@main\n"
    },
    {
      "commit": "c9fd2061194516867d04c3219d9dfe078ecdd1cc",
      "tree": "ad5c634a0a0ffd97c6f1657b35fd6ef261a0f97f",
      "parents": [
        "88998f5c20c9a9ed2363bfa4367581529086f140"
      ],
      "author": {
        "name": "Mike Wyrzykowski",
        "email": "mwyrzykowski@apple.com",
        "time": "Fri Jun 12 23:24:49 2026"
      },
      "committer": {
        "name": "Mike Wyrzykowski",
        "email": "mwyrzykowski@apple.com",
        "time": "Fri Jun 12 23:24:49 2026"
      },
      "message": "Unreviewed, build fix after 315139@main\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d317043\nrdar://179524986\n\nUnreviewed, build fix after 315139@main\n\n* Source/WebKit/WebProcess/Model/WebModelPlayer.mm:\n(WebKit::WebModelPlayer::reload):\n\nCanonical link: https://commits.webkit.org/315153@main\n"
    },
    {
      "commit": "88998f5c20c9a9ed2363bfa4367581529086f140",
      "tree": "ac668a66df480c202b75442b18ba436d919c5808",
      "parents": [
        "4401bf8b0133fd4f34e2f8f7004daf92fc9ff6db"
      ],
      "author": {
        "name": "Alex Christensen",
        "email": "achristensen@apple.com",
        "time": "Fri Jun 12 23:11:31 2026"
      },
      "committer": {
        "name": "Alex Christensen",
        "email": "achristensen@apple.com",
        "time": "Fri Jun 12 23:11:31 2026"
      },
      "message": "Remove WKJSHandle serialization code\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d316953\nrdar://179416806\n\nReviewed by Ryosuke Niwa.\n\n_WKJSHandle was the SPI prototype, and it had serialization code to\nwork with _WKRemoteObjectRegistry to help Safari transition away from\nthe injected bundle SPI.  That transition code is no longer needed,\nso remove it.  We keep the SPI as just a stub to keep old Safari running\nwith new WebKit.\n\nTests: Tools/TestWebKitAPI/Tests/WebKit/WKWebView/JSHandlePlugIn.mm\n       Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolation.mm\n       Tools/TestWebKitAPI/Tests/WebKit/WKWebView/TextExtractionTests.mm\n       Tools/TestWebKitAPI/Tests/WebKit/WKWebView/WKWebViewSnapshot.mm\n       Tools/TestWebKitAPI/Tests/WebKit/WKWebView/WritingTools.mm\n\n* Source/WebKit/UIProcess/API/APIJSHandle.cpp:\n(API::JSHandle::~JSHandle):\n* Source/WebKit/UIProcess/API/APIJSHandle.h:\n* Source/WebKit/UIProcess/API/Cocoa/WKJSHandle.mm:\n(-[WKJSHandle initWithCoder:]): Deleted.\n(-[WKJSHandle encodeWithCoder:]): Deleted.\n(+[_WKJSHandle supportsSecureCoding]):\n(-[_WKJSHandle initWithCoder:]):\n(-[_WKJSHandle encodeWithCoder:]): Deleted.\n* Source/WebKit/UIProcess/API/Cocoa/_WKJSHandle.h:\n* Source/WebKit/WebProcess/InjectedBundle/API/Cocoa/WKWebProcessPlugInFrame.mm:\n(+[WKWebProcessPlugInFrame jsHandleFromValue:withContext:]):\n* Source/WebKit/WebProcess/InjectedBundle/API/Cocoa/WKWebProcessPlugInFramePrivate.h:\n* Tools/TestWebKitAPI/PlatformMac.cmake:\n* Tools/TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/JSHandlePlugIn.mm:\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/JSHandlePlugInProtocol.h: Removed.\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/TextExtractionTests.mm:\n(-[JSHandleReceiver receiveDictionaryFromWebProcess:]): Deleted.\n(TestWebKitAPI::InjectedBundle)):\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/WritingTools.mm:\n\nCanonical link: https://commits.webkit.org/315152@main\n"
    },
    {
      "commit": "4401bf8b0133fd4f34e2f8f7004daf92fc9ff6db",
      "tree": "029c4120b5dc8397394b6fc21c145ecbf5165e0c",
      "parents": [
        "67f1900d8045336f14fcfa70940ea97fbb22b6f1"
      ],
      "author": {
        "name": "Yusuke Suzuki",
        "email": "ysuzuki@apple.com",
        "time": "Fri Jun 12 23:09:29 2026"
      },
      "committer": {
        "name": "Yusuke Suzuki",
        "email": "ysuzuki@apple.com",
        "time": "Fri Jun 12 23:09:29 2026"
      },
      "message": "[JSC] Reland global liveness MovHint removal\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d316804\nrdar://179252499\n\nReviewed by Yijia Huang.\n\nThe previous attempt at this (295369@main) was reverted because removing\npruneByLiveness from the OSR availability iteration loop caused a bug,\nstale heap entries (whose base nodes have a valid stack flush via PutStackSinking,\nso they no longer need materialization) would accumulate in availabilityAtHead\nand reach FTLs buildExitArguments, where they crash the \"Could not find\nmaterialization\" assertion. That fix needs more work and is left for a\nseparate change.\n\nThis patch only relands the MovHint removal improvement. The phase now\nperforms a global backward liveness analysis instead of the prior\nsingle-successor-walk heuristic.\n\n* Source/JavaScriptCore/dfg/DFGMovHintRemovalPhase.cpp:\n\nCanonical link: https://commits.webkit.org/315151@main\n"
    },
    {
      "commit": "67f1900d8045336f14fcfa70940ea97fbb22b6f1",
      "tree": "2db4cb7f43bc62d2b7ee6a46531d87f01990b826",
      "parents": [
        "c39df7216dbe6d88871b5e3ced55096c090ff27c"
      ],
      "author": {
        "name": "Wenson Hsieh",
        "email": "wenson_hsieh@apple.com",
        "time": "Fri Jun 12 23:06:19 2026"
      },
      "committer": {
        "name": "Wenson Hsieh",
        "email": "wenson_hsieh@apple.com",
        "time": "Fri Jun 12 23:06:19 2026"
      },
      "message": "[Automatic Password Upgrades] Web process sometimes crashes when mapping stale node ID to JS handle\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d317014\nrdar://179507309\n\nReviewed by Abrar Rahman Protyasha.\n\nAdd a missing null check for the document\u0027s `globalObject`, before attempting to resolve it to a\nnode handle.\n\nTest: TextExtractionTests.RequestJSHandleForNodeInDetachedSubframe\n\n* Source/WebKit/WebProcess/WebPage/WebFrame.cpp:\n(WebKit::createJSHandle):\n(WebKit::WebFrame::createAndPrepareToSendJSHandle const):\n(WebKit::WebFrame::requestJSHandleForExtractedText):\n(WebKit::WebFrame::requestContainerJSHandleForExtractedText):\n(WebKit::WebFrame::requestContainerJSHandleForSearchTexts):\n(WebKit::WebFrame::getNodeForSelectorPaths):\n* Source/WebKit/WebProcess/WebPage/WebFrame.h:\n* Source/WebKit/WebProcess/WebPage/WebPage.cpp:\n(WebKit::WebPage::hitTestAtPoint):\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/TextExtractionTests.mm:\n(TestWebKitAPI::RequestJSHandleForNodeInDetachedSubframe)):\n\nCanonical link: https://commits.webkit.org/315150@main\n"
    },
    {
      "commit": "c39df7216dbe6d88871b5e3ced55096c090ff27c",
      "tree": "e88923751dec44edab2e9c1cac5cb15431f8fb90",
      "parents": [
        "9414a9722a8439557c0c3972eec476dc922a1566"
      ],
      "author": {
        "name": "Karl Dubost",
        "email": "karlcow@apple.com",
        "time": "Fri Jun 12 23:05:40 2026"
      },
      "committer": {
        "name": "Karl Dubost",
        "email": "karlcow@apple.com",
        "time": "Fri Jun 12 23:05:40 2026"
      },
      "message": "rename rendering/svg/SVGPathData.{h,cpp} to SVGPathFromElement.{h,cpp}\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d316966\nrdar://179478197\n\nReviewed by Nikolas Zimmermann.\n\nThis just renames SVGPathData to SVGPathFromElement to avoid\na name clash when it is time to implement Mixin SVGPathData.\nhttps://w3c.github.io/svgwg/specs/paths/#InterfaceSVGPathData\n\n* Source/WebCore/SaferCPPExpectations/UncheckedLocalVarsCheckerExpectations:\n* Source/WebCore/Sources.txt:\n* Source/WebCore/WebCore.xcodeproj/project.pbxproj:\n* Source/WebCore/rendering/PathOperation.cpp:\n* Source/WebCore/rendering/svg/RenderSVGModelObject.cpp:\n* Source/WebCore/rendering/svg/RenderSVGShape.cpp:\n* Source/WebCore/rendering/svg/RenderSVGTextPath.cpp:\n* Source/WebCore/rendering/svg/SVGPathFromElement.cpp: Renamed from Source/WebCore/rendering/svg/SVGPathData.cpp.\n(WebCore::pathFromCircleElement):\n(WebCore::pathFromEllipseElement):\n(WebCore::pathFromLineElement):\n(WebCore::pathFromPathElement):\n(WebCore::pathFromPolygonElement):\n(WebCore::pathFromPolylineElement):\n(WebCore::pathFromRectElement):\n(WebCore::pathFromUseElement):\n(WebCore::pathFromGraphicsElement):\n* Source/WebCore/rendering/svg/SVGPathFromElement.h: Renamed from Source/WebCore/rendering/svg/SVGPathData.h.\n* Source/WebCore/rendering/svg/legacy/LegacyRenderSVGShape.cpp:\n* Source/WebCore/svg/SVGAnimateMotionElement.cpp:\n* Source/WebCore/svg/SVGGraphicsElement.cpp:\n\nCanonical link: https://commits.webkit.org/315149@main\n"
    },
    {
      "commit": "9414a9722a8439557c0c3972eec476dc922a1566",
      "tree": "dc014d9c2f4b1beaff4444dd4e5453cf129d3841",
      "parents": [
        "4705fbbff35e8b996b2b5451f4112f151a2fdd70"
      ],
      "author": {
        "name": "Ryosuke Niwa",
        "email": "rniwa@webkit.org",
        "time": "Fri Jun 12 23:04:38 2026"
      },
      "committer": {
        "name": "Ryosuke Niwa",
        "email": "rniwa@webkit.org",
        "time": "Fri Jun 12 23:04:38 2026"
      },
      "message": "REGRESSION: Use-after-free in Node::m_shadowIncludingRoot via destructor cascade not propagating into shadow roots\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d312712\nrdar://175103172\n\nReviewed by Geoffrey Garen.\n\nWhen a document is torn down via Document::removedLastRef through removeDetachedChildrenInContainer,\nthe \u003chtml\u003e element is removed from the document. Since \u003chtml\u003e is still in tree scope at this point,\nnotifyChildNodeRemoved is called, which walks the entire subtree - including shadow roots - and sets\nm_shadowIncludingRoot to \u003chtml\u003e for all descendants. This is correct at that moment.\n\nThen \u003chtml\u003e is freed when the loop\u0027s RefPtr releases it (children don\u0027t ref-count their parents -\nm_parentNode is CheckedPtr). This triggers a destructor cascade: ~ContainerNode(\u003chtml\u003e) via\nremoveDetachedChildrenInContainer(\u003chtml\u003e) processes \u003cbody\u003e, then ~ContainerNode(\u003cbody\u003e) processes\nthe \u003cvideo\u003e element, and so on. Each step calls resetShadowIncludingRoot() on the direct child,\nfixing that node\u0027s cache. However, since IsConnected and IsInShadowTree flags were cleared during\nthe initial notifyChildNodeRemoved walk, isInTreeScope() returns false, so notifyChildNodeRemoved\nis skipped in this case. This means the shadow root and its descendants are never updated -\nm_shadowIncludingRoot of these nodes still point to the now-freed \u003chtml\u003e.\n\nNodes kept alive by mechanisms other than JS wrappers - such as HTMLMediaElement which survives as\nan ActiveDOMObject - retain their shadow DOM with dangling m_shadowIncludingRoot pointers. When\nthese nodes are subsequently used (e.g., VTT cue display tree updates via an event loop task), the\nstale pointer is dereferenced, causing an use-after-free.\n\nThis PR fixes this use-after-free bug by updating m_shadowIncludingRoot for removed subtrees when\nthe root\u0027s refCount is greater than 1 (i.e. there is an external reference to the node beyond the\nRefPtr in removeDetachedChildrenInContainer).\n\nNo new tests since existing media tests such as media/track/webvtt-parser-does-not-leak.html would\nhit debug assertions without this fix, and this bug requires a node to be kept alive by C++ code.\n\n* Source/WebCore/dom/ContainerNodeAlgorithms.cpp:\n(WebCore::removeDetachedChildrenInContainer):\n* Source/WebCore/dom/Node.cpp:\n(WebCore::Node::updateShadowIncludingRootForSubtree):\n* Source/WebCore/dom/Node.h:\n\nOriginally-landed-as: 305413.700@safari-7624-branch (5d07bda85f02). rdar://176059252\nCanonical link: https://commits.webkit.org/315148@main\n"
    },
    {
      "commit": "4705fbbff35e8b996b2b5451f4112f151a2fdd70",
      "tree": "72c42730bfd1df7255bd7f09cb77b7cd6215c726",
      "parents": [
        "6edbf3f983bd75b1ca65ebecdf0c812b404b48d5"
      ],
      "author": {
        "name": "Brent Fulgham",
        "email": "bfulgham@apple.com",
        "time": "Fri Jun 12 23:03:59 2026"
      },
      "committer": {
        "name": "Brent Fulgham",
        "email": "bfulgham@webkit.org",
        "time": "Fri Jun 12 23:03:59 2026"
      },
      "message": "Split JSDOMWindow.cpp into smaller bits to improve build parallelism\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d316818\nrdar://179292668\n\nReviewed by Geoffrey Garen.\n\nOne a decent M2 Ultra build, JSDOMWindow.cpp is taking roughly 40 seconds to compile. This\nis happening at the tail end of the WebCore step of the build, and is blocking linking and\nfurther build steps from starting. This represents ~17 seconds of wasted time since only a\nsingle core is working, and other tasks are blocked.\n\nWe can improve matters by splitting this single large compilation unit into smaller pieces\nthat can build in parallel.\n\nThis change shortened overall build time be ~75 seconds on a local build since more\npost-WebCore work was able to start earlier.\n\n* Source/WebCore/CMakeLists.txt:\n* Source/WebCore/DerivedSources-output.xcfilelist:\n* Source/WebCore/Sources.txt:\n* Source/WebCore/WebCore.xcodeproj/project.pbxproj:\n* Source/WebCore/WebCoreMacros.cmake:\n* Source/WebCore/bindings/scripts/CodeGenerator.pm:\n(new):\n(IgnoreStandaloneConstructorAttributes):\n* Source/WebCore/bindings/scripts/CodeGeneratorJS.pm:\n(AddToImplIncludes):\n(AddToAuxImplIncludes):\n(UseStandaloneConstructorAttributes):\n(GenerateRuntimeEnableConditionalString):\n(GenerateAttributeGetterAndSetterDeclaration):\n(GenerateAttributeGetterDefinition):\n(WriteData):\n* Source/WebCore/bindings/scripts/IDLAttributes.json:\n* Source/WebCore/bindings/scripts/generate-bindings-all.pl:\n(spawnGenerateBindingsIfNeeded):\n* Source/WebCore/bindings/scripts/generate-bindings.pl:\n(generateBindings):\n* Source/WebCore/bindings/scripts/test/DOMWindow.idl:\n* Source/WebCore/bindings/scripts/test/JS/JSDOMWindow.cpp:\n(WebCore::JSDOMWindowDOMConstructor::prototypeForStructure):\n(WebCore::jsDOMWindow_DOMWindowConstructorGetter): Deleted.\n(WebCore::jsDOMWindow_ExposedStarConstructorGetter): Deleted.\n(WebCore::jsDOMWindow_ExposedToWorkerAndWindowConstructorGetter): Deleted.\n(WebCore::jsDOMWindow_TestConditionalConstructorGetter): Deleted.\n(WebCore::jsDOMWindow_TestConditionalIncludesConstructorGetter): Deleted.\n(WebCore::jsDOMWindow_TestConditionallyReadWriteConstructorGetter): Deleted.\n(WebCore::jsDOMWindow_TestDefaultToJSONConstructorGetter): Deleted.\n(WebCore::jsDOMWindow_TestDefaultToJSONFilteredByExposedConstructorGetter): Deleted.\n(WebCore::jsDOMWindow_TestEnabledBySettingConstructorGetter): Deleted.\n(WebCore::jsDOMWindow_TestEnabledForContextConstructorGetter): Deleted.\n(WebCore::jsDOMWindow_TestInterfaceConstructorGetter): Deleted.\n(WebCore::jsDOMWindow_TestNodeConstructorGetter): Deleted.\n(WebCore::jsDOMWindow_TestObjectConstructorGetter): Deleted.\n(WebCore::jsDOMWindow_TestPromiseRejectionEventConstructorGetter): Deleted.\n* Source/WebCore/bindings/scripts/test/JS/JSDOMWindowConstructorAttributes.cpp: Added.\n(WebCore::jsDOMWindow_DOMWindowConstructorGetter):\n(WebCore::JSC_DEFINE_CUSTOM_GETTER):\n(WebCore::jsDOMWindow_ExposedStarConstructorGetter):\n(WebCore::jsDOMWindow_ExposedToWorkerAndWindowConstructorGetter):\n(WebCore::jsDOMWindow_TestConditionalConstructorGetter):\n(WebCore::jsDOMWindow_TestConditionalIncludesConstructorGetter):\n(WebCore::jsDOMWindow_TestConditionallyReadWriteConstructorGetter):\n(WebCore::jsDOMWindow_TestDefaultToJSONConstructorGetter):\n(WebCore::jsDOMWindow_TestDefaultToJSONFilteredByExposedConstructorGetter):\n(WebCore::jsDOMWindow_TestEnabledBySettingConstructorGetter):\n(WebCore::jsDOMWindow_TestEnabledForContextConstructorGetter):\n(WebCore::jsDOMWindow_TestInterfaceConstructorGetter):\n(WebCore::jsDOMWindow_TestNodeConstructorGetter):\n(WebCore::jsDOMWindow_TestObjectConstructorGetter):\n(WebCore::jsDOMWindow_TestPromiseRejectionEventConstructorGetter):\n* Source/WebCore/bindings/scripts/test/JS/JSTestEnabledForContext.cpp:\n* Source/WebCore/page/DOMWindow.idl:\n\nCanonical link: https://commits.webkit.org/315147@main\n"
    },
    {
      "commit": "6edbf3f983bd75b1ca65ebecdf0c812b404b48d5",
      "tree": "bbef9dc3c48418a2d0464ca8a434342c7d393168",
      "parents": [
        "7f60f0c0ee1d8d2594f04fca8b875305409a7e33"
      ],
      "author": {
        "name": "Karl Dubost",
        "email": "karlcow@apple.com",
        "time": "Fri Jun 12 22:52:39 2026"
      },
      "committer": {
        "name": "Karl Dubost",
        "email": "karlcow@apple.com",
        "time": "Fri Jun 12 22:52:39 2026"
      },
