[{"author":{"emails":["zalan@apple.com","zbujtas@gmail.com"],"name":"Alan Baradlay"},"branch":"main","hash":"12920a284e78c330070d9a3264014f84b18df8c9","identifier":"319597@main","message":"[line-clamp] text-overflow ellipsis should show on non-clamped content\nhttps://bugs.webkit.org/show_bug.cgi?id=322122\n<rdar://problem/185348784>\n\nReviewed by Antti Koivisto.\n\n  <div style=\"display: -webkit-box; -webkit-box-orient: vertical; -webkit-line-clamp: 3;\n    width: 50px; overflow: hidden; text-overflow: ellipsis; white-space: nowrap\">\n    This content overflows\n  </div>\n\nThere is one line and room for three, so nothing is clamped and text-overflow should end\nthe line with an ellipsis. Instead the line was clipped mid-glyph with no ellipsis at all.\n\nSee https://github.com/w3c/csswg-drafts/issues/10823\n\n* Source/WebCore/layout/formattingContexts/inline/InlineFormattingUtils.cpp:\n(WebCore::Layout::InlineFormattingUtils::lineEndingTruncationPolicy):\n* LayoutTests/TestExpectations:\n\nCanonical link: https://commits.webkit.org/319597@main","order":0,"repository_id":"webkit","timestamp":1787321111},{"author":{"emails":["zalan@apple.com","zbujtas@gmail.com"],"name":"Alan Baradlay"},"branch":"main","hash":"fdbc1f896f5865455335e43a63137772389ed54c","identifier":"319598@main","message":"[cleanup] Replace Document's two render tree booleans with an explicit RenderTreeState\nhttps://bugs.webkit.org/show_bug.cgi?id=322218\n<rdar://problem/185452641>\n\nReviewed by Sam Weinig.\n\nA document's render tree is in one of three states: not built, built, or being taken down. Taking one down is not\ninstantaneous - destroyRenderTree() walks the tree destroying renderers - so for that duration the tree is still\nthere but must not be walked or added to, which is a different situation from there being no tree at all.\n\nTwo booleans covered those three states between them, and neither named the third. hasLivingRenderTree() was\nrenderView() && !renderTreeBeingDestroyed(), so a false answer meant either of the other two and callers could not\ntell which; anyone who needed to went around it and read renderView() directly. \"Living\" invites the question of\nwhether a tree being destroyed counts, which is exactly the ambiguity.\n\n(RenderObject::renderTreeBeingDestroyed() stays for now. It is a forwarder on a different class rather than a second way of\nasking the same question of a Document, and it reads well at its 59 call sites, so only its body moves to the new state.)\n\nNo change in behavior.\n\n* Source/WebCore/dom/Document.h:\n(WebCore::Document::renderTreeState const):\n(WebCore::Document::renderTreeBeingDestroyed const): Deleted.\n(WebCore::Document::hasLivingRenderTree const): Deleted.\n* Source/WebCore/dom/Document.cpp:\n(WebCore::Document::createRenderTree):\n(WebCore::Document::destroyRenderTree):\n(WebCore::Document::topDocument const):\n(WebCore::Document::removedLastRef):\n(WebCore::Document::caretPositionFromPoint):\n(WebCore::Document::updateTextRenderer):\n(WebCore::Document::updateSVGRenderer):\n(WebCore::Document::ensurePendingRenderTreeUpdate):\n(WebCore::Document::styleForElementIgnoringPendingStylesheets):\n(WebCore::Document::didBecomeCurrentDocumentInFrame):\n(WebCore::Document::willBeRemovedFromFrame):\n(WebCore::Document::implicitClose):\n(WebCore::Document::prepareMouseEvent):\n(WebCore::Document::mainFrameDocument const):\n* Source/WebCore/rendering/RenderObjectDocument.h:\n(WebCore::RenderObject::renderTreeBeingDestroyed const):\n* Source/WebCore/rendering/RenderObject.h: Fix a stale comment naming the wrong header.\n* Source/WebCore/accessibility/AXObjectCache.cpp:\n(WebCore::AXObjectCache::notificationPostTimerFired):\n* Source/WebCore/accessibility/AXSearchManager.cpp:\n(WebCore::appendAccessibilityObject):\n* Source/WebCore/accessibility/AccessibilityScrollView.cpp:\n(WebCore::AccessibilityScrollView::webAreaObject const):\n* Source/WebCore/accessibility/isolatedtree/AXIsolatedTree.cpp:\n(WebCore::AXIsolatedTree::updateChildren):\n* Source/WebCore/animation/KeyframeEffect.cpp:\n(WebCore::KeyframeEffect::applyPendingAcceleratedActions):\n* Source/WebCore/dom/Element.cpp:\n(WebCore::Element::clientWidth):\n(WebCore::Element::clientHeight):\n* Source/WebCore/dom/Node.cpp:\n(WebCore::Node::computeEditabilityWithStyle const):\n(WebCore::Node::inRenderedDocument const):\n* Source/WebCore/dom/TreeScope.cpp:\n(WebCore::absolutePointIfNotClipped):\n(WebCore::TreeScope::elementFromPoint):\n(WebCore::TreeScope::elementsFromPoint):\n* Source/WebCore/editing/FrameSelection.cpp:\n(WebCore::FrameSelection::updateSelectionAppearanceNow):\n* Source/WebCore/editing/mac/EditorMac.mm:\n(WebCore::Editor::selectionWillChange):\n* Source/WebCore/html/MediaElementSession.cpp:\n(WebCore::isElementMainContentForPurposesOfAutoplay):\n* Source/WebCore/layout/integration/LayoutIntegrationBoxTreeUpdater.cpp:\n(WebCore::LayoutIntegration::BoxTreeUpdater::tearDown):\n* Source/WebCore/layout/integration/inline/LayoutIntegrationLineLayout.cpp:\n(WebCore::LayoutIntegration::LineLayout::~LineLayout):\n* Source/WebCore/loader/FrameLoader.cpp:\n(WebCore::FrameLoader::clear):\n* Source/WebCore/loader/HistoryController.cpp:\n(WebCore::HistoryController::saveDocumentState):\n* Source/WebCore/loader/ImageLoader.cpp:\n(WebCore::ImageLoader::updateFromElement):\n(WebCore::ImageLoader::dispatchPendingBeforeLoadEvent):\n(WebCore::ImageLoader::dispatchPendingLoadEvent):\n(WebCore::ImageLoader::dispatchPendingErrorEvent):\n* Source/WebCore/page/LocalFrame.cpp:\n(WebCore::LocalFrame::setView):\n* Source/WebCore/page/Page.cpp:\n(WebCore::Page::destroyRenderTrees):\n* Source/WebCore/page/text-extraction/TextExtraction.cpp:\n(WebCore::TextExtraction::resolveMouseTarget):\n* Source/WebCore/rendering/svg/legacy/LegacyRenderSVGResourceContainer.cpp:\n(WebCore::LegacyRenderSVGResourceContainer::markAllClientLayersForInvalidation):\n* Source/WebCore/style/StyleResolveForDocument.cpp:\n(WebCore::Style::resolveForDocument):\n* Source/WebCore/style/StyleScope.cpp:\n(WebCore::Style::Scope::updateActiveStyleSheets):\n(WebCore::Style::Scope::styleSheetsForStyleSheetList):\n* Source/WebKit/WebProcess/WebPage/WebPage.cpp:\n(WebKit::WebPage::didChangeSelection):\n(WebKit::WebPage::discardedComposition):\n(WebKit::WebPage::sendEditorStateUpdate):\n* Source/WebKit/WebProcess/cocoa/VideoPresentationManager.mm:\n(WebKit::inlineVideoFrame):\n\nCanonical link: https://commits.webkit.org/319598@main","order":0,"repository_id":"webkit","timestamp":1787321471},{"author":{"emails":["csaavedra@igalia.com"],"name":"Claudio Saavedra"},"branch":"main","hash":"12b9f977fe4cc62ab847e52c1968a529ead2b6b8","identifier":"319599@main","message":"[GLIB] Use GRefPtrWrapped for the GTlsCertificate IPC serializer\nhttps://bugs.webkit.org/show_bug.cgi?id=322269\n\nReviewed by Carlos Garcia Campos.\n\nMigrate ArgumentCoder<GRefPtr<GTlsCertificate>> to a generated serializer\nusing GRefPtrWrapped. The wire format is unchanged: the certificate chain\nand private key (de)serialize as GByteArray members, so this builds on the\ngenerated GByteArray coder.\n\n* Source/WebKit/PlatformGTK.cmake:\n* Source/WebKit/PlatformWPE.cmake:\n* Source/WebKit/Shared/glib/ArgumentCodersGLib.cpp:\n* Source/WebKit/Shared/glib/ArgumentCodersGLib.h:\n* Source/WebKit/Shared/glib/CoreIPCGTlsCertificate.cpp: Added.\n(WebKit::CoreIPCGTlsCertificate::CoreIPCGTlsCertificate):\n(WebKit::CoreIPCGTlsCertificate::operator GRefPtr<GTlsCertificate> const):\n* Source/WebKit/Shared/glib/CoreIPCGTlsCertificate.h: Added.\n* Source/WebKit/Shared/glib/CoreIPCGTlsCertificate.serialization.in: Added.\n* Source/WebKit/SourcesGTK.txt:\n* Source/WebKit/SourcesWPE.txt:\n\nCanonical link: https://commits.webkit.org/319599@main","order":0,"repository_id":"webkit","timestamp":1787321573},{"author":{"emails":["zalan@apple.com","zbujtas@gmail.com"],"name":"Alan Baradlay"},"branch":"main","hash":"77327f67bb617aa82eda8beb0a0b3abc5b3cb728","identifier":"319600@main","message":"[cleanup] Ask the list marker for its text through one accessor\nhttps://bugs.webkit.org/show_bug.cgi?id=322183\n<rdar://problem/185419069>\n\nReviewed by Antti Koivisto.\n\nNo behavior change.\n\n* Source/WebCore/accessibility/AccessibilityNodeObject.cpp:\n(WebCore::AccessibilityNodeObject::stringValue const):\n* Source/WebCore/accessibility/AccessibilityRenderObject.cpp:\n(WebCore::AccessibilityRenderObject::textUnderElement const):\n(WebCore::AccessibilityRenderObject::stringValue const):\n(WebCore::AccessibilityRenderObject::listMarkerText const):\n* Source/WebCore/accessibility/AccessibilityObject.cpp:\n(WebCore::lineStartListMarkerText):\n(WebCore::AccessibilityObject::listMarkerTextForNodeAndPosition):\n* Source/WebCore/rendering/RenderListItem.cpp:\n(WebCore::RenderListItem::markerText const):\n* Source/WebCore/rendering/RenderListItem.h:\n* Source/WebCore/rendering/RenderListMarker.cpp:\n(WebCore::RenderListMarker::layout):\n(WebCore::RenderListMarker::layoutContentContainer):\n* Source/WebCore/rendering/RenderListMarker.h:\n(WebCore::RenderListMarker::textContent const):\n* Source/WebCore/rendering/RenderTreeAsText.cpp:\n(WebCore::RenderTreeAsText::writeRenderObject):\n(WebCore::markerTextForListItem):\n\nCanonical link: https://commits.webkit.org/319600@main","order":0,"repository_id":"webkit","timestamp":1787322241},{"author":{"emails":["sihui_liu@apple.com"],"name":"Sihui Liu"},"branch":"main","hash":"a74316b16e9a7b2067d23ededbdfebf7741d7e74","identifier":"319601@main","message":"[Site Isolation] Make SiteIsolation tests that need full isolation opt out of shared process mode\nhttps://bugs.webkit.org/show_bug.cgi?id=322156\nrdar://185382380\n\nReviewed by Ryosuke Niwa.\n\nRunning the SiteIsolation API tests in shared process mode makes some of them fail because they expect to be running in\nfull isolation mode, for instance by asserting that two different sites are in two different processes. Those tests need\nto opt out of shared process mode explicitly. This is a step towards making shared process mode the default.\n\nAdd setFeatureEnabled(), which replaces enableFeature() and takes the value rather than hardcoding YES, and build\ndisableSharedProcess() and siteIsolatedViewAndDelegateWithoutSharedProcess() on top of it. Switch NavigationWithIFrames,\nCancelProvisionalLoad and CrossProcessHistoryTraversalCoalesce to the latter. None of their expectations change, and the\nopt-out is a no-op in the current default configuration.\n\nTo keep targeted coverage of shared process mode, add a variant of each of those tests that opts in instead.\nCrossProcessHistoryTraversalCoalesceWithSharedProcess keeps apple.com out of the shared process through the user\ninteraction override, because the traversal it coalesces is only a cross-process one if the two subframes are in\ndifferent processes.\n\n* Tools/Scripts/webkitpy/api_tests/allowlist.txt:\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolation.mm:\n(TestWebKitAPI::enableSiteIsolation):\n(TestWebKitAPI::disableSharedProcess):\n(TestWebKitAPI::siteIsolatedViewWithSharedProcess):\n(TestWebKitAPI::siteIsolatedViewAndDelegateWithoutSharedProcess):\n(TestWebKitAPI::TEST(SiteIsolation, QueryFramesStateAfterGoingBackToCachedPageWithIframe)):\n(TestWebKitAPI::TEST(SiteIsolation, NavigationWithIFrames)):\n(TestWebKitAPI::TEST(SiteIsolation, NavigationWithIFramesWithSharedProcess)):\n(TestWebKitAPI::TEST(SiteIsolation, CancelProvisionalLoad)):\n(TestWebKitAPI::TEST(SiteIsolation, CancelProvisionalLoadWithSharedProcess)):\n(TestWebKitAPI::TEST(SiteIsolation, BFCacheSameSitePageChangesTopDocumentURL)):\n(TestWebKitAPI::TEST(SiteIsolation, BFCacheCrossSitePageKeepsTopDocumentURL)):\n(TestWebKitAPI::(SiteIsolation, SharedProcessExcludesLoopback)):\n(TestWebKitAPI::(SiteIsolation, SelectElementPopupAfterFocusChangesDuringTracking)):\n(TestWebKitAPI::(SiteIsolation, MultiProcessBFCacheCrossSiteEvictionDoesNotCrashIframe)):\n(TestWebKitAPI::(SiteIsolation, MultiProcessBFCacheRestoreWithCrossSiteIframeDoesNotCrash)):\n(TestWebKitAPI::(SiteIsolation, ProvisionalSubframeCommitAfterMainFrameSwapDoesNotCrash)):\n(TestWebKitAPI::(SiteIsolation, MultiProcessBFCacheSameSiteReusedIframeNotFrozen)):\n(TestWebKitAPI::(SiteIsolation, MultiProcessBFCacheRestoreRerendersReattachedIframe)):\n(TestWebKitAPI::(SiteIsolation, MultiProcessBFCacheRepeatedSameSiteSuspendCachesEachEntry)):\n(TestWebKitAPI::(SiteIsolation, MultiProcessBFCacheSameSiteEvictionDoesNotCrashIframe)):\n(TestWebKitAPI::(SiteIsolation, UserGesture)):\n(TestWebKitAPI::(SiteIsolation, CrossProcessHistoryTraversalCoalesce)):\n(TestWebKitAPI::(SiteIsolation, CrossProcessHistoryTraversalCoalesceWithSharedProcess)):\n(TestWebKitAPI::(SiteIsolation, RestoredPageIsRenderedAfterCrossSiteBFCacheRoundTrip)):\n(TestWebKitAPI::(SiteIsolation, RestoredPageWithIframeIsRenderedAfterCrossSiteBFCacheRoundTrip)):\n(TestWebKitAPI::enableFeature): Deleted.\n\nCanonical link: https://commits.webkit.org/319601@main","order":0,"repository_id":"webkit","timestamp":1787323839},{"author":{"emails":["ahmad.saleem792@gmail.com","ahmad.saleem792+github@gmail.com","ahmad_saleem@apple.com"],"name":"Ahmad Saleem"},"branch":"main","hash":"25340120c860b6d135d7b6fc7a36d8cbd17ca0dd","identifier":"319602@main","message":"Canvas 2D hit testing and transform mutations should not require the canvas bitmap\nhttps://bugs.webkit.org/show_bug.cgi?id=322160\nrdar://185387739\n\nReviewed by Kimmo Kinnunen.\n\nisPointInPath(), isPointInStroke(), drawFocusIfNeeded() and all six CTM\nmutators opened with `if (!effectiveDrawingContext()) return;`. That runs\nbuffer() -> allocateImageBuffer(), so a pure geometry query on a fresh\ncanvas committed width * height * 4 bytes plus an IOSurface. Neither\nhit-testing helper uses the context it fetched: Path::contains() is a CG\npath query, and PathCG::strokeContains() builds its own GraphicsContext\nover the 1x1 scratchContext().\n\nIt is also a correctness bug. validateArea() returns false when the area\nis zero, so a canvas with a zero width or height has no bitmap at all.\nHit tests therefore returned false for points genuinely inside the path,\nand every CTM mutation was silently dropped.\n\nThe spec does not permit this. Per the canvas state [1]: \"The rendering\ncontext's bitmaps are not part of the drawing state, as they depend on\nwhether and how the rendering context is bound to a canvas element.\" The\nsame section lists \"The current transformation matrix.\" as the first\ncomponent of the drawing state. Nor is the CTM merely a painting input:\n\"The current transformation matrix is applied to coordinates when\ncreating the current default path, and when painting text, shapes, and\nPath2D objects\" [2]. Dropping a mutation therefore corrupts the path as\nit is built -- which is what we do, by folding the inverse into m_path --\nso the damage does not depend on there being a bitmap to paint into.\n\nBoth hit-testing algorithms are likewise pure geometry once the\nnon-finite check has run [3][4], over inputs that all exist without a\nbacking store: the current default path, of which \"There is only one\ncurrent default path, it is not part of the drawing state\" [5], the CTM,\nand for isPointInStroke() the line styles of the CanvasPathDrawingStyles\nmixin. Firefox already behaves this way; Chrome matches our old behavior.\n\nDrop the check outright in the two hit-testing helpers, move the fetch to\nthe point of use behind `if (auto* c = effectiveDrawingContext())` in the\nmutators so the state update happens either way, and hoist the cheap\nearly-outs above the fetch in drawFocusIfNeededInternal() so the common\nunfocused case no longer allocates.\n\nReordering cannot let state().transform drift from the context CTM:\nm_hasCreatedImageBuffer is only cleared by didUpdateCanvasSizeProperties()\non a size change, which also resets the state stack and clears the path.\n\n[1] https://html.spec.whatwg.org/multipage/canvas.html#the-canvas-state\n[2] https://html.spec.whatwg.org/multipage/canvas.html#transformations\n[3] https://html.spec.whatwg.org/multipage/canvas.html#dom-context-2d-ispointinpath\n[4] https://html.spec.whatwg.org/multipage/canvas.html#dom-context-2d-ispointinstroke\n[5] https://html.spec.whatwg.org/multipage/canvas.html#current-default-path\n\nTests: 2d.path.isPointInPath.nobitmap{,.path2d,.winding,.transform}\n       2d.path.isPointInStroke.nobitmap{,.path2d,.transform}\n\nThose live under html/canvas/{element,offscreen}/path-objects/ and are\ngenerated by /html/canvas/tools/gentest.py from tools/yaml/path-objects.yaml,\nso the seven new YAML entries emit the HTMLCanvasElement, OffscreenCanvas and\nworker flavor of each. All 21 baselines are a FAIL before this change.\n\n* LayoutTests/imported/w3c/web-platform-tests/html/canvas/element/path-objects/2d.path.isPointInPath.nobitmap-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/canvas/element/path-objects/2d.path.isPointInPath.nobitmap.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/canvas/element/path-objects/2d.path.isPointInPath.nobitmap.path2d-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/canvas/element/path-objects/2d.path.isPointInPath.nobitmap.path2d.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/canvas/element/path-objects/2d.path.isPointInPath.nobitmap.transform-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/canvas/element/path-objects/2d.path.isPointInPath.nobitmap.transform.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/canvas/element/path-objects/2d.path.isPointInPath.nobitmap.winding-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/canvas/element/path-objects/2d.path.isPointInPath.nobitmap.winding.