      "message": "Differential text-alignment while stretching\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d61855\nrdar://94161279\n\nReviewed by Nikolas Zimmermann.\n\nWhen an SVG \u003ctext\u003e or \u003ctspan\u003e carries a list-valued x or y attribute,\nWebKit splits its content into one chunk per listed value. Each\nSVGTextChunk independently carried the element\u0027s textLength and applied\nlengthAdjust\u003d\"spacingAndGlyphs\" on its own, so every glyph was scaled to\nfill the full target length — the glyphs piled up on top of each other\nand rendered as a horizontal black bar.\n\nFirefox and Chrome render it correctly.\n\nSVG 2 §11.10 scopes textLength to \"this element\": \"the adjustments on\nall character data within this element are controlled by the value of\n\u0027textLength\u0027 on this element exclusively\". Apply\nlengthAdjust\u003d\"spacingAndGlyphs\" once across the group of chunks that\nshare an owning text content element: compute one scale and one pivot\nover the group, write a single transform to every box in every chunk,\nand skip per-chunk textLength application for the group. Single-chunk\nelements (the common case) keep the existing fast path unchanged.\n\nThree related cases remain unhandled and are pinned with FIXME + WPT:\n* lengthAdjust\u003d\"spacing\" with list-valued x/y,\n* nested \u003ctspan textLength\u003e inside \u003ctext textLength\u003e,\n* and the inline-size / forced-line-break guards that per §11.10 disable\n  textLength entirely.\n\nTests: imported/w3c/web-platform-tests/svg/text/reftests/textLength-list-x-spacingAndGlyphs-expected.svg\n       imported/w3c/web-platform-tests/svg/text/reftests/textLength-list-x-spacingAndGlyphs-ref.svg\n       imported/w3c/web-platform-tests/svg/text/reftests/textLength-list-x-spacingAndGlyphs.svg\n       imported/w3c/web-platform-tests/svg/text/reftests/textLength-list-y-spacing-expected.svg\n       imported/w3c/web-platform-tests/svg/text/reftests/textLength-list-y-spacing-ref.svg\n       imported/w3c/web-platform-tests/svg/text/reftests/textLength-list-y-spacing.svg\n       imported/w3c/web-platform-tests/svg/text/reftests/textLength-list-y-spacingAndGlyphs-expected.svg\n       imported/w3c/web-platform-tests/svg/text/reftests/textLength-list-y-spacingAndGlyphs-ref.svg\n       imported/w3c/web-platform-tests/svg/text/reftests/textLength-list-y-spacingAndGlyphs.svg\n\n* LayoutTests/TestExpectations:\n* LayoutTests/imported/w3c/web-platform-tests/svg/text/reftests/textLength-list-x-spacingAndGlyphs-expected.svg: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/text/reftests/textLength-list-x-spacingAndGlyphs-ref.svg: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/text/reftests/textLength-list-x-spacingAndGlyphs.svg: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/text/reftests/textLength-list-y-spacing-expected.svg: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/text/reftests/textLength-list-y-spacing-ref.svg: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/text/reftests/textLength-list-y-spacing.svg: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/text/reftests/textLength-list-y-spacingAndGlyphs-expected.svg: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/text/reftests/textLength-list-y-spacingAndGlyphs-ref.svg: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/text/reftests/textLength-list-y-spacingAndGlyphs.svg: Added.\n* Source/WebCore/rendering/svg/SVGTextChunk.cpp:\n(WebCore::SVGTextChunk::SVGTextChunk):\n(WebCore::SVGTextChunk::layout const):\n* Source/WebCore/rendering/svg/SVGTextChunk.h:\n* Source/WebCore/rendering/svg/SVGTextChunkBuilder.cpp:\n(WebCore::SVGTextChunkBuilder::layoutTextChunks):\n(WebCore::SVGTextChunkBuilder::applyElementLevelTextLength):\n* Source/WebCore/rendering/svg/SVGTextChunkBuilder.h:\n\nCanonical link: https://commits.webkit.org/315146@main\n"
    },
    {
      "commit": "7f60f0c0ee1d8d2594f04fca8b875305409a7e33",
      "tree": "90de519ec7806cf027a3a3f214ffccc09cc5f194",
      "parents": [
        "adb3736972fd2ba8dab6ad3de8dc6a0c0406f4be"
      ],
      "author": {
        "name": "Keith Miller",
        "email": "keith_miller@apple.com",
        "time": "Fri Jun 12 22:47:29 2026"
      },
      "committer": {
        "name": "Keith Miller",
        "email": "keith_miller@apple.com",
        "time": "Fri Jun 12 22:47:29 2026"
      },
      "message": "[JSC] Remove extra prints from JSTests\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d317027\nrdar://179512404\n\nReviewed by Yusuke Suzuki and Brandon Stewart.\n\nCanonical link: https://commits.webkit.org/315145@main\n"
    },
    {
      "commit": "adb3736972fd2ba8dab6ad3de8dc6a0c0406f4be",
      "tree": "920c51eed29998d5ae8b625a87d55c92dd832045",
      "parents": [
        "0ac4fe29c728f3a1e8de18ffeac88c3b18c6d40a"
      ],
      "author": {
        "name": "Vassili Bykov",
        "email": "v_bykov@apple.com",
        "time": "Fri Jun 12 22:33:53 2026"
      },
      "committer": {
        "name": "Vassili Bykov",
        "email": "v_bykov@apple.com",
        "time": "Fri Jun 12 22:33:53 2026"
      },
      "message": "Mark myself (ast-hugger) as a reviewer\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d317024\nrdar://179510585\n\nReviewed by Dan Hecht, Keith Miller, and Pascoe.\n\nUpdating my status after receiving the approval.\n\n* metadata/contributors.json:\n\nCanonical link: https://commits.webkit.org/315144@main\n"
    },
    {
      "commit": "0ac4fe29c728f3a1e8de18ffeac88c3b18c6d40a",
      "tree": "7ee1d10646511d354fea66a9e48000071eb7b5bc",
      "parents": [
        "c7fe05eb98f63f711766aa2822520c8557a1f404"
      ],
      "author": {
        "name": "Jonathan Bedard",
        "email": "jbedard@apple.com",
        "time": "Fri Jun 12 22:22:13 2026"
      },
      "committer": {
        "name": "Jonathan Bedard",
        "email": "jbedard@apple.com",
        "time": "Fri Jun 12 22:22:13 2026"
      },
      "message": "Exclude glib from Apple builds\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d317033\nrdar://179518299\n\nReviewed by Ryan Haddad.\n\n* .submitproject-append:\n\nCanonical link: https://commits.webkit.org/315143@main\n"
    },
    {
      "commit": "c7fe05eb98f63f711766aa2822520c8557a1f404",
      "tree": "13bdbaaae0a904a155f3dbec36fc34cb3f9e21e0",
      "parents": [
        "d32378b4f5840ea927aaa9ac15f1811fdbb1e8a4"
      ],
      "author": {
        "name": "Kai Tamkun",
        "email": "k_tamkun@apple.com",
        "time": "Fri Jun 12 21:52:40 2026"
      },
      "committer": {
        "name": "Kai Tamkun",
        "email": "k_tamkun@apple.com",
        "time": "Fri Jun 12 21:52:40 2026"
      },
      "message": "[JSC] ToBoolean/TypeOfIsUndefined/TypeOfIsFunction/TypeOf/CompareEq def value in DFGClobberize doesn\u0027t depend on node\u0027s origin.semantic\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d311663\nrdar://173924142\n\nReviewed by Marcus Plutowski.\n\nThe semantics of operations like `typeof` are realm-dependent when the input has the\n`MasqueradesAsUndefined` flag set. This patch prevents constant folding of these\nexpressions if they have different realms to preserve the semantics.\n\nAdded regress-173924142.js to ensure that the operations behave as expected even across realms.\n\n* JSTests/stress/regress-173924142.js: Added.\n(assert):\n(otherGlobal.eval.returnMultipleValues):\n(returnMultipleValues):\n(i.returnMultipleValues):\n(otherGlobalMasqueraderAfter.const.property.of.Object.getOwnPropertyNames):\n* Source/JavaScriptCore/dfg/DFGClobberize.h:\n(JSC::DFG::clobberize):\n\nOriginally-landed-as: 305413.657@rapid/safari-7624.2.5.110-branch (882fc55c5e17). rdar://176058724\nCanonical link: https://commits.webkit.org/315142@main\n"
    },
    {
      "commit": "d32378b4f5840ea927aaa9ac15f1811fdbb1e8a4",
      "tree": "ded5a34723107243cb343ff7c970e7e46bbe35d2",
      "parents": [
        "98f8025ff153e48d4d98f10eff44cf462b079ce2"
      ],
      "author": {
        "name": "Sihui Liu",
        "email": "sihui_liu@apple.com",
        "time": "Fri Jun 12 21:45:37 2026"
      },
      "committer": {
        "name": "Sihui Liu",
        "email": "sihui_liu@apple.com",
        "time": "Fri Jun 12 21:45:37 2026"
      },
      "message": "[Site Isolation] Multiple layout tests are crashing due to assertion failure: frame-\u003epage() \u003d\u003d this\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d316417\nrdar://178830885\n\nReviewed by Charlie Wolfe.\n\nUnder Site Isolation, frames of the same page can be hosted in different processes and frame state updates are async:\nweb process hosting the frame \u003d\u003e UI process \u003d\u003e other web processes hosting the same frame remotely.\nThere is a race where a web process detaches a frame locally before handling an in-flight state update message from\nanother process. For example, the process hosting the parent frame removes an iframe element via JavaScript (e.g.\ndocument.write()), which detaches the frame synchronously — but UIProcess has already forwarded a state update for that\nframe, which arrives after the detach. In this case it is safe to ignore the update, since the frame will be destroyed\nsoon.\n\nReplace ASSERT(frame-\u003epage() \u003d\u003d this) with early returns to handle this race. The exception is\nframeWasRemovedInAnotherProcess, where markAsRemovedInAnotherProcess() must still run unconditionally to prevent a\nspurious DidDestroyFrame from being sent to UIProcess when the frame is later destroyed locally.\n\n* Source/WebKit/WebProcess/WebPage/WebPage.cpp:\n(WebKit::WebPage::didFinishLoadInAnotherProcess):\n(WebKit::WebPage::frameWasRemovedInAnotherProcess):\n(WebKit::WebPage::allFrameTreeSyncDataChangedInAnotherProcess):\n(WebKit::WebPage::createProvisionalFrame):\n(WebKit::WebPage::loadDidCommitInAnotherProcess):\n\nCanonical link: https://commits.webkit.org/315141@main\n"
    },
    {
      "commit": "98f8025ff153e48d4d98f10eff44cf462b079ce2",
      "tree": "c17472cd7f68722738ae76ea0e280f290ecdded4",
      "parents": [
        "0ff66663ddfcbc432925828ff2cd0522a22fb5de"
      ],
      "author": {
        "name": "Brandon Stewart",
        "email": "brandonstewart@apple.com",
        "time": "Fri Jun 12 21:41:49 2026"
      },
      "committer": {
        "name": "Brandon Stewart",
        "email": "brandonstewart@apple.com",
        "time": "Fri Jun 12 21:41:49 2026"
      },
      "message": "[css-grid] Import css/css-grid WPT tests 2026-06-12\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d316999\nrdar://179498013\n\nReviewed by Alan Baradlay.\n\nRe-import the css/css-grid web-platform-tests suite from upstream. This\nrefreshes 2013 tests (1360 reftests, 624 JS, 29 crash, 29 pixel/manual)\nagainst the latest upstream revision: it adds new subgrid gap and\ntrack-sizing coverage plus a grid-repeat out-of-bounds crash test, and\nmigrates two extra-margin references from XHTML to HTML.\n\nFour newly imported/updated subgridded-to-grid-lanes reftests fail with\nsmall reference image diffs (~1-2%) and are marked ImageOnlyFailure\nunder the existing tracking bug webkit.org/b/316453:\n  - gap/column-subgrid-grid-gap-015.html\n  - gap/row-subgrid-grid-gap-015.html\n  - track-sizing/column-subgrid-extra-margin-005.html\n  - track-sizing/row-subgrid-extra-margin-005.html\n\nUpstream commit: https://github.com/web-platform-tests/wpt/commit/d8a8414e5baa2d680a4f57d40fa3aa01dffcf7aa\n\nCanonical link: https://commits.webkit.org/315140@main\n"
    },
    {
      "commit": "0ff66663ddfcbc432925828ff2cd0522a22fb5de",
      "tree": "8a77090e35f04dd49cb322f680b35f01ad73203c",
      "parents": [
        "57942aeaf17b188b5a02a73cc2e05d5697a10ba9"
      ],
      "author": {
        "name": "Jean Haberer",
        "email": "jean.haberer@apple.com",
        "time": "Fri Jun 12 21:39:32 2026"
      },
      "committer": {
        "name": "Jean Haberer",
        "email": "jean.haberer@apple.com",
        "time": "Fri Jun 12 21:39:32 2026"
      },
      "message": "Increase memory limit for immersive models\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d316994\nrdar://171065710\n\nReviewed by Mike Wyrzykowski.\n\nReload the entity at a higher memory limit when entering immersive\npresentation, and back at the standard limit on exit.\n\n* Source/WebCore/Modules/model-element/HTMLModelElement.cpp:\n* Source/WebCore/Modules/model-element/ModelPlayer.h:\n* Source/WebCore/Modules/model-element/PlaceholderModelPlayer.cpp:\n* Source/WebCore/Modules/model-element/PlaceholderModelPlayer.h:\n* Source/WebCore/Modules/model-element/dummy/DummyModelPlayer.cpp:\n* Source/WebCore/Modules/model-element/dummy/DummyModelPlayer.h:\n* Source/WebKit/WebProcess/Model/ModelProcessModelPlayer.cpp:\n* Source/WebKit/WebProcess/Model/ModelProcessModelPlayer.h:\n* Source/WebKit/WebProcess/Model/WebModelPlayer.h:\n* Source/WebKit/WebProcess/Model/WebModelPlayer.mm:\nPlumb the signal that informs the model process of the initial immersive\npresentation state for the first load of the model.\n\n* Source/WebKit/ModelProcess/ModelConnectionToWebProcess.cpp:\n* Source/WebKit/ModelProcess/ModelConnectionToWebProcess.h:\n* Source/WebKit/ModelProcess/ModelProcess.cpp:\n* Source/WebKit/ModelProcess/ModelProcess.h:\n* Source/WebKit/ModelProcess/ModelProcessCreationParameters.h:\n* Source/WebKit/ModelProcess/ModelProcessCreationParameters.serialization.in:\n* Source/WebKit/ModelProcess/ModelProcessModelPlayerManagerProxy.cpp:\n* Source/WebKit/UIProcess/Model/cocoa/ModelProcessProxyCocoa.mm:\nAdd the debug default for the immersive memory limit.\n\n* Source/WebKit/ModelProcess/cocoa/ModelProcessModelPlayerProxy.h:\n* Source/WebKit/ModelProcess/cocoa/ModelProcessModelPlayerProxy.messages.in:\n* Source/WebKit/ModelProcess/cocoa/ModelProcessModelPlayerProxy.mm:\nAdd the logic that unloads and reloads the entity with the right\nmemory limit if needed.\n\nCanonical link: https://commits.webkit.org/315139@main\n"
    },
    {
      "commit": "57942aeaf17b188b5a02a73cc2e05d5697a10ba9",
      "tree": "69632d06c3a8f22217e0d67934cf95699edc6d53",
      "parents": [
        "29b8b63ffbbe6f9d33fb5f474d4029f08b58217e"
      ],
      "author": {
        "name": "Zak Ridouh",
        "email": "zakr@apple.com",
        "time": "Fri Jun 12 21:19:14 2026"
      },
      "committer": {
        "name": "Zak Ridouh",
        "email": "zakr@apple.com",
        "time": "Fri Jun 12 21:19:14 2026"
      },
      "message": "[Site Isolation] BlurFocusedElement is broken when the focused element is inside a cross-origin iframe on iOS\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d310061\nrdar://172704039\n\nReviewed by Abrar Rahman Protyasha.\n\nblurFocusedElement() sends the BlurFocusedElement IPC message to\nlegacyMainFrameProcess(), which is the wrong process when the focused\nelement lives in a site-isolated cross-origin iframe.\n\nPass the focused element\u0027s frame identifier through to\nsendToProcessContainingFrame(), matching the pattern already used by\nSetFocusedElementValue, SetFocusedElementSelectedIndex, and\nSetSelectElementIsOpen.\n\n* LayoutTests/http/tests/site-isolation/blur-focused-element-cross-origin-iframe-expected.txt: Added.\n* LayoutTests/http/tests/site-isolation/blur-focused-element-cross-origin-iframe.html: Added.\n* LayoutTests/http/tests/site-isolation/resources/blur-input-iframe.html: Added.\n* Source/WebKit/UIProcess/WebPageProxy.cpp:\n* Source/WebKit/UIProcess/WebPageProxy.h:\n* Source/WebKit/UIProcess/ios/WKContentViewInteraction.mm:\n(-[WKContentView endEditingAndUpdateFocusAppearanceWithReason:]):\n(-[WKContentView focusedFormControlViewDidSubmit:]):\n(-[WKContentView focusedFormControlViewDidCancel:]):\n(-[WKContentView dismissQuickboardViewControllerAndRevealFocusedFormOverlayIfNecessary:]):\n* Source/WebKit/UIProcess/ios/WebPageProxyIOS.mm:\n(WebKit::WebPageProxy::blurFocusedElement):\n\nCanonical link: https://commits.webkit.org/315138@main\n"
    },
    {
      "commit": "29b8b63ffbbe6f9d33fb5f474d4029f08b58217e",
      "tree": "5885acaf2f200161dfeba8f039f1954d0c0e7649",
      "parents": [
        "0ea898a2ff9f4b6605ffaf93891267858f1b5e71"
      ],
      "author": {
        "name": "Zak Ridouh",
        "email": "zakr@apple.com",
        "time": "Fri Jun 12 21:14:16 2026"
      },
      "committer": {
        "name": "Zak Ridouh",
        "email": "zakr@apple.com",
        "time": "Fri Jun 12 21:14:16 2026"
      },
      "message": "[Site Isolation] Remove now passing page-cache tests from Test Expectations\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d316937\nrdar://179405847\n\nReviewed by Alex Christensen.\n\nThese back/forward-cache tests now pass under site isolation; remove their\nstale [ Failure ] entries from the mac and iOS site-isolation expectations.\n\n* LayoutTests/platform/ios-site-isolation/TestExpectations:\n* LayoutTests/platform/mac-site-isolation/TestExpectations:\n\nCanonical link: https://commits.webkit.org/315137@main\n"
    },
    {
      "commit": "0ea898a2ff9f4b6605ffaf93891267858f1b5e71",
      "tree": "06e25f22e48c11d5c9770780c4790b8e900f05b8",
      "parents": [
        "b0c4b5139e34076a28ee6d9b59ba5cf0871e22a4"
      ],
      "author": {
        "name": "Yulun Wu",
        "email": "yulun_wu@apple.com",
        "time": "Fri Jun 12 20:56:31 2026"
      },
      "committer": {
        "name": "Yulun Wu",
        "email": "yulun_wu@apple.com",
        "time": "Fri Jun 12 20:56:31 2026"
      },
      "message": "[GFC] Grid items ignore row-gap/column-gap\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d316923\n\u003crdar://179385621\u003e\n\nReviewed by Sammy Gill.\n\nThis PR fixes two off by one errors that caused grid items to be mispositioned\nand/or oversized with row/column gap set.\n\ncomputeGridLinePosition accumulates grid track sizes and grid gaps up to line X\nand should include X gutters, not x-1 gutters.\n\ngridAreaDimensionSize from grid lines start to end was incorrectly counting\nspan (end - start) gutters when it should be counting span - 1 gutters.\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-grid/alignment/grid-gutters-explicit-placement-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-grid/alignment/grid-gutters-explicit-placement.html: Added.\n* Source/WebCore/layout/formattingContexts/grid/GridLayoutUtils.cpp:\n(WebCore::Layout::GridLayoutUtils::computeGridLinePosition):\n(WebCore::Layout::GridLayoutUtils::gridAreaDimensionSize):\n\nCanonical link: https://commits.webkit.org/315136@main\n"
    },
    {
      "commit": "b0c4b5139e34076a28ee6d9b59ba5cf0871e22a4",
      "tree": "e6ff337c0238706ac686eff71231ff43aa96a193",
      "parents": [
        "23df7d03b8f7f9bbff942638be9b54f2631266fb"
      ],
      "author": {
        "name": "Keith Miller",
        "email": "keith_miller@apple.com",
        "time": "Fri Jun 12 20:51:20 2026"
      },
      "committer": {
        "name": "Keith Miller",
        "email": "keith_miller@apple.com",
        "time": "Fri Jun 12 20:51:20 2026"
      },
      "message": "[CMake] LowLevelInterpreterLib shouldn\u0027t serialize with the rest of JSC\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d316869\nrdar://179296313\n\nReviewed by Geoffrey Garen.\n\nEvery JavaScriptCore translation unit was waiting for LLIntAssembly.h\ngeneration before it could begin compiling, even though only\nLowLevelInterpreter.cpp uses the header.\n\nThe serialization came from two CMake behaviors combining:\n\n1. LLIntAssembly.h was listed as a source of LowLevelInterpreterLib,\n    which put it into the target\u0027s compile-ordering phony.\n2. Consuming the target as $\u003cTARGET_OBJECTS:...\u003e propagated that\n    phony as an order-only dependency to JavaScriptCore\u0027s compile-\n    ordering phony, which all of its unified sources transitively\n    depend on.\n\nInstead of adding LowLevelInterpreterLib as a SOURCE link against the\nobject file as a PRIVATE_LIBRARY by name. LowLevelInterpreter.cpp.o\nstill has a direct file-level dependency on LLIntAssembly.h, but no\npropagation reaches JavaScriptCore, so unified sources can compile in\nparallel with offlineasm.\n\nCanonical link: https://commits.webkit.org/315135@main\n"
    },
    {
      "commit": "23df7d03b8f7f9bbff942638be9b54f2631266fb",
      "tree": "720a17b82a82f56ad11b4974b36fb32f6e2b7424",
      "parents": [
        "c329236d6f8eb05d72d0aa0d262fbac2b4cb602d"
      ],
      "author": {
        "name": "Sammy Gill",
        "email": "sammy.gill@apple.com",
        "time": "Fri Jun 12 20:43:05 2026"
      },
      "committer": {
        "name": "Sammy Gill",
        "email": "sgill26@apple.com",
        "time": "Fri Jun 12 20:43:05 2026"
      },
      "message": "amazon.design: bottom of navigation menu is clipped on devices with certain viewports\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d306649\nrdar://169307770\n\nReviewed by Brent Fulgham.\n\nOn certain types of iOS devices, particularly Pro Max phones,\nthe bottom portion of the navigation menu gets obscured by Safari\u0027s navigation\ntoolbar. The page\u0027s navigation bar content is a flex item with margin-top:\nauto inside a flexbox that has a height based off 100vh. It seems likes\nthere are some offests that are subtracted from the 100vh in an attempt\nto make sure the content is placed correctly since the auto top margin\npushes the content to the bottom.\n\nHowever, it does not seem like this is enough since on the aforementioned\ndevices the bottom of the \"Amazon Log In,\" text ends up getting hidden by\nSafari\u0027s toolbar. The reason is does not seem to reproduce on Pro devices\nis because those devices have a narrower viewport and second line is\ncreated after the log in text. This line is created because there is a\nSVG that appears after the text that does not fit on the line. That\npushes the \"Amazon Log In,\" text a bit up and what ends up happening is\nthe SVG ends up getting clicked. In fact, if you set the viewport\ndimensions to the same dimensions as a Pro device on other browsers you\nend up getting the same layout. However, it does not become visible\nuntil you hover over the text so for the purposes of this targeted fix\nit is probably ok.\n\nTo fix this we can apply a quirk that forces the flexbox that contains\nthe navigation bar content to use 100dvh, which takes into\nconvisderation the space taken up by Safari\u0027s navigation bar, instead of\n100vh.\n\nCanonical link: https://commits.webkit.org/315134@main\n"
    },
    {
      "commit": "c329236d6f8eb05d72d0aa0d262fbac2b4cb602d",
      "tree": "a1cbaf1de1a67a1fbcc5f05772d986b18d7d3cbd",
      "parents": [
        "eb36fe1d6447d973bb1d112b745f74a0bb000a83"
      ],
      "author": {
        "name": "Ahmad Saleem",
        "email": "ahmad.saleem792+github@gmail.com",
        "time": "Fri Jun 12 20:31:52 2026"
      },
      "committer": {
        "name": "Ahmad Saleem",
        "email": "ahmad.saleem792@gmail.com",
        "time": "Fri Jun 12 20:31:52 2026"
      },
      "message": "SVGFEConvolveMatrixElement should reject invalid order attribute values\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d304107\nrdar://166438611\n\nReviewed by Taher Ali.\n\nThis patch aligns WebKit with Gecko / Firefox and Blink / Chromium.\n\nWhen the order attribute is set to an invalid value (e.g., negative numbers\nor zero), the orderX and orderY SVG DOM getters return the initial value of 3\nper WPT, rather than the invalid parsed value. But the filter must still fail\nto render — otherwise an invalid order combined with a matching kernelMatrix\nlength would paint as if valid (e.g. order\u003d\"-3\" with a 9-element kernelMatrix\nwould otherwise succeed as order\u003d\"3\").\n\nTo satisfy both requirements, track the invalid state via a new\nm_hasInvalidOrderAttribute flag, set when parsing produces a value \u003c 1 and\ncleared on a valid update. The DOM getters still report 3, while\ncreateFilterEffect checks the flag and returns an empty IntSize so filter\ncreation fails.\n\nNote: when a CSS filter reference fails, HTML elements still paint without\nthe filter (only SVG elements are suppressed via hasFailedFilterForSVG).\nThat discrepancy is pre-existing and out of scope for this patch.\n\n* Source/WebCore/svg/SVGFEConvolveMatrixElement.cpp:\n(WebCore::SVGFEConvolveMatrixElement::attributeChanged):\n(WebCore::SVGFEConvolveMatrixElement::createFilterEffect const):\n* Source/WebCore/svg/SVGFEConvolveMatrixElement.h:\n* LayoutTests/imported/w3c/web-platform-tests/svg/types/scripted/SVGAnimatedInteger-expected.txt: Progression\n\nCanonical link: https://commits.webkit.org/315133@main\n"
    },
    {
      "commit": "eb36fe1d6447d973bb1d112b745f74a0bb000a83",
      "tree": "65bd02bd0432b57f6f6fa6eb262542da466da518",
      "parents": [
        "af4ee67f24a3659185165c90ab8915826e65daf9"
      ],
      "author": {
        "name": "Marta Darbinyan",
        "email": "darbinyan@apple.com",
        "time": "Fri Jun 12 20:30:59 2026"
      },
      "committer": {
        "name": "Marta Darbinyan",
        "email": "darbinyan@apple.com",
        "time": "Fri Jun 12 20:30:59 2026"
      },
      "message": "Unreviewed, reverting 315121@main (844ebfeb1d99)\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d317025\nrdar://179511043\n\nBroke iOS builds on main\n\nReverted change:\n\n    Delegated Apple Pay: Move HAVE_PASSKIT_DELEGATED_REQUEST to WebKit\n    https://bugs.webkit.org/show_bug.cgi?id\u003d315564\n    rdar://165837621\n    315121@main (844ebfeb1d99)\n\nCanonical link: https://commits.webkit.org/315132@main\n"
    },
    {
      "commit": "af4ee67f24a3659185165c90ab8915826e65daf9",
      "tree": "ebab5a94e0d7a97b6be5efddb034c15f2514db2a",
      "parents": [
        "54ff85f6c8e4ffbb9264630bb107c8fafe4086be"
      ],
      "author": {
        "name": "Marta Darbinyan",
        "email": "darbinyan@apple.com",
        "time": "Fri Jun 12 20:26:24 2026"
      },
      "committer": {
        "name": "Marta Darbinyan",
        "email": "darbinyan@apple.com",
        "time": "Fri Jun 12 20:26:24 2026"
      },
      "message": "[Gardening]: REGRESSION(315022@main): [iOS macOS]  imported/w3c/web-platform-tests/largest-contentful-paint/multiple-redirects-TAO.html is a flaky failure\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d317017\nrdar://179508696\n\nUnreviewed test gardening\n\n* LayoutTests/TestExpectations:\n\nCanonical link: https://commits.webkit.org/315131@main\n"
    },
    {
      "commit": "54ff85f6c8e4ffbb9264630bb107c8fafe4086be",
      "tree": "9daf2dcf1bfd740592929392c9bf09c628a7284e",
      "parents": [
        "a6f42da10166a940ded9fdaa2018012470362516"
      ],
      "author": {
        "name": "Alejandro G. Castro",
        "email": "alex@igalia.com",
        "time": "Fri Jun 12 20:24:36 2026"
      },
      "committer": {
        "name": "Alejandro G. Castro",
        "email": "alex@igalia.com",
        "time": "Fri Jun 12 20:24:36 2026"
      },
      "message": "[WPE][arm64] Gardening of layout tests\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d317023\n\nUnreviewed test gardening.\n\nReport and mark new expected failures and flaky tests on the\nWPE arm64 release bot.\n\n* LayoutTests/platform/glib/TestExpectations:\n* LayoutTests/platform/wpe/TestExpectations:\n\nCanonical link: https://commits.webkit.org/315130@main\n"
    },
    {
      "commit": "a6f42da10166a940ded9fdaa2018012470362516",
      "tree": "56747f5de194b01aeb6f764b35f1948d47814774",
      "parents": [
        "ba459bae8fa7fff9852a9017e3735ec9dc20844a"
      ],
      "author": {
        "name": "Vassili Bykov",
        "email": "v_bykov@apple.com",
        "time": "Fri Jun 12 20:22:18 2026"
      },
      "committer": {
        "name": "Vassili Bykov",
        "email": "v_bykov@apple.com",
        "time": "Fri Jun 12 20:22:18 2026"
      },
      "message": "[JSC] BBQJIT tail call shuffle should detect overlapping stack slots\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d312288\nrdar://174490087\n\nReviewed by Dan Hecht.\n\nBecause in a tail call the caller and the callee frames overlap, BBQJIT::emitTailCall()\nuses emitShuffle() to orchestrate the copying of call arguments into their destination\nlocations in such a way that if a caller temp resides in the callee argument space and is\nitself passed as an argument, it is not clobbered before it\u0027s been moved to its final\nlocation.\n\nThe move hazard detection in emitShuffleMove() compares stack locations by offset only\n(via Location::operator\u003d\u003d). The core assumption here is that source and destination values\nwith different base addresses never overlap, so a write to a destination address A never\nclobbers a source value at address B.\n\nThis assumption does not always hold. Caller temps (source values) are always 16-byte\naligned regardless of value type. Callee arguments (destination values) are packed\ncontiguously. If an i64 argument at address B is followed by a v128 argument, the v128\nargument occupies the address range [B+8, B+24). This range overlaps two temp slots with\nranges [B, B+16) and [B+16, B+32). Because hazard detection currently only considers the\nbase address, this overlap will go unnoticed and the shuffle may write the v128 argument\nbefore the values in the overlapping source slots have been moved.\n\nThis patch adds Location::overlaps() method which considers actual ranges for Stack and\nStackArgument locations. The method replaces Location::operator\u003d\u003d() for hazard detection.\n\nThe new method is also used in destination uniqueness assertion in emitShuffle.\n\nTest: JSTests/wasm/stress/tail-call-v128-ref-stack-overlap.js\n\nOriginally-landed-as: 305413.670@safari-7624-branch (73c288dd8c72). rdar://176058891\nCanonical link: https://commits.webkit.org/315129@main\n"
    },
    {
      "commit": "ba459bae8fa7fff9852a9017e3735ec9dc20844a",
      "tree": "a37d241e1c971ee61c1294a80e52b8e3461fe49e",
      "parents": [
        "8963f8f945165a7ed67bf6a21e26def2e2f6877d"
      ],
      "author": {
        "name": "Yusuke Suzuki",
        "email": "ysuzuki@apple.com",
        "time": "Fri Jun 12 19:51:13 2026"
      },
      "committer": {
        "name": "Yusuke Suzuki",
        "email": "ysuzuki@apple.com",
        "time": "Fri Jun 12 19:51:13 2026"
      },
      "message": "[JSC] Remove ucal_clone by reorganize ucal code\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d316970\nrdar://179440479\n\nReviewed by Yijia Huang.\n\nLet\u0027s change the scope of withCalendar / withTimeZone so that we do not\nneed to call ucal_clone, which is significantly slower. Also we\nintroduce TinyLRUCache to Calendar cache too.\n\n* Source/JavaScriptCore/runtime/temporal/core/CalendarICUBridge.cpp:\n(JSC::TemporalCore::CalendarLRUCachePolicy::isKeyNull):\n(JSC::TemporalCore::CalendarLRUCachePolicy::createValueForNullKey):\n(JSC::TemporalCore::CalendarLRUCachePolicy::createValueForKey):\n(JSC::TemporalCore::CalendarLRUCachePolicy::createKeyForStorage):\n(JSC::TemporalCore::calendarCacheEntry):\n(JSC::TemporalCore::withCalendar):\n(JSC::TemporalCore::surpassesMonths):\n(JSC::TemporalCore::calendarDateUntil):\n* Source/JavaScriptCore/runtime/temporal/core/TimeZoneICUBridge.cpp:\n\nCanonical link: https://commits.webkit.org/315128@main\n"
    },
    {
      "commit": "8963f8f945165a7ed67bf6a21e26def2e2f6877d",
      "tree": "2cf982c4adc1eb2283ce6804829ecfbbc5e099a7",
      "parents": [
        "4b8ee8d96bd1911587fb97c01779b7116d960ea3"
      ],
      "author": {
        "name": "Alejandro G. Castro",
        "email": "alex@igalia.com",
        "time": "Fri Jun 12 19:50:24 2026"
      },
      "committer": {
        "name": "Alejandro G. Castro",
        "email": "alex@igalia.com",
        "time": "Fri Jun 12 19:50:24 2026"
      },
      "message": "[GTK][WPE] Gardening of tests\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d317012\n\nUnreviewed test gardening.\n\nReport and mark new expected failures and flaky tests on the\nGTK and WPE x86_64 release bots.\n\n* LayoutTests/platform/glib/TestExpectations:\n* LayoutTests/platform/gtk/TestExpectations:\n\nCanonical link: https://commits.webkit.org/315127@main\n"
    },
    {
      "commit": "4b8ee8d96bd1911587fb97c01779b7116d960ea3",
      "tree": "54456167726df49ec23a9e10cbfa4faa127ef0d9",
      "parents": [
        "74720ee2b7df6a33982136654d14bc3cd4236ab7"
      ],
      "author": {
        "name": "Yusuke Suzuki",
        "email": "ysuzuki@apple.com",
        "time": "Fri Jun 12 19:49:10 2026"
      },
      "committer": {
        "name": "Yusuke Suzuki",
        "email": "ysuzuki@apple.com",
        "time": "Fri Jun 12 19:49:10 2026"
      },
      "message": "[JSC] Use runtime check for fast path for Spread\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d316957\nrdar://179423267\n\nReviewed by Yijia Huang.\n\nCurrently DFG / FTL Spread only take fast path when AbstractValue is\nproven Array with specific shape. But this is a bit too conservative,\nlet\u0027s have runtime check with original Array structures so that we can\nstill take the fast path even when it is not proven.\n\n* Source/JavaScriptCore/dfg/DFGGraph.cpp:\n(JSC::DFG::Graph::canDoFastSpreadWithStructureCheck):\n* Source/JavaScriptCore/dfg/DFGGraph.h:\n* Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:\n* Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:\n(JSC::FTL::DFG::LowerDFGToB3::compileSpread):\n\nCanonical link: https://commits.webkit.org/315126@main\n"
    },
    {
      "commit": "74720ee2b7df6a33982136654d14bc3cd4236ab7",
      "tree": "31e8eac8f3580612ba87562be31f7c116817667e",
      "parents": [
        "ccfb13ac522147b6c2b8b7ab290a47344467fbde"
      ],
      "author": {
        "name": "Basuke Suzuki",
        "email": "basuke@apple.com",
        "time": "Fri Jun 12 19:25:15 2026"
      },
      "committer": {
        "name": "Basuke Suzuki",
        "email": "basuke@apple.com",
        "time": "Fri Jun 12 19:25:15 2026"
      },
      "message": "[Site Isolation] Iframe pushState misroutes history.back() under UseUIProcessForBackForwardItemLoading\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d316881\nrdar://179304807\n\nReviewed by Charlie Wolfe and Sihui Liu.\n\nHistoryController::pushState built the topItem from frame-\u003erootFrame(), so the\nIPC payload\u0027s frameID identified the rootFrame even when an iframe initiated\nthe navigation. Under UseUIProcessForBackForwardItemLoading (auto-enabled with\nSiteIsolation), UIProcess routes history.back() by currentItem-\u003enavigatedFrameID()\nand so navigated the main frame to its own URL — back() became a no-op and the\niframe stayed at the latest pushed entry.\n\nBuild the tree from the navigating frame, matching what regular iframe\nnavigations already do via WebLocalFrameLoaderClient::createHistoryItemTree.\nThe IPC payload\u0027s root frameID then identifies the iframe directly, and\nWebBackForwardList::completeFrameStateForNavigation handles grafting the\niframe-rooted FrameState onto the main tree as it does for any other\nsub-frame navigation.\n\nTools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolation.mm:\nIframePushStateBackForwardRoutesToIframe.\n\n* Source/WebCore/loader/HistoryController.cpp:\n(WebCore::HistoryController::pushState):\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolation.mm:\n\nCanonical link: https://commits.webkit.org/315125@main\n"
    },
    {
      "commit": "ccfb13ac522147b6c2b8b7ab290a47344467fbde",
      "tree": "fa7b07effd0346cd45f16bfa0d5fe5551482ae32",
      "parents": [
        "7a6f5e3b706a471ce7a4c9e85bc27973886178dc"
      ],
      "author": {
        "name": "Geoffrey Garen",
        "email": "ggaren@apple.com",
        "time": "Fri Jun 12 19:02:46 2026"
      },
      "committer": {
        "name": "Geoffrey Garen",
        "email": "ggaren@apple.com",
        "time": "Fri Jun 12 19:02:46 2026"
      },
      "message": "Null dereference beneath speechSynthesis.speak\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d311761\nrdar://173393491\n\nReviewed by Sihui Liu.\n\nWe have a fuzzer test case that sometimes reproduces a null deref on this path.\n\nTest: fast/speechsynthesis/speech-synthesis-speak-fuzzer-crash.html\n\n* LayoutTests/fast/speechsynthesis/speech-synthesis-speak-fuzzer-crash-expected.txt: Added.\n* LayoutTests/fast/speechsynthesis/speech-synthesis-speak-fuzzer-crash.html: Added.\n* Source/WebCore/platform/cocoa/PlatformSpeechSynthesizerCocoa.mm:\n(-[WebSpeechSynthesisWrapper speakUtterance:]):\n(-[WebSpeechSynthesisWrapper speechSynthesizer:didStartSpeechUtterance:]):\n(-[WebSpeechSynthesisWrapper speechSynthesizer:didFinishSpeechUtterance:]):\n(-[WebSpeechSynthesisWrapper speechSynthesizer:didPauseSpeechUtterance:]):\n(-[WebSpeechSynthesisWrapper speechSynthesizer:didContinueSpeechUtterance:]):\n(-[WebSpeechSynthesisWrapper speechSynthesizer:didCancelSpeechUtterance:]):\n(-[WebSpeechSynthesisWrapper speechSynthesizer:willSpeakRangeOfSpeechString:utterance:]):\n\nOriginally-landed-as: 305413.635@rapid/safari-7624.2.5.110-branch (834f01c6724e). rdar://176059232\nCanonical link: https://commits.webkit.org/315124@main\n"
    },
    {
      "commit": "7a6f5e3b706a471ce7a4c9e85bc27973886178dc",
      "tree": "b7f52bf3d74a5755be724be43338c000241ec8b0",
      "parents": [
        "9681e24c3b287eab1f380c38ed7488db874d66fa"
      ],
      "author": {
        "name": "Charlie Wolfe",
        "email": "charliew@apple.com",
        "time": "Fri Jun 12 19:00:13 2026"
      },
      "committer": {
        "name": "Charlie Wolfe",
        "email": "charliew@apple.com",
        "time": "Fri Jun 12 19:00:13 2026"
      },