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/canvas/element/path-objects/2d.path.isPointInStroke.nobitmap-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/canvas/element/path-objects/2d.path.isPointInStroke.nobitmap.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/canvas/element/path-objects/2d.path.isPointInStroke.nobitmap.path2d-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/canvas/element/path-objects/2d.path.isPointInStroke.nobitmap.path2d.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/canvas/element/path-objects/2d.path.isPointInStroke.nobitmap.transform-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/canvas/element/path-objects/2d.path.isPointInStroke.nobitmap.transform.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/canvas/offscreen/path-objects/2d.path.isPointInPath.nobitmap-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/canvas/offscreen/path-objects/2d.path.isPointInPath.nobitmap.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/canvas/offscreen/path-objects/2d.path.isPointInPath.nobitmap.path2d-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/canvas/offscreen/path-objects/2d.path.isPointInPath.nobitmap.path2d.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/canvas/offscreen/path-objects/2d.path.isPointInPath.nobitmap.path2d.worker-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/canvas/offscreen/path-objects/2d.path.isPointInPath.nobitmap.path2d.worker.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/canvas/offscreen/path-objects/2d.path.isPointInPath.nobitmap.path2d.worker.js: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/canvas/offscreen/path-objects/2d.path.isPointInPath.nobitmap.transform-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/canvas/offscreen/path-objects/2d.path.isPointInPath.nobitmap.transform.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/canvas/offscreen/path-objects/2d.path.isPointInPath.nobitmap.transform.worker-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/canvas/offscreen/path-objects/2d.path.isPointInPath.nobitmap.transform.worker.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/canvas/offscreen/path-objects/2d.path.isPointInPath.nobitmap.transform.worker.js: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/canvas/offscreen/path-objects/2d.path.isPointInPath.nobitmap.winding-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/canvas/offscreen/path-objects/2d.path.isPointInPath.nobitmap.winding.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/canvas/offscreen/path-objects/2d.path.isPointInPath.nobitmap.winding.worker-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/canvas/offscreen/path-objects/2d.path.isPointInPath.nobitmap.winding.worker.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/canvas/offscreen/path-objects/2d.path.isPointInPath.nobitmap.winding.worker.js: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/canvas/offscreen/path-objects/2d.path.isPointInPath.nobitmap.worker-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/canvas/offscreen/path-objects/2d.path.isPointInPath.nobitmap.worker.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/canvas/offscreen/path-objects/2d.path.isPointInPath.nobitmap.worker.js: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/canvas/offscreen/path-objects/2d.path.isPointInStroke.nobitmap-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/canvas/offscreen/path-objects/2d.path.isPointInStroke.nobitmap.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/canvas/offscreen/path-objects/2d.path.isPointInStroke.nobitmap.path2d-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/canvas/offscreen/path-objects/2d.path.isPointInStroke.nobitmap.path2d.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/canvas/offscreen/path-objects/2d.path.isPointInStroke.nobitmap.path2d.worker-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/canvas/offscreen/path-objects/2d.path.isPointInStroke.nobitmap.path2d.worker.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/canvas/offscreen/path-objects/2d.path.isPointInStroke.nobitmap.path2d.worker.js: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/canvas/offscreen/path-objects/2d.path.isPointInStroke.nobitmap.transform-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/canvas/offscreen/path-objects/2d.path.isPointInStroke.nobitmap.transform.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/canvas/offscreen/path-objects/2d.path.isPointInStroke.nobitmap.transform.worker-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/canvas/offscreen/path-objects/2d.path.isPointInStroke.nobitmap.transform.worker.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/canvas/offscreen/path-objects/2d.path.isPointInStroke.nobitmap.transform.worker.js: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/canvas/offscreen/path-objects/2d.path.isPointInStroke.nobitmap.worker-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/canvas/offscreen/path-objects/2d.path.isPointInStroke.nobitmap.worker.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/canvas/offscreen/path-objects/2d.path.isPointInStroke.nobitmap.worker.js: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/canvas/isPointInPath-without-bitmap-expected.txt: Removed.\n* LayoutTests/imported/w3c/web-platform-tests/html/canvas/isPointInPath-without-bitmap.html: Removed.\n* LayoutTests/imported/w3c/web-platform-tests/html/canvas/isPointInStroke-without-bitmap-expected.txt: Removed.\n* LayoutTests/imported/w3c/web-platform-tests/html/canvas/isPointInStroke-without-bitmap.html: Removed.\n* Source/WebCore/html/canvas/CanvasRenderingContext2D.cpp:\n(WebCore::CanvasRenderingContext2D::drawFocusIfNeededInternal):\n* Source/WebCore/html/canvas/CanvasRenderingContext2DBase.cpp:\n(WebCore::CanvasRenderingContext2DBase::scale):\n(WebCore::CanvasRenderingContext2DBase::rotate):\n(WebCore::CanvasRenderingContext2DBase::translate):\n(WebCore::CanvasRenderingContext2DBase::transform):\n(WebCore::CanvasRenderingContext2DBase::setTransform):\n(WebCore::CanvasRenderingContext2DBase::resetTransform):\n(WebCore::CanvasRenderingContext2DBase::isPointInPathInternal):\n(WebCore::CanvasRenderingContext2DBase::isPointInStrokeInternal):\n\nCanonical link: https://commits.webkit.org/319602@main","order":0,"repository_id":"webkit","timestamp":1787325310},{"author":{"emails":["mwyrzykowski@apple.com"],"name":"Mike Wyrzykowski"},"branch":"main","hash":"d08b07cb04750fb136385b8f89616aca494429a4","identifier":"319603@main","message":"Add \"snorm10-10-10-2\" to enum GPUVertexFormat.\nhttps://bugs.webkit.org/show_bug.cgi?id=322155\nrdar://185379686\n\nReviewed by Dan Glastonbury.\n\nAdd missing format now required by the specification.\n\n* Source/WebCore/Modules/WebGPU/GPUVertexFormat.h:\n(WebCore::convertToBacking):\n* Source/WebCore/Modules/WebGPU/GPUVertexFormat.idl:\n* Source/WebCore/Modules/WebGPU/Implementation/WebGPUConvertToBackingContext.cpp:\n(WebCore::WebGPU::ConvertToBackingContext::convertToBacking):\n* Source/WebCore/Modules/WebGPU/InternalAPI/WebGPU.serialization.in:\n* Source/WebCore/Modules/WebGPU/InternalAPI/WebGPUVertexFormat.h:\n* Source/WebGPU/WebGPU/RenderPipeline.mm:\n(WebGPU::vertexFormat):\n(WebGPU::vertexFormatSize):\n(WebGPU::name):\n(WebGPU::formatType):\n* Source/WebGPU/WebGPU/WebGPU.h:\n* Source/WebKit/GPUProcess/graphics/Model/WebKitMesh.mm:\n(WebModel::toMetal):\n* Source/WebKit/WebProcess/Model/ModelInlineConverters.h:\n(WebKit::toVertexFormat):\n\nTest:\n\n* LayoutTests/http/tests/webgpu/webgpu/api/operation/vertex_state/correctness.spec.js:\n(makeRgb10a2Signed):\n(normalizeRgb10a2Signed):\n(VertexStateTest.prototype.generateTestData):\n* LayoutTests/http/tests/webgpu/webgpu/capability_info.js:\n\nCanonical link: https://commits.webkit.org/319603@main","order":0,"repository_id":"webkit","timestamp":1787325947},{"author":{"emails":["sam@webkit.org"],"name":"Sam Weinig"},"branch":"main","hash":"0d599a87fc423ce58ec92d1b77326b6ce96007c6","identifier":"319604@main","message":"Remove non-standard Blend node from Style::Calculation tree\nhttps://bugs.webkit.org/show_bug.cgi?id=322209\n\nReviewed by Alan Baradlay.\n\nRemove non-standard Blend node from Style::Calculation tree. The standard\nnodes can be used just as well.\n\n* Source/WebCore/css/calc/CSSCalcOperator.cpp:\n* Source/WebCore/css/calc/CSSCalcOperator.h:\n* Source/WebCore/style/calc/StyleCalculationTree+Conversion.cpp:\n* Source/WebCore/style/calc/StyleCalculationTree+Copy.cpp:\n* Source/WebCore/style/calc/StyleCalculationTree+Evaluation.cpp:\n* Source/WebCore/style/calc/StyleCalculationTree.cpp:\n* Source/WebCore/style/calc/StyleCalculationTree.h:\n\nCanonical link: https://commits.webkit.org/319604@main","order":0,"repository_id":"webkit","timestamp":1787328588},{"author":{"emails":["m_finkel@apple.com","sysrqb@apple.com"],"name":"Matthew Finkel"},"branch":"main","hash":"c52bbb5187e1602b26568547b57440f196bba56a","identifier":"319605@main","message":"Srcdoc iframes bypass SameSite Strict and Lax cookies\nhttps://bugs.webkit.org/show_bug.cgi?id=313220\nrdar://175498842\n\nReviewed by Charlie Wolfe.\n\nWhen we set firstPartyForCookies on a subframe, we check if either:\n\n1) shouldInheritSecurityOriginFromOwner is true for the current document's URL, or\n2) if the current document's URL is same-registrable-domain as the top-level document URL\n\nIn the case of an iframe with srcdoc, shouldInheritSecurityOriginFromOwner\nreturns true (as documented), and this causes us to set the page's mainFrameURL\nas the firstPartyForCookies. We need a conditional exception for\nshouldInheritSecurityOriginFromOwner, but it should take nested iframes into\naccount. This patch adjusts the logic so we inherit the ancestor frame's\nsiteForCookies instead of the page's URL. The same-registrable-domain check\nremains unchanged.\n\nTest: http/tests/cookies/same-site/fetch-in-srcdoc-iframe-inside-cross-origin-iframe.html\n\n* LayoutTests/http/tests/cookies/same-site/fetch-in-srcdoc-iframe-inside-cross-origin-iframe-expected.txt: Added.\n* LayoutTests/http/tests/cookies/same-site/fetch-in-srcdoc-iframe-inside-cross-origin-iframe.html: Added.\n* LayoutTests/http/tests/cookies/same-site/img-from-srcdoc-iframe-inside-cross-origin-iframe-expected.txt: Added.\n* LayoutTests/http/tests/cookies/same-site/img-from-srcdoc-iframe-inside-cross-origin-iframe.html: Added.\n* LayoutTests/http/tests/cookies/same-site/resources/record-image-cookies.py: Added.\n* LayoutTests/http/tests/cookies/same-site/resources/srcdoc-creator-img-inside-cross-origin-iframe.html: Added.\n* LayoutTests/http/tests/cookies/same-site/resources/srcdoc-creator-inside-cross-origin-iframe.html: Added.\n* Source/WebCore/loader/FrameLoader.cpp:\n(WebCore::FrameLoader::setFirstPartyForCookies):\n\nOriginally-landed-as: 305413.948@safari-7624.4-branch (edd74642a6ef). rdar://184744188\nCanonical link: https://commits.webkit.org/319605@main","order":0,"repository_id":"webkit","timestamp":1787328738},{"author":{"emails":["173393835+cupidsity@users.noreply.github.com"],"name":"lilly"},"branch":"main","hash":"eb5951ff3b182564d777694d41bf308b5d422e5b","identifier":"319606@main","message":"corner-shape: square and notch corners are built as round and scoop on outlines and box-shadow spread\nhttps://bugs.webkit.org/show_bug.cgi?id=322215\nrdar://185452130\n\nReviewed by Simon Fraser.\n\nFixes and adds tests for the case when a box mixes a finite superellipse corner\n(scoop, squircle, superellipse(0.6)) with a square or notch corner, the outline and\nbox-shadow spread contours draw the square and notch corners as round and scoop,\nwith rippling along the adjoining edges.\n\nTests: imported/w3c/web-platform-tests/css/css-borders/corner-shape/corner-shape-bevel-round-scoop-square-outset-ref.html\n       imported/w3c/web-platform-tests/css/css-borders/corner-shape/corner-shape-bevel-round-scoop-square-outset.html\n       imported/w3c/web-platform-tests/css/css-borders/corner-shape/corner-shape-notch-squircle-outset-ref.html\n       imported/w3c/web-platform-tests/css/css-borders/corner-shape/corner-shape-notch-squircle-outset.html\n       imported/w3c/web-platform-tests/css/css-borders/corner-shape/corner-shape-superellipse-concave-outset-ref.html\n       imported/w3c/web-platform-tests/css/css-borders/corner-shape/corner-shape-superellipse-concave-outset.html\n       imported/w3c/web-platform-tests/css/css-borders/corner-shape/corner-shape-superellipse-convex-outset-ref.html\n       imported/w3c/web-platform-tests/css/css-borders/corner-shape/corner-shape-superellipse-convex-outset.html\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-borders/corner-shape/corner-shape-bevel-round-scoop-square-outset-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-borders/corner-shape/corner-shape-bevel-round-scoop-square-outset-ref.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-borders/corner-shape/corner-shape-bevel-round-scoop-square-outset.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-borders/corner-shape/corner-shape-notch-squircle-outset-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-borders/corner-shape/corner-shape-notch-squircle-outset-ref.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-borders/corner-shape/corner-shape-notch-squircle-outset.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-borders/corner-shape/corner-shape-superellipse-concave-outset-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-borders/corner-shape/corner-shape-superellipse-concave-outset-ref.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-borders/corner-shape/corner-shape-superellipse-concave-outset.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-borders/corner-shape/corner-shape-superellipse-convex-outset-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-borders/corner-shape/corner-shape-superellipse-convex-outset-ref.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-borders/corner-shape/corner-shape-superellipse-convex-outset.html: Added.\n* Source/WebCore/platform/graphics/CornerShapeUtilities.cpp:\n(WebCore::borderContourPath):\n\nCanonical link: https://commits.webkit.org/319606@main","order":0,"repository_id":"webkit","timestamp":1787329938},{"author":{"emails":["ntim@apple.com","ntim.bugs@gmail.com"],"name":"Tim Nguyen"},"branch":"main","hash":"4f28f72d3c957b2fe1ee7e28dd6ab4e604273d3f","identifier":"319607@main","message":"[Site Isolation] cnn.com \"Sign-in with Google\" popup displays with top content cut off\nhttps://bugs.webkit.org/show_bug.cgi?id=322202\nrdar://168622112\n\nReviewed by Simon Fraser, Wenson Hsieh, Sihui Liu, and Abrar Rahman Protyasha.\n\nWhen going to https://www.cnn.com/account/log-in and then clicking \"Continue with Google\", WebKit initially opens a popup\nin the same process as cnn.com, but then does a process swap to google.com. When the process swap is performed, the top content\ninset is not carried over, resulting in the top part of the popup getting cut-off.\n\nFix this by carrying over the content insets in WebPage::reinitializeWebPage when swapping processes.\n\nTest: Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolation.mm\n\n* Source/WebCore/testing/Internals.cpp:\n(WebCore::Internals::obscuredContentInsetTop):\n* Source/WebCore/testing/Internals.h:\n* Source/WebCore/testing/Internals.idl:\n* Source/WebKit/WebProcess/WebPage/WebPage.cpp:\n(WebKit::WebPage::reinitializeWebPage):\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolation.mm:\n(TestWebKitAPI::TEST(SiteIsolation, ObscuredContentInsetsSurviveWindowOpenProcessSwap)):\n\nCanonical link: https://commits.webkit.org/319607@main","order":0,"repository_id":"webkit","timestamp":1787330969},{"author":{"emails":["pgriffis@igalia.com"],"name":"Patrick Griffis"},"branch":"main","hash":"32aac5dacfa53cb1d89423f91f2e49e1210a3952","identifier":"319608@main","message":"[GStreamer] Fix issues with pipewire device capture\nhttps://bugs.webkit.org/show_bug.cgi?id=321834\n\nReviewed by Philippe Normand.\n\n- Every call to getUserMedia() or enumerateDevices() made a new connection\nand sent a request to the portal. So it was very easy for 5 dialogs to\npop up opening one site. This keeps a single connection and reuses it.\n\n- accessCamera() used to wait for responses by using a nested mainloop,\nthis causes reentrancy issues that are impossible to reason about,\njust remove the mainloop as everything is async anyway.\n\nThis re-enables this feature on WPE which incorrectly asserted nobody\nuses WPE with portals.\n\n* Source/WebCore/platform/mediastream/gstreamer/DesktopPortal.cpp:\n(WebCore::DesktopPortal::~DesktopPortal):\n(WebCore::DesktopPortal::notifyResponse):\n(WebCore::DesktopPortalCamera::accessCamera):\n* Source/WebCore/platform/mediastream/gstreamer/DesktopPortal.h:\n(WebCore::DesktopPortal::notifyResponse): Deleted.\n* Source/WebCore/platform/mediastream/gstreamer/PipeWireCaptureDeviceManager.cpp:\n(WebCore::PipeWireCaptureDeviceManager::~PipeWireCaptureDeviceManager):\n(WebCore::PipeWireCaptureDeviceManager::notifyDevicesComputed):\n(WebCore::PipeWireCaptureDeviceManager::provisionDevices):\n(WebCore::PipeWireCaptureDeviceManager::computeCaptureDevices):\n* Source/WebCore/platform/mediastream/gstreamer/PipeWireCaptureDeviceManager.h:\n\nCanonical link: https://commits.webkit.org/319608@main","order":0,"repository_id":"webkit","timestamp":1787331165},{"author":{"emails":["ysuzuki@apple.com","yusukesuzuki@slowstart.org","utatane.tea@gmail.com"],"name":"Yusuke Suzuki"},"branch":"main","hash":"b74760b1824cecb3c476eee726a722e558f633a2","identifier":"319609@main","message":"[WTF] Fix roundevenf / roundeven sign for 0\nhttps://bugs.webkit.org/show_bug.cgi?id=322252\nrdar://185487391\n\nReviewed by Keith Miller.\n\nnon ARM64 architecture's roundevenf / roundeven implementations have a\nproblem that it returns roundevenf(-0.5) => +0.0 instead of -0.0. This\npatch fixes it.\n\nTest: Tools/TestWebKitAPI/Tests/WTF/MathExtras.cpp\n\n* Source/WTF/wtf/MathExtras.h:\n(roundevenf):\n(roundeven):\n* Tools/TestWebKitAPI/Tests/WTF/MathExtras.cpp:\n(TestWebKitAPI::isNegativeZero):\n(TestWebKitAPI::TEST(WTF, roundeven)):\n\nCanonical link: https://commits.webkit.org/319609@main","order":0,"repository_id":"webkit","timestamp":1787332378},{"author":{"emails":["aestes@apple.com"],"name":"Andy Estes"},"branch":"main","hash":"d960e0221dda2a1db726c47230cbbdbcd3031be2","identifier":"319610@main","message":"[iOS] Current time stops updating on youtube.com after switching playback to an AVSystemRoute\nhttps://bugs.webkit.org/show_bug.cgi?id=322256\nrdar://184547900\n\nReviewed by Eric Carlson.\n\nAfter switching to a MediaDeviceRoute, WebKit issues a seek to the current playback position.\nMediaPlayerPrivateWirelessPlayback::readyDidChange advanced the ready state to HaveEnoughData as\nsoon as the route reported itself ready, without regard for whether the route had yet published a\nseekable time range. HTMLMediaElement::seekTask treats an empty seekable range as \"no seek required\"\nand returns early; since the target time differs from the current time, it does so without firing\nseeking, seeked, or timeupdate, so a page waiting on seeked stalls indefinitely.\n\nResolved this by gating the transition to HaveEnoughData on the route having published a non-empty\nseekable range in addition to being ready, and re-evaluate that condition from both readyDidChange\nand timeRangeDidChange so whichever arrives second completes the transition.\n\nWebMockMediaDeviceRoute previously left timeRange default-initialized. Gave it a valid default so\nthat existing tests which set `route.ready = true` without specifying a time range continue to\nbecome playable.\n\nTest: media/wireless-playback-media-player/ready-state-requires-seekable-range.html\n\n* LayoutTests/media/wireless-playback-media-player/ready-state-requires-seekable-range-expected.txt: Added.\n* LayoutTests/media/wireless-playback-media-player/ready-state-requires-seekable-range.html: Added.\n* Source/WebCore/platform/graphics/MediaPlayerPrivateWirelessPlayback.cpp:\n(WebCore::MediaPlayerPrivateWirelessPlayback::updateReadyState):\n(WebCore::MediaPlayerPrivateWirelessPlayback::timeRangeDidChange):\n(WebCore::MediaPlayerPrivateWirelessPlayback::readyDidChange):\n* Source/WebCore/platform/graphics/MediaPlayerPrivateWirelessPlayback.h:\n* Source/WebCore/testing/cocoa/WebMockMediaDeviceRoute.mm:\n(-[WebMockMediaDeviceRoute init]):\n\nCanonical link: https://commits.webkit.org/319610@main","order":0,"repository_id":"webkit","timestamp":1787334893},{"author":{"emails":["dpino@igalia.com"],"name":"Diego Pino Garcia"},"branch":"main","hash":"1d20142e3c43b9199c3db94eb963d84c64bc4ae0","identifier":"319611@main","message":"inspector/heap/getPreview.html is a flaky failure\nhttps://bugs.webkit.org/show_bug.cgi?id=207209\n\nReviewed by Alexey Proskuryakov.\n\nThe test picked its target heap-snapshot node using an unreliable\nheuristic: the instance with the highest 'id' among all instances of\na given class. That is not guaranteed to be the specific object the\ntest just created (window.myString/myFunction/myMap), since other\nincidental allocations of the same class can happen in the same\nsnapshot window and end up with a higher id, making the test flaky.\n\nReplaced all four occurrences of this heuristic (GetPreviewForString,\nGetPreviewForFunction, GetPreviewForObject, and the collected-object\ncase) with a deterministic findNodeByPropertyName() helper: walk each\ncandidate node's retainer edges and pick the one actually referenced\nby the expected property/variable name.\n\nLocal reproduction went from failing in roughly 16-18% of iterations\nbefore this change to 0 failures in 400 iterations after it.\n\nAlso removed the now-stale flaky-test expectations for GTK and\nmac-wk2.\n\n* LayoutTests/inspector/heap/getPreview.html:\n* LayoutTests/platform/gtk/TestExpectations:\n* LayoutTests/platform/mac-wk2/TestExpectations:\n\nCanonical link: https://commits.webkit.org/319611@main","order":0,"repository_id":"webkit","timestamp":1787335676},{"author":{"emails":["sgill26@apple.com","sammy.gill@apple.com"],"name":"Sammy Gill"},"branch":"main","hash":"8345bb765b035fd3de5d91f13c637367cf142e92","identifier":"319612@main","message":"[margin-trim] Trimmed margins should not be reflected in computed style\nhttps://bugs.webkit.org/show_bug.cgi?id=321104\nrdar://184215336\n\nReviewed by Alan Baradlay.\n\nThe CSSWG resolved that margin-trim does not affect the resolved value of the margin\nproperties, so a trimmed margin must still be reported by getComputedStyle.\n\nhttps://github.com/w3c/csswg-drafts/issues/11506\n\nWe wrote 0 into the child's margin box when trimming it, and Style::Extractor reads the\nused margin off the renderer, so trimming leaked into the computed value.\n\nMargin collapsing also has similar behavior with regards to this so we\ncan resolve this problem by making the underlying trimming logic similar\nto the collapsing logic. The code stores various information with\nregards to margin collapsing in a helper struct and uses that\ninformation to compute the position of the box but the actual value of\nthe renderer's margin box field remains the same.\n\nDiscarding the margins as they are consumed also fixes a pre-existing bug. The old code only\nzeroed the child's margin box, but the collapsed-through margin that reaches the container's\nheight comes from the child's rare data, so a trimming container that cannot collapse with its\nchildren (one with a block-end border, say) still grew by a margin that margin-trim had\ndiscarded, even though the child itself was repositioned flush to the trimmed edge. That\nmargin is now discarded before MarginInfo sees it.\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-box/margin-trim/margin-trim-computed-value-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-box/margin-trim/margin-trim-computed-value.html: Added.\nReplaced the existing tests with a new one that contains some subtests\nto make sure the new behavior holds.\n\n* Source/WebCore/rendering/RenderBlockFlow.cpp:\n(WebCore::RenderBlockFlow::adjustBlockEndChildrenForMarginTrim):\ntrimBlockEndChildrenMargins becomes adjustBlockEndChildrenForMarginTrim: its margin\nbox writes ran after every child had been laid out and after MarginInfo had already consumed\ntheir margins, and for block flow descendants the parent reads the collapsed margins out of\nrare data rather than the margin box, so they no longer had any bearing on the container's\nblock size by the time they ran. The self-collapsing repositioning it performs is still needed\nto pull such a child back to the trimmed block-end edge when a preceding sibling's margin has\ncollapsed through it.\n\nThat preceding sibling's margin is itself adjoining the trimmed edge and should be trimmed as\nwell, but MarginInfo has already accumulated it, so a container that cannot collapse with its\nchildren still grows by it. This is not a regression: with the same content the old code grew\nby the larger of that margin and the trimmed child's own margin, so the value can only get\nsmaller here (41px before, 32px now, 27px once the FIXME added to\nadjustBlockEndChildrenForMarginTrim is addressed). The block-start edge already handles the\nequivalent case through LayoutState::marginTrimBlockStart.\n\n(WebCore::RenderBlockFlow::marginValuesForChild):\nDiscard the trimmed sides as it hands the child's margins to the collapsing code. Every\nblock axis consumer of a child's margins goes through it, so the child's logical top is\ncomputed with the margin discarded without anything mutating the child. Which side is trimmed\nis answered by shouldTrimChildMargin for a first or last in-flow child, plus the existing\nLayoutState::marginTrimBlockStart flag for a margin that collapses through to a trimming\nancestor's block-start edge.\n\n(WebCore::RenderBlockFlow::marginBeforeEstimateForChild):\nBail out when the child's block-start margin is trimmed, including when it collapses through to\na trimming ancestor's edge, so that the estimate agrees with what marginValuesForChild computes\nonce the margins are actually consumed. The estimate previously used the untrimmed margin in the\ncollapsed-through case and then walked into the grandchildren to collapse margins that are\ntrimmed along with it.\n\n* Source/WebCore/rendering/RenderBox.cpp:\n(WebCore::RenderBox::computeBlockDirectionMargins):\nDo not return 0 for a trimmed margin but let the caller determine if\ntrimming is happening and perform the appropriate logic in that\nsituation.\n\nCanonical link: https://commits.webkit.org/319612@main","order":0,"repository_id":"webkit","timestamp":1787336871},{"author":{"emails":["sam@webkit.org"],"name":"Sam Weinig"},"branch":"main","hash":"c5153973ea3f0f32499c47df9504284b259a59bd","identifier":"319613@main","message":"Remove imported/w3c/web-platform-tests/css/css-values/percentage-rem-low.html from TestExpectations\nhttps://bugs.webkit.org/show_bug.cgi?id=203320\n\nReviewed by Alan Baradlay and Tim Nguyen.\n\nimported/w3c/web-platform-tests/css/css-values/percentage-rem-low.html is now passing.\n\n* LayoutTests/TestExpectations:\n\nCanonical link: https://commits.webkit.org/319613@main","order":0,"repository_id":"webkit","timestamp":1787338584},{"branch":"main","hash":"61fc55e15fb67f6df7f4a525568c98123aad3f59","identifier":"319614@main","order":0,"repository_id":"webkit","timestamp":1787338701},{"author":{"emails":["zalan@apple.com","zbujtas@gmail.com"],"name":"Alan Baradlay"},"branch":"main","hash":"86d27022072df830a2b8749ca4a685fd900677d8","identifier":"319615@main","message":"[list-marker] A list marker's text reaches names and values that asked for text without list markers\nhttps://bugs.webkit.org/show_bug.cgi?id=322187\n<rdar://problem/185422271>\n\nReviewed by Antti Koivisto.\n\n  <style>\n  li { list-style-type: \"\\627\\644\\641\" }\n  </style>\n  <ul><li id=item>Item Five\n  <a role=button aria-labelledby=\"button item\" id=button>Reply\n\nWhether a marker's text belongs in a name is the caller's to decide, and IncludeListMarkerText is how\nit says so: aria-labelledby name computation passes No, and textUnderElement() answers for the marker\nonly when it is Yes.\n\nA marker whose text needs bidi resolution does not draw that text itself, it keeps it in content\nrenderers, and those are reachable through AccessibilityRenderObject::firstChild(), which answers from\nthe render tree before it consults canHaveChildren(). The walk that builds a name reaches them that\nway and takes their text, so the flag stops governing what the caller asked about. The name computed\nfor the button above comes out as \"Reply \u0627\u0644\u0641Item Five\", and the list item's own value with it. Neither\nthe string above nor a right-to-left list of plain decimals is exotic, so this is what any\naria-labelledby pointing at such a list item reports today.\n\n* LayoutTests/accessibility/list-marker-content-renderers-text-expected.txt: Added.\n* LayoutTests/accessibility/list-marker-content-renderers-text.html: Added.\n* Source/WebCore/accessibility/AccessibilityNodeObject.cpp:\n(WebCore::AccessibilityNodeObject::canHaveChildren const):\n* Source/WebCore/accessibility/AccessibilityRenderObject.cpp:\n(WebCore::AccessibilityRenderObject::textUnderElement const):\n\nCanonical link: https://commits.webkit.org/319615@main","order":0,"repository_id":"webkit","timestamp":1787338744},{"author":{"emails":["iroy@apple.com","issacroy05@gmail.com"],"name":"Issac Roy"},"branch":"main","hash":"24279dccdd79ccf2e03c043ea4c499f8738530a2","identifier":"319616@main","message":"TLF: Use historical flakiness information from EWS to ignore flaky tests\nrdar://157892382\nhttps://bugs.webkit.org/show_bug.cgi?id=318291\n\nReviewed by Aakash Jain.\n\n`claude` summary:\n\nEWS reports test failures and flakiness to results.webkit.org but never reads\nany of it back, so a test already known to flake still fails the build and\nblames whoever happened to be testing. `flaky_verdicts_for` consults that\nhistory for every failure a step surfaced. A clean-tree flake convicts on one\nbuild, since the change cannot have caused it. Convicting with the change in\nthe tree takes `PRS_FOR_DIRTY_TREE_FLAKE` pull requests, and blaming other\npeople's patches takes `PRS_FOR_BETWEEN_BUILD_FLAKE` and\n`AUTHORS_FOR_BETWEEN_BUILD_FLAKE`. Counting builds would not do: `build_url`\ncarries the build number, so retrying one pull request would let a change that\ngenuinely made a test non-deterministic excuse its own failure.\n\nBoth rules tally the same three sets over the same rows, so they share\n`_evidence_in`, `_convict` and `_rows_by_flaky_type`, and both report\n`build_urls` \u2014 `results_db_details` always wrote them and only the reader\nignored them. A row with a null `flaky_type` no longer raises from `sorted()`\ninside the code meant to make bad data visible.\n\nTest names ride in the query string, and a step's worth of long WPT paths\noverflows nginx's 8k request line, so `_query_flaky` asks about\n`TESTS_PER_FLAKY_QUERY` at a time, each chunk allowed\n`FLAKY_QUERY_TIMEOUT_SECONDS` rather than the 10s default that used to cover a\nsingle test. A failed chunk fails the whole query, since a partial answer reads\nas an absence of history for the rest. `TwistedAdditions.request` builds the\nquery with `urlencode(doseq=True)`, which repeats a key for a list value and\nescapes names that carry their own query string.\n\nNothing is ignored yet. `SHOULD_IGNORE_FLAKY_TESTS` is False, so a verdict is\nrecorded and logged but no test leaves the failing set and no build changes\ncolour. `SetBuildSummary` reads a `force_build_success` property rather than\nmatching `SUCCESS_MSGS` against a step's summary text, so turning that flag on\ndoes not depend on wording. `FlakyVerdict.intra_build_evidence` records whether\nany build saw the test behave inconsistently, exported per run as\n`results-db_*_run_flaky`, `_flaky_unsupported` and `_flaky_unknown`: the\nbetween-builds rule is the only one that can convict without that evidence, so\nwhether it earns its place is a property query rather than a log scrape.\n\n* Tools/CISupport/Shared/steps.py:\n(SetBuildSummary):\n(SetBuildSummary.run):\n* Tools/CISupport/ews-build/results_db.py:\n(FlakyVerdict):\n(FlakyVerdict.is_flaky):\n(FlakyVerdict.evidence):\n(ResultsDatabase):\n(ResultsDatabase._evidence_in):\n(ResultsDatabase._convict):\n(ResultsDatabase._rows_by_flaky_type):\n(ResultsDatabase._is_intra_build_flake):\n(ResultsDatabase._is_inter_build_flake):\n(ResultsDatabase._parse_results_ews_response):\n(ResultsDatabase._query_flaky):\n(ResultsDatabase.flaky_verdicts_for):\n(ResultsDatabase.flaky_verdicts_for.logger):\n* Tools/CISupport/ews-build/steps.py:\n(RunWebKitTests):\n(RunWebKitTests.__init__):\n(RunWebKitTests.runCommand):\n(RunWebKitTests.filter_failures_using_results_db):\n(RunWebKitTests.results_db_ignore_message):\n(RunWebKitTests.evaluateCommand):\n(RunWebKitTests.getResultSummary):\n(ReRunWebKitTests.evaluateCommand):\n(ReRunWebKitTests.runCommand):\n* Tools/CISupport/ews-build/steps_unittest.py:\n(TestFilterLayoutTestFailuresUsingResultsDB._configure):\n(TestFilterLayoutTestFailuresUsingResultsDB):\n(TestFilterLayoutTestFailuresUsingResultsDB.test_a_flaky_verdict_is_recorded_without_ignoring_the_failure):\n(TestFilterLayoutTestFailuresUsingResultsDB.test_a_test_with_no_verdict_is_not_treated_as_sound):\n(TestFilterLayoutTestFailuresUsingResultsDB.test_the_ignore_message_covers_both_categories):\n(TestFilterLayoutTestFailuresUsingResultsDB.test_set_build_summary_restores_success_from_the_property):\n(TestFilterLayoutTestFailuresUsingResultsDB.test_ignoring_every_failure_sets_the_property_set_build_summary_reads):\n(TestFilterLayoutTestFailuresUsingResultsDB.test_ignoring_every_failure_sets_the_property_set_build_summary_reads.Cmd):\n(TestFilterLayoutTestFailuresUsingResultsDB.test_wpe_platform_is_translated_to_uppercase_for_results_db):\n(TestFilterLayoutTestFailuresUsingResultsDB.test_caps_number_of_results_db_queries):\n(TestLayoutTestStepsReportAsTheyRun):\n(TestLayoutTestStepsReportAsTheyRun.test_the_first_run_exports_the_verdicts_it_relied_on):\n(TestLayoutTestStepsReportAsTheyRun.test_the_first_run_exports_the_verdicts_it_relied_on.fake_filter):\n* Tools/CISupport/ews-build/twisted_additions.py:\n(TwistedAdditions.request):\n\nCanonical link: https://commits.webkit.org/319616@main","order":0,"repository_id":"webkit","timestamp":1787338798},{"author":{"emails":["jmichaud@igalia.com","justin@justinmichaud.com"],"name":"Justin Michaud"},"branch":"main","hash":"9a18171a13fbfc3aea4c53e341edb856eed21f02","identifier":"319617@main","message":"[Linux] Remove RT threads\nhttps://bugs.webkit.org/show_bug.cgi?id=319535\n\nReviewed by Carlos Garcia Campos.\n\n(reland due to macOS regression; now there is no behaviour change on darwin)\n\nPatch 1 of 2, the second removes sched_yield.\n\nRT threads showed a 10% win on MotionMark clamped to two cores. This\ngoes away if you turn off DVFS, so I believe the biggest mechanism\nbehind this is the increased effective clock speed.\n\nWe can recover that by setting the min clamp for DVFS directly. Most WPE\nworkloads probably won't be using DVFS (that is, they will be set to\nperformance), but this seems like the right call to me for desktop anyway.