      "message": "encodeAsCBOR() emplaces the versions array twice and reads it after move\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d316974\nrdar://179451130\n\nReviewed by Pascoe.\n\nThe versions array was inserted under CBORValue(1) and then again under\nkCtapAuthenticatorGetInfoVersionsKey (which is also 1). Since it\u0027s the same key it is a no-op\ninsert. Keep the single emplace using the named constant.\n\n* Source/WebCore/Modules/webauthn/fido/AuthenticatorGetInfoResponse.cpp:\n(fido::encodeAsCBOR):\n\nCanonical link: https://commits.webkit.org/315123@main\n"
    },
    {
      "commit": "9681e24c3b287eab1f380c38ed7488db874d66fa",
      "tree": "f6854b8b288b622567c216cd083d3c8535469dca",
      "parents": [
        "844ebfeb1d997360dad9aebd280811b3ec4dd2f8"
      ],
      "author": {
        "name": "Rupin Mittal",
        "email": "rupin@apple.com",
        "time": "Fri Jun 12 18:48:59 2026"
      },
      "committer": {
        "name": "Rupin Mittal",
        "email": "rupin@apple.com",
        "time": "Fri Jun 12 18:48:59 2026"
      },
      "message": "[Site Isolation] Make UserGestureIndicator not require the mainFrameDocument\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d316924\nrdar://179386506\n\nReviewed by Aditya Keerthi.\n\nAfter 314903@main, logUserInteractionWithReducedTimeResolution() is capable of\nworking with a non-mainFrame document. So we amend UserGestureIndicator to not\nneed to pass in the mainFrameDocument.\n\nIt\u0027s not possible to add a new test for this. UserGestureIndicator only calls\nlogUserInteractionWithReducedTimeResolution() when the ProcessInteractionStyle\npassed in is ProcessInteractionStyle::Immediate. This only happens for mouse\nand touch events (see EventHandler::handleMousePressEvent and handleTouchEvent)\nwhich are always processed in the main frame first. This means that for those\nevents, the user interaction is already attributed to the main frame\u0027s origin.\nThis scenario is covered by existing tests which still pass after this change\nwith and without site isolation (user-interaction-in-cross-origin-sub-frame.html).\n\nEven though we can\u0027t add a new test, it still makes sense to ensure that\nUserGestureIndicator isn\u0027t dependent on accessing the mainFrameDocument.\n\n* Source/WebCore/dom/UserGestureIndicator.cpp:\n(WebCore::UserGestureIndicator::UserGestureIndicator):\n\nCanonical link: https://commits.webkit.org/315122@main\n"
    },
    {
      "commit": "844ebfeb1d997360dad9aebd280811b3ec4dd2f8",
      "tree": "7db3cf1dc775bfe36a99e45dc359c81481de7b9e",
      "parents": [
        "d93e2231de6506d017dd13bc0fe3c02367c9bd98"
      ],
      "author": {
        "name": "David Stockley",
        "email": "stockley@apple.com",
        "time": "Fri Jun 12 18:47:18 2026"
      },
      "committer": {
        "name": "Abrar Rahman Protyasha",
        "email": "a_protyasha@apple.com",
        "time": "Fri Jun 12 18:47:18 2026"
      },
      "message": "Delegated Apple Pay: Move HAVE_PASSKIT_DELEGATED_REQUEST to WebKit\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d315564\nrdar://165837621\n\nReviewed by Abrar Rahman Protyasha.\n\nGiven Delegated Apple Pay launched in iOS 26.4, this PR adds the relevant PlatformHave\nmacros to the open source codebase.\n\nNo new tests are required, existing tests surrounding Delegated Apple Pay will suffice.\n\n* Source/WTF/wtf/PlatformHave.h:\n\nCanonical link: https://commits.webkit.org/315121@main\n"
    },
    {
      "commit": "d93e2231de6506d017dd13bc0fe3c02367c9bd98",
      "tree": "d444afab350835e7a7ae44022113ca85f9341c2d",
      "parents": [
        "461dbf7066ba0e0c9cfe92b9792da613be101df4"
      ],
      "author": {
        "name": "Elliott Williams",
        "email": "emw@apple.com",
        "time": "Fri Jun 12 18:45:24 2026"
      },
      "committer": {
        "name": "Elliott Williams",
        "email": "emw@apple.com",
        "time": "Fri Jun 12 18:45:24 2026"
      },
      "message": "Fix broken measure-build-perf patch\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d317002\nrdar://179502229\n\nUnreviewed CI fix. The `webkit-swift-interface` patch no longer applies;\nfix it.\n\n* Tools/Scripts/measure-build-time:\n(IncrementalBuild6):\n\nCanonical link: https://commits.webkit.org/315120@main\n"
    },
    {
      "commit": "461dbf7066ba0e0c9cfe92b9792da613be101df4",
      "tree": "6a8fa866f4f1072603885240e2011a4d3313681e",
      "parents": [
        "66c073b22627b409d20b0ac96237df6ac89eb6c1"
      ],
      "author": {
        "name": "Charlie Wolfe",
        "email": "charliew@apple.com",
        "time": "Fri Jun 12 18:42:04 2026"
      },
      "committer": {
        "name": "Charlie Wolfe",
        "email": "charliew@apple.com",
        "time": "Fri Jun 12 18:42:04 2026"
      },
      "message": "AuthenticatorAssertionResponse::m_synchronizable is left uninitialized\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d316975\nrdar://179451483\n\nReviewed by Pascoe.\n\nm_synchronizable had no in-class initializer and neither constructor set it, so it held an\nindeterminate value. LocalAuthenticator only calls setSynchronizable() conditionally, so on the path\nwhere the keychain group is null and the attributes lack kSecAttrSynchronizable the garbage value\nwas read into authDataFlags(). Default-initialize it to false.\n\n* Source/WebCore/Modules/webauthn/AuthenticatorAssertionResponse.h:\n\nCanonical link: https://commits.webkit.org/315119@main\n"
    },
    {
      "commit": "66c073b22627b409d20b0ac96237df6ac89eb6c1",
      "tree": "80d8a8be81dedbadacbca0bc3726adf665d9a93b",
      "parents": [
        "21e15196b456f1a14ad17bd28f84736c7278e0fb"
      ],
      "author": {
        "name": "David Stockley",
        "email": "stockley@apple.com",
        "time": "Fri Jun 12 18:40:18 2026"
      },
      "committer": {
        "name": "Abrar Rahman Protyasha",
        "email": "a_protyasha@apple.com",
        "time": "Fri Jun 12 18:40:18 2026"
      },
      "message": "Delegated Apple Pay: Remove bincompat staging code from WebKit\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d315562\nrdar://165836164\n\nReviewed by Abrar Rahman Protyasha.\n\nWhen rolling out support for Delegated Apple Pay, temporary staging SPI and a\nrespondsToSelector check was added to ensure the build process didn\u0027t break. Now that\nthe delegated payments API is public in the iOS 26.4 SDK, this SPI and selector check can\nnow be removed.\n\nNo new tests are required, existing tests surrounding Delegated Apple Pay will suffice.\n\n* Source/WebCore/PAL/pal/spi/cocoa/PassKitSPI.h:\n* Source/WebKit/Configurations/AllowedSPI.toml:\n* Source/WebKit/Shared/ApplePay/cocoa/WebPaymentCoordinatorProxyCocoa.mm:\n(WebKit::WebPaymentCoordinatorProxy::platformPaymentRequest):\n\nCanonical link: https://commits.webkit.org/315118@main\n"
    },
    {
      "commit": "21e15196b456f1a14ad17bd28f84736c7278e0fb",
      "tree": "8b4a3b9dbaa40f1a62c9d7607470f11003e02a40",
      "parents": [
        "4e561e6e24860adba388f722794bb9bd9bc11f2c"
      ],
      "author": {
        "name": "Charlie Wolfe",
        "email": "charliew@apple.com",
        "time": "Fri Jun 12 18:36:42 2026"
      },
      "committer": {
        "name": "Charlie Wolfe",
        "email": "charliew@apple.com",
        "time": "Fri Jun 12 18:36:42 2026"
      },
      "message": "Fix typo in IDBIndex getAll* exception messages\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d316979\nrdar://179452761\n\nReviewed by Aditya Keerthi.\n\n* Source/WebCore/Modules/indexeddb/IDBIndex.cpp:\n(WebCore::IDBIndex::doGetAllShared):\n\nCanonical link: https://commits.webkit.org/315117@main\n"
    },
    {
      "commit": "4e561e6e24860adba388f722794bb9bd9bc11f2c",
      "tree": "a02f0759cf89dafe92bfb7734ade449da3c35911",
      "parents": [
        "2f073190fecd8722c04b080dd747a9aaeeda5584"
      ],
      "author": {
        "name": "Pascoe",
        "email": "pascoe@apple.com",
        "time": "Fri Jun 12 17:59:50 2026"
      },
      "committer": {
        "name": "Pascoe",
        "email": "pascoe@apple.com",
        "time": "Fri Jun 12 17:59:50 2026"
      },
      "message": "[WebAuthn] Fix crash during requestPIN\nrdar://179212159\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d316911\n\nReviewed by Abrar Rahman Protyasha, Richard Robinson, and Aditya Keerthi.\n\nCall completionHandler(nullString()) on early-return paths in requestPin() and\nrequestNewPin() instead of letting the CompletionHandler be destroyed uncalled.\nThe caller already handles a null pin gracefully.\n\n* Source/WebKit/UIProcess/WebAuthentication/AuthenticatorManager.cpp:\n(WebKit::AuthenticatorManager::requestPin):\n(WebKit::AuthenticatorManager::requestNewPin):\n\nCanonical link: https://commits.webkit.org/315116@main\n"
    },
    {
      "commit": "2f073190fecd8722c04b080dd747a9aaeeda5584",
      "tree": "6a65190c25923f79eaa61bd48a9d5a3bc1a959b6",
      "parents": [
        "3b350434b86d1d50ddca79cbcd057aa3cf7f106a"
      ],
      "author": {
        "name": "Said Abou-Hallawa",
        "email": "said@apple.com",
        "time": "Fri Jun 12 17:32:45 2026"
      },
      "committer": {
        "name": "Said Abou-Hallawa",
        "email": "sabouhallawa@apple.com",
        "time": "Fri Jun 12 17:32:45 2026"
      },
      "message": "Before creating a remote AVF image decoder, the mime-type should be checked if it is supported\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d311953\nrdar://172058208\n\nReviewed by Jer Noble.\n\nRemoteImageDecoderAVFProxy::createDecoder() should MESSAGE_CHECK() whether the\nmime-type is supported or not before calling create(). GPU process should not\ntrust WebProcess for this check and should terminate itself.\n\n* Source/WebCore/platform/graphics/avfoundation/objc/ImageDecoderAVFObjC.mm:\n(WebCore::ImageDecoderAVFObjC::create):\n* Source/WebKit/GPUProcess/media/RemoteImageDecoderAVFProxy.cpp:\n(WebKit::RemoteImageDecoderAVFProxy::createDecoder):\n* Source/WebKit/WebProcess/GPU/media/RemoteImageDecoderAVFManager.cpp:\n(WebKit::RemoteImageDecoderAVFManager::createImageDecoder):\n\nOriginally-landed-as: 305413.655@rapid/safari-7624.2.5.110-branch (2669cd39c908). rdar://176059127\nCanonical link: https://commits.webkit.org/315115@main\n"
    },
    {
      "commit": "3b350434b86d1d50ddca79cbcd057aa3cf7f106a",
      "tree": "23b696ac6f86f164c08756ed48aeb610abcf61fb",
      "parents": [
        "6350c54363c185145ff0457d6d8d5c1f299bbddd"
      ],
      "author": {
        "name": "Rupin Mittal",
        "email": "rupin@apple.com",
        "time": "Fri Jun 12 17:24:44 2026"
      },
      "committer": {
        "name": "Rupin Mittal",
        "email": "rupin@apple.com",
        "time": "Fri Jun 12 17:24:44 2026"
      },
      "message": "[Site Isolation] 2x resourceLoadStatistics/omit-document-referrer* tests are failing\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d316971\nrdar://179440666\n\nReviewed by Alex Christensen.\n\nThese tests check that if advancedPrivacyProtectionsEnabled\u003dtrue, then\ndocument.referrer is omitted in third-party iframes. With site isolation on,\nthe tests fail because the referrer is not omitted.\n\nDocument::referrerForBindings() returns the referrer instead of omitting it\nwhen it cannot access the main frame document, which is what happens with site\nisolation enabled. We make the decision to omit the referrer if the\nAdvancedPrivacyProtections::BaselineProtections flag is on. Currently, this flag\nis only set on the main frame\u0027s DocumentLoader (we need the main frame\u0027s document\nto access this).\n\nWe fix this issue by ensuring that the flag is set on the DocumentLoader of a\nthird-party iframe as well. We do this by setting the flag on the LoadParameters\nthat are sent to WebPage::loadRequest() in continueNavigationInNewProcess so that\nthey eventually make it to the DocumentLoader. Document::referrerForBindings()\ncan then check the flag on the current Document\u0027s loader.\n\n* LayoutTests/platform/ios-site-isolation/TestExpectations:\n* LayoutTests/platform/mac-site-isolation/TestExpectations:\n* Source/WebCore/dom/Document.cpp:\n(WebCore::Document::referrerForBindings):\n* Source/WebKit/UIProcess/WebPageProxy.cpp:\n(WebKit::WebPageProxy::continueNavigationInNewProcess):\n\nCanonical link: https://commits.webkit.org/315114@main\n"
    },
    {
      "commit": "6350c54363c185145ff0457d6d8d5c1f299bbddd",
      "tree": "92d7d3f2fbe4554747b7301ad3d7877060a05c87",
      "parents": [
        "346f097d212d209cefa65e2f02d74f29def23865"
      ],
      "author": {
        "name": "Keith Miller",
        "email": "keith_miller@apple.com",
        "time": "Fri Jun 12 17:15:45 2026"
      },
      "committer": {
        "name": "Keith Miller",
        "email": "keith_miller@apple.com",
        "time": "Fri Jun 12 17:15:45 2026"
      },
      "message": "[CMake] codesign JavaScriptCore binary products\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d316946\nrdar://179410684\n\nReviewed by Geoffrey Garen and Yusuke Suzuki.\n\nThe binaries produced by the CMake build with the Apple internal\nSDK are not signed and don\u0027t have any entitlements. This causes\nJSC to not JIT and other fun things. This causes a bunch of JSC\ntests to fail.\n\nI added a WEBKIT_PROCESS_ENTITLEMENTS function so we can add\ncodesigning for subsequent build products in the future from the\nsame shared function.\n\nCanonical link: https://commits.webkit.org/315113@main\n"
    },
    {
      "commit": "346f097d212d209cefa65e2f02d74f29def23865",
      "tree": "0f41f67148466e59058f175ad41897a52d1d8213",
      "parents": [
        "cc25c9e277138fd967f2367ace6eec9499968317"
      ],
      "author": {
        "name": "Marta Darbinyan",
        "email": "darbinyan@apple.com",
        "time": "Fri Jun 12 16:56:04 2026"
      },
      "committer": {
        "name": "Marta Darbinyan",
        "email": "darbinyan@apple.com",
        "time": "Fri Jun 12 16:56:04 2026"
      },
      "message": "[Gardening]: [iOS]  ASSERTION FAILED: m_creationThreadID \u003d\u003d currentThreadID() in  TestWebKitAPI.CopyHTML.SanitizationPreservesCharacterSetInSelectedText\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d316931\nrdar://179401567\n\nUnreviewed test gardening\n\n* TestExpectations/apitests:\n\nCanonical link: https://commits.webkit.org/315112@main\n"
    },
    {
      "commit": "cc25c9e277138fd967f2367ace6eec9499968317",
      "tree": "f623e8293f35225bf43549c17733e3dece4e28c0",
      "parents": [
        "b549e94395ec3526c10d8e3abd0b418d036fb923"
      ],
      "author": {
        "name": "Chris Dumez",
        "email": "cdumez@apple.com",
        "time": "Fri Jun 12 16:52:07 2026"
      },
      "committer": {
        "name": "Darin Adler",
        "email": "darin@apple.com",
        "time": "Fri Jun 12 16:52:07 2026"
      },
      "message": "Fix some uninitialized data members in WebCore/html\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d316959\n\nReviewed by Rupin Mittal and Darin Adler.\n\n* Source/WebCore/html/HTMLMediaElement.h:\n* Source/WebCore/html/LazyLoadFrameObserver.h:\n* Source/WebCore/html/track/TrackBase.h:\n\nCanonical link: https://commits.webkit.org/315111@main\n"
    },
    {
      "commit": "b549e94395ec3526c10d8e3abd0b418d036fb923",
      "tree": "097d12def286225d9bce304bdac3bfc0264a7bd3",
      "parents": [
        "6cc340adc68dbe2b5baa0f77d638731fc577746a"
      ],
      "author": {
        "name": "lilly",
        "email": "173393835+codedbycupidity@users.noreply.github.com",
        "time": "Fri Jun 12 16:47:57 2026"
      },
      "committer": {
        "name": "Simon Fraser",
        "email": "simon.fraser@apple.com",
        "time": "Fri Jun 12 16:47:57 2026"
      },
      "message": "Implement CSS corner-shape logical and physical side shorthands\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d316835\nrdar://179277008\n\nReviewed by Simon Fraser.\n\nAdds the 8 missing CSS corner-shape side shorthands, 4 physical (corner-top-shape,\ncorner-right-shape, corner-bottom-shape, corner-left-shape) and 4 logical\n(corner-block-start-shape, corner-block-end-shape, corner-inline-start-shape,\ncorner-inline-end-shape), to CSSProperties.json using the existing CoalescingPair\nshorthand pattern, which handles 1–2 value expansion\n\nPasses existing WPT tests\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-borders/corner-shape/corner-shape-computed-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-borders/corner-shape/corner-shape-valid-expected.txt:\n* Source/WebCore/css/CSSProperties.json:\n* Source/WebCore/css/ShorthandSerializer.cpp:\n(WebCore::ShorthandSerializer::serialize):\n\nCanonical link: https://commits.webkit.org/315110@main\n"
    },
    {
      "commit": "6cc340adc68dbe2b5baa0f77d638731fc577746a",
      "tree": "54fd9d0af8823c0f03bb40ac7eb42eff650b4539",
      "parents": [
        "719a73b464bfaf60a7e3c2c716ce5045f4ae838e"
      ],
      "author": {
        "name": "Kai Tamkun",
        "email": "k_tamkun@apple.com",
        "time": "Fri Jun 12 16:41:50 2026"
      },
      "committer": {
        "name": "Kai Tamkun",
        "email": "k_tamkun@apple.com",
        "time": "Fri Jun 12 16:41:50 2026"
      },
      "message": "Importing modules from a document with no base URL causes null deref\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d316862\nrdar://179143870\n\nReviewed by Yusuke Suzuki.\n\nThis replaces an assertion that the base URL is valid when dynamically importing a module\nfrom ScriptModuleLoader with an actual validation.\n\nTest: js/dom/modules/import-from-javascript-url-new-window.html\n\n* LayoutTests/js/dom/modules/import-from-javascript-url-new-window-expected.txt: Added.\n* LayoutTests/js/dom/modules/import-from-javascript-url-new-window.html: Added.\n* Source/WebCore/bindings/js/ScriptModuleLoader.cpp:\n(WebCore::ScriptModuleLoader::importModule):\n\nCanonical link: https://commits.webkit.org/315109@main\n"
    },
    {
      "commit": "719a73b464bfaf60a7e3c2c716ce5045f4ae838e",
      "tree": "60f8d41507a865d63bb25b02a83f9839e8f9187e",
      "parents": [
        "f9f215d168b0a6bbb3d24ea061cce1a211f498f4"
      ],
      "author": {
        "name": "Brandon Stewart",
        "email": "brandonstewart@apple.com",
        "time": "Fri Jun 12 16:27:31 2026"
      },
      "committer": {
        "name": "Brandon Stewart",