\n\nFinally, in this 2-core case, we use nice to lower the priority of the\njit workers, and this gives us a small but noticable bump on SP3.\nWe use RTKit still to raise the priority of the former RT threads, which\ngives a further small boost.\n\nCanonical link: https://commits.webkit.org/318709@main\n\n* Source/JavaScriptCore/jit/JITWorklistThread.cpp:\n(JSC::JITWorklistThread::JITWorklistThread):\n* Source/JavaScriptCore/wasm/WasmWorklist.cpp:\n* Source/WTF/wtf/AutomaticThread.cpp:\n(WTF::AutomaticThread::AutomaticThread):\n(WTF::AutomaticThread::start):\n* Source/WTF/wtf/AutomaticThread.h:\n* Source/WTF/wtf/PlatformGTK.cmake:\n* Source/WTF/wtf/PlatformJSCOnly.cmake:\n* Source/WTF/wtf/PlatformWPE.cmake:\n* Source/WTF/wtf/Threading.cpp:\n(WTF::Thread::entryPoint):\n(WTF::Thread::create):\n(WTF::Thread::setCurrentThreadIsUserInteractive):\n(WTF::Thread::setCurrentThreadIsUserInitiated):\n(WTF::Thread::setCurrentThreadQOS):\n(WTF::Thread::currentThreadQOS):\n(WTF::Thread::currentThreadIsRealtime):\n* Source/WTF/wtf/Threading.h:\n* Source/WTF/wtf/ThreadingEnums.h:\n(WTF::compilerThreadQOS):\n* Source/WTF/wtf/linux/HighPriorityThreads.cpp: Added.\n(WTF::HighPriorityThreads::singleton):\n(WTF::HighPriorityThreads::HighPriorityThreads):\n(WTF::HighPriorityThreads::registerThread):\n(WTF::HighPriorityThreads::setEnabled):\n(WTF::HighPriorityThreads::applyState):\n(WTF::realTimeKitGetProperty):\n(WTF::HighPriorityThreads::realTimeKitMakeThreadHighPriority):\n(WTF::HighPriorityThreads::scheduleDiscardRealTimeKitProxy):\n(WTF::HighPriorityThreads::discardRealTimeKitProxyTimerFired):\n* Source/WTF/wtf/linux/HighPriorityThreads.h: Renamed from Source/WTF/wtf/linux/RealTimeThreads.h.\n* Source/WTF/wtf/linux/RealTimeThreads.cpp: Removed.\n* Source/WTF/wtf/posix/ThreadingPOSIX.cpp:\n(WTF::schedulingAttributesForQOS):\n(WTF::logSchedulingAttributesFailure):\n(WTF::Thread::establishHandle):\n(WTF::Thread::updateSchedulingAttributes const):\n(WTF::Thread::initializeSchedulingAttributes):\n(WTF::Thread::initializeCurrentTLS):\n* Source/WTF/wtf/win/ThreadingWin.cpp:\n(WTF::Thread::updateSchedulingAttributes const):\n(WTF::Thread::initializeSchedulingAttributes):\n(WTF::Thread::initializeCurrentTLS):\n* Source/WebCore/platform/audio/RealtimeAudioThread.cpp:\n(WebCore::shouldCreateRealtimeThread):\n(WebCore::createMaybeRealtimeAudioThread):\n(): Deleted.\n* Source/WebKit/WebProcess/WebProcess.cpp:\n(WebKit::WebProcess::createWebPage):\n(WebKit::WebProcess::removeWebPage):\n(WebKit::WebProcess::pageActivityStateDidChange):\n* Source/WebKit/WebProcess/glib/WebProcessGLib.cpp:\n(WebKit::WebProcess::platformInitializeProcess):\n* Tools/TestWebKitAPI/Tests/WTF/Threading.cpp:\n(TestWebKitAPI::TEST(WTF_Thread, SchedulingAttributesFollowQOS)):\n(TestWebKitAPI::TEST(WTF_Thread, HighPriorityThreadsRestoresClampWhenReenabled)):\n\nCanonical link: https://commits.webkit.org/319617@main","order":0,"repository_id":"webkit","timestamp":1787338848},{"branch":"main","hash":"f9e2fad6eb7281828c695afa74ec7372cb506a3f","identifier":"319618@main","order":0,"repository_id":"webkit","timestamp":1787341174},{"author":{"emails":["sgill26@apple.com","sammy.gill@apple.com"],"name":"Sammy Gill"},"branch":"main","hash":"f6f4e6b51aaefb7e34969e0fdac979a3d4c519b0","identifier":"319619@main","message":"run-webkit-tests should not launch a browser with results by default\nhttps://bugs.webkit.org/show_bug.cgi?id=322287\nrdar://problem/185524214\n\nReviewed by Ryosuke Niwa and Zak Ridouh.\n\nWhen run-webkit-tests finished a run with unexpected results it opened\nresults.html in a browser. Depending on your workflow this can be\nslightly jarring and disruptive since it will happen on any invocation\nwith unexpected results - even if you are expecting those unexpected\nresults! Some informal conversations suggest that most people prefer the\nbehavior where the results file is not opened up by default.\n\nTo improve the ergonomics a bit let's make --no-show-results the default\nand introduce a --show-results to allow users to have the previous\nbehavior.\n\n--no-show-results is still accepted so that the existing invocations which\npass it explicitly.\n\n* Introduction.md:\nMake sure that the Introduction documentation is updated to reflect this\nnew behavior along with how to get the old one back.\n\n* Tools/Scripts/webkitpy/layout_tests/controllers/manager.py:\n(Manager._end_test_run):\nWhen the test run has finished print out the the location of the results\nfile if there are any unexpected results.\n\nCanonical link: https://commits.webkit.org/319619@main","order":0,"repository_id":"webkit","timestamp":1787341281},{"author":{"emails":["jespinal23@apple.com"],"name":"Jetzel Espinal"},"branch":"main","hash":"32377c7c9a09a52407a72c927fcf6e909207018e","identifier":"319620@main","message":"[GARDENING][visionOS]REGRESSION(317307@main): interaction-region/paused-video-regions.html is a constant text failure.\nhttps://bugs.webkit.org/show_bug.cgi?id=322296\nrdar://185536403\n\nUnreviewed test gardening.\n\n* LayoutTests/platform/visionos/TestExpectations:\n\nCanonical link: https://commits.webkit.org/319620@main","order":0,"repository_id":"webkit","timestamp":1787344181},{"author":{"emails":["ysuzuki@apple.com","yusukesuzuki@slowstart.org","utatane.tea@gmail.com"],"name":"Yusuke Suzuki"},"branch":"main","hash":"3b9afb2b4f23fc2eb9555835a2ce0c6ebdb26056","identifier":"319621@main","message":"[JSC] Fix boundary related code in BBQ / OMG\nhttps://bugs.webkit.org/show_bug.cgi?id=322255\nrdar://185488178\n\nReviewed by Yijia Huang.\n\n1. ref.cast's trapping null check should be used only when\n   Options::useWasmFaultSignalHandler() is true. (in practice, currently\n   all wasm environment is having useWasmFaultSignalHandler = true).\n2. Instead of offset, we should use boundary for check skipping. But\n   actually this does not matter in practice since we end up crossing\n   trapping zone, so anyway, we get a trap correctly. But anyway,\n   computation was slightly wrong and slightly conservative.\n\nTests: JSTests/wasm/stress/ref-cast-null-without-fault-signal-handler.js\n       JSTests/wasm/stress/signaling-memory-large-offset-bounds-check.js\n\n* JSTests/wasm/stress/ref-cast-null-without-fault-signal-handler.js: Added.\n* JSTests/wasm/stress/signaling-memory-large-offset-bounds-check.js: Added.\n(loadExpression):\n(instantiateForPages):\n(async testPages):\n(async test):\n* Source/JavaScriptCore/b3/B3LowerMacros.cpp:\n* Source/JavaScriptCore/wasm/WasmBBQJIT.h:\n(JSC::Wasm::BBQJITImpl::BBQJIT::emitCheckAndPreparePointer):\n* Source/JavaScriptCore/wasm/WasmBBQJIT64.cpp:\n(JSC::Wasm::BBQJITImpl::BBQJIT::emitRefTestOrCast):\n* Source/JavaScriptCore/wasm/WasmBBQJIT64.h:\n(JSC::Wasm::BBQJITImpl::BBQJIT::emitCheckAndPrepareAndMaterializePointerApply):\n* Source/JavaScriptCore/wasm/WasmOMGIRGenerator.cpp:\n(JSC::Wasm::OMGIRGenerator::emitCheckAndPreparePointer):\n\nCanonical link: https://commits.webkit.org/319621@main","order":0,"repository_id":"webkit","timestamp":1787346894},{"author":{"emails":["sgill26@apple.com","sammy.gill@apple.com"],"name":"Sammy Gill"},"branch":"main","hash":"c2cb2f43b38d604aa1ad69640e342ce7156c68a4","identifier":"319622@main","message":"[margin-trim] Drop inline values from syntax\nhttps://bugs.webkit.org/show_bug.cgi?id=322106\nrdar://185527437\n\nReviewed by Alan Baradlay.\n\nThe CSSWG resolved that margin-trim no longer applies to flex and grid\ncontainers (w3c/csswg-drafts#14284). With those layout systems out of scope the\nproperty only applies to block containers and multi-column containers, where it\nhas no effect on the inline-axis margins of its children, so the inline,\ninline-start and inline-end keywords could never do anything. The syntax is now:\n\n    none | block | [ block-start || block-end ]\n\nIn this patch we basically remove it from the style and layout code so\nthat it is now consistent with the new grammar. With respect to the\nlayout code it was basically dead code anyways since the inline values\ndid not have any effect outside of flex and grid.\n\n* Source/WebCore/css/parser/CSSPropertyParserConsumer+Box.cpp:\n(WebCore::CSSPropertyParserHelpers::consumeMarginTrim):\nNo longer needs to build a value list: a single side\nserializes as itself and both sides collapse to block, so the four-keyword\n\"block inline\" case and the canonical-order FIXME both go away.\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-box/margin-trim/block-container-inline-001-expected.html: Removed.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-box/margin-trim/block-container-inline-001.html: Removed.\nThis test asserted that margin-trim: inline does not trim\nthe inline margins of block-level children; that declaration no longer parses, so\nthe test would pass vacuously and is removed.\n\n* Source/WebCore/style/values/box/StyleMarginTrim.cpp:\n(WebCore::Style::CSSValueConversion<MarginTrim>::operator):\nSince all we get get is a keyword value now the logic related to the\nCSSValueList is dead and can be removed as well.\n\nCanonical link: https://commits.webkit.org/319622@main","order":0,"repository_id":"webkit","timestamp":1787347543},{"author":{"emails":["csaavedra@igalia.com"],"name":"Claudio Saavedra"},"branch":"main","hash":"8704a40051233695d3453eb4965b5e6653493b96","identifier":"319623@main","message":"[GLIB] Use GRefPtrWrapped for the GUnixFDList IPC serializer\nhttps://bugs.webkit.org/show_bug.cgi?id=322270\n\nReviewed by Carlos Garcia Campos.\n\nMigrate ArgumentCoder<GRefPtr<GUnixFDList>> to a generated serializer\nusing GRefPtrWrapped. The wire format is unchanged: the file descriptors\n(de)serialize as a Vector<UnixFileDescriptor>.\n\n* Source/WebKit/PlatformGTK.cmake:\n* Source/WebKit/PlatformWPE.cmake:\n* Source/WebKit/Shared/glib/ArgumentCodersGLib.cpp:\n* Source/WebKit/Shared/glib/ArgumentCodersGLib.h:\n* Source/WebKit/Shared/glib/CoreIPCGUnixFDList.cpp: Added.\n(WebKit::CoreIPCGUnixFDList::CoreIPCGUnixFDList):\n(WebKit::CoreIPCGUnixFDList::fileDescriptors const):\n* Source/WebKit/Shared/glib/CoreIPCGUnixFDList.h: Added.\n* Source/WebKit/Shared/glib/CoreIPCGUnixFDList.serialization.in: Added.\n* Source/WebKit/SourcesGTK.txt:\n* Source/WebKit/SourcesWPE.txt:\n\nCanonical link: https://commits.webkit.org/319623@main","order":0,"repository_id":"webkit","timestamp":1787348888},{"author":{"emails":["sgill26@apple.com","sammy.gill@apple.com"],"name":"Sammy Gill"},"branch":"main","hash":"e1e532f4f12ffb9a5afe3b573f4268364d994eb8","identifier":"319624@main","message":"[Grid Lanes] Rename remaining references to masonry in the code.\nhttps://bugs.webkit.org/show_bug.cgi?id=322291\nrdar://185533476\n\nReviewed by Vitor Roriz and Tim Nguyen.\n\nThe CSSWG resolved to rename the \"masonry layout\" feature to \"Grid Lanes\".\nSome of the code was already renamed but the layout code was still\nreferring to the old Masonry name and terms. Some notable changes that\nwere not a pure masonry -> grid lanes remapping:\n\n- The spec renamed \"masonry axis,\" to \"stacking axis,\" so that is\n  changed as well.\n- Similarly, areMasonryColumns/Rows is changed to hasStackingAxisColumns/Rows\n  along with other functions/code with the same idea.\n- masonryGridAreaFromGridAxisSpan -> gridAreaFromGridAxisSpan because\n  this is a lot more concise and is still accurate and clear.\n\nAlso a lot of the comments have been updated with the new terms and\nlinks to the new section in the spec.\n\nCanonical link: https://commits.webkit.org/319624@main","order":0,"repository_id":"webkit","timestamp":1787349008},{"author":{"emails":["jer.noble@apple.com"],"name":"Jer Noble"},"branch":"main","hash":"ef91821a05e7c4bc43099f8c20aa29fab35d6e95","identifier":"319625@main","message":"REGRESSION(312373@main): [iPad] Spotify music videos fail to play\nrdar://178167054\nhttps://bugs.webkit.org/show_bug.cgi?id=322239\n\nReviewed by Eric Carlson.\n\nSpotify gates music video playback on whether the following call returns true:\n> WebKitMediaKeys.isTypeSupported(\"com.apple.fps.1_0\", \"video/mp2t; ...\");\n\nHowever, 312373@main fixed a bug where the MSE MediaPlayer would report that it\nwas capable of playing back MIME types like \"video/mp2t\", and web-facing APIs\nlike HTMLMediaElement.canPlayType() and WebKitMediaKeys.isTypeSupported() would\nfalsely return that those MIME types were playable.\n\nFixing this bug broke Spotify's query, which was always incorrect. Restore the\nbehavior prior to 312373@main by quirking WebKitMediaKeys.isTypeSupported()\nto return `true` when asked about MPEG-2 transport streams.\n\n* Source/WebCore/Modules/encryptedmedia/legacy/WebKitMediaKeys.cpp:\n(WebCore::WebKitMediaKeys::isTypeSupported):\n* Source/WebCore/Modules/encryptedmedia/legacy/WebKitMediaKeys.h:\n* Source/WebCore/Modules/encryptedmedia/legacy/WebKitMediaKeys.idl:\n* Source/WebCore/page/Quirks.cpp:\n* Source/WebCore/page/Quirks.h:\n* Source/WebCore/page/QuirksData.h:\n\nCanonical link: https://commits.webkit.org/319625@main","order":0,"repository_id":"webkit","timestamp":1787349378},{"author":{"emails":["jespinal23@apple.com"],"name":"Jetzel Espinal"},"branch":"main","hash":"0e32e921ed82d2d1d48775a2a897a85e26c69e52","identifier":"319626@main","message":"[GARDENING][iOS]NEW TEST(319203@main): fast/visual-viewport/ios/interactive-widget/resizes-content-orientation-rotations.html (layout-tests) is a constant text failure.\nhttps://bugs.webkit.org/show_bug.cgi?id=322305\nrdar://185542943\n\nUnreviewed test gardening.\n\n* LayoutTests/platform/ios/TestExpectations:\n\nCanonical link: https://commits.webkit.org/319626@main","order":0,"repository_id":"webkit","timestamp":1787349870},{"author":{"emails":["pvollan@apple.com","peavo@outlook.com"],"name":"Per Arne Vollan"},"branch":"main","hash":"7d86b2c8a054e15691ae22c2b6f9ca287858770d","identifier":"319627@main","message":"Error opening local HTML files from Notes\nhttps://bugs.webkit.org/show_bug.cgi?id=322053\nrdar://174169483\n\nReviewed by Sihui Liu.\n\nOpening a HTML file from the Notes app is failing when the Develop menu is enabled in Safari.\nThis is because the storage class of the HTML file on disk is different then the path Safari\ncreated a sandbox extension for, which is the root of the file system in developer mode.\n\nFix this by checking if the file path has a separate storage class, and if so, don't create\nan extension for the root of the file system, but instead create an extension for the parent\ndirectory of the file. By doing so, the system will not deny the WebContent process to create\na sandbox extension for the Networking process.\n\nThis bug depends on the System Integrity Protection mode, which makes it non-trivial to\ncreate a test case.\n\n* Source/WTF/wtf/FileSystem.h:\n* Source/WTF/wtf/cocoa/FileSystemCocoa.mm:\n(WTF::FileSystemImpl::homeDirectory):\n* Source/WebKit/Shared/AuxiliaryProcess.h:\n* Source/WebKit/Shared/mac/AuxiliaryProcessMac.mm:\n(WebKit::populateSandboxInitializationParameters):\n(WebKit::AuxiliaryProcess::openDirectoryCacheInvalidated):\n(WebKit::AuxiliaryProcess::getHomeDirectory): Deleted.\n* Source/WebKit/UIProcess/WebPageProxy.cpp:\n(WebKit::pathHasSeparateStorageClass):\n(WebKit::WebPageProxy::maybeInitializeSandboxExtensionHandle):\n\nCanonical link: https://commits.webkit.org/319627@main","order":0,"repository_id":"webkit","timestamp":1787351322},{"author":{"emails":["ahmad.saleem792@gmail.com","ahmad.saleem792+github@gmail.com","ahmad_saleem@apple.com"],"name":"Ahmad Saleem"},"branch":"main","hash":"7432aeeb7c556549276f6d1c2d764f8ab6d4790f","identifier":"319628@main","message":"Typing a space in editable content inside <summary> or <button> also activates it\nhttps://bugs.webkit.org/show_bug.cgi?id=322245\nrdar://185479319\n\nReviewed by Ryosuke Niwa.\n\nHTMLSummaryElement and HTMLButtonElement implement space activation across three\nevents: keydown calls setActive(true), keypress marks the event handled to suppress\nscrolling, and keyup dispatches a simulated click if the element is still active.\n\nNeither checks whether the key press was actually directed at the element. When an\nediting host is nested inside the <summary>/<button>, the editor handles the keypress\nat the target and marks it handled, so callDefaultEventHandlersInBubblingOrder() stops\nbefore reaching the ancestor -- but keydown and keyup are not consumed, so they bubble\ninto these handlers, which set the active state and then dispatch a click. The result\nis that typing a space into the editable element both inserts the space and toggles the\n<details> / activates the <button>.\n\nGate the keyboard handling on the element itself being focused. Focus is the right\ndiscriminator rather than the event target: <summary contenteditable> is both focused\nand editable and must still toggle (the summary's own handler runs before the editor's,\nso no text is inserted), while a focused editable descendant must not activate the\nancestor. Using the focused element also avoids depending on event target retargeting,\nwhich keeps the auto-generated <summary> inside <details>'s user-agent shadow tree\nworking.\n\n* LayoutTests/imported/w3c/web-platform-tests/editing/other/typing-space-in-editable-button.tentative-expected.txt: Progression\n* LayoutTests/imported/w3c/web-platform-tests/editing/other/typing-space-in-editable-summary.tentative-expected.txt: Ditto\n* LayoutTests/platform/glib/imported/w3c/web-platform-tests/editing/other/typing-space-in-editable-button.tentative-expected.txt: Renamed from LayoutTests/platform/gtk/imported/w3c/web-platform-tests/editing/other/typing-space-in-editable-button.tentative-expected.txt.\n* LayoutTests/platform/wpe/imported/w3c/web-platform-tests/editing/other/typing-space-in-editable-button.tentative-expected.txt: Removed.\n* Source/WebCore/html/HTMLButtonElement.cpp:\n(WebCore::HTMLButtonElement::defaultEventHandler):\n* Source/WebCore/html/HTMLSummaryElement.cpp:\n(WebCore::HTMLSummaryElement::defaultEventHandler):\n\nCanonical link: https://commits.webkit.org/319628@main","order":0,"repository_id":"webkit","timestamp":1787353949},{"author":{"emails":["aleksei@apple.com","titan.vl@gmail.com"],"name":"Aleksei Marchenko"},"branch":"main","hash":"4490cd9a89cc244a137d6b0cea780e61b76dbe12","identifier":"319629@main","message":"Support per-child entity transforms for <model> inside a spatial portal\nhttps://bugs.webkit.org/show_bug.cgi?id=322166\nrdar://182292326\n\nReviewed by Mike Wyrzykowski.\n\nCSS transform/translate/rotate/scale on a <model> nested in a spatial: portal\nnow drive that child's entity, composed as (CSS) x (asset's original scale),\nCSS outermost. The container still owns auto-fit, stage mode and\nportal-transform, and a child's transform stays out of the auto containing\nvolume. Translations convert from CSS px to meters with pointsPerMeter,\nand are deliberately not divided out of the container's scale: a child\nsits inside the back spatial context, so portal-transform fits its position\nalong with its size.\n\nCSS wins for a nested child: entityTransform throws InvalidStateError while a\nCSS transform applies, and CSS overrides one set through the attribute.\nstagemode no longer blocks entityTransform in a portal -- it drives the\ncontainer, this drives the child. Non-uniform and shearing transforms are\nrefused, keeping the last accepted one.\n\nSuch a child has no renderer, so RenderTreeUpdater keeps its resolved style,\nElement::renderOrDisplayContentsStyle() returns it, and\nKeyframeEffect::ticksContinuouslyWhileActive() keeps ticking without one;\notherwise transitions only snap.\n\nTests: spatial-css/spatial-portal-model-entity-transform.html\n       spatial-css/spatial-portal-model-transform-transition.html\n       spatial-css/spatial-portal-model-transform-unsupported.html\n       spatial-css/spatial-portal-model-transform.html\n\n* LayoutTests/spatial-css/resources/spatial-portal-utils.js:\n* LayoutTests/spatial-css/spatial-portal-model-entity-transform-expected.txt: Added.\n* LayoutTests/spatial-css/spatial-portal-model-entity-transform.html: Added.\n* LayoutTests/spatial-css/spatial-portal-model-transform-expected.txt: Added.\n* LayoutTests/spatial-css/spatial-portal-model-transform-transition-expected.txt: Added.\n* LayoutTests/spatial-css/spatial-portal-model-transform-transition.html: Added.\n* LayoutTests/spatial-css/spatial-portal-model-transform-unsupported-expected.txt: Added.\n* LayoutTests/spatial-css/spatial-portal-model-transform-unsupported.html: Added.\n* LayoutTests/spatial-css/spatial-portal-model-transform.html: Added.\n* LayoutTests/spatial-css/spatial-portal-nested-model-stagemode-expected.txt:\n* LayoutTests/spatial-css/spatial-portal-nested-model-stagemode.html:\n* LayoutTests/spatial-css/spatial-portal-transform-auto-expected.txt:\n* LayoutTests/spatial-css/spatial-portal-transform-auto.html:\n* LayoutTests/spatial-css/spatial-portal-transform-none-expected.txt:\n* LayoutTests/spatial-css/spatial-portal-transform-none.html:\n* Source/WebCore/Modules/model-element/HTMLModelElement.cpp:\n(WebCore::HTMLModelElement::effectiveModelPlayer const):\n(WebCore::HTMLModelElement::updateEntityTransformFromCSS):\n(WebCore::HTMLModelElement::didUpdateEntityTransformInsidePortal):\n(WebCore::HTMLModelElement::setEntityTransform):\n(WebCore::HTMLModelElement::setPlaybackRate):\n(WebCore::HTMLModelElement::duration const):\n(WebCore::HTMLModelElement::paused const):\n(WebCore::HTMLModelElement::setPaused):\n(WebCore::HTMLModelElement::updateAutoplay):\n(WebCore::HTMLModelElement::updateLoop):\n(WebCore::HTMLModelElement::currentTime const):\n(WebCore::HTMLModelElement::setCurrentTime):\n(WebCore::HTMLModelElement::modelPlayerForAnimation const): Deleted.\n* Source/WebCore/Modules/model-element/HTMLModelElement.h:\n* Source/WebCore/Modules/model-element/SpatialPortalController.cpp:\n(WebCore::SpatialPortalController::loadChildModelIfReady):\n(WebCore::SpatialPortalController::childTransformDidChange):\n* Source/WebCore/Modules/model-element/SpatialPortalController.h:\n* Source/WebCore/animation/KeyframeEffect.cpp:\n(WebCore::KeyframeEffect::ticksContinuouslyWhileActive const):\n* Source/WebCore/dom/Element.cpp:\n(WebCore::Element::storeDisplayContentsOrNoneStyle):\n(WebCore::Element::renderOrDisplayContentsStyle const):\n* Source/WebCore/rendering/updating/RenderTreeUpdater.cpp:\n(WebCore::RenderTreeUpdater::updateElementRenderer):\n* Source/WebCore/style/StyleTransformResolver.cpp:\n(WebCore::Style::TransformResolver::hasTransformRelatedProperty):\n* Source/WebCore/style/StyleTransformResolver.h:\n* Source/WebKit/ModelProcess/cocoa/ModelProcessModelPlayerProxy.h:\n* Source/WebKit/ModelProcess/cocoa/ModelProcessModelPlayerProxy.mm:\n(WebKit::ModelProcessModelPlayerProxy::childEntityTransformSRT const):\n(WebKit::ModelProcessModelPlayerProxy::updateTransform):\n(WebKit::ModelProcessModelPlayerProxy::didFinishLoading):\n(WebKit::ModelProcessModelPlayerProxy::setEntityTransform):\n(WebKit::ModelProcessModelPlayerProxy::setPortalTransform):\n* Source/WebKit/WebProcess/Model/ModelProcessModelPlayer.cpp:\n(WebKit::ModelProcessModelPlayer::setPortalTransform):\n\nCanonical link: https://commits.webkit.org/319629@main","order":0,"repository_id":"webkit","timestamp":1787354755},{"branch":"main","hash":"7b56a059223f8116c20cfd668ae8935e84d800de","identifier":"319630@main","order":0,"repository_id":"webkit","timestamp":1787355189},{"author":{"emails":["sgill26@apple.com","sammy.gill@apple.com"],"name":"Sammy Gill"},"branch":"main","hash":"85db209cf65d735fab78a76c5321a57fef7af0dd","identifier":"319631@main","message":"[Grid Lanes] Remove redundant \"Phase\" suffix from GridLanesLayout::Phase enum values.\nhttps://bugs.webkit.org/show_bug.cgi?id=322307\nrdar://185544976\n\nReviewed by Tim Nguyen.\n\nThe values of GridLanesLayout::Phase repeated the name of the enum\nitself (LayoutPhase, MinContentPhase, MaxContentPhase). Drop the\nredundant suffix so the values read as Phase::Layout, Phase::MinContent\nand Phase::MaxContent. No change in behavior.\n\n* Source/WebCore/rendering/GridLanesLayout.cpp:\n(WebCore::GridLanesLayout::calculateGridLanesIntrinsicLogicalWidth):\n(WebCore::GridLanesLayout::insertIntoGridAndLayoutItem):\n* Source/WebCore/rendering/GridLanesLayout.h:\n* Source/WebCore/rendering/RenderGrid.cpp:\n(WebCore::RenderGrid::layoutGridLanes):\n(WebCore::RenderGrid::computeIntrinsicLogicalWidths):\n\nCanonical link: https://commits.webkit.org/319631@main","order":0,"repository_id":"webkit","timestamp":1787355325},{"author":{"emails":["zalan@apple.com","zbujtas@gmail.com"],"name":"Alan Baradlay"},"branch":"main","hash":"9518e96ced9f5f2ba70d9e9b651ced426ebc2d8e","identifier":"319632@main","message":"[list-marker] Lay bullet markers out as marker text so they take part in inline layout\nhttps://bugs.webkit.org/show_bug.cgi?id=321473\n<rdar://problem/185157814>\n\nReviewed by Antti Koivisto.\n\nMarker content is inline content: what it measures, where it sits on the line and how bidi orders it are inline layout's answers to give.\nEvery kind of marker goes through it except a disc, circle or square, which the marker measures and paints itself from the font metrics,\ninto a box it sizes for that purpose alone. So marker drawing exists twice, and the two have to be kept in step.\n\nIt is also what stands in the way of making an inside marker an inline box, which is where this is going:\nan inline box has no box of its own to paint into, so anything the marker draws for itself has nowhere to go.\n\nA list-style-image that fails to load now rebuilds the marker rather than relaying it out. It falls\nback to its list-style-type, and that text needs renderers the marker was not built with. Nothing\nabout the element's style changed, and a pseudo-element list item is only revisited through its host\n(RenderTreeUpdater::updateAfterDescendants), so imageChanged() invalidates the host's renderers\ninstead of the element's style.\n\n* Source/WebCore/layout/formattingContexts/inline/text/TextUtil.cpp:\n(WebCore::Layout::TextUtil::width):\n* Source/WebCore/layout/integration/LayoutIntegrationBoxTreeUpdater.cpp:\n(WebCore::LayoutIntegration::markerTextSynthesizesGlyph):\n(WebCore::LayoutIntegration::BoxTreeUpdater::createLayoutBox):\n(WebCore::LayoutIntegration::updateContentCharacteristic):\n(WebCore::LayoutIntegration::BoxTreeUpdater::updateContent):\n* Source/WebCore/layout/layouttree/LayoutInlineTextBox.h:\n(WebCore::Layout::InlineTextBox::hasSynthesizedGlyph const):\n* Source/WebCore/rendering/RenderListMarker.cpp:\n(WebCore::RenderListMarker::textNeedsBidiResolution const):\n(WebCore::RenderListMarker::needsContentContainer const):\n(WebCore::RenderListMarker::paint):\n(WebCore::RenderListMarker::layoutContentContainer):\n(WebCore::RenderListMarker::imageChanged):\n(WebCore::RenderListMarker::updateContent):\n(WebCore::RenderListMarker::updateContentContainerText):\n(WebCore::RenderListMarker::computeIntrinsicLogicalWidthContributions):\n(WebCore::RenderListMarker::updateInlineMargins):\n(WebCore::RenderListMarker::relativeMarkerRect):\n(WebCore::RenderListMarker::synthesizesGlyph const):\n(WebCore::RenderListMarker::drawsBulletShape const): Deleted.\n* Source/WebCore/rendering/RenderListMarker.h:\n* Source/WebCore/rendering/RenderTreeAsText.cpp:\n(WebCore::write):\n* Source/WebCore/rendering/TextBoxPainter.cpp:\n(WebCore::TextBoxPainter::paint):\n(WebCore::TextBoxPainter::hasSynthesizedGlyph const):\n(WebCore::TextBoxPainter::paintSynthesizedGlyph):\n* Source/WebCore/rendering/TextBoxPainter.h:\n\nCanonical link: https://commits.webkit.org/319632@main","order":0,"repository_id":"webkit","timestamp":1787358835},{"author":{"emails":["jespinal23@apple.com"],"name":"Jetzel Espinal"},"branch":"main","hash":"14cf46bf0d988503bf621915307967dd21005b02","identifier":"319633@main","message":"[GARDENING][macOS]REGRESSION(319200@main): accessibility/isolated-tree/aria-owns-id-change.html (layout-tests) is a constant Timeout.\nhttps://bugs.webkit.org/show_bug.cgi?id=322313\nrdar://185553044\n\nUnreviewed test gardening.\n\n* LayoutTests/platform/mac/TestExpectations:\n\nCanonical link: https://commits.webkit.org/319633@main","order":0,"repository_id":"webkit","timestamp":1787359192},{"author":{"emails":["ysuzuki@apple.com","yusukesuzuki@slowstart.org","utatane.tea@gmail.com"],"name":"Yusuke Suzuki"},"branch":"main","hash":"cffd5ed032c478c1dee5311a89b91e64909e8b90","identifier":"319634@main","message":"[WTF] Align PriorityQueue to std::priority_queue and fix WasmWorklist\nhttps://bugs.webkit.org/show_bug.cgi?id=322303\nrdar://185541345\n\nReviewed by Dan Hecht.\n\nWe found that WasmWorklist's PriorityQueue's ordering is opposite and\nnot correct. The reason is that PriorityQueue and std::priority_queue's\ncomparator is opposite and when changing std::priority_queue to\nPriorityQueue, we didn't change the comparator. But this is error-prone.\nThis patch fixes that issue and also change PriorityQueue's comparator\nto align it to std::priority_queue's one. So by default, taking\nstd::less, and populating the greatest value first. Doing the same in\nPriorityQueue.\n\nTest: Tools/TestWebKitAPI/Tests/WTF/PriorityQueue.cpp\n\n* Source/JavaScriptCore/b3/air/AirAllocateRegistersByGreedy.cpp:\n(JSC::B3::Air::Greedy::TmpPriority::operator<):\n(JSC::B3::Air::Greedy::TmpPriority::isHigherPriority): Deleted.\n* Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp:\n(JSC::DFG::InliningCandidateIsLowerPriority::operator() const):\n(JSC::DFG::InliningPlan::build):\n(JSC::DFG::isHigherPriorityInliningCandidate): Deleted.\n* Source/JavaScriptCore/wasm/WasmInliningDecision.cpp:\n(JSC::Wasm::InliningNodeIsLowerPriority::operator() const):\n(JSC::Wasm::InliningDecision::expand):\n(JSC::Wasm::isHigherPriority): Deleted.\n* Source/JavaScriptCore/wasm/WasmWorklist.cpp:\n(JSC::Wasm::Worklist::completePlanSynchronously):\n* Source/JavaScriptCore/wasm/WasmWorklist.h:\n(JSC::Wasm::Worklist::QueueElementIsLowerPriority::operator() const):\n(JSC::Wasm::Worklist::isHigherPriority): Deleted.\n* Source/WTF/wtf/MathExtras.h:\n(isLessThan): Deleted.\n(isLessThanEqual): Deleted.\n(isGreaterThan): Deleted.\n(isGreaterThanEqual): Deleted.\n* Source/WTF/wtf/PriorityQueue.h:\n* Source/WebCore/loader/ResourceMonitorThrottler.h:\n* Source/WebCore/page/ImageAnalysisQueue.h:\n(WebCore::ImageAnalysisQueue::firstIsHigherPriority): Deleted.\n* Source/WebKit/NetworkProcess/cache/NetworkCacheStorage.cpp:\n(WebKit::NetworkCache::Storage::ReadOperationIsLowerPriority::operator() const):\n(WebKit::NetworkCache::Storage::isHigherPriority): Deleted.\n* Source/WebKit/NetworkProcess/cache/NetworkCacheStorage.h:\n* Tools/TestWebKitAPI/Tests/WTF/PriorityQueue.cpp:\n(enqueue):\n(dequeue):\n(TEST(WTF_PriorityQueue, Basic)):\n(TEST(WTF_PriorityQueue, ReversedComparator)):\n(MoveOnlyIsLessThan::operator() const):\n(MoveOnlyIsGreaterThan::operator() const):\n(TEST(WTF_PriorityQueue, MoveOnly)):\n(TEST(WTF_PriorityQueue, DecreaseKey)):\n(TEST(WTF_PriorityQueue, IncreaseKey)):\n(TEST(WTF_PriorityQueue, IncreaseKeyWithAReversedComparator)):\n(TEST(WTF_PriorityQueue, Iteration)):\n(TEST(WTF_PriorityQueue, EqualElementsAreAValidHeap)):\n(ReversibleComparator::operator() const):\n(TEST(WTF_PriorityQueue, IsValidHeapDetectsAGreaterChild)):\n(PrioritizedTaskIsLowerPriority::operator() const):\n(TEST(WTF_PriorityQueue, IncreaseKeyMovesTowardsTheFront)):\n(TEST(WTF_PriorityQueue, RandomActions)):\n(isHigherPriority): Deleted.\n(TEST(WTF_PriorityQueue, CustomPriorityFunction)): Deleted.\n\nCanonical link: https://commits.webkit.org/319634@main","order":0,"repository_id":"webkit","timestamp":1787359567},{"author":{"emails":["djg@apple.com"],"name":"Dan Glastonbury"},"branch":"main","hash":"c22c85fd52be074f029f80ab95d154c45802a991","identifier":"319635@main","message":"Remove redundant paint state save/restore around SVG gradient fill/stroke\nhttps://bugs.webkit.org/show_bug.cgi?id=322250\nrdar://185485580\n\nReviewed by Simon Fraser.\n\nPathOrShapeGradientApplier bracketed each gradient apply in its own\ncontext->save()/restore() pair, costing two IPC messages per gradient-filled shape\npaint when rendering in the GPU process. The pair has been vestigial since\n32921@main moved the CTM mutations it was originally added for into the gradient's\nown space transform.\n\nRemove it. All callers already bracket the apply/postApply sequence in an outer\nGraphicsContextStateSaver, and LegacyRenderSVGResourceSolidColor has never restored\nthis state either, so gradient paint now behaves like solid-color paint.\n\nWorth ~2.5% on MotionMark 1.3 Suits.\n\n* Source/WebCore/rendering/svg/legacy/LegacyRenderSVGResourceGradient.cpp:\n(WebCore::PathOrShapeGradientApplier::applyResource):\n(WebCore::PathOrShapeGradientApplier::postApplyResource):\n\nCanonical link: https://commits.webkit.org/319635@main","order":0,"repository_id":"webkit","timestamp":1787360479},{"author":{"emails":["djg@apple.com"],"name":"Dan Glastonbury"},"branch":"main","hash":"4f1ddc1d813f89f2a529c841dcdbb5b038d8d63a","identifier":"319636@main","message":"Avoid constructing a Timeout on the common stream IPC send path\nhttps://bugs.webkit.org/show_bug.cgi?id=322259\nrdar://185490398\n\nReviewed by Kimmo Kinnunen.\n\nTimeout's constructor eagerly computes ApproximateTime::now() + delta, but\nStreamClientConnection::send() only consults the deadline if tryAcquire() has to\nblock, which is rare since the ring buffer normally has room. The cost was paid\non every message, and showed up in MotionMark 1.3 Suits profiles where IPC\naccounted for ~22% of samples.\n\nAdd StreamClientConnectionBuffer::acquireNoWait() for the non-blocking case and\ntry it first when the destination ID is unchanged, falling back to the existing\nTimeout-based path otherwise. Skipping trySendDestinationIDIfNeeded() on that\nfast path is equivalent to the early return it would have taken, since\nm_currentDestinationID is only assigned after the SetStreamDestinationID message\nhas been released. Timeout keeps its by-value semantics, so the shared budget\nacross trySendDestinationIDIfNeeded() + tryAcquire() is unaffected.\n\n* Source/WebKit/Platform/IPC/StreamClientConnection.h:\n(IPC::StreamClientConnection::send):\n* Source/WebKit/Platform/IPC/StreamClientConnectionBuffer.h:\n(IPC::StreamClientConnectionBuffer::acquireNoWait):\n\nCanonical link: https://commits.webkit.org/319636@main","order":0,"repository_id":"webkit","timestamp":1787360595},{"author":{"emails":["sgill26@apple.com","sammy.gill@apple.com"],"name":"Sammy Gill"},"branch":"main","hash":"00055d9dab65a99dbe3407afad48d425d13e0a24","identifier":"319637@main","message":"[margin-trim][cleanup] Move margin trimming machinery out of RenderBox\nhttps://bugs.webkit.org/show_bug.cgi?id=255434\nrdar://108030923\n\nReviewed by Alan Baradlay.\n\nNow that margin-trim only applies to block containers, RenderBlockFlow is the\nonly renderer that can trim one of its children's margins. The\nmachinery for it does not need to sit on RenderBox anymore, where every other\nlayout system can see it.\n\nTo help cleanup the code a bit and make the responsibility clear we can\nmove most of the code that lives in RenderBox into RenderBlockFlow.\n\n* Source/WebCore/rendering/RenderBox.cpp:\n(WebCore::RenderBox::computeLogicalWidth const):\n(WebCore::RenderBox::computeOrTrimInlineMargin const): Deleted.