        "email": "brandonstewart@apple.com",
        "time": "Fri Jun 12 16:27:31 2026"
      },
      "message": "[Site Isolation] Emit live Page.frameNavigated/frameDetached from cross-origin processes\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d316664\nrdar://179117260\n\nReviewed by BJ Burg.\n\nUnder Site Isolation a cross-origin frame commits in its own WebContent process, so\nthe per-page InspectorPageAgent (which lives in the main frame\u0027s process) never sees\nit. The UIProcess ProxyingPageAgent aggregates frame state across processes, but it\nreceived no frame lifecycle events from non-main processes, so dynamically added or\nremoved cross-origin iframes were invisible to it.\n\nRe-enable the dispatch of frameNavigated/frameDetached to the cross-process\nPageAgentProxy (registered in the enabledPageProxy slot of each participating\nprocess\u0027s InstrumentingAgents). PageAgentProxy forwards them over IPC to the\nUIProcess ProxyingPageAgent. Late-joining processes are already instrumented via\nWebPageInspectorController::didCreateFrame, and the frame\u0027s InstrumentingAgents\nfalls back to the page\u0027s, where the proxy is registered -- so no additional\ninstrumentation plumbing is needed.\n\nThis dispatch was reverted previously because it crashed. The crash was a\nuse-after-free: WebInspectorBackend::disablePageInstrumentation() destroyed the\nPageAgentProxy without clearing it from the page\u0027s InstrumentingAgents enabledPageProxy\nslot, so the next frame commit in that process dereferenced a freed pointer. Fix by\ndisabling (which clears the slot) before destroying.\n\n* Source/WebCore/inspector/InspectorInstrumentation.cpp:\n(WebCore::InspectorInstrumentation::frameDetachedFromParentImpl):\n(WebCore::InspectorInstrumentation::didCommitLoadImpl):\nDispatch to enabledPageProxy() alongside enabledPageAgent(). Include\nPageAgentInstrumentation.h for the now-required complete type.\n\n* Source/WebKit/WebProcess/Inspector/WebInspectorBackend.cpp:\n(WebKit::WebInspectorBackend::disablePageInstrumentation):\nCall PageAgentProxy::disable() (clears the enabledPageProxy slot) before destroying\nit, fixing the dangling-pointer crash.\n\n* Source/WebKit/WebProcess/Inspector/PageAgentProxy.cpp:\n(WebKit::PageAgentProxy::frameNavigated):\n(WebKit::PageAgentProxy::frameDetached):\nGuard against a null parentProcessConnection() rather than dereferencing it.\n\n* Source/JavaScriptCore/inspector/protocol/Page.json:\nRemove frameDetached\u0027s targetTypes:[\"page\"] restriction so it is available on the\n\"web-page\" multiplexing target (matching frameNavigated), where the ProxyingPageAgent\ndispatches it. Without this the frontend rejected it as an unspecified method.\n\n* Source/WebInspectorUI/UserInterface/Controllers/DOMDebuggerManager.js:\n(WI.DOMDebuggerManager.prototype._mainFrameDidChange):\nGuard against a transiently-null mainFrame while frame events from multiple Site\nIsolation processes are reconciled. Full cross-process merge is the live-UI follow-up.\n\nCanonical link: https://commits.webkit.org/315108@main\n"
    },
    {
      "commit": "f9f215d168b0a6bbb3d24ea061cce1a211f498f4",
      "tree": "ea343e799b09beb51a00c5143bba58f0fc592069",
      "parents": [
        "f03a38dfc461b3d9a0d119c7ed67796bb281daae"
      ],
      "author": {
        "name": "Wenson Hsieh",
        "email": "wenson_hsieh@apple.com",
        "time": "Fri Jun 12 16:19:33 2026"
      },
      "committer": {
        "name": "Wenson Hsieh",
        "email": "wenson_hsieh@apple.com",
        "time": "Fri Jun 12 16:19:33 2026"
      },
      "message": "Improve text extraction interaction summaries when inserting text\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d316963\nrdar://179428861\n\nReviewed by Lily Spiniolas.\n\nInstead of always returning a canned result (\"Inserted text by simulating paste with plain text\"),\nleverage element interaction descriptions to surface additional context about the element that was\njust interacted with.\n\nTest: Tools/TestWebKitAPI/Tests/WebKit/WKWebView/TextExtractionTests.mm\n\n* Source/WebCore/page/text-extraction/TextExtraction.cpp:\n(WebCore::TextExtraction::textDescription):\n\nMove these methods further up the file (this code is otherwise unchanged).\n\n(WebCore::TextExtraction::focusAndInsertText):\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/TextExtractionTests.mm:\n(TestWebKitAPI::TEST(TextExtractionTests, InteractionResultSummary)):\n\nCanonical link: https://commits.webkit.org/315107@main\n"
    },
    {
      "commit": "f03a38dfc461b3d9a0d119c7ed67796bb281daae",
      "tree": "a493e0b9e2db91157e9b0fa24e91fc3e33b460e4",
      "parents": [
        "97721ca8c2a59ef7b9b3ad7bcf3b489fb767d34b"
      ],
      "author": {
        "name": "Chris Dumez",
        "email": "cdumez@apple.com",
        "time": "Fri Jun 12 15:59:22 2026"
      },
      "committer": {
        "name": "Chris Dumez",
        "email": "cdumez@apple.com",
        "time": "Fri Jun 12 15:59:22 2026"
      },
      "message": "REGRESSION(309877@main): window.event not restored when a window.onerror handler throws\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d316968\n\nReviewed by Anne van Kesteren.\n\nJSErrorHandler::handleEvent saves the window\u0027s current event, sets it to the\nerror event for the duration of the onerror call, and is supposed to restore it\nafterwards. 309877@main refactored this function into a lambda that returns\nearly when the handler throws (if (exception) return exception;), placing the\nsetCurrentEvent(savedEvent) restore on the success path only. As a result, when\na window.onerror handler throws, window.event is left pointing at the error\nevent instead of being restored to the previously current event.\n\nRestore window.event with a makeScopeExit right after it is saved, so it runs on\nboth the normal and throwing paths, mirroring JSEventListener::handleEvent (which\nhas always done this and was not changed by 309877@main).\n\nTest: imported/w3c/web-platform-tests/dom/events/window-event-restored-after-throwing-onerror.html\n\n* LayoutTests/imported/w3c/web-platform-tests/dom/events/window-event-restored-after-throwing-onerror-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/dom/events/window-event-restored-after-throwing-onerror.html: Added.\n* Source/WebCore/bindings/js/JSErrorHandler.cpp:\n(WebCore::JSErrorHandler::handleEvent):\n\nCanonical link: https://commits.webkit.org/315106@main\n"
    },
    {
      "commit": "97721ca8c2a59ef7b9b3ad7bcf3b489fb767d34b",
      "tree": "7c22e02c938c5720c006ee50e3438d2c3d0ea45f",
      "parents": [
        "3e38165dc47083cb5628f943e6d718b5dfd0828c"
      ],
      "author": {
        "name": "Chris Dumez",
        "email": "cdumez@apple.com",
        "time": "Fri Jun 12 15:47:54 2026"
      },
      "committer": {
        "name": "Chris Dumez",
        "email": "cdumez@apple.com",
        "time": "Fri Jun 12 15:47:54 2026"
      },
      "message": "JSCustomElementInterface fails to visit m_connectedMoveCallback during GC\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d316965\n\nReviewed by Anne van Kesteren.\n\nJSCustomElementInterface stores each custom element reaction callback as a\nJSC::Weak\u003cJSObject\u003e with no custom WeakHandleOwner, so the visitor.append()\ncalls in visitJSFunctionsInGCThread() are the only thing keeping those\nfunctions alive across a garbage collection. That function appended every\ncallback except m_connectedMoveCallback, which was added later (in the\nconnectedMoveCallback() implementation) without updating the visit list.\n\nAs a result, once the only other reference to the connectedMoveCallback\nfunction is dropped (e.g. the method is deleted off the constructor\u0027s\nprototype), the function can be collected while its custom element definition\nis still live and registered. After collection hasConnectedMoveCallback()\nreturns false, so a subsequent moveBefore() enqueues the\ndisconnected/connected reactions instead of connectedMove, silently changing\nobservable behavior.\n\nFix this by visiting m_connectedMoveCallback alongside the other callbacks,\nin member-declaration order.\n\nTest: fast/custom-elements/connectedMoveCallback-survives-gc.html\n\n* LayoutTests/fast/custom-elements/connectedMoveCallback-survives-gc-expected.txt: Added.\n* LayoutTests/fast/custom-elements/connectedMoveCallback-survives-gc.html: Added.\n* Source/WebCore/bindings/js/JSCustomElementInterface.cpp:\n(WebCore::JSCustomElementInterface::visitJSFunctionsInGCThread const):\n\nCanonical link: https://commits.webkit.org/315105@main\n"
    },
    {
      "commit": "3e38165dc47083cb5628f943e6d718b5dfd0828c",
      "tree": "c61633edc9c177b9febcf4f7799740cd2225d26d",
      "parents": [
        "06d7373045cefd2ef7022e719365cbfcbf23d114"
      ],
      "author": {
        "name": "Carlos Alberto Lopez Perez",
        "email": "clopez@igalia.com",
        "time": "Fri Jun 12 15:43:53 2026"
      },
      "committer": {
        "name": "Carlos Alberto Lopez Perez",
        "email": "clopez@igalia.com",
        "time": "Fri Jun 12 15:43:53 2026"
      },
      "message": "[WPE][cross-toolchain-helper] For the optional chromium build, do not set CHROMIUM_EXTRA_ARGS\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d315999\n\nReviewed by Nikolas Zimmermann.\n\nThe flags we were passing to Chromium are not longer valid as those switches got renamed,\nthis resulted in Chromium not enabling hardware acceleration (about://gpu).\n\nLeave the value empty so the recipe defaults to the right values, which are defined via\nPACKAGECONFIG options, and on the current version will resolve to:\n\n\"--use-angle\u003dgles-egl \\\n --ozone-platform-hint\u003dwayland \\\n --ozone-platform\u003dwayland\n --enable-features\u003dAcceleratedVideoDecoder,AcceleratedVideoDecodeLinuxGL,AcceleratedVideoDecodeLinuxZeroCopyGL\"\n\n* Tools/yocto/image_extras/chromium.conf:\n\nCanonical link: https://commits.webkit.org/315104@main\n"
    },
    {
      "commit": "06d7373045cefd2ef7022e719365cbfcbf23d114",
      "tree": "72fbe040d9835cf0248fc6edaeda3319128cd9a4",
      "parents": [
        "2387eef3bad24a2fea2ba5f9943e38d446a07983"
      ],
      "author": {
        "name": "Carlos Alberto Lopez Perez",
        "email": "clopez@igalia.com",
        "time": "Fri Jun 12 15:42:12 2026"
      },
      "committer": {
        "name": "Carlos Alberto Lopez Perez",
        "email": "clopez@igalia.com",
        "time": "Fri Jun 12 15:42:12 2026"
      },
      "message": "[WPE][cross-toolchain-helper] Allow detached tmux/screen sessions, set logind KillUserProcesses\u003dno\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d316989\n\nReviewed by Nikolas Zimmermann.\n\nConfigure the image with KillUserProcesses\u003dno for logind, so it is possible\nto run detached screen or tmux sessions in the background. This is a general\nuseful thing for development and matches the behaviour expected on login\nsessions from most desktop distributions.\n\n* Tools/yocto/meta-openembedded_and_meta-webkit.patch:\n\nCanonical link: https://commits.webkit.org/315103@main\n"
    },
    {
      "commit": "2387eef3bad24a2fea2ba5f9943e38d446a07983",
      "tree": "542a22443602c76ade2fd03b432fcbfaf0b9186b",
      "parents": [
        "42b3ecc4724deceda84578093f57f6fd842abf6e"
      ],
      "author": {
        "name": "Tyler Wilcock",
        "email": "tyler_w@apple.com",
        "time": "Fri Jun 12 15:32:42 2026"
      },
      "committer": {
        "name": "Tyler Wilcock",
        "email": "tyler_w@apple.com",
        "time": "Fri Jun 12 15:32:42 2026"
      },
      "message": "AX: An anchor element that has a click handler but no href should still be considered a link\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d316929\nrdar://179398579\n\nReviewed by Chris Fleizach.\n\nAs a markup repair, Chrome and Firefox expose an \u003ca\u003e with a click handler but\nno href as a link. WebKit did not: Element::isLink() is only true for anchors\nwith an href, so a hrefless anchor with an onclick handler fell through role\ndetermination to the generic Inline role and was ignored by the accessibility tree.\n\nWith this commit, we implement this markup repair.\n\n* LayoutTests/accessibility/anchor-with-click-handler-is-link-expected.txt: Added.\n* LayoutTests/accessibility/anchor-with-click-handler-is-link.html: Added.\n* Source/WebCore/accessibility/AXObjectCache.cpp:\n(WebCore::isClickEvent):\n(WebCore::AXObjectCache::onEventListenerAdded):\n(WebCore::AXObjectCache::onEventListenerRemoved):\n(WebCore::AXObjectCache::handleClickHandlerChanged):\n(WebCore::AXObjectCache::handleAttributeChange):\n* Source/WebCore/accessibility/AXObjectCache.h:\n* Source/WebCore/accessibility/AccessibilityNodeObject.cpp:\n(WebCore::AccessibilityNodeObject::determineAccessibilityRoleFromNode const):\n\nCanonical link: https://commits.webkit.org/315102@main\n"
    },
    {
      "commit": "42b3ecc4724deceda84578093f57f6fd842abf6e",
      "tree": "3e0a070826d6642a5a1477aec92f759022e1be8b",
      "parents": [
        "7176d03868861a90728104e83d928b33a37b117a"
      ],
      "author": {
        "name": "Tyler Wilcock",
        "email": "tyler_w@apple.com",
        "time": "Fri Jun 12 15:11:03 2026"
      },
      "committer": {
        "name": "Tyler Wilcock",
        "email": "tyler_w@apple.com",
        "time": "Fri Jun 12 15:11:03 2026"
      },
      "message": "AX: AXTextOperations skip text input fields when isolated tree is enabled\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d316961\nrdar://179428392\n\nReviewed by Chris Fleizach.\n\nWith isolated tree mode enabled, AXTextOperations (e.g. replace) skip\ntext inputs. The cause is in AXObjectCache::textMarkerDataForVisiblePosition.\nWhen shouldCreateAXThreadCompatibleMarkers() is true, it builds a TextMarkerData\nwith the `ignored` field set from object-\u0026gt;isIgnored(). An \u0026lt;input\u0026gt;\u0026apos;s inner\nuser-agent-shadow text is an AX-ignored object, so its marker was flagged ignored\u003dtrue.\nWhen that marker range was later converted back to a SimpleRange on the main thread,\ncharacterOffsetForTextMarkerData / objectForTextMarkerData return null for an\nignored marker, so the range was dropped and never operated on.\n\nThe main reason this bug occurred is because TextMarkerData\u0026apos;s `ignored`\nfield did not actually map to the canonical notion of accessibility-is-ignored.\nBased on how the live tree actually sets and uses it, the intent is to\ndenote whether the marker is within a secure field. The bug is fixed\nby hardcoding `ignored` to false for anything that\u0026apos;s not a secure field.\n\nTo keep the name from inviting the same mistake again, this commit renames\nthe field from `ignored` to `isRedacted`.\n\nThis progresses test accessibility/mac/text-operation/text-operation-replace-across-multiple-fields.html\nin isolated tree mode.\n\n* LayoutTests/accessibility-isolated-tree/TestExpectations:\n* Source/WebCore/accessibility/AXObjectCache.cpp:\n(WebCore::AXObjectCache::characterOffsetForTextMarkerData):\n(WebCore::AXObjectCache::textMarkerDataForCharacterOffset):\n(WebCore::AXObjectCache::textMarkerDataForNextCharacterOffset):\n(WebCore::AXObjectCache::textMarkerDataForPreviousCharacterOffset):\n(WebCore::AXObjectCache::objectForTextMarkerData):\n(WebCore::AXObjectCache::textMarkerDataForVisiblePosition):\n* Source/WebCore/accessibility/AXTextMarker.cpp:\n(WebCore::TextMarkerData::TextMarkerData):\n(WebCore::AXTextMarker::operator CharacterOffset const):\n(WebCore::AXTextMarker::description const):\n* Source/WebCore/accessibility/AXTextMarker.h:\n(WebCore::TextMarkerData::TextMarkerData):\n(WebCore::AXTextMarker::isRedacted const):\n(WebCore::AXTextMarker::isIgnored const): Deleted.\n* Source/WebCore/accessibility/ios/WebAccessibilityObjectWrapperIOS.mm:\n(+[WebAccessibilityTextMarker textMarkerWithCharacterOffset:cache:]):\n(-[WebAccessibilityTextMarker isIgnored]):\n* Source/WebCore/accessibility/mac/AXObjectCacheMac.mm:\n(WebCore::textMarkerForCharacterOffset):\n\nCanonical link: https://commits.webkit.org/315101@main\n"
    },
    {
      "commit": "7176d03868861a90728104e83d928b33a37b117a",
      "tree": "4fe871ff9bb7de0fb2a05537686ccd1a8d702f22",
      "parents": [
        "b29dbe2549487a275f32363f8d00b8f1771e3f2d"
      ],
      "author": {
        "name": "Jean Haberer",
        "email": "jean.haberer@apple.com",
        "time": "Fri Jun 12 15:05:12 2026"
      },
      "committer": {
        "name": "Jean Haberer",
        "email": "jean.haberer@apple.com",
        "time": "Fri Jun 12 15:05:12 2026"
      },
      "message": "Remove Spatial Backdrop developer preview in favor of the Immersive API\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d316910\nrdar://160271766\n\nReviewed by Etienne Segonzac.\n\nRemove the whole Spatial Backdrop Developer preview.\nDevelopers can now use the new Immersive API, which is out of\ndeveloper preview to provide spatial backdrop.\n\nAdd a console error if we detect an old spatial-backdrop link tag.\n\n* Source/WTF/Scripts/Preferences/UnifiedWebPreferences.yaml:\n* Source/WTF/wtf/PlatformEnableCocoa.h:\n* Source/WebCore/Headers.cmake:\n* Source/WebCore/Sources.txt:\n* Source/WebCore/WebCore.xcodeproj/project.pbxproj:\n* Source/WebCore/dom/Document.cpp:\n* Source/WebCore/dom/Document.h:\n* Source/WebCore/dom/SpatialBackdropSource.cpp: Removed.\n* Source/WebCore/dom/SpatialBackdropSource.h: Removed.\n* Source/WebCore/html/HTMLLinkElement.cpp:\n* Source/WebCore/html/HTMLLinkElement.h:\n* Source/WebCore/html/HTMLLinkElement.idl:\n* Source/WebCore/html/LinkRelAttribute.cpp:\n* Source/WebCore/html/LinkRelAttribute.h:\n* Source/WebCore/page/ChromeClient.h:\n* Source/WebCore/page/Page.cpp:\n* Source/WebCore/page/Page.h:\n* Source/WebKit/Shared/API/Cocoa/WebKitPrivate.h:\n* Source/WebKit/Shared/WebCoreArgumentCoders.serialization.in:\n* Source/WebKit/SourcesCocoa.txt:\n* Source/WebKit/UIProcess/API/Cocoa/WKWebView.mm:\n* Source/WebKit/UIProcess/API/Cocoa/WKWebViewInternal.h:\n* Source/WebKit/UIProcess/API/Cocoa/WKWebViewPrivate.h:\n* Source/WebKit/UIProcess/API/Cocoa/_WKSpatialBackdropSource.h: Removed.\n* Source/WebKit/UIProcess/API/Cocoa/_WKSpatialBackdropSource.mm: Removed.\n* Source/WebKit/UIProcess/API/Cocoa/_WKSpatialBackdropSourceInternal.h: Removed.\n* Source/WebKit/UIProcess/Cocoa/PageClientImplCocoa.h:\n* Source/WebKit/UIProcess/Cocoa/PageClientImplCocoa.mm:\n* Source/WebKit/UIProcess/PageClient.h:\n* Source/WebKit/UIProcess/WebPageProxy.cpp:\n* Source/WebKit/UIProcess/WebPageProxy.h:\n* Source/WebKit/UIProcess/WebPageProxy.messages.in:\n* Source/WebKit/UIProcess/WebPageProxyInternals.h:\n* Source/WebKit/WebKit.xcodeproj/project.pbxproj:\n* Source/WebKit/WebProcess/WebCoreSupport/WebChromeClient.cpp:\n* Source/WebKit/WebProcess/WebCoreSupport/WebChromeClient.h:\n* Source/WebKit/WebProcess/WebPage/WebPage.cpp:\n* Source/WebKit/WebProcess/WebPage/WebPage.h:\n\nCanonical link: https://commits.webkit.org/315100@main\n"
    },
    {
      "commit": "b29dbe2549487a275f32363f8d00b8f1771e3f2d",
      "tree": "e1d9a5fba404c51c23e41b55e63275ce0b58af5a",
      "parents": [
        "7aacc6579a0267ca6db554536c3fff0d406686c5"
      ],
      "author": {
        "name": "Dan Hecht",
        "email": "dan.hecht@apple.com",
        "time": "Fri Jun 12 14:58:26 2026"
      },
      "committer": {
        "name": "Dan Hecht",
        "email": "dan.hecht@apple.com",
        "time": "Fri Jun 12 14:58:26 2026"
      },
      "message": "[JSC] Remove OMGIRGenerator::RootBlock\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d316956\nrdar://179420996\n\nReviewed by Yusuke Suzuki.\n\nThe root block level usesSIMD tracking is a relic of how the code used\nto work but it\u0027s no longer used. So let\u0027s just remove RootBlock and\nsome related code.\n\n* Source/JavaScriptCore/wasm/WasmOMGIRGenerator.cpp:\n(JSC::Wasm::OMGIRGenerator::OMGIRGenerator):\n(JSC::Wasm::OMGIRGenerator::insertEntrySwitch):\n(JSC::Wasm::OMGIRGenerator::addLoop):\n(JSC::Wasm::OMGIRGenerator::emitCatchImpl):\n(JSC::Wasm::OMGIRGenerator::emitCatchTableImpl):\n(JSC::Wasm::OMGIRGenerator::emitInlineDirectCall):\n(JSC::Wasm::OMGIRGenerator::usesSIMD): Deleted.\n\nCanonical link: https://commits.webkit.org/315099@main\n"
    },
    {
      "commit": "7aacc6579a0267ca6db554536c3fff0d406686c5",
      "tree": "45171ba2d60bd84b6e049f73adab5c910b828f2a",
      "parents": [
        "5a62df176e3b50f969cef1d86afff9c007a0f2f1"
      ],
      "author": {
        "name": "Ryosuke Niwa",
        "email": "rniwa@webkit.org",
        "time": "Fri Jun 12 14:53:57 2026"
      },
      "committer": {
        "name": "Ryosuke Niwa",
        "email": "rniwa@webkit.org",
        "time": "Fri Jun 12 14:53:57 2026"
      },
      "message": "Use-after-free in Element::dispatchBlurEvent\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d312365\nrdar://174646151\n\nReviewed by Rupin Mittal, Chris Dumez, and Anne van Kesteren.\n\nDeployed more smart pointers to fix the bug.\n\nTest: fast/events/blur-window-with-focus-in-shadow-tree-crash.html\n\n* LayoutTests/fast/events/blur-window-with-focus-in-shadow-tree-crash-expected.txt: Added.\n* LayoutTests/fast/events/blur-window-with-focus-in-shadow-tree-crash.html: Added.\n* Source/WebCore/page/FocusController.cpp:\n(WebCore::dispatchEventsOnWindowAndFocusedElement):\n\nOriginally-landed-as: 305413.673@safari-7624-branch (f045966f731c). rdar://176058798\nCanonical link: https://commits.webkit.org/315098@main\n"
    },
    {
      "commit": "5a62df176e3b50f969cef1d86afff9c007a0f2f1",
      "tree": "1c5dab2c7ee352cfed7c79aa474dac0327cccdf1",
      "parents": [
        "5ccb692f3e65ac32d6d6b83796dd8c9ca0bf1e1b"
      ],
      "author": {
        "name": "Tyler Wilcock",
        "email": "tyler_w@apple.com",
        "time": "Fri Jun 12 14:46:30 2026"
      },
      "committer": {
        "name": "Tyler Wilcock",
        "email": "tyler_w@apple.com",
        "time": "Fri Jun 12 14:46:30 2026"
      },
      "message": "AX: VoiceOver does not expose aria-actions custom actions when the action target is accessibility-ignored\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d316854\nrdar://179286650\n\nReviewed by Dominic Mazzoni.\n\nWhen an element with aria-actions points at action targets that are themselves\naccessibility-ignored, VoiceOver exposed no custom actions for the source element,\neven though the relation itself was built and synced correctly.\n\nThis happened whenever the action target was ignored. As an optimization, we cache\nonly a limited set of properties for nodes that are ignored, unless they are\n\"unconnected\" nodes (not in the exposed tree) that are part of a relation.\n\nHowever, we failed to add the ignored object into AXIsolatedTree::m_unconnectedNodes\nuntil after the oject had already been created, defeating the behavior of caching all\nproperties for objects in relations. Because we didn\u0027t cache all properties for these\nobjects, they computed an empty accname, and thus were not allowed to be exposed as actions.\n\nThis fix is simple: add to m_unconnectedNodes before creating the isolated object.\n\n* LayoutTests/accessibility/aria-actions-ignored-target-expected.txt: Added.\n* LayoutTests/accessibility/aria-actions-ignored-target.html: Added.\n* Source/WebCore/accessibility/isolatedtree/AXIsolatedTree.cpp:\n(WebCore::AXIsolatedTree::addUnconnectedNode):\n\nCanonical link: https://commits.webkit.org/315097@main\n"
    },
    {
      "commit": "5ccb692f3e65ac32d6d6b83796dd8c9ca0bf1e1b",
      "tree": "df90e4dd5127863ac731e6465e91415c2e89222d",
      "parents": [
        "7143ace56abb865760f080d2e558497d06be20e5"
      ],
      "author": {
        "name": "Patrick Griffis",
        "email": "pgriffis@igalia.com",
        "time": "Fri Jun 12 14:43:51 2026"
      },
      "committer": {
        "name": "Patrick Griffis",
        "email": "pgriffis@igalia.com",
        "time": "Fri Jun 12 14:43:51 2026"
      },
      "message": "[WPE] Implement a fallback popup menu\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d310383\n\nReviewed by Carlos Garcia Campos.\n\nWhen using WPE, depending on the backend, it may not have the capability\nof creating a popup menu. In this case we fallback to WebKit rendering\nits own.\n\nThe fallback popup supports all of the styling WebKit supports.\nIt tries to mimic a native OS popup in behavior where possible.\n\n* Source/WebCore/Sources.txt:\n* Source/WebCore/WebCore.xcodeproj/project.pbxproj:\n* Source/WebCore/css/CSSPseudoSelectors.json:\n* Source/WebCore/css/html.css:\n(select::-internal-fallback-popup-menu):\n(select::-internal-fallback-popup-menu-item,):\n(select::-internal-fallback-popup-menu-item-selected):\n(select::-internal-fallback-popup-menu-item:hover,):\n(select::-internal-fallback-popup-menu-group-label):\n(select::-internal-fallback-popup-menu-separator):\n* Source/WebCore/html/FallbackPopupMenu.cpp: Added.\n(WebCore::applyFontCascade):\n(WebCore::applyItemStyle):\n(WebCore::applyMenuStyle):\n(WebCore::FallbackPopupMenu::FallbackPopupMenu):\n(WebCore::FallbackPopupMenu::~FallbackPopupMenu):\n(WebCore::FallbackPopupMenu::show):\n(WebCore::FallbackPopupMenu::hide):\n(WebCore::FallbackPopupMenu::updateFromElement):\n(WebCore::FallbackPopupMenu::updateFromElementTimerFired):\n(WebCore::FallbackPopupMenu::disconnectClient):\n(WebCore::FallbackPopupMenu::itemClicked):\n(WebCore::FallbackPopupMenu::maybeClose):\n(WebCore::FallbackPopupMenu::buildPopupTree):\n(WebCore::FallbackPopupMenu::deletePopupTree):\n* Source/WebCore/html/FallbackPopupMenu.h: Added.\n(WebCore::FallbackPopupMenu::create):\n* Source/WebCore/html/HTMLSelectElement.cpp:\n(WebCore::HTMLSelectElement::menuListDefaultEventHandler):\n* Source/WebCore/html/HTMLSelectElement.h:\n* Source/WebCore/html/LazyLoadVideoObserver.h:\n* Source/WebCore/platform/PopupMenuClient.h:\n(WebCore::PopupMenuClient::showFallbackPopupMenu):\n* Source/WebCore/rendering/svg/RenderSVGText.cpp:\n* Source/WebKit/UIProcess/API/wpe/WebKitPopupMenu.cpp:\n(WebKit::WebKitPopupMenu::showPopupMenu):\n* Source/WebKit/UIProcess/WebPageProxy.cpp:\n* Source/WebKit/UIProcess/WebPageProxyInternals.h:\n* Source/WebKit/UIProcess/WebPopupMenuProxy.h:\n* Source/WebKit/WebProcess/WebCoreSupport/WebChromeClient.cpp:\n(WebKit::WebChromeClient::createPopupMenu const):\n* Source/WebKit/WebProcess/WebCoreSupport/WebPopupMenu.h:\n* Source/WebKit/WebProcess/WebPage/WebPage.cpp:\n(WebKit::WebPage::failedToShowPopupMenu):\n* Source/WebKit/WebProcess/WebPage/WebPage.h:\n* Source/WebKit/WebProcess/WebPage/WebPage.messages.in:\n\nCanonical link: https://commits.webkit.org/315096@main\n"
    },
    {
      "commit": "7143ace56abb865760f080d2e558497d06be20e5",
      "tree": "c57877b2840b92497585b632de59d40f7e5cf889",
      "parents": [
        "a58677958ef8fc58e910606655c7b06191d788dd"
      ],
      "author": {
        "name": "Darryl Parkinson",
        "email": "d_parkinson@apple.com",
        "time": "Fri Jun 12 14:33:57 2026"
      },
      "committer": {
        "name": "Darryl Parkinson",
        "email": "d_parkinson@apple.com",
        "time": "Fri Jun 12 14:33:57 2026"
      },
      "message": "Gate AddOriginAccessAllowListEntry IPC behind AllowTestOnlyIPC\nrdar://171243270\n\nReviewed by Charlie Wolfe and Ryosuke Niwa.\n\nOrigin access allowlist IPC messages on NetworkConnectionToWebProcess\nmodify a process-global allowlist with no validation, allowing a\ncompromised WebContent process to bypass CORS for all connections.\n\nThese messages are only used by TestRunner SPI. Gate them behind\nEnabledBy\u003dAllowTestOnlyIPC so they are rejected unless the test-only\nflag is set.\n\nTest: Tools/TestWebKitAPI/Tests/WebKitCocoa/IPCTestingAPI.mm\n\n* Source/WTF/Scripts/Preferences/UnifiedWebPreferences.yaml:\n* Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.messages.in:\n* Tools/TestWebKitAPI/Tests/WebKitCocoa/IPCTestingAPI.mm:\n(AddOriginAccessAllowListEntryRequiresTestOnlyIPC)):\n(AddOriginAccessAllowListEntryAllowedWithTestOnlyIPC)):\n* Tools/WebKitTestRunner/TestController.cpp:\n(WTR::TestController::resetPreferencesToConsistentValues):\n* Tools/WebKitTestRunner/TestOptions.cpp:\n(WTR::TestOptions::defaults):\n(WTR::TestOptions::keyTypeMapping):\n* Tools/WebKitTestRunner/TestOptions.h:\n(WTR::TestOptions::allowTestOnlyOriginAccessAllowListIPC const):\n\nOriginally-landed-as: 305413.421@rapid/safari-7624.2.5.110-branch (44da09d437d9). rdar://176067091\nCanonical link: https://commits.webkit.org/315095@main\n"
    },
    {
      "commit": "a58677958ef8fc58e910606655c7b06191d788dd",
      "tree": "dc5b21157fbca1d55b2d6cc446da02f4610a31dc",
      "parents": [
        "71eb21b1186a755c8de2c0ef9e7f743ac20f0406"
      ],
      "author": {
        "name": "Taher Ali",
        "email": "taher_ali@apple.com",
        "time": "Fri Jun 12 14:22:37 2026"
      },
      "committer": {
        "name": "Taher Ali",
        "email": "taher_ali@apple.com",
        "time": "Fri Jun 12 14:22:37 2026"
      },
      "message": "Animated GIF freezes when presentation attributes are changed on SVG image referenced by use element\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d314093\nrdar://179414226\n\nReviewed by Said Abou-Hallawa.\n\nWhen an SVG \u003cimage\u003e element displaying an animated GIF is referenced by a\n\u003cuse\u003e element, rapidly changing a presentation attribute like opacity causes\nthe animation to freeze.\n\nEach setAttribute call triggers invalidateInstances(), which rebuilds the\n\u003cuse\u003e shadow tree. The clone\u0027s renderer destruction calls\nRenderImageResource::willBeDestroyed(), which unconditionally calls\nstopAnimation() on the shared BitmapImage. Since the animation timer is\nkilled faster than the frame duration, it never fires to advance frames.\n\nThe previous landing of this fix (313531@main) used CachedImage::isVisibleInViewport()\nto decide whether to stop the animation, but it was reverted because it caused a\nMotionMark performance regression and a crash.\n\nThis version instead introduces CachedImage::numberOfRendererClients(), which\nwalks the client list and counts only renderer clients.\n\nTest: svg/custom/use-animated-image-opacity-change.html\n\n* LayoutTests/fast/images/stopped-animation-deleted-image.html:\n* LayoutTests/svg/custom/resources/animated-gif-for-use-test.gif: Added.\n* LayoutTests/svg/custom/use-animated-image-opacity-change-expected.txt: Added.\n* LayoutTests/svg/custom/use-animated-image-opacity-change.html: Added.\n* Source/WebCore/loader/cache/CachedImage.cpp:\n(WebCore::CachedImage::hasRendererClients const):\n* Source/WebCore/loader/cache/CachedImage.h:\n* Source/WebCore/loader/cache/CachedImageClient.h:\n(WebCore::CachedImageClient::isRendererClient const):\n* Source/WebCore/rendering/RenderImageResource.cpp:\n(WebCore::RenderImageResource::willBeDestroyed):\n* Source/WebCore/rendering/RenderObject.h:\n\nCanonical link: https://commits.webkit.org/315094@main\n"
    },
    {
      "commit": "71eb21b1186a755c8de2c0ef9e7f743ac20f0406",
      "tree": "f65de57fad77760852c768c793d94f8e5723448e",
      "parents": [
        "a8884b8e05e683e3e5022a2034cc4ff5bf98ccc1"
      ],
      "author": {
        "name": "Aakash Jain",
        "email": "aakash_jain@apple.com",
        "time": "Fri Jun 12 13:56:31 2026"
      },
      "committer": {
        "name": "Aakash Jain",
        "email": "aakash_jain@apple.com",
        "time": "Fri Jun 12 13:56:31 2026"
      },
      "message": "[ews] Improve logging for S3 upload in case of failure\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d316988\nrdar://179476116\n\nUnreviewed minor fix.\n\n* Tools/Scripts/upload-file-to-url:\n\nCanonical link: https://commits.webkit.org/315093@main\n"
    },
    {
      "commit": "a8884b8e05e683e3e5022a2034cc4ff5bf98ccc1",
      "tree": "226405b9f43538af949226b839173179264bacc7",
      "parents": [
        "cf16656cdaabfbd898f3c3542a7ad9c95fbbd25c"
      ],
      "author": {
        "name": "Claudio Saavedra",
        "email": "csaavedra@igalia.com",
        "time": "Fri Jun 12 13:45:36 2026"
      },
      "committer": {
        "name": "Claudio Saavedra",
        "email": "csaavedra@igalia.com",
        "time": "Fri Jun 12 13:45:36 2026"
      },
      "message": "Non-unified build fixes for June 12th, 2026\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d316987\n\nUnreviewed build fixes.\n\n* Source/WebCore/accessibility/AccessibilityScrollView.cpp:\n* Source/WebCore/editing/InsertNestedListCommand.cpp:\n* Source/WebCore/editing/ModifySelectionListLevel.cpp:\n* Source/WebCore/editing/RemoveFormatCommand.cpp:\n* Source/WebCore/editing/SimplifyMarkupCommand.cpp:\n* Source/WebCore/html/HTMLMeterElement.cpp:\n* Source/WebCore/inspector/agents/frame/FrameDOMAgent.cpp:\n* Source/WebCore/style/computed/StyleComputedStyleProperties+GettersCustom.cpp:\n* Source/WebCore/style/values/images/StyleObjectViewBox.cpp:\n* Source/WebCore/workers/shared/SharedWorkerScriptLoader.cpp:\n\nCanonical link: https://commits.webkit.org/315092@main\n"
    },
    {
      "commit": "cf16656cdaabfbd898f3c3542a7ad9c95fbbd25c",
      "tree": "959d31921dce3638f60718abc17143244edff452",
      "parents": [
        "41ce48e2d2b7bc97b9a3754ddfc32a8a69f90019"
      ],
      "author": {
        "name": "Adrian Perez de Castro",
        "email": "aperez@igalia.com",
        "time": "Fri Jun 12 13:28:30 2026"
      },
      "committer": {
        "name": "Adrian Perez de Castro",
        "email": "aperez@igalia.com",
        "time": "Fri Jun 12 13:28:30 2026"
      },
      "message": "[GTK][WPE] Expose search inputs as WEBKIT_INPUT_PURPOSE_SEARCH\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d316942\n\nReviewed by Carlos Garcia Campos.\n\nExpose the internal WebCore::InputMode::Search / HTMLInputElement::isSearchField()\nas WEBKIT_INPUT_PURPOSE_SEARCH in the public API for the GTK and WPE ports, and as\nWPE_INPUT_PURPOSE_SEARCH in WPEPlatform.\n\nIn the case of the GTK port the WEBKIT_INPUT_PURPOSE_SEARCH value is folded into\nGTK_INPUT_PURPOSE_FREE_FORM because the toolkit does not provide an equivalent.\nApplications can still use the WebKitInputPurpose value, though.\n\n* Source/WebKit/Shared/glib/InputMethodState.cpp:\n(WebKit::InputMethodState::setPurposeOrHintForInputMode):\n(WebKit::InputMethodState::setPurposeForInputElement):\n* Source/WebKit/Shared/glib/InputMethodState.h:\n* Source/WebKit/Shared/glib/InputMethodState.serialization.in:\n* Source/WebKit/UIProcess/API/glib/InputMethodFilter.cpp:\n(WebKit::toWebKitPurpose):\n* Source/WebKit/UIProcess/API/glib/WebKitInputMethodContext.h.in:\n* Source/WebKit/UIProcess/API/gtk/WebKitInputMethodContextImplGtk.cpp:\n(toGtkInputPurpose):\n* Source/WebKit/UIProcess/API/wpe/WebKitInputMethodContextImplWPE.cpp:\n(toWPEInputPurpose):\n* Source/WebKit/WPEPlatform/wpe/WPEInputMethodContext.h:\n* Tools/TestWebKitAPI/Tests/WebKit/WKPage/glib/TestInputMethodContext.cpp:\n(testWebKitInputMethodContextContentType):\n\nCanonical link: https://commits.webkit.org/315091@main\n"
    },
    {
      "commit": "41ce48e2d2b7bc97b9a3754ddfc32a8a69f90019",
      "tree": "ce8bd21680385722e0d1ec6272ada71b30ee0bd2",
      "parents": [
        "5756012375b90fd63a73eeee8295d88c739bd350"
      ],
      "author": {
        "name": "Carlos Garcia Campos",
        "email": "cgarcia@igalia.com",
        "time": "Fri Jun 12 13:01:39 2026"
      },
      "committer": {
        "name": "Carlos Garcia Campos",
        "email": "cgarcia@igalia.com",
        "time": "Fri Jun 12 13:01:39 2026"
      },
      "message": "Unreviewed. Fix the build\n\nAdd missing include.\n\n* Source/WebCore/Modules/mediacapabilities/MediaCapabilities.cpp:\n\nCanonical link: https://commits.webkit.org/315090@main\n"
    },
    {
      "commit": "5756012375b90fd63a73eeee8295d88c739bd350",
      "tree": "9e5ab382f7147b7932d2d78b574fe43463f8c841",
      "parents": [
        "083f263204a7f4fa1168ce116eaf30cd8c1868b2"
      ],
      "author": {
        "name": "Przemyslaw Gorszkowski",
        "email": "pgorszkowski@igalia.com",
        "time": "Fri Jun 12 12:37:11 2026"
      },
      "committer": {
        "name": "Przemyslaw Gorszkowski",
        "email": "pgorszkowski@igalia.com",
        "time": "Fri Jun 12 12:37:11 2026"