\nInstead of having a \"compute or trim,\" function let's just replace it\nwith the code inline since it's really only used in one place.\n\nCanonical link: https://commits.webkit.org/319637@main","order":0,"repository_id":"webkit","timestamp":1787362071},{"branch":"main","hash":"112604f6a167ea78c004e392cd123edde551f2b5","identifier":"319638@main","order":0,"repository_id":"webkit","timestamp":1787366532},{"author":{"emails":["rniwa@webkit.org","rniwa@apple.com"],"name":"Ryosuke Niwa"},"branch":"main","hash":"adf3372359dc8d160a16ee4bf0f9cb5e6b3b7d6f","identifier":"319639@main","message":"[Site Isolation] fast/events/suspend-timers.html fails\nhttps://bugs.webkit.org/show_bug.cgi?id=322300\n\nReviewed by Sihui Liu.\n\nAlways enable UseUIProcessForBackForwardItemLoading in the test.\n\n* LayoutTests/fast/events/suspend-timers.html:\n\nCanonical link: https://commits.webkit.org/319639@main","order":0,"repository_id":"webkit","timestamp":1787367460},{"author":{"emails":["ahmad.saleem792@gmail.com","ahmad.saleem792+github@gmail.com","ahmad_saleem@apple.com"],"name":"Ahmad Saleem"},"branch":"main","hash":"baf4a9a7ec0b8436f3dec8cb8c4b418f0795a308","identifier":"319640@main","message":"dialog close() restores focus unconditionally instead of only when focus is inside the dialog or it was modal\nhttps://bugs.webkit.org/show_bug.cgi?id=322310\nrdar://185549474\n\nReviewed by Tim Nguyen.\n\nThe close the dialog steps gate the focus restore [1]:\n\n    If subject's node document's focused area of the document's DOM anchor is a\n    shadow-including inclusive descendant of subject, or wasModal is true, then\n    run the focusing steps for element; the viewport should not be scrolled by\n    doing this step.\n\nWe ran that unconditionally, so closing a non-modal dialog yanked focus back\neven when the author had moved it elsewhere. The stray focus change is\nobservable: it fires focusin, letting a listener re-enter the dialog's own state\nmachine. Capture wasModal after removing the open attribute, matching the spec's\nstep order, and gate on it.\n\nThe check uses the composed tree, not the shadow-including tree: a node slotted\ninto a dialog inside a shadow root is not a shadow-including descendant, yet\nfocus restore is expected for it. See whatwg/html#8904 [2], cited by\ndialog-focus-previous-outside.html for that case.\n\nThis removes the FIXME from 319173@main and fixes the bug by handling focus\nproperly.\n\n[1] https://html.spec.whatwg.org/multipage/interactive-elements.html#close-the-dialog\n[2] https://github.com/whatwg/html/issues/8904\n\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/interactive-elements/the-dialog-element/dialog-closedby-corner-cases-expected.txt: Progression\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/interactive-elements/the-dialog-element/dialog-focus-previous-outside-expected.txt: Ditto\n* Source/WebCore/html/HTMLDialogElement.cpp:\n(WebCore::HTMLDialogElement::close):\n\nCanonical link: https://commits.webkit.org/319640@main","order":0,"repository_id":"webkit","timestamp":1787369842},{"author":{"emails":["richard_robinson2@apple.com"],"name":"Richard Robinson"},"branch":"main","hash":"22fbd8510ca81ff8d8cc2e03f50a5dbb186dbb9d","identifier":"319641@main","message":"Use a normal UUID for the `FileSystemHandleGlobalIdentifier` type\nhttps://bugs.webkit.org/show_bug.cgi?id=322301\nrdar://185540297\n\nReviewed by Abrar Rahman Protyasha.\n\nThe `FileSystemHandleGlobalIdentifier` type is the only type across the entire codebase that\nused a UUID-based ObjectIdentifier. Switch to just a normal UUID to be consistent with everything else.\n\nThis also unblocks being able to remove the UUID version of ObjectIdentifier, a mistake introduced\nby a less pragmatic version of myself several years ago.\n\n* Source/WebCore/Modules/filesystem/FileSystemHandle.cpp:\n(WebCore::FileSystemHandle::markAsUnresolved):\n* Source/WebCore/Modules/filesystem/FileSystemHandleGlobalIdentifier.h:\n* Source/WebCore/Modules/indexeddb/server/SQLiteIDBBackingStore.cpp:\n(WebCore::IDBServer::SQLiteIDBBackingStore::addFileSystemHandleRecordsForObjectStoreRecord):\n* Source/WebCore/bindings/js/SerializedScriptValue.cpp:\n(WebCore::CloneSerializer::dumpDerivedTerminal):\n* Source/WebKit/NetworkProcess/storage/FileSystemStorageManager.cpp:\n(WebKit::FileSystemStorageManager::createHandle):\n* Source/WebKit/Scripts/webkit/messages.py:\n(atomic_object_identifier):\n(serialized_identifiers):\n(types_that_cannot_be_forward_declared):\n(headers_for_type):\n* Source/WebKit/Scripts/webkit/tests/MessageArgumentDescriptions.cpp:\n(IPC::serializedIdentifiers):\n* Source/WebKit/Shared/WTFArgumentCoders.serialization.in:\n\nCanonical link: https://commits.webkit.org/319641@main","order":0,"repository_id":"webkit","timestamp":1787372961},{"author":{"emails":["ysuzuki@apple.com","yusukesuzuki@slowstart.org","utatane.tea@gmail.com"],"name":"Yusuke Suzuki"},"branch":"main","hash":"2cba6521075d9a3a968a4a00f5e352f6e578c61f","identifier":"319642@main","message":"[JSC] Make Air::padInference faster by avoiding visiting args twice\nhttps://bugs.webkit.org/show_bug.cgi?id=322311\nrdar://185549590\n\nReviewed by Dan Hecht.\n\nAvoiding calling forEachArg twice and collecting hasEarlyDef /\nhasLateUseOrDef at once via paddingSummary.\n\n* Source/JavaScriptCore/b3/air/AirInst.cpp:\n(JSC::B3::Air::Inst::paddingSummary):\n(JSC::B3::Air::Inst::needsPadding): Deleted.\n* Source/JavaScriptCore/b3/air/AirInst.h:\n* Source/JavaScriptCore/b3/air/AirPadInterference.cpp:\n(JSC::B3::Air::padInterference):\n\nCanonical link: https://commits.webkit.org/319642@main","order":0,"repository_id":"webkit","timestamp":1787375930},{"author":{"emails":["rniwa@webkit.org","rniwa@apple.com"],"name":"Ryosuke Niwa"},"branch":"main","hash":"cd9803c538a58c8ffc75f03b7ce121e408c5f6f1","identifier":"319643@main","message":"[Site Isolation] fast/files/file-reader-back-forward-cache.html fails\nhttps://bugs.webkit.org/show_bug.cgi?id=322314\n\nReviewed by Sihui Liu.\n\nIgnore the console logs since they're not the primary point of this test.\n\n* LayoutTests/fast/files/file-reader-back-forward-cache.html:\n\nCanonical link: https://commits.webkit.org/319643@main","order":0,"repository_id":"webkit","timestamp":1787380210},{"author":{"emails":["mtan@igalia.com"],"name":"tannal"},"branch":"main","hash":"089848d399ffbc765f2f8d914f8b0b55cca87be7","identifier":"319644@main","message":"Resync `mathml` from WPT Upstream\n\nhttps://bugs.webkit.org/show_bug.cgi?id=321996\n\nRebase WPT tests in the mathml/ directory.\n\nUpstream commit: https://github.com/web-platform-tests/wpt/commit/4eeb06f9241da36ca3543dcbd25ce67727262238\n\nReviewed by Fr\u00e9d\u00e9ric Wang N\u00e9lar.\n\n* LayoutTests/imported/w3c/resources/resource-files.json:\n* LayoutTests/imported/w3c/web-platform-tests/mathml/relations/html5-tree/a-rel-getter-setter-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/mathml/relations/html5-tree/a-rel-getter-setter.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/mathml/relations/html5-tree/a-rel-policy-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/mathml/relations/html5-tree/a-rel-policy.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/mathml/relations/html5-tree/href-target-base-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/mathml/relations/html5-tree/href-target-base.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/mathml/relations/html5-tree/support/a-rel-target.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/mathml/relations/html5-tree/support/w3c-import.log:\n* LayoutTests/imported/w3c/web-platform-tests/mathml/relations/html5-tree/w3c-import.log:\n* LayoutTests/TestExpectations:\n\nCanonical link: https://commits.webkit.org/319644@main","order":0,"repository_id":"webkit","timestamp":1787399826},{"author":{"emails":["sosuke@bun.com","sosuke@bun.sh","aosukeke@gmail.com"],"name":"Sosuke Suzuki"},"branch":"main","hash":"96ca975b2a61a52093cccecd9249e2b410085eea","identifier":"319645@main","message":"[JSC] Use `objectCloneFast` for the first source in `Object.assign`'s batching path\nhttps://bugs.webkit.org/show_bug.cgi?id=322161\n\nReviewed by Yusuke Suzuki.\n\nObject.assign({}, state, patch) with 2 or 3 sources goes through the batching path in\nobjectConstructorAssign, which enumerates every source and replays the first source's\nshape one property at a time via putOwnDataPropertyBatching. objectCloneFast is only\nreachable from objectAssignFast, which is used for a single source or 5+ arguments.\n\nTry objectCloneFast for the first source at the start of the batching path and start\nthe per-source loop from the second source when it succeeds. The batching path's\nexisting preconditions already satisfy what objectCloneFast requires.\n\n                                               Baseline                  Patched\n\nobject-assign-clone-multiple-sources        0.9998+-0.0420     ^      0.7104+-0.0486        ^ definitely 1.4073x faster\nobject-assign-multiple-sources              9.5170+-0.2249     ^      6.2294+-0.2320        ^ definitely 1.5278x faster\n\nTests: JSTests/microbenchmarks/object-assign-clone-multiple-sources.js\n       JSTests/stress/object-assign-clone-multiple-sources.js\n\n* JSTests/microbenchmarks/object-assign-clone-multiple-sources.js: Added.\n* JSTests/stress/object-assign-clone-multiple-sources.js: Added.\n(shouldBe):\n(shouldBeArray):\n(makeState):\n* Source/JavaScriptCore/runtime/ObjectConstructor.cpp:\n(JSC::JSC_DEFINE_HOST_FUNCTION):\n\nCanonical link: https://commits.webkit.org/319645@main","order":0,"repository_id":"webkit","timestamp":1787413882},{"author":{"emails":["sosuke@bun.com","sosuke@bun.sh","aosukeke@gmail.com"],"name":"Sosuke Suzuki"},"branch":"main","hash":"cea233cedec0d634e84b0eb2d3e495e62c9a6959","identifier":"319646@main","message":"[JSC] `SymbolTableEntry` should not allocate a `WatchpointSet` until somebody watches the variable\nhttps://bugs.webkit.org/show_bug.cgi?id=321587\n\nReviewed by Yusuke Suzuki.\n\nEvery closure variable that its own function stores to (which includes the initializing store of\n`var` / `let` / `function` / `class` bindings and captured parameters) and every global variable\ngets SymbolTableEntry::prepareToWatch() when its CodeBlock is linked or the global is declared.\nThat allocated a 16-byte FatEntry plus a WatchpointSet (a 32-byte libpas cell) per variable.\nThe WatchpointSet is only needed once DFG constant-folds a load of the variable and adds a\nWatchpoint to it; until then LLInt, Baseline and DFG only read and step its\nClearWatchpoint / IsWatched / IsInvalidated state.\n\nThis patch makes FatEntry hold an InlineWatchpointSet, which keeps that state in one word and\ninflates to a WatchpointSet only when a Watchpoint is added. The op_get_from_scope /\nop_put_to_scope metadata, ResolveOp, DFG NotifyWrite and ScopedArgumentsTable now point at the\nInlineWatchpointSet, and LLInt / Baseline / DFG / FTL check its word inline before falling back to\nthe WatchpointSet state. Since an InlineWatchpointSet cannot be shared, copies of a\nSymbolTableEntry are now always thin; the few places that took the watchpoint set from a copy use\nSymbolTable::find() instead, and JSGlobalObject::defineOwnProperty sets the read-only bit in place\nrather than replacing the entry.\n\nIn a server application made of about 250 CommonJS modules, main allocated 1,466 WatchpointSets\nright after loading the application, while this patch allocates none. Even after the code has\nbeen JIT-compiled by DFG/FTL, only 376 of the 1,752 watchpoint sets got inflated; the rest stayed\ninline watchpoint sets.\n\n* Source/JavaScriptCore/b3/B3AbstractHeapRepository.h:\n* Source/JavaScriptCore/bytecode/BytecodeList.rb:\n* Source/JavaScriptCore/bytecode/VariableWriteFireDetail.cpp:\n(JSC::VariableWriteFireDetail::touch):\n* Source/JavaScriptCore/bytecode/VariableWriteFireDetail.h:\n* Source/JavaScriptCore/bytecode/Watchpoint.h:\n(JSC::InlineWatchpointSet::inflatedSetConcurrently const):\n(JSC::InlineWatchpointSet::offsetOfData):\n(JSC::InlineWatchpointSet::thinFlag):\n(JSC::InlineWatchpointSet::encodedThinState):\n(JSC::InlineWatchpointSet::encodeState):\n* Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp:\n(JSC::DFG::ByteCodeParser::parseBlock):\n* Source/JavaScriptCore/dfg/DFGGraph.cpp:\n(JSC::DFG::Graph::tryGetConstantClosureVar):\n* Source/JavaScriptCore/dfg/DFGNode.h:\n(JSC::DFG::Node::watchpointSet):\n* Source/JavaScriptCore/dfg/DFGOperations.cpp:\n(JSC::DFG::JSC_DEFINE_NOEXCEPT_JIT_OPERATION):\n* Source/JavaScriptCore/dfg/DFGOperations.h:\n* Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:\n(JSC::DFG::SpeculativeJIT::compileNotifyWrite):\n* Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:\n(JSC::FTL::DFG::LowerDFGToB3::compileNotifyWrite):\n* Source/JavaScriptCore/jit/AssemblyHelpers.h:\n(JSC::AssemblyHelpers::branchIfInlineWatchpointSetIsStillValid):\n* Source/JavaScriptCore/jit/JIT.cpp:\n(JSC::JIT::emitNotifyWriteWatchpoint):\n* Source/JavaScriptCore/jit/JIT.h:\n* Source/JavaScriptCore/jit/JITOperations.cpp:\n(JSC::JSC_DEFINE_JIT_OPERATION):\n* Source/JavaScriptCore/llint/LowLevelInterpreter.asm:\n* Source/JavaScriptCore/llint/LowLevelInterpreter64.asm:\n* Source/JavaScriptCore/lol/LOLJITOperations.cpp:\n(JSC::LOL::JSC_DEFINE_JIT_OPERATION):\n* Source/JavaScriptCore/runtime/CommonSlowPathsInlines.h:\n(JSC::CommonSlowPaths::cacheGlobalLexicalVar):\n(JSC::CommonSlowPaths::tryCachePutToScopeGlobal):\n(JSC::CommonSlowPaths::tryCacheGetFromScopeGlobal):\n* Source/JavaScriptCore/runtime/GetPutInfo.h:\n(JSC::ResolveOp::ResolveOp):\n* Source/JavaScriptCore/runtime/JSGlobalObject.cpp:\n(JSC::JSGlobalObject::defineOwnProperty):\n(JSC::JSGlobalObject::addStaticGlobals):\n* Source/JavaScriptCore/runtime/JSSymbolTableObject.h:\n(JSC::symbolTablePutTouchWatchpointSet):\n(JSC::symbolTablePutInvalidateWatchpointSet):\n(JSC::symbolTablePut):\n* Source/JavaScriptCore/runtime/ProgramExecutable.cpp:\n(JSC::ProgramExecutable::initializeGlobalProperties):\n* Source/JavaScriptCore/runtime/ScopedArgumentsTable.cpp:\n(JSC::ScopedArgumentsTable::trySetWatchpointSet):\n* Source/JavaScriptCore/runtime/ScopedArgumentsTable.h:\n* Source/JavaScriptCore/runtime/SymbolTable.cpp:\n(JSC::SymbolTableEntry::inflateSlow):\n(JSC::SymbolTable::hasScopedWatchpointSet):\n(JSC::SymbolTableEntry::copySlow): Deleted.\n(JSC::SymbolTableEntry::prepareToWatch): Deleted.\n* Source/JavaScriptCore/runtime/SymbolTable.h:\n(JSC::SymbolTableEntry::varOffsetFromBits):\n(JSC::SymbolTableEntry::scopeOffsetFromBits):\n(JSC::SymbolTableEntry::SymbolTableEntry):\n(JSC::SymbolTableEntry::operator=):\n(JSC::SymbolTableEntry::isWatchable const):\n(JSC::SymbolTableEntry::prepareToWatch):\n(JSC::SymbolTableEntry::watchpointSet):\n(JSC::SymbolTableEntry::pack):\n(JSC::SymbolTableEntry::disableWatching): Deleted.\n* Source/JavaScriptCore/runtime/SymbolTableInlines.h:\n(JSC::SymbolTableEntry::SymbolTableEntry):\n(JSC::SymbolTableEntry::operator=):\n(JSC::SymbolTable::prepareToWatchScopedArgument):\n(JSC::SymbolTableEntry::inflate): Deleted.\n\nCanonical link: https://commits.webkit.org/319646@main","order":0,"repository_id":"webkit","timestamp":1787414954},{"author":{"emails":["com.webkit.iidmsa@gmail.com","com.idmsa@gmail.com"],"name":"Fady Farag"},"branch":"main","hash":"889d15f0a77e0701ab5db32607647476a5d0498b","identifier":"319647@main","message":"[Gardening] Remove outdated test expectation after 319592@main\nhttps://bugs.webkit.org/show_bug.cgi?id=321998\nrdar://185499780\n\nUnreviewed.\n\n* LayoutTests/platform/ios/TestExpectations:\n\nCanonical link: https://commits.webkit.org/319647@main","order":0,"repository_id":"webkit","timestamp":1787421663},{"author":{"emails":["pvollan@apple.com","peavo@outlook.com"],"name":"Per Arne Vollan"},"branch":"main","hash":"cb7daacd43302439e72f19b9577d2b10c629d242","identifier":"319648@main","message":"[macOS] The Networking process sandbox should inherit network access from the UI process\nhttps://bugs.webkit.org/show_bug.cgi?id=311807\nrdar://171541375\n\nReviewed by Chris Dumez.\n\nThis was already fixed for iOS in rdar://159116963. This patch enables the feature on macOS\nwith an additional link check.\n\nNo new tests, since both WebKitTestRunner and TestWebKitAPI are not blocking network access.\n\n* Source/WTF/wtf/PlatformEnableCocoa.h:\n* Source/WTF/wtf/cocoa/RuntimeApplicationChecksCocoa.h:\n* Source/WTF/wtf/cocoa/RuntimeApplicationChecksCocoa.mm:\n(WTF::computeSDKAlignedBehaviors):\n* Source/WTF/wtf/spi/darwin/dyldSPI.h:\n* Source/WebKit/NetworkProcess/cocoa/NetworkProcessCocoa.mm:\n(WebKit::blockNetworkAccessIfNeeded):\n(WebKit::NetworkProcess::platformInitializeNetworkProcessCocoa):\n* Source/WebKit/NetworkProcess/mac/com.apple.WebKit.NetworkProcess.sb.in:\n* Source/WebKit/Scripts/process-entitlements.sh:\n\nOriginally-landed-as: 305413.701@safari-7624-branch (8f582cbc1a83). rdar://184743905\nCanonical link: https://commits.webkit.org/319648@main","order":0,"repository_id":"webkit","timestamp":1787423983},{"author":{"emails":["k_tamkun@apple.com","kai@tamkun.io"],"name":"Kai Tamkun"},"branch":"main","hash":"7711916200dda7e418b321e34493f66a7af2a0b0","identifier":"319649@main","message":"[JSC] NodeMustGenerate incorrectly cleared on CheckOverflow ArithAdd/ArithSub in DFGFixupPhase Inc/Dec handler\nhttps://bugs.webkit.org/show_bug.cgi?id=315213\nrdar://176984293\n\nReviewed by Yijia Huang.\n\nThis patch prevents overflow checks for increment/decrement in DFG from being mistakenly DCE'd.\n\nTest: JSTests/stress/inc-dec-int32-overflow-dce.js\n\n* JSTests/stress/inc-dec-int32-overflow-dce.js: Added.\n(shouldBe):\n(inc):\n(dec):\n* Source/JavaScriptCore/dfg/DFGFixupPhase.cpp:\n(JSC::DFG::FixupPhase::fixupNode):\n\nOriginally-landed-as: 305413.1015@safari-7624.5-branch (7951c397a1ba). rdar://185368748\nCanonical link: https://commits.webkit.org/319649@main","order":0,"repository_id":"webkit","timestamp":1787430888},{"author":{"emails":["richard_robinson2@apple.com"],"name":"Richard Robinson"},"branch":"main","hash":"314133b7a60e4c00c9160e685cf56cc11901c298","identifier":"319650@main","message":"[WTF] Remove UUID version of ObjectIdentifier\nhttps://bugs.webkit.org/show_bug.cgi?id=322324\nrdar://185566036\n\nReviewed by Ben Nham.\n\nI introduced this version of ObjectIdentifier two years ago, when I was more na\u00efve and less pragmatic.\nRemove this unnecessary and unused version by effectively reverting 279402@main.\n\nThis greatly re-simplifies the code and also makes crash log stack symbols and compilation errors a lot\neasier to read.\n\nTest: Source/JavaScriptCore/assembler/testmasm.cpp\n\n* Source/JavaScriptCore/assembler/testmasm.cpp:\n* Source/JavaScriptCore/wasm/debugger/WasmExecutionHandler.cpp:\n(JSC::Wasm::findVM):\n(JSC::Wasm::WTF_REQUIRES_LOCK):\n(JSC::Wasm::ExecutionHandler::callStackStringFor):\n* Source/JavaScriptCore/wasm/debugger/tests/ExecutionHandlerTest.cpp:\n(ExecutionHandlerTest::switchTarget):\n* Source/JavaScriptCore/yarr/YarrJIT.cpp:\n* Source/WTF/wtf/CrossThreadCopier.h:\n* Source/WTF/wtf/Forward.h:\n* Source/WTF/wtf/ObjectIdentifier.cpp:\n(WTF::ObjectIdentifierMainThreadAccessTraits::generateIdentifierInternal):\n(WTF::printInternal):\n(WTF::ObjectIdentifierThreadSafeAccessTraits::generateIdentifierInternal):\n(WTF::ObjectIdentifierMainThreadAccessTraits<uint64_t>::generateIdentifierInternal): Deleted.\n(WTF::ObjectIdentifierThreadSafeAccessTraits<uint64_t>::generateIdentifierInternal): Deleted.\n(WTF::ObjectIdentifierMainThreadAccessTraits<UUID>::generateIdentifierInternal): Deleted.\n(WTF::ObjectIdentifierThreadSafeAccessTraits<UUID>::generateIdentifierInternal): Deleted.\n* Source/WTF/wtf/ObjectIdentifier.h:\n(WTF::ObjectIdentifierGenericBase::toUInt64 const):\n(WTF::ObjectIdentifierGenericBase::isValidIdentifier):\n(WTF::ObjectIdentifierGenericBase::ObjectIdentifierGenericBase):\n(WTF::ObjectIdentifierGenericBase::hashTableDeletedValue):\n(WTF::ObjectIdentifierGeneric::ObjectIdentifierGeneric):\n(WTF::ObjectIdentifierGeneric::isHashTableEmptyValue const):\n(WTF::add):\n(WTF::operator==):\n(WTF::operator<=>):\n(WTF::ObjectIdentifierGenericBase<uint64_t>::isHashTableDeletedValue const): Deleted.\n(WTF::ObjectIdentifierGenericBase<uint64_t>::toUInt64 const): Deleted.\n(WTF::ObjectIdentifierGenericBase<uint64_t>::toRawValue const): Deleted.\n(WTF::ObjectIdentifierGenericBase<uint64_t>::loggingString const): Deleted.\n(WTF::ObjectIdentifierGenericBase<uint64_t>::isValidIdentifier): Deleted.\n(WTF::ObjectIdentifierGenericBase<uint64_t>::ObjectIdentifierGenericBase): Deleted.\n(WTF::ObjectIdentifierGenericBase<uint64_t>::hashTableDeletedValue): Deleted.\n(WTF::ObjectIdentifierGenericBase<UUID>::isHashTableDeletedValue const): Deleted.\n(WTF::ObjectIdentifierGenericBase<UUID>::toRawValue const): Deleted.\n(WTF::ObjectIdentifierGenericBase<UUID>::loggingString const): Deleted.\n(WTF::ObjectIdentifierGenericBase<UUID>::isValidIdentifier): Deleted.\n(WTF::ObjectIdentifierGenericBase<UUID>::ObjectIdentifierGenericBase): Deleted.\n(WTF::ObjectIdentifierGenericBase<UUID>::hashTableDeletedValue): Deleted.\n(WTF::ObjectIdentifierGenericBaseStringTypeAdapter<uint64_t>::length const): Deleted.\n(WTF::ObjectIdentifierGenericBaseStringTypeAdapter<uint64_t>::is8Bit const): Deleted.\n(WTF::ObjectIdentifierGenericBaseStringTypeAdapter<uint64_t>::writeTo const): Deleted.\n(WTF::ObjectIdentifierGenericBaseStringTypeAdapter<uint64_t>::ObjectIdentifierGenericBaseStringTypeAdapter): Deleted.\n* Source/WTF/wtf/text/TextStream.cpp:\n(WTF::operator<<):\n* Source/WTF/wtf/text/TextStream.h:\n* Source/WebCore/Modules/indexeddb/IDBTransaction.cpp:\n(WebCore::IDBTransaction::renameIndex):\n(WebCore::IDBTransaction::deleteIndex):\n* Source/WebCore/Modules/indexeddb/server/MemoryIDBBackingStore.cpp:\n(WebCore::IDBServer::MemoryIDBBackingStore::createObjectStore):\n(WebCore::IDBServer::MemoryIDBBackingStore::addIndex):\n* Source/WebCore/Modules/indexeddb/server/SQLiteIDBBackingStore.cpp:\n(WebCore::IDBServer::SQLiteIDBBackingStore::migrateIndexInfoTableForIDUpdate):\n(WebCore::IDBServer::SQLiteIDBBackingStore::migrateIndexRecordsTableForIDUpdate):\n(WebCore::IDBServer::SQLiteIDBBackingStore::extractExistingDatabaseInfo):\n(WebCore::IDBServer::SQLiteIDBBackingStore::createObjectStore):\n(WebCore::IDBServer::SQLiteIDBBackingStore::deleteObjectStore):\n(WebCore::IDBServer::SQLiteIDBBackingStore::renameObjectStore):\n(WebCore::IDBServer::SQLiteIDBBackingStore::clearObjectStore):\n(WebCore::IDBServer::SQLiteIDBBackingStore::uncheckedGetExistingPrimaryKeyForIndexKey):\n(WebCore::IDBServer::SQLiteIDBBackingStore::overwriteRecord):\n(WebCore::IDBServer::SQLiteIDBBackingStore::checkIndexConstraintsForPut):\n(WebCore::IDBServer::SQLiteIDBBackingStore::uncheckedPutIndexKey):\n(WebCore::IDBServer::SQLiteIDBBackingStore::uncheckedPutIndexRecord):\n(WebCore::IDBServer::SQLiteIDBBackingStore::deleteIndex):\n(WebCore::IDBServer::SQLiteIDBBackingStore::renameIndex):\n(WebCore::IDBServer::SQLiteIDBBackingStore::keyExistsInObjectStore):\n(WebCore::IDBServer::SQLiteIDBBackingStore::deleteRecord):\n(WebCore::IDBServer::SQLiteIDBBackingStore::deleteRange):\n(WebCore::IDBServer::SQLiteIDBBackingStore::updateAllIndexesForAddRecord):\n(WebCore::IDBServer::SQLiteIDBBackingStore::addRecord):\n(WebCore::IDBServer::SQLiteIDBBackingStore::deleteFileSystemHandleRecordsForObjectStore):\n(WebCore::IDBServer::SQLiteIDBBackingStore::getRecord):\n(WebCore::IDBServer::SQLiteIDBBackingStore::getAllObjectStoreRecords):\n(WebCore::IDBServer::SQLiteIDBBackingStore::uncheckedGetIndexRecordForOneKey):\n(WebCore::IDBServer::SQLiteIDBBackingStore::getCount):\n(WebCore::IDBServer::SQLiteIDBBackingStore::uncheckedGetKeyGeneratorValue):\n(WebCore::IDBServer::SQLiteIDBBackingStore::uncheckedSetKeyGeneratorValue):\n(WebCore::IDBServer::SQLiteIDBBackingStore::revertGeneratedKeyNumber):\n(WebCore::IDBServer::SQLiteIDBBackingStore::addIndex):\n* Source/WebCore/Modules/indexeddb/server/SQLiteIDBCursor.cpp:\n(WebCore::IDBServer::SQLiteIDBCursor::internalFetchNextRecord):\n(WebCore::IDBServer::SQLiteIDBCursor::boundIDValue const):\n* Source/WebCore/Modules/indexeddb/server/UniqueIDBDatabase.cpp:\n(WebCore::IDBServer::UniqueIDBDatabase::createIndexAsyncAfterQuotaCheck):\n* Source/WebCore/Modules/indexeddb/shared/IDBCursorInfo.cpp:\n(WebCore::IDBCursorInfo::loggingString const):\n* Source/WebCore/dom/ViewTransition.cpp:\n(WebCore::effectiveViewTransitionName):\n* Source/WebCore/inspector/InspectorIdentifierRegistry.h:\n(Inspector::IdentifierRegistry::protocolFrameId):\n* Source/WebCore/loader/NavigationIdentifier.h:\n* Source/WebCore/page/FrameIdentifier.cpp:\n(WebCore::operator<<):\n* Source/WebCore/page/RemoteFrame.cpp:\n(WebCore::RemoteFrame::hostingProcessIdentifier const):\n* Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:\n* Source/WebCore/testing/Internals.cpp:\n(WebCore::Internals::identifierForTimeline const):\n* Source/WebKit/NetworkProcess/NetworkResourceLoader.cpp:\n(WebKit::escapeIDForJSON):\n* Source/WebKit/Platform/IPC/Connection.h:\n(IPC::Connection::sendWithAsyncReply):\n(IPC::Connection::sendWithPromisedReply):\n(IPC::Connection::send):\n(IPC::Connection::sendSync):\n(IPC::Connection::waitForAndDispatchImmediately):\n* Source/WebKit/Platform/IPC/Decoder.cpp:\n* Source/WebKit/Platform/IPC/MessageSender.h:\n* Source/WebKit/Platform/IPC/MessageSenderInlines.h:\n(IPC::MessageSender::send):\n(IPC::MessageSender::sendSync):\n(IPC::MessageSender::sendWithAsyncReply):\n* Source/WebKit/Platform/IPC/StreamClientConnection.h:\n(IPC::StreamClientConnection::send):\n(IPC::StreamClientConnection::sendWithAsyncReply):\n(IPC::StreamClientConnection::sendWithAsyncReplyOnDispatcher):\n(IPC::StreamClientConnection::sendSync):\n(IPC::StreamClientConnection::waitForAndDispatchImmediately):\n* Source/WebKit/Platform/IPC/StreamServerConnection.h:\n(IPC::StreamServerConnection::send):\n* Source/WebKit/Shared/AuxiliaryProcess.h:\n(WebKit::AuxiliaryProcess::addMessageReceiver):\n(WebKit::AuxiliaryProcess::removeMessageReceiver):\n* Source/WebKit/Shared/RemoteLayerTree/RemoteLayerTreeTransaction.mm:\n(WebKit::RemoteLayerTreeTransaction::LayerCreationProperties::hostingContextID const):\n* Source/WebKit/Shared/WTFArgumentCoders.serialization.in:\n* Source/WebKit/Shared/WebFoundTextRange.cpp:\n(WebKit::WebFoundTextRange::CueData::hash const):\n(WebKit::operator<<):\n* Source/WebKit/Shared/unix/AuxiliaryProcessMain.cpp:\n(WebKit::AuxiliaryProcessMainCommon::parseCommandLine):\n* Source/WebKit/UIProcess/Automation/BidiScriptAgent.h:\n* Source/WebKit/UIProcess/AuxiliaryProcessProxy.h:\n(WebKit::AuxiliaryProcessProxy::sendWithAsyncReply):\n(WebKit::AuxiliaryProcessProxy::send):\n(WebKit::AuxiliaryProcessProxy::sendSync):\n(WebKit::AuxiliaryProcessProxy::addMessageReceiver):\n(WebKit::AuxiliaryProcessProxy::removeMessageReceiver):\n* Source/WebKit/UIProcess/Extensions/WebExtensionContext.cpp:\n(WebKit::WebExtensionContext::isPrivilegedMessage const):\n* Source/WebKit/UIProcess/Extensions/WebExtensionController.h:\n(WebKit::WebExtensionController::sendToAllProcesses):\n* Source/WebKit/UIProcess/Model/PortalPresentationManagerProxy.mm:\n(WebKit::PortalPresentationManagerProxy::invalidateModel):\n(WebKit::PortalPresentationManagerProxy::ensurePortalPresentation):\n* Source/WebKit/UIProcess/RemoteLayerTree/RemoteAnimationTimeline.cpp:\n(WebKit::RemoteAnimationTimeline::toJSONForTesting const):\n* Source/WebKit/UIProcess/WebFrameProxy.h:\n* Source/WebKit/UIProcess/WebPageProxy.h:\n* Source/WebKit/UIProcess/WebProcessPool.h:\n* Source/WebKit/UIProcess/ios/WKContentViewInteraction.mm:\n(+[WKFoundTextRange foundTextRangeWithWebFoundTextRange:]):\n* Source/WebKit/WebProcess/GPU/graphics/RemoteRenderingBackendProxy.cpp:\n(WebKit::RemoteRenderingBackendProxy::send):\n(WebKit::RemoteRenderingBackendProxy::sendSync):\n(WebKit::RemoteRenderingBackendProxy::sendWithAsyncReply):\n* Source/WebKit/WebProcess/GPU/graphics/RemoteRenderingBackendProxy.h:\n* Source/WebKit/WebProcess/WebPage/RemoteLayerTree/PlatformCALayerRemoteCustom.mm:\n(WebKit::PlatformCALayerRemoteCustom::PlatformCALayerRemoteCustom):\n* Source/WebKit/WebProcess/WebPage/WebPage.h:\n\nCanonical link: https://commits.webkit.org/319650@main","order":0,"repository_id":"webkit","timestamp":1787431933},{"author":{"emails":["jer.noble@apple.com"],"name":"Jer Noble"},"branch":"main","hash":"4fa207d1c8d4a14afbda9ffa02b9070effd52d9b","identifier":"319651@main","message":"[WebCore] Memory underflow in PlatformRawAudioData::copyTo()\nrdar://176473804\nhttps://bugs.webkit.org/show_bug.cgi?id=318500\n\nReviewed by Jean-Yves Avenard\n\nWhen PlatformRawAudioData::copyTo() is told to copy zero samples, just bail out early. This\navoids a calculation where the number of samples has 1 subtracted from it, causing a math\nunderflow.\n\nCherry-pick https://commits.webkit.org/314451@main for test to pass.\n\nTest: fast/webcodecs/audio-data-copy-to-zero-frames-crash.html\n\n* LayoutTests/fast/webcodecs/audio-data-copy-to-zero-frames-crash-expected.txt: Added.\n* LayoutTests/fast/webcodecs/audio-data-copy-to-zero-frames-crash.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/webcodecs/audio-data-copyTo.any-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/webcodecs/audio-data-copyTo.any.js:\n(test):\n* LayoutTests/imported/w3c/web-platform-tests/webcodecs/audio-data-copyTo.any.worker-expected.txt:\n* Source/WebCore/Modules/webcodecs/WebCodecsAudioDataAlgorithms.cpp:\n(WebCore::computeCopyElementCount):\n* Source/WebCore/platform/audio/cocoa/PlatformRawAudioDataCocoa.cpp:\n(WebCore::PlatformRawAudioData::copyTo):\n\nOriginally-landed-as: 305413.1119@safari-7624.5-branch (6b8717a224a0). rdar://185368929\nCanonical link: https://commits.webkit.org/319651@main","order":0,"repository_id":"webkit","timestamp":1787436471},{"author":{"emails":["gsnedders@apple.com","me@gsnedders.com"],"name":"Sam Sneddon"},"branch":"main","hash":"b3f6dc92c6a45dbd5f4fcec996c551e319ffe678","identifier":"319652@main","message":"[webkitpy] [webkitcorepy] Expected failures / unexpected successes not properly handled\nhttps://bugs.webkit.org/show_bug.cgi?id=309834\nrdar://172412849\n\nReviewed by Elliott Williams.\n\nThe test runners did not correctly handle Python's @unittest.expectedFailure\ndecorator. Expected failures were reported as \"passed\", and unexpected\nsuccesses (where a test marked as expected-to-fail actually passes) were\nconflated with regular failures without being clearly identified.\n\nTrack expected failures and unexpected successes as distinct outcomes\nthroughout the pipeline, instead of conflating them with passes and\nfailures.\n\n* Tools/Scripts/libraries/webkitcorepy/webkitcorepy/testing/test_runner.py:\n(TestRunner.run): Report expected failures as \"expected failure\" instead of\n\"passed\", and treat unexpected successes as failures.\n* Tools/Scripts/libraries/webkitcorepy/webkitcorepy/tests/testing/__init__.py: Added.\n* Tools/Scripts/libraries/webkitcorepy/webkitcorepy/tests/testing/test_runner_unittest.py: Added.\n(_Test_TestRunner):\n(_Test_TestRunner._test_pass):\n(_Test_TestRunner._test_fail):\n(_Test_TestRunner._test_error):\n(_Test_TestRunner._test_skip):\n(_Test_TestRunner._test_expected_failure):\n(_Test_TestRunner._test_unexpected_success):\n(_Test_TestRunner.id):\n(StubTestRunner):\n(StubTestRunner.__init__):\n(StubTestRunner.tests):\n(StubTestRunner.run_test):\n(TestRunnerTest):\n(TestRunnerTest._normalize):\n(TestRunnerTest._run):\n(TestRunnerTest.test_passed):\n(TestRunnerTest.test_failed):\n(TestRunnerTest.test_errored):\n(TestRunnerTest.test_skipped):\n(TestRunnerTest.test_unexpected_success_causes_failure):\n(TestRunnerTest.test_expected_failure_returns_success):\n* Tools/Scripts/webkitpy/test/main.py:\n(Tester._run_tests): Include expected/actual values for expected failures\nand unexpected successes in uploaded test results.\n* Tools/Scripts/webkitpy/test/printer.py:\n(Printer.print_finished_test): Accept expected_failures and\nunexpected_successes, so unexpected successes are shown as failures and\nexpected failures get their own summary suffix.\n* Tools/Scripts/webkitpy/test/printer_unittest.py: Added.\n(PrinterTest):\n(PrinterTest.setUp):\n(PrinterTest._make_printer):\n(PrinterTest._drive):\n(PrinterTest.test_passed):\n(PrinterTest.test_failed):\n(PrinterTest.test_errored):\n(PrinterTest.test_unexpected_success):\n(PrinterTest.test_expected_failure):\n(PrinterTest.test_failed_with_expected_failures_list):\n* Tools/Scripts/webkitpy/test/runner.py:\n(Runner.__init__): Track expected failures and unexpected successes.\n(Runner.handle): Ditto.\n(_Worker.handle): Compute expected_failures and unexpected_successes\nseparately instead of folding unexpected successes into failures.\n* Tools/Scripts/webkitpy/test/runner_unittest.py:\n(FakeModuleSuite.run): Support 'x' (expected failure) and 'u' (unexpected\nsuccess) fake results.\n(RunnerTest.test_run_expected_failures):\n\nCanonical link: https://commits.webkit.org/319652@main","order":0,"repository_id":"webkit","timestamp":1787437620},{"author":{"emails":["gsnedders@apple.com","me@gsnedders.com"],"name":"Sam Sneddon"},"branch":"main","hash":"ee946304054a01105a85ac54b45aff01e8041143","identifier":"319653@main","message":"REGRESSION(319652@main): webkitpy.test.runner_unittest.RunnerTest.test_run_expected_failures\nhttps://bugs.webkit.org/show_bug.cgi?id=322341\nrdar://185604141\n\nUnreviewed test fix.\n\n* Tools/Scripts/webkitpy/test/runner_unittest.py:\n(FakeModuleSuite.run): Add the newly reachable values.\n\nCanonical link: https://commits.webkit.org/319653@main","order":0,"repository_id":"webkit","timestamp":1787439954},{"branch":"main","hash":"6a2b412d19043efdff526685ff7b5cb8c083a36f","identifier":"319654@main","order":0,"repository_id":"webkit","timestamp":1787442078},{"author":{"emails":["173393835+cupidsity@users.noreply.github.com"],"name":"lilly"},"branch":"main","hash":"5278e92549a1635a7387a4cd9566b2d2af211e11","identifier":"319655@main","message":"corner-shape: offset-path does not respect corner-shape\nhttps://bugs.webkit.org/show_bug.cgi?id=322210\nrdar://185447602\n\nReviewed by Simon Fraser.\n\nThread the reference box's corner curvatures through MotionPathData so the\n<coord-box> path can be built from the corner-shape contour, falling back\nto the rounded rect when every corner is round.\n\n* Source/WebCore/platform/animation/values/paths/AcceleratedEffectBoxPath.cpp:\n(WebCore::tryPath):\n* Source/WebCore/platform/graphics/CornerShapeUtilities.cpp:\n(WebCore::borderContourPath):\n* Source/WebCore/platform/graphics/CornerShapeUtilities.h:\n* Source/WebCore/rendering/BorderShape.cpp:\n(WebCore::BorderShape::pathForShapedRect):\n* Source/WebCore/rendering/BorderShape.h:\n* Source/WebCore/rendering/MotionPath.cpp:\n(WebCore::MotionPath::motionPathDataForRenderer):\n* Source/WebCore/rendering/MotionPath.h:\n* Source/WebCore/rendering/PathOperation.cpp:\n(WebCore::BoxPathOperation::getPath const):\n* Source/WebKit/Shared/WebCoreArgumentCoders.serialization.in:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-borders/corner-shape/corner-shape-offset-path-coord-box-001-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-borders/corner-shape/corner-shape-offset-path-coord-box-001-ref.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-borders/corner-shape/corner-shape-offset-path-coord-box-001.