      },
      "message": "[GStreamer] Video element with canvas captureStream source should not use holepunch rendering\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d316297\n\nReviewed by Philippe Normand.\n\nIntroduce a dedicated Canvas device type in CaptureDevice::DeviceType\nto distinguish CanvasCaptureMediaStreamTrack sources from Camera sources.\nUpdate all switch statements and type checks across the mediastream stack to\nhandle Canvas as a video type.\nDisable GStreamer hole-punch rendering for canvas-captured streams since they\nrender via a different path.\n\nNo new tests.\n\nThere is: ManualTests/mediastream/mediastream-canvas-to-video.html, which can\nbe used to test this change. It should behave in the same way with:\nWEBKIT_GST_HOLE_PUNCH_QUIRK\u003dfake and without it.\n\n* Source/WebCore/Modules/mediastream/CanvasCaptureMediaStreamTrack.cpp:\n(WebCore::CanvasCaptureMediaStreamTrack::Source::Source):\n* Source/WebCore/Modules/mediastream/CanvasCaptureMediaStreamTrack.h:\n* Source/WebCore/Modules/mediastream/MediaDeviceInfo.cpp:\n(WebCore::toMediaDeviceInfoKind):\n* Source/WebCore/Modules/mediastream/MediaStreamTrack.cpp:\n(WebCore::MediaStreamTrack::captureState):\n* Source/WebCore/dom/Document.cpp:\n(WebCore::updateCaptureSourceToPageMutedState):\n* Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:\n(WebCore::MediaPlayerPrivateGStreamer::isHolePunchRenderingEnabled const):\n* Source/WebCore/platform/mediastream/CaptureDevice.h:\n* Source/WebCore/platform/mediastream/RealtimeMediaSource.cpp:\n(WebCore::toSourceType):\n* Source/WebCore/platform/mediastream/gstreamer/GStreamerCaptureDeviceManager.cpp:\n(WebCore::GStreamerCaptureDeviceManager::refreshCaptureDevices):\n* Source/WebCore/platform/mock/MockRealtimeMediaSourceCenter.cpp:\n\nCanonical link: https://commits.webkit.org/315089@main\n"
    },
    {
      "commit": "083f263204a7f4fa1168ce116eaf30cd8c1868b2",
      "tree": "57b6ef05f73b5ca46840d3bd81b66f0cd2faff07",
      "parents": [
        "3919bd62ec83c09518a8000ff29870a613d22e5b"
      ],
      "author": {
        "name": "Przemyslaw Gorszkowski",
        "email": "pgorszkowski@igalia.com",
        "time": "Fri Jun 12 12:04:33 2026"
      },
      "committer": {
        "name": "Przemyslaw Gorszkowski",
        "email": "pgorszkowski@igalia.com",
        "time": "Fri Jun 12 12:04:33 2026"
      },
      "message": "navigator.mediaCapabilities wrapper should not become GC-collectable before its navigator object\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d315684\n\nReviewed by Ryosuke Niwa.\n\nnavigator.mediaCapabilities wrapper should not become GC-collectable before its navigator object.\nThe MediaCapabilities interface is annotated [SameObject] in the spec:\nhttps://www.w3.org/TR/media-capabilities/#idl-index\nIt means that navigator.mediaCapabilities must return the same object on every access.\n\nSee: https://github.com/WebPlatformForEmbedded/WPEWebKit/pull/1678\n\nOriginal author: Andrzej Surdej (https://github.com/asurdej-comcast)\n\nUpdated existing LayoutTest with mediaCapabilities case.\n\n* LayoutTests/fast/dom/navigator-property-gc-after-frame-detach-expected.txt:\n* LayoutTests/fast/dom/navigator-property-gc-after-frame-detach.html:\n* Source/WebCore/Modules/mediacapabilities/MediaCapabilities.cpp:\n(WebCore::MediaCapabilities::MediaCapabilities):\n(WebCore::MediaCapabilities::navigator):\n* Source/WebCore/Modules/mediacapabilities/MediaCapabilities.h:\n(WebCore::MediaCapabilities::create):\n* Source/WebCore/Modules/mediacapabilities/MediaCapabilities.idl:\n* Source/WebCore/Modules/mediacapabilities/NavigatorMediaCapabilities.cpp:\n(WebCore::NavigatorMediaCapabilities::NavigatorMediaCapabilities):\n(WebCore::NavigatorMediaCapabilities::from):\n* Source/WebCore/Modules/mediacapabilities/NavigatorMediaCapabilities.h:\n* Source/WebCore/Modules/mediacapabilities/WorkerNavigatorMediaCapabilities.cpp:\n(WebCore::WorkerNavigatorMediaCapabilities::WorkerNavigatorMediaCapabilities):\n(WebCore::WorkerNavigatorMediaCapabilities::from):\n* Source/WebCore/Modules/mediacapabilities/WorkerNavigatorMediaCapabilities.h:\n\nCanonical link: https://commits.webkit.org/315088@main\n"
    },
    {
      "commit": "3919bd62ec83c09518a8000ff29870a613d22e5b",
      "tree": "bf62d1fef96b4cf0b2f275435b5d918ca8c19350",
      "parents": [
        "7abc2361027ff0b9cd4f8d6c284f9ef89205eb5a"
      ],
      "author": {
        "name": "Chris Dumez",
        "email": "cdumez@apple.com",
        "time": "Fri Jun 12 11:27:55 2026"
      },
      "committer": {
        "name": "Chris Dumez",
        "email": "cdumez@apple.com",
        "time": "Fri Jun 12 11:27:55 2026"
      },
      "message": "ScreenTime data removal uses an unanchored host suffix match, deleting unrelated sites\u0027 data\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d316884\n\nReviewed by Abrar Rahman Protyasha.\n\nScreenTimeWebsiteDataSupport::removeScreenTimeData() built a set of host\nstrings from the origins to remove, then for every URL in the ScreenTime\nhistory deleted it when [[url host] hasSuffix:domainString]. A bare\nhasSuffix: check has no label boundary, so removing ScreenTime data for\n\"apple.com\" also matched and deleted history for \"notapple.com\",\n\"myapple.com\", \"evilapple.com\", etc. — any host that happens to end with\nthe literal suffix.\n\nWebsiteDataRecord::hostIsInDomain() already implements the correct\nsemantics: a suffix match additionally requires either an exact match or\nthat the character preceding the suffix is \u0027.\u0027. Add an NSString-based\nequivalent and use it in place of the bare hasSuffix: check, so that\n\"apple.com\" matches \"apple.com\" and \"www.apple.com\" but not \"notapple.com\".\n\nThe comparison is kept in NSString space because the\nfetchAllHistoryWithCompletionHandler completion block may run off the\nmain thread, where WTF::String ref-counting is not thread-safe. Also\n break out of the inner loop once a URL matches (avoiding a redundant\ndeleteHistoryForURL: for the same URL), and skip empty hosts when\nbuilding the match set.\n\nTest: ScreenTime.RemoveDataDoesNotMatchUnanchoredHostSuffix\n\n* Source/WebKit/UIProcess/WebsiteData/Cocoa/ScreenTimeWebsiteDataSupport.mm:\n(WebKit::ScreenTimeWebsiteDataSupport::hostIsInDomain):\n(WebKit::ScreenTimeWebsiteDataSupport::removeScreenTimeData):\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/ScreenTime.mm:\n(TEST(ScreenTime, RemoveDataDoesNotMatchUnanchoredHostSuffix)):\n\nCanonical link: https://commits.webkit.org/315087@main\n"
    },
    {
      "commit": "7abc2361027ff0b9cd4f8d6c284f9ef89205eb5a",
      "tree": "2b7588912533d086f067fa4234cebd49d780c49f",
      "parents": [
        "6a4f65a5bcc38e610c91fe957a47f5463242c70b"
      ],
      "author": {
        "name": "Nikolas Zimmermann",
        "email": "nzimmermann@igalia.com",
        "time": "Fri Jun 12 11:24:01 2026"
      },
      "committer": {
        "name": "Nikolas Zimmermann",
        "email": "zimmermann@kde.org",
        "time": "Fri Jun 12 11:24:01 2026"
      },
      "message": "[CMake] Glob all Source/cmake/*.cmake files when deciding to remove CMakeCache.txt\n\nReviewed by Carlos Alberto Lopez Perez.\n\nshouldRemoveCMakeCache() only checked a hand-picked subset of cmake files\n(the port Options file, OptionsCommon and WebKitCompilerFlags) against the\ncache mtime, so edits to other configuration files that influence the\ngenerated cache -- WebKitFeatures, VersioningUtils, did not trigger an\nautomatic reconfigure.\n\nReplace the enumerated checks (and the redundant Windows-only OptionsWin\nspecial case) with a glob over Source/cmake/*.cmake, so every current and\nfuture module is covered automatically.\n\n* Tools/Scripts/webkitdirs.pm:\n(shouldRemoveCMakeCache):\n\nCanonical link: https://commits.webkit.org/315086@main\n"
    },
    {
      "commit": "6a4f65a5bcc38e610c91fe957a47f5463242c70b",
      "tree": "51e784d6f3e3d18b0ccd364fa00759c8f1625b0e",
      "parents": [
        "834967406989dc98e038dc03a810f085db79738a"
      ],
      "author": {
        "name": "Philippe Normand",
        "email": "philn@igalia.com",
        "time": "Fri Jun 12 11:02:52 2026"
      },
      "committer": {
        "name": "Philippe Normand",
        "email": "philn@igalia.com",
        "time": "Fri Jun 12 11:02:52 2026"
      },
      "message": "[GStreamer] Migrate MediaStream source element to PadProbeHandle\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d316551\n\nReviewed by Xabier Rodriguez-Calvar.\n\nRefactoring migrating from gst_pad_add_probe to PadProbeHandle.\n\n* Source/WebCore/platform/mediastream/gstreamer/GStreamerMediaStreamSource.cpp:\n(webkitMediaStreamSrcAddTrack):\n(webkitMediaStreamSrcPadProbeCb): Deleted.\n\nCanonical link: https://commits.webkit.org/315085@main\n"
    },
    {
      "commit": "834967406989dc98e038dc03a810f085db79738a",
      "tree": "abcba32ea5f47fcb662faa2009a6ab32a5cd72e2",
      "parents": [
        "efc6c2bff8dfb18f7aab7f2bbc899812180b08d8"
      ],
      "author": {
        "name": "Nikolas Zimmermann",
        "email": "nzimmermann@igalia.com",
        "time": "Fri Jun 12 10:03:29 2026"
      },
      "committer": {
        "name": "Nikolas Zimmermann",
        "email": "zimmermann@kde.org",
        "time": "Fri Jun 12 10:03:29 2026"
      },
      "message": "[LBSE] Position non-layered transformed SVG content in the paint transform recursion\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d316943\n\nReviewed by Rob Buis.\n\nAn SVG renderer with a 2D transform but no RenderLayer is painted by walking\nthe transform recursion in paintRendererByApplyingTransformForSVG() rather than\nthrough the RenderLayer paint paths. This makes that recursion position containers,\ntext and shape content correctly without a self-painting layer.\n\ncomputeRendererTransform() undoes the alignReferenceBox shift that\ntransformReferenceBoxRect() applies to non-layer renderers. That correction was\nkeyed on RenderSVGModelObject, which excludes RenderSVGText - it now applies to\nevery non-layered isSVGLayerAwareRenderer(), so text is covered too.\n\npaintRendererByApplyingTransformForSVG() folds its separate container and leaf\nbranches into a shared paintInScope() helper. A renderer paints its own content\nat paintOffset + currentSVGLayoutLocation(), so at a transform-scope root the\nself offset is (nominal - current), placing content at its visual top-left.\nThis drives shapes, images, text and a container\u0027s own outline uniformly -\ncontainers also recurse into their children from the nominal origin, with the\nanonymous outermost viewport starting at (0, 0).\n\nThe code stays dormant until requiresLayer() becomes conditional.\nAdd a test for outlines on transformed containers that was broken in the\nconditional layer LBSE variant, and is now fixed.\n\nTests: svg/transforms/transformed-container-self-outline.svg\n\n* LayoutTests/svg/transforms/transformed-container-self-outline-expected.svg: Added.\n* LayoutTests/svg/transforms/transformed-container-self-outline.svg: Added.\n* Source/WebCore/rendering/RenderLayerSVGAdditions.cpp:\n(WebCore::RenderLayer::computeRendererTransformForSVG const):\n(WebCore::RenderLayer::paintRendererByApplyingTransformForSVG):\n\nCanonical link: https://commits.webkit.org/315084@main\n"
    },
    {
      "commit": "efc6c2bff8dfb18f7aab7f2bbc899812180b08d8",
      "tree": "cc639a88379418965156fbdf82fb30c7ad5aa23f",
      "parents": [
        "df6bba12ff65e9a48e20fe19feec614836b48bde"
      ],
      "author": {
        "name": "Pascoe",
        "email": "pascoe@apple.com",
        "time": "Fri Jun 12 09:11:16 2026"
      },
      "committer": {
        "name": "Pascoe",
        "email": "pascoe@apple.com",
        "time": "Fri Jun 12 09:11:16 2026"
      },
      "message": "Un-unify WKAttachmentTests.mm to fix build failure under certain configurations\nrdar://179455874\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d316983\n\nUnreviewed, build fix.\n\nIncluding this file in unified sources causes issues under some configurations.\n\nUn-unify until that\u0027s sorted.\n\n* Tools/TestWebKitAPI/SourcesCocoa.txt:\n\nCanonical link: https://commits.webkit.org/315083@main\n"
    },
    {
      "commit": "df6bba12ff65e9a48e20fe19feec614836b48bde",
      "tree": "29ed1693f65459830e45836b5bc8fa33aa14812f",
      "parents": [
        "e7614b2ab45ae73216ade1edda829ffe0fb62392"
      ],
      "author": {
        "name": "Sergio Villar Senin",
        "email": "svillar@igalia.com",
        "time": "Fri Jun 12 07:47:44 2026"
      },
      "committer": {
        "name": "Sergio Villar Senin",
        "email": "svillar@igalia.com",
        "time": "Fri Jun 12 07:47:44 2026"
      },
      "message": "[WebXR] WebGL extensions not enabled when using xrCompatible context creation attribute\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d316540\n\nReviewed by Dan Glastonbury.\n\nWhenever a XR experience requests a XR compatible canvas to a GL context\nit must be ensured that all the required GL extensions are available.\nThat is done by the different implementations of\nenabledRequiredWebXRExtensions().\n\nThe aforementioned call is the recommended way to create an XR\ncompatible canvas because it\u0027s asynchronous. However there is also the\npossibility of creating them using the xrCompatible boolean flag at\ncreation time. If that method was used the required list of GL\nextensions was not enforced. We must call\nenableRequiredWebXRExtensions() also in that case.\n\n* Source/WebCore/platform/graphics/android/GraphicsContextGLTextureMapperAndroid.cpp:\n(WebCore::GraphicsContextGLTextureMapperAndroid::platformInitializeExtensions):\n(WebCore::GraphicsContextGLTextureMapperAndroid::enableRequiredWebXRExtensions):\n(WebCore::GraphicsContextGLTextureMapperAndroid::enableRequiredWebXRExtensionsImpl):\n* Source/WebCore/platform/graphics/android/GraphicsContextGLTextureMapperAndroid.h:\n* Source/WebCore/platform/graphics/gbm/GraphicsContextGLTextureMapperGBM.cpp:\n(WebCore::GraphicsContextGLTextureMapperGBM::platformInitializeExtensions):\n(WebCore::GraphicsContextGLTextureMapperGBM::enableRequiredWebXRExtensions):\n(WebCore::GraphicsContextGLTextureMapperGBM::enableRequiredWebXRExtensionsImpl):\n* Source/WebCore/platform/graphics/gbm/GraphicsContextGLTextureMapperGBM.h:\n\nCanonical link: https://commits.webkit.org/315082@main\n"
    },
    {
      "commit": "e7614b2ab45ae73216ade1edda829ffe0fb62392",
      "tree": "bd5b43d1062a2d025dd245e6fa39a6533ba2f3c8",
      "parents": [
        "7c4cdd40963bfc1179b43e178a58277afbfb9be0"
      ],
      "author": {
        "name": "Luke Warlow",
        "email": "lwarlow@igalia.com",
        "time": "Fri Jun 12 07:22:48 2026"
      },
      "committer": {
        "name": "Luke Warlow",
        "email": "lwarlow@igalia.com",
        "time": "Fri Jun 12 07:22:48 2026"
      },
      "message": "Enable Close Watcher API in preview\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d315502\n\nReviewed by Anne van Kesteren.\n\nThis enables the Close Watcher API flag in preview and merges the flag with\nthat for the closedby attribute.\n\nMany closedby tests rely on the behaviour provided by close watchers,\nso it doesn\u0027t make sense to keep them separate.\n\nRename the setTheCloseWatcher() to setCloseWatcher() per feedback.\n\n* Source/WTF/Scripts/Preferences/UnifiedWebPreferences.yaml:\n* Source/WebCore/dom/Document.cpp:\n(WebCore::Document::activeCloseableDialog const): Deleted.\n* Source/WebCore/dom/Document.h:\n* Source/WebCore/html/HTMLDialogElement.cpp:\n(WebCore::HTMLDialogElement::insertionSteps):\n(WebCore::HTMLDialogElement::postConnectionSteps):\n(WebCore::HTMLDialogElement::removingSteps):\n(WebCore::HTMLDialogElement::attributeChanged):\n(WebCore::HTMLDialogElement::setupSteps):\n(WebCore::HTMLDialogElement::setCloseWatcher):\n(WebCore::HTMLDialogElement::setTheCloseWatcher): Deleted.\n* Source/WebCore/html/HTMLDialogElement.h:\n* Source/WebCore/html/HTMLDialogElement.idl:\n* Source/WebCore/page/EventHandler.cpp:\n(WebCore::EventHandler::defaultKeyboardEventHandler):\n* Source/WebCore/page/PointerCaptureController.cpp:\n(WebCore::PointerCaptureController::pointerEventWillBeDispatched):\n\nCanonical link: https://commits.webkit.org/315081@main\n"
    },
    {
      "commit": "7c4cdd40963bfc1179b43e178a58277afbfb9be0",
      "tree": "30ea78b9927879d1bd8d10b39774364c11cbd979",
      "parents": [
        "0c895f72ea62c68760daa412615d7d750c8d373a"
      ],
      "author": {
        "name": "Ahmad Saleem",
        "email": "ahmad.saleem792+github@gmail.com",
        "time": "Fri Jun 12 07:18:13 2026"
      },
      "committer": {
        "name": "Ahmad Saleem",
        "email": "ahmad.saleem792@gmail.com",
        "time": "Fri Jun 12 07:18:13 2026"
      },
      "message": "[SVG] text-orientation does not affect glyph orientation in SVG \u003ctext\u003e\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d315190\nrdar://178044217\n\nReviewed by Nikolas Zimmermann.\n\nSVG \u003ctext\u003e ignored the CSS \u0027text-orientation\u0027 property when computing the\nper-glyph rotation in vertical writing modes. The value is parsed, computed\nand inherited like any other property, but SVGTextLayoutEngineBaseline only\never consulted the deprecated \u0027glyph-orientation-vertical\u0027 property, so\n\u0027mixed\u0027 / \u0027upright\u0027 / \u0027sideways\u0027 had no effect on the rendered glyphs or on\nSVGTextContentElement.getRotationOfChar().\n\nIn addition, the sideways-rl / sideways-lr writing modes did not typeset\nglyphs sideways: they fell through to the per-character UAX#50 path instead\nof rotating every glyph a quarter turn toward the block direction.\n\nThis patch makes calculateGlyphOrientationAngle() honor the writing mode and\n\u0027text-orientation\u0027 per SVG2 / CSS Writing Modes 3:\n\n- sideways-rl / sideways-lr: every glyph is rotated a quarter turn\n  (clockwise for sideways-rl, counter-clockwise for sideways-lr),\n  independent of \u0027text-orientation\u0027 and the character\u0027s intrinsic vertical\n  orientation. The counter-clockwise case returns 270deg so the existing\n  advance/orientation-shift handling applies; getRotationOfChar() reports it\n  as -90 via the atan2-based extraction.\n- vertical-rl / vertical-lr: \u0027text-orientation\u0027 determines the orientation\n  (upright -\u003e 0deg, sideways -\u003e 90deg). The initial \u0027mixed\u0027 value falls back\n  to \u0027glyph-orientation-vertical\u0027, preserving the legacy property when\n  \u0027text-orientation\u0027 is unset.\n\n* LayoutTests/imported/w3c/web-platform-tests/svg/text/scripted/getrotationofchar-expected.txt: Progressions\n* LayoutTests/imported/w3c/web-platform-tests/svg/text/scripted/getstartpositionofchar-expected.txt: Rebaseline\n* Source/WebCore/rendering/svg/SVGTextLayoutEngineBaseline.cpp:\n(WebCore::SVGTextLayoutEngineBaseline::calculateGlyphOrientationAngle const):\n\nCanonical link: https://commits.webkit.org/315080@main\n"
    },
    {
      "commit": "0c895f72ea62c68760daa412615d7d750c8d373a",
      "tree": "b4e74dfb36db361a26fb89dc05d93391c915b14e",
      "parents": [
        "ca82e8080fe03ee8363136aff9ec0c1b4a683b78"
      ],
      "author": {
        "name": "Lauro Moura",
        "email": "lmoura@igalia.com",
        "time": "Fri Jun 12 07:15:29 2026"
      },
      "committer": {
        "name": "Carlos Garcia Campos",
        "email": "cgarcia@igalia.com",
        "time": "Fri Jun 12 07:15:29 2026"
      },
      "message": "[GTK][WPE] Fix crash in SkiaGLContext destructor when EGL is torn down during process exit\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d315115\n\nReviewed by Carlos Garcia Campos.\n\nThe ThreadedCompositor constructor allocates and passes to the\ncompositor thread a SkiaGLContext, but currently it does not clear such\ncontext on the cleanup path (i.e. the invalidate() path).\n\nThis behavior may lead to crashes where the compositor thread might end\nup accessing EGL resources that are already being torn down by EGL\natexit handlers from the main thread. For example, this seems to be\nquite present in some high-churn scenarios like the WebDriver tests.\n\nThis commit fixes this by ensuring the compositor thread releases the\nEGL context it holds in the invalidation path, mirroring the allocation\nfrom the constructor.\n\n* Source/WebCore/platform/graphics/skia/PlatformDisplaySkia.cpp:\n(WebCore::PlatformDisplay::setSkiaGLContextForCurrentThread):\n* Source/WebKit/WebProcess/WebPage/CoordinatedGraphics/ThreadedCompositor.cpp:\n(WebKit::ThreadedCompositor::invalidate):\n\nCanonical link: https://commits.webkit.org/315079@main\n"
    },
    {
      "commit": "ca82e8080fe03ee8363136aff9ec0c1b4a683b78",
      "tree": "a1c41ea7159c5b13ca78dc835b41e77f3ebc2541",
      "parents": [
        "1b8d46aa9ed65f2fcfa385f01a24ad5b569b225e"
      ],
      "author": {
        "name": "Tyler Wilcock",
        "email": "tyler_w@apple.com",
        "time": "Fri Jun 12 05:38:04 2026"
      },
      "committer": {
        "name": "Tyler Wilcock",
        "email": "tyler_w@apple.com",
        "time": "Fri Jun 12 05:38:04 2026"
      },
      "message": "AX: VoiceOver can jump to the top of the page when navigating to an element that immediately becomes ignored via JS\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d316617\nrdar://179065364\n\nReviewed by Dominic Mazzoni.\n\nVoiceOver\u0027s AnyType navigation (VO-Right) uses the accessibility search predicate\nwith immediateDescendantsOnly\u003dYES. To find the next element, AXSearchManager\u0027s\nappendChildrenToArray() locates the start object among the container\u0027s unignored\nchildren (crossFrameUnignoredChildren()) and collects the children after it.\n\nWhen the start object can\u0027t be located in those children, appendChildrenToArray fell\nthrough to returning the first child for a forward search, which can potentially\nmove a VoiceOver user very far back in the page.\n\nThe start object can fail to be located when it became ignored after a dynamic\nupdate. For example, a previous navigation could trigger a JS event handler that\nmakes an element become ignored.\n\nIn this scenario, rather than starting the walk from an object that can no longer be\nlocated, resolve the positioning start up front to the nearest unignored element in\nthe resume direction: the unignored element just before the start for a forward\nsearch, just after it for a backward search, found by stepping through the\nincluding-ignored tree (previousInPreOrder()/nextInPreOrder()). The existing\nparent-walk then resumes from there as usual.\n\ncriteria.startObject is deliberately left unchanged, so relative search keys\n(SameType, DifferentType, HeadingSameLevel, and similar) still compare candidates\nagainst the original start rather than the resolved neighbor.\n\n* LayoutTests/accessibility/search-predicate-ignored-start-backward-expected.txt: Added.\n* LayoutTests/accessibility/search-predicate-ignored-start-backward.html: Added.\n* LayoutTests/accessibility/search-predicate-ignored-start-no-loop-to-top-expected.txt: Added.\n* LayoutTests/accessibility/search-predicate-ignored-start-no-loop-to-top.html: Added.\n* LayoutTests/accessibility/search-predicate-ignored-start-non-immediate-expected.txt: Added.\n* LayoutTests/accessibility/search-predicate-ignored-start-non-immediate.html: Added.\n* LayoutTests/accessibility/search-predicate-ignored-start-relative-search-key-expected.txt: Added.\n* LayoutTests/accessibility/search-predicate-ignored-start-relative-search-key.html: Added.\n* LayoutTests/platform/glib/TestExpectations:\n* Source/WebCore/accessibility/AXCoreObject.cpp:\n(WebCore::AXCoreObject::previousInPreOrder):\n* Source/WebCore/accessibility/AXCoreObject.h:\n* Source/WebCore/accessibility/AXSearchManager.cpp:\n(WebCore::AXSearchManager::findMatchingObjectsInternalAsStream):\n\nCanonical link: https://commits.webkit.org/315078@main\n"
    },
    {
      "commit": "1b8d46aa9ed65f2fcfa385f01a24ad5b569b225e",
      "tree": "a44d469487e79eff50fe41a2f2366f14ee0b1e75",
      "parents": [
        "ac523e3ec970a4417e31472b5212ee0ab5f87597"
      ],
      "author": {
        "name": "WebKit Revert Bot",
        "email": "revert-bot@webkit.org",
        "time": "Fri Jun 12 05:02:40 2026"
      },
      "committer": {
        "name": "Keith Miller",
        "email": "keith_miller@apple.com",
        "time": "Fri Jun 12 05:02:40 2026"
      },
      "message": "Unreviewed, reverting 315076@main.\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d316969\n\nbroke mac cmake build downstream of JSC\n\nReverted changeset:\n\n\"[CMake] LowLevelInterpreterLib shouldn\u0027t serialize with the rest of JSC\"\n\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d316869\nhttps://commits.webkit.org/315076@main\nCanonical link: https://commits.webkit.org/315077@main\n"
    },
    {
      "commit": "ac523e3ec970a4417e31472b5212ee0ab5f87597",
      "tree": "105f5cdabd7a5610aa5b3c48f5174eeedae30f0b",
      "parents": [
        "7830cc6341b519edd8ffa9726c0bebc1715d52da"
      ],
      "author": {
        "name": "Keith Miller",
        "email": "keith_miller@apple.com",
        "time": "Fri Jun 12 04:18:09 2026"
      },
      "committer": {
        "name": "Keith Miller",
        "email": "keith_miller@apple.com",
        "time": "Fri Jun 12 04:18:09 2026"
      },
      "message": "[CMake] LowLevelInterpreterLib shouldn\u0027t serialize with the rest of JSC\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d316869\nrdar://179296313\n\nReviewed by Geoffrey Garen.\n\nEvery JavaScriptCore translation unit was waiting for LLIntAssembly.h\ngeneration before it could begin compiling, even though only\nLowLevelInterpreter.cpp uses the header.\n\nThe serialization came from two CMake behaviors combining:\n\n1. LLIntAssembly.h was listed as a source of LowLevelInterpreterLib,\n    which put it into the target\u0027s compile-ordering phony.\n2. Consuming the target as $\u003cTARGET_OBJECTS:...\u003e propagated that\n    phony as an order-only dependency to JavaScriptCore\u0027s compile-\n    ordering phony, which all of its unified sources transitively\n    depend on.\n\nInstead of adding LowLevelInterpreterLib as a SOURCE link against the\nobject file as a PRIVATE_LIBRARY by name. LowLevelInterpreter.cpp.o\nstill has a direct file-level dependency on LLIntAssembly.h, but no\npropagation reaches JavaScriptCore, so unified sources can compile in\nparallel with offlineasm.\n\nCanonical link: https://commits.webkit.org/315076@main\n"
    },
    {
      "commit": "7830cc6341b519edd8ffa9726c0bebc1715d52da",
      "tree": "a44d469487e79eff50fe41a2f2366f14ee0b1e75",
      "parents": [
        "177aa8b796d47768ec1b52ffc37bf92e6659b596"
      ],
      "author": {
        "name": "Yijia Huang",
        "email": "yijia_huang@apple.com",
        "time": "Fri Jun 12 04:16:08 2026"
      },
      "committer": {
        "name": "Yijia Huang",
        "email": "yijia_huang@apple.com",
        "time": "Fri Jun 12 04:16:08 2026"
      },
      "message": "[JSC][Temporal] Cache ICU UCalendar per TimeZoneID in TimeZoneICUBridge\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d316815\nrdar://179262861\n\nReviewed by Yusuke Suzuki.\n\nTimeZoneICUBridge: Previously every getOffsetNanosecondsFor,\ngetPossibleEpochNanosecondsFor, and getTimeZoneTransition call opened\nand closed a UCalendar via ucal_open/ucal_close per invocation.\n\nThis patch caches one UCalendar per IANA timezone in a static per-process\nTinyLRUCache\u003cTimeZone, RefPtr\u003cTimeZoneCacheEntry\u003e, 8\u003e. Using TimeZone as\nthe key avoids cross-thread String ownership issues and uses the\nalready-resolved canonical ID for comparison. TimeZoneCacheEntry is\nThreadSafeRefCounted so callers hold a RefPtr that keeps the entry alive\neven if the LRU evicts it. Each entry owns its UCalendar via\nunique_ptr\u003cUCalendar, ICUDeleter\u003cucal_close\u003e\u003e so it is properly closed\nwhen evicted and destroyed. Initialization is folded into withTimeZone\nunder the entry lock, no separate atomic flag needed.\n\ngetTimeZoneTransition previously cloned the calendar to query before/after\noffsets at each transition. Since only ucal_setMillis + ucal_get are used\n(no ucal_set field overrides), cal can be reused directly for the queries\nand ucal_clone is eliminated.\n\ngetNamedTimeZoneEpochNanoseconds previously called getOffsetNanosecondsFor\nrecursively while holding the entry lock; that call is now inlined using\ngetOffsetMsAtEpoch to avoid deadlock.\n\nCalendarICUBridge: buildCalendarTemplate now takes const AbstractLocker\u0026\nto document that the caller holds the entry lock. CalendarCacheEntry::cal\nis now unique_ptr\u003cUCalendar, ICUDeleter\u003cucal_close\u003e\u003e for proper cleanup.\nInitialization is folded into withCalendar under the entry lock. Two\nucal_clone calls are eliminated:\n- calendarDateUntil: trialCalOwned clone removed; workCal walks the month\n  loop directly since ucal_setMillis(startMs) resets it afterward.\n- calendarDateFromFields: countCal clone removed; cal counts months then\n  resets via ucal_setMillis(calMs) before advancing to the target month.\n\nCanonical link: https://commits.webkit.org/315075@main\n"
    },
    {
      "commit": "177aa8b796d47768ec1b52ffc37bf92e6659b596",
      "tree": "2ec9ee73a9d9f3930dcf973443ecc821cb7a950b",
      "parents": [
        "54d003b450a00cc0ac4054756a52e78a0e628f1b"
      ],
      "author": {
        "name": "Keith Miller",
        "email": "keith_miller@apple.com",
        "time": "Fri Jun 12 04:10:55 2026"
      },
      "committer": {
        "name": "Keith Miller",
        "email": "keith_miller@apple.com",
        "time": "Fri Jun 12 04:10:55 2026"
      },
      "message": "Move JSC\u0027s non-cell primitive structured cloning into Source/JavaScriptCore\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d316699\nrdar://179152880\n\nReviewed by Yusuke Suzuki.\n\nToday every byte of structured-clone code lives in WebCore\u0027s\nSerializedScriptValue.cpp, even though the wire format encodes\nmany JSC-implemented types (Array, Object, Map, Set, Date,\nRegExp, ArrayBuffer, ...). This is the first patch of a series\nthat moves JSC-type serialization into JSC. Later patches will\nmove the walker, collections, the ArrayBuffer family, and so on.\n\nThis patch introduces three new JSC headers:\n\n- StructuredCloneTags.h owns the full SerializationTag\nenum, the version constants, and the shared\nSerializationReturnCode. WebCore-only tags keep their names but\nare now defined in JSC so the wire format and the version-retry\npath stay coherent in one place.\n\n- CloneBase.h promotes the existing pure-JSC CloneBase out of\nWebCore. It also hosts the SERIALIZE_TRACE macro and the\nverboseCloneTrace flag used by both sides.\n\n- CloneSerializerBase.h and CloneDeserializerBase.h are CRTP\ntemplates constrained by C++20 concepts\n(StructuredCloneSerializerHandler /\nStructuredCloneDeserializerHandler). They handle immediate-value\ntags inline (Undefined, Null, Int, Zero, One, False, True,\nDouble) and dispatch every remaining tag through the Derived\nhooks dumpDerivedTerminal / readDerivedTerminal.\n\nWebCore\u0027s CloneSerializer / CloneDeserializer now derive from\nthese bases. dumpIfTerminal and the immediate-value branch of\nreadTerminal move into JSC. Everything else (DOM tags, the\nwalker, transfer state, version-upgrade retry orchestration)\nstays in WebCore for this patch. The wire format is\nbyte-identical to the previous version.\n\nNo new tests, no behavior change. Covered by existing tests.\n\n* Source/JavaScriptCore/CMakeLists.txt:\n* Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj:\n* Source/JavaScriptCore/runtime/CloneBase.h: Added.\n(JSC::CloneBase::CloneBase):\n(JSC::CloneBase::fail):\n(JSC::CloneBase::objectPoolTags const):\n(JSC::CloneBase::appendObjectPoolTag):\n(JSC::CloneBase::isSafeToRecurse):\n* Source/JavaScriptCore/runtime/CloneDeserializerBase.h: Added.\n(JSC::requires):\n(JSC::StructuredCloneInternal::readLittleEndian):\n(JSC::CloneDeserializerBase::CloneDeserializerBase):\n(JSC::CloneDeserializerBase::readLittleEndian):\n(JSC::CloneDeserializerBase::read):\n(JSC::CloneDeserializerBase::readTag):\n(JSC::CloneDeserializerBase::readTerminalImpl):\n(JSC::CloneDeserializerBase::readTerminal):\n* Source/JavaScriptCore/runtime/CloneSerializerBase.h: Added.\n(JSC::requires):\n(JSC::StructuredCloneInternal::writeLittleEndian):\n(JSC::StructuredCloneInternal::writeLittleEndian\u003cuint8_t\u003e):\n(JSC::CloneSerializerBase::CloneSerializerBase):\n(JSC::CloneSerializerBase::write):\n(JSC::CloneSerializerBase::dumpIfTerminal):\n* Source/JavaScriptCore/runtime/StructuredCloneTags.h: Added.\n(JSC::majorVersionFor):\n(JSC::minorVersionFor):\n(JSC::makeVersion):\n(JSC::currentVersion):\n(JSC::canBeAddedToObjectPool):\n(JSC::name):\n(WTF::printInternal):\n* Source/WebCore/bindings/js/SerializedScriptValue.cpp:\n(WebCore::CloneSerializer::serialize):\n(WebCore::CloneSerializer::CloneSerializer):\n(WebCore::CloneSerializer::dumpDerivedTerminal):\n(WebCore::CloneSerializer::write):\n(WebCore::CloneDeserializer::deserializeString):\n(WebCore::CloneDeserializer::readString):\n(WebCore::CloneDeserializer::isTagExposed const):\n(WebCore::CloneDeserializer::readDerivedTerminal):\n(WebCore::name): Deleted.\n(WTF::printInternal): Deleted.\n(WebCore::canBeAddedToObjectPool): Deleted.\n(WebCore::majorVersionFor): Deleted.\n(WebCore::minorVersionFor): Deleted.\n(WebCore::makeVersion): Deleted.\n(WebCore::currentVersion): Deleted.\n(WebCore::CloneBase::CloneBase): Deleted.\n(WebCore::CloneBase::fail): Deleted.\n(WebCore::CloneBase::objectPoolTags const): Deleted.\n(WebCore::CloneBase::appendObjectPoolTag): Deleted.\n(WebCore::CloneBase::isSafeToRecurse): Deleted.\n(WebCore::writeLittleEndian): Deleted.\n(WebCore::writeLittleEndian\u003cuint8_t\u003e): Deleted.\n(WebCore::CloneSerializer::dumpImmediate): Deleted.\n(WebCore::CloneSerializer::dumpIfTerminal): Deleted.\n(WebCore::CloneDeserializer::readLittleEndian): Deleted.\n(WebCore::CloneDeserializer::readTag): Deleted.\n(WebCore::CloneDeserializer::readTerminal): Deleted.\n* Source/WebCore/bindings/js/SerializedScriptValue.h:\n\nCanonical link: https://commits.webkit.org/315074@main\n"
    },
    {
      "commit": "54d003b450a00cc0ac4054756a52e78a0e628f1b",
      "tree": "eedfc9c6e01c436d041217fefd99111e2e5234d4",
      "parents": [
        "6a685086c9911b31715b157db67cf81cfd87e091"
      ],
      "author": {
        "name": "Alice Tang",
        "email": "tang.alice.000@gmail.com",
        "time": "Fri Jun 12 03:49:23 2026"
      },
      "committer": {
        "name": "Sammy Gill",
        "email": "sgill26@apple.com",
        "time": "Fri Jun 12 03:49:23 2026"
      },
      "message": "Implement CSS object-view-box parsing and feature flag\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d316220\nrdar://178647990\n\nReviewed by Sammy Gill and Tim Nguyen.\n\nAdd the cssObjectViewBoxEnabled feature flag and implement parsing for\nthe CSS object-view-box property. Accepts none | \u003cbasic-shape-rect\u003e\n(inset(), rect(), xywh()). All three forms canonicalize to InsetFunction\nin the computed style. The round \u003cborder-radius\u003e form of inset() and\nrendering are left for a follow-up.\n\n* Source/WTF/Scripts/Preferences/UnifiedWebPreferences.yaml:\n* Source/WebCore/css/CSSProperties.json:\n* Source/WebCore/css/parser/CSSPropertyParserConsumer+ObjectViewBox.cpp: Added.\n* Source/WebCore/css/parser/CSSPropertyParserConsumer+ObjectViewBox.h: Added.\n* Source/WebCore/css/parser/CSSPropertyParserConsumer+Shapes.cpp:\n* Source/WebCore/css/parser/CSSPropertyParserConsumer+Shapes.h:\n* Source/WebCore/style/StyleBuilderCustom.h:\n* Source/WebCore/style/computed/StyleComputedStyleBase.h:\n* Source/WebCore/style/computed/data/StyleNonInheritedMiscData.cpp:\n* Source/WebCore/style/computed/data/StyleNonInheritedMiscData.h:\n* Source/WebCore/style/values/images/StyleObjectViewBox.cpp: Added.\n* Source/WebCore/style/values/images/StyleObjectViewBox.h: Added.\n\nCanonical link: https://commits.webkit.org/315073@main\n"
    }
  ],
  "next": "6a685086c9911b31715b157db67cf81cfd87e091"
}