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-borders/corner-shape/corner-shape-offset-path-coord-box-002-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-borders/corner-shape/corner-shape-offset-path-coord-box-002-ref.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-borders/corner-shape/corner-shape-offset-path-coord-box-002.html: Added.\n\nCanonical link: https://commits.webkit.org/319655@main","order":0,"repository_id":"webkit","timestamp":1787443009},{"author":{"emails":["morningstar@apple.com","dawn_flores@apple.com","matteo_flores@apple.com"],"name":"Dawn Morningstar"},"branch":"main","hash":"e7ffac0f4edddadd2999733b109277919ae9bab9","identifier":"319656@main","message":"[webkitpy] Support pre-boot launchd configuration for simulated devices\nhttps://bugs.webkit.org/show_bug.cgi?id=322243\nrdar://185473232\n\nReviewed by David Kilzer.\n\nlaunchd_sim reads its config when it starts, so if a port wants something in\nplace for the boot itself it has to be written before we boot the device.\nThis allows for a port to supply something for the boot.\n\n* Tools/Scripts/webkitpy/xcode/simulated_device.py:\n(SimulatedDeviceManager):\n(SimulatedDeviceManager._configure_launchd_before_booting):\n(SimulatedDeviceManager._boot_device):\n* Tools/Scripts/webkitpy/xcode/simulated_device_unittest.py:\n(FakeDevice):\n(FakeAdditions):\n(FakeAdditions.__init__):\n(FakeAdditions.launchd_configuration):\n(setUp):\n(tearDown):\n(_run_with):\n(_path):\n(test_configuration_is_written_before_boot):\n(test_every_named_file_is_written):\n(test_nothing_written_without_apple_additions):\n(test_nothing_written_when_no_configuration_is_given):\n(test_existing_keys_are_kept):\n(test_unreadable_file_is_replaced_rather_than_raising):\n(test_failure_to_write_is_not_fatal):\n(test_failure_to_write_is_not_fatal.refuse):\n\nCanonical link: https://commits.webkit.org/319656@main","order":0,"repository_id":"webkit","timestamp":1787452256},{"author":{"emails":["zakr@apple.com"],"name":"Zak Ridouh"},"branch":"main","hash":"884e3169771bfde0f93c3bc3ed12c55144d5cd04","identifier":"319657@main","message":"[IFC] Do not leave stale display content when partial merge fails in InlineContentBuilder\n<https://bugs.webkit.org/show_bug.cgi?id=319704>\n<rdar://177161065>\n\nReviewed by Alan Baradlay.\n\nField MTE reports show a use-after-free destroying InlineDisplay::Content during\nLineLayout::layout()'s clearInlineContent(): a display box's CheckedPtr<Layout::Box>\nstill references a Layout::Box that was already freed.\n\nPartial inline layout keeps the previous display content alive so the newly-built\nlines can be spliced into it, relying on InlineDamage::m_detachedLayoutBoxes to keep\nremoved layout boxes alive across the merge. When handlePartialDisplayContentUpdate\ncannot compute a valid damaged range, it returned early through ASSERT_NOT_REACHED()\nand left the previous display content untouched. The caller then destroys the\nInlineDamage (m_lineDamage = { }), freeing the detached layout boxes while the display\nboxes still reference them; the next clearInlineContent() touches freed memory.\n\nDrop the previous display content on that fallback path (after collecting its ink\noverflow for repaint) so we never carry stale CheckedPtr<Layout::Box> references past\nthe point their target is released. This hardens an ASSERT_NOT_REACHED() branch and\ndoes not change behavior on the fast path.\n\n* Source/WebCore/layout/integration/inline/LayoutIntegrationInlineContentBuilder.cpp:\n(WebCore::LayoutIntegration::InlineContentBuilder::handlePartialDisplayContentUpdate const):\n* LayoutTests/fast/block/inside-inlines/block-in-inline-partial-relayout-crash.html: Added.\n* LayoutTests/fast/block/inside-inlines/block-in-inline-partial-relayout-crash-expected.txt: Added.\n\nOriginally-landed-as: 305413.1123@safari-7624.5-branch (039ba968916b). rdar://185369077\nCanonical link: https://commits.webkit.org/319657@main","order":0,"repository_id":"webkit","timestamp":1787461604},{"author":{"emails":["jean-yves.avenard@apple.com","jya@apple.com","jyavenard@gmail.com"],"name":"Jean-Yves Avenard"},"branch":"main","hash":"3e5b31e006359db053de870eaacfede629f49c64","identifier":"319658@main","message":"use-after-free of AudioParam via cross-thread non-atomic ref/deref in AudioNodeOutput::disconnectAllParams()\nrdar://177930032\n\nReviewed by Youenn Fablet.\n\nMake AudioParam use thread-safe refcounted.\n\nTest: webaudio/AudioParam/audioparam-cross-thread-ref-deref-crash.html\n\n* LayoutTests/webaudio/AudioParam/audioparam-cross-thread-ref-deref-crash-expected.txt: Added.\n* LayoutTests/webaudio/AudioParam/audioparam-cross-thread-ref-deref-crash.html: Added.\n* Source/WebCore/Modules/webaudio/AudioParam.h:\n\nOriginally-landed-as: 305413.1077@safari-7624.5-branch (62fcbfe61a49). rdar://185368484\nCanonical link: https://commits.webkit.org/319658@main","order":0,"repository_id":"webkit","timestamp":1787467978},{"author":{"emails":["richard_robinson2@apple.com"],"name":"Richard Robinson"},"branch":"main","hash":"0f924849f534426b33d9b81e64365ab85597626d","identifier":"319659@main","message":"[CMake] Fix the CMake build after 319646@main\nhttps://bugs.webkit.org/show_bug.cgi?id=322348\nrdar://185619817\n\nReviewed by Zak Ridouh.\n\nThe CMake build requires `JSC::SymbolTableEntry::inflate` to be `JS_EXPORT_PRIVATE` since it uses\n`-fpch-codegen` which hoists inline function bodies out of the PCH into the PCH's own object file\nas strong external definitions.\n\n* Source/JavaScriptCore/runtime/SymbolTable.h:\n\nCanonical link: https://commits.webkit.org/319659@main","order":0,"repository_id":"webkit","timestamp":1787473808},{"branch":"main","hash":"1feb6ac19b06a18bee095b204f70551cb22eff3b","identifier":"319660@main","order":0,"repository_id":"webkit","timestamp":1787494290},{"author":{"emails":["173393835+cupidsity@users.noreply.github.com"],"name":"lilly"},"branch":"main","hash":"53e6dc79c7d38591f39d70fecb9938d4fa0678a1","identifier":"319661@main","message":"corner-shape: algorithm for outset curves needs to be updated to match new algorithm\nhttps://bugs.webkit.org/show_bug.cgi?id=322282\nrdar://185519894\n\nReviewed by Simon Fraser.\n\nAdopts https://github.com/web-platform-tests/wpt/pull/61696\n\nPasses existing tests\n\n* Source/WebCore/platform/graphics/BezierUtilities.cpp:\n(WebCore::resampleByArcLength): Deleted.\n(WebCore::hermiteInterpolate): Deleted.\n(WebCore::addCatmullRomBeziers): Deleted.\n* Source/WebCore/platform/graphics/BezierUtilities.h:\n* Source/WebCore/platform/graphics/CornerShapeUtilities.cpp:\n(WebCore::borderContourPath):\n* Source/WebCore/platform/graphics/CornerShapeUtilities.h:\n* Source/WebCore/platform/graphics/GeometryUtilities.cpp:\n(WebCore::findLineIntersection):\n(WebCore::crossProduct): Deleted.\n* Source/WebCore/platform/graphics/GeometryUtilities.h:\n* Source/WebCore/rendering/BorderShape.cpp:\n(WebCore::addAlignedToCurveOffsetContour):\n* Source/WebCore/platform/graphics/FloatPoint.h:\n(WebCore::FloatPoint::cross const):\n* Source/WebCore/platform/graphics/FloatSize.h:\n(WebCore::FloatSize::cross const):\n* LayoutTests/TestExpectations:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-borders/corner-shape/corner-shape-bevel-round-scoop-square-outset-expected.html:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-borders/corner-shape/corner-shape-bevel-round-scoop-square-outset-ref.html:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-borders/corner-shape/corner-shape-box-shadow-spread-elliptical.html:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-borders/corner-shape/corner-shape-notch-squircle-outset-expected.html:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-borders/corner-shape/corner-shape-notch-squircle-outset-ref.html:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-borders/corner-shape/corner-shape-outline-offset-elliptical.html:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-borders/corner-shape/corner-shape-superellipse-concave-outset-expected.html:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-borders/corner-shape/corner-shape-superellipse-concave-outset-ref.html:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-borders/corner-shape/corner-shape-superellipse-concave.html:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-borders/corner-shape/corner-shape-superellipse-convex-outset-expected.html:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-borders/corner-shape/corner-shape-superellipse-convex-outset-ref.html:\n* LayoutTests/fast/scrolling/corner-shape-nested-clips-overflow-scroll.html:\n* LayoutTests/fast/scrolling/corner-shape-overflow-scroll-uneven-radii.html:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-borders/corner-shape/corner-shape-scoop.html:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-borders/corner-shape/corner-shape-superellipse-scoop.html:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-borders/corner-shape/render-corner-shape.html:\n\nCanonical link: https://commits.webkit.org/319661@main","order":0,"repository_id":"webkit","timestamp":1787511929},{"author":{"emails":["koivisto@iki.fi","antti@apple.com","antti.j.koivisto@nokia.com"],"name":"Antti Koivisto"},"branch":"main","hash":"5dd82e774cf8a2ead554aa962a73e855606b1d4c","identifier":"319662@main","message":"::selection fails to repaint on style change\nhttps://bugs.webkit.org/show_bug.cgi?id=321846\nrdar://184994906\n\nReviewed by Alan Baradlay.\n\nActive selections fail to visually update if ::selection style changes. The repaint code compares\nthe highlight pseudo-element styles cached in the parent ComputedStyle, and ::selection was still\nresolving without caching, so there was never a previous style to compare against.\n\n* LayoutTests/fast/repaint/highlight-pseudo-rule-change-expected.txt:\n* LayoutTests/fast/repaint/highlight-pseudo-rule-change.html:\n\nThe ::selection case passes now.\n\n* Source/WebCore/rendering/RenderElement.cpp:\n(WebCore::RenderElement::selectionPseudoStyle const):\n\nUse textSegmentPseudoStyle(), which already does this with lazyPseudoElementStyle(). It was an\nexact copy of what selectionPseudoStyle() was doing, minus the caching.\n\n* Source/WebCore/rendering/RenderElement.h:\n* Source/WebCore/rendering/RenderText.h:\n(WebCore::RenderText::selectionPseudoStyle const):\n\n* Source/WebCore/rendering/StyledMarkedText.cpp:\n(WebCore::resolveStyleForMarkedText):\n* Source/WebCore/rendering/TextBoxPainter.cpp:\n(WebCore::TextBoxPainter::paintForegroundAndDecorations):\n* Source/WebCore/rendering/TextPaintStyle.cpp:\n(WebCore::computeTextSelectionPaintStyle):\n\nThe returned style is now owned by the parent ComputedStyle rather than the caller, so the locals\nneed to be CheckedPtr.\n\nCanonical link: https://commits.webkit.org/319662@main","order":0,"repository_id":"webkit","timestamp":1787512439},{"author":{"emails":["zimmermann@kde.org","zimmermann@physik.rwth-aachen.de","zimmermann@webkit.org","nzimmermann@blackberry.com","nzimmermann@rim.com","nzimmermann@igalia.com"],"name":"Nikolas Zimmermann"},"branch":"main","hash":"df06a95a287e3dd4e525ea60934a433e2ccba9fa","identifier":"319663@main","message":"[LBSE] Assertion failure for SVG resource containers with a namespace prefix\nhttps://bugs.webkit.org/show_bug.cgi?id=322357\n\nReviewed by Patrick Griffis.\n\nCreating the renderer for <svg:filter> fires an assertion:\n\nASSERTION FAILED: SVGElement::isResourceContainerTagName(element.tagQName())\nSource/WebCore/rendering/svg/RenderSVGResourceContainer.cpp(47)\n...\n\nA tag can be written with a namespace prefix, as in <svg:filter>. Two\nQualifiedNames are only equal when their prefixes match as well, so\n<svg:filter> is not equal to SVGNames::filterTag. isResourceContainerTagName()\nlooked up the whole tag in a HashSet<QualifiedName> and thus missed every\nprefixed resource container. Element::hasTagName() gets this right by calling\nQualifiedName::matches(), which compares the local name and the namespace and\nignores the prefix.\n\nFix debug assertions in svg/dynamic-updates - covered by existing tests.\n\n* Source/WebCore/svg/SVGElement.cpp:\n(WebCore::SVGElement::isResourceContainerTagName):\n\nCanonical link: https://commits.webkit.org/319663@main","order":0,"repository_id":"webkit","timestamp":1787514655},{"author":{"emails":["dan.hecht@apple.com"],"name":"Dan Hecht"},"branch":"main","hash":"9f07374e9eb2398ebf629352f5fc0a509ae631b8","identifier":"319664@main","message":"[JSC] Do not clone patchpoints for Wasm calls within a try block\nrdar://178657225\nhttps://bugs.webkit.org/show_bug.cgi?id=316791\n\nReviewed by Yijia Huang.\n\nSimilar to throw/rethrow patchpoints, a Wasm OMG call patchpoint inside\na Try block carries an exception-restoration stackmap keyed by its CallSiteIndex,\nso it should not be cloned. If B3 Select specialization (or B3DuplicateTails)\nduplicates them, that leaves two call sites sharing one stackmap even with\npotentially differing live-value layouts.\n\nExtend 266643@main to also mark call patchpoints cloningForbidden when\nm_tryCatchDepth != 0, and make specializeSelect() bail when a\ncloning-forbidden value is in the range it would clone.\n\nTest: JSTests/wasm/stress/omg-reduce-strength-select-exception-stackmap.js\n\nOriginally-landed-as: 305413.972@safari-7624.5-branch (db24355101bd). rdar://185368817\nCanonical link: https://commits.webkit.org/319664@main","order":0,"repository_id":"webkit","timestamp":1787517075},{"author":{"emails":["zalan@apple.com","zbujtas@gmail.com"],"name":"Alan Baradlay"},"branch":"main","hash":"8c4fd56347648a238656e54d696b308dca674fe8","identifier":"319665@main","message":"[block] align-content moves a float child twice\nhttps://bugs.webkit.org/show_bug.cgi?id=322298\n<rdar://problem/185536955>\n\nReviewed by Antti Koivisto.\n\nalign-content distributes a block container's extra space by moving its content. shiftForAlignContent moves\nevery child box and FloatingObjects::shiftFloatsBy then moves the float renderers again, so a float that is a\nchild of the container travels twice as far as the content it sits with.\n\nA float taken from a child's float list moves twice as well: the child moves with the rest of the content and\nshiftFloatsBy then moves the float's renderer, which belongs to that child. Only the FloatingObject's frame\nrect needs the shift there, since that rect is in this container's coordinate space.\n\n* Source/WebCore/rendering/FloatingObjects.cpp:\n(WebCore::FloatingObjects::shiftFloatsBy):\n* Source/WebCore/rendering/RenderBlockFlow.cpp:\n(WebCore::RenderBlockFlow::shiftForAlignContent):\n* LayoutTests/imported/w3c/web-platform-tests/css/css-align/blocks/align-content-block-float-001.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-align/blocks/align-content-block-float-001-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-align/blocks/align-content-block-004-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-align/blocks/align-content-block-005-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-align/blocks/align-content-block-006-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-align/blocks/align-content-block-007-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-align/blocks/align-content-block-008-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-align/blocks/align-content-block-009-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-align/blocks/align-content-block-010-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-align/blocks/align-content-block-011-expected.txt:\n* Source/WebCore/rendering/FloatingObjects.h:\n\nCanonical link: https://commits.webkit.org/319665@main","order":0,"repository_id":"webkit","timestamp":1787518182},{"author":{"emails":["phinehas133@gmail.com","phinehas.fuachie20@gmail.com","pfuachie2@apple.com"],"name":"Phinehas Fuachie"},"branch":"main","hash":"55d9d9007f54ee61fa38accb59cd88a8d4075847","identifier":"319666@main","message":"Use-after-free in MediaElementAudioSourceNode::provideInput when iframe is detached\nhttps://bugs.webkit.org/show_bug.cgi?id=315989\nrdar://175673159\n\nReviewed by Chris Dumez.\n\nHTMLMediaElement::clearMediaPlayer() resets m_player on the main thread without holding\nm_audioSourceNode->processLock(), but the audio render thread reads m_player via\naudioSourceProvider() inside MediaElementAudioSourceNode::process() while holding that lock.\nBecause audioSourceProvider() returns a raw AudioSourceProvider* and drops its local\nRefPtr<MediaPlayer> on return, and MediaPlayer is DestructionThread::Main, the main thread can\nsynchronously run ~MediaPlayer (destroying the RemoteAudioSourceProvider) while the render thread\nis still inside provideInput() with the now-dangling pointer.\n\nThis is reachable from HTMLMediaElement::stop() (ActiveDOMObject stop on iframe detach) and\nuserCancelledLoad().\n\nMatch the contract already enforced by createMediaPlayer() and\nmediaPlayerWill/DidInitializeMediaEngine() by holding the audio node's processLock around\nplayer->invalidate() / m_player = nullptr in clearMediaPlayer(). process() acquires the same lock\nwith tryLock(), so this cannot deadlock \u2014 the render thread will simply zero its output for one\nquantum while the main thread tears down.\n\nTest: webaudio/mediaelementsource-clear-detached-frame.html\n\n* LayoutTests/webaudio/mediaelementsource-clear-detached-frame-expected.txt: Added.\n* LayoutTests/webaudio/mediaelementsource-clear-detached-frame.html: Added.\n* LayoutTests/webaudio/resources/mediaelementsource-clear-detached-frame-iframe.html: Added.\n* Source/WebCore/html/HTMLMediaElement.cpp:\n(WebCore::HTMLMediaElement::clearMediaPlayer): Deleted.\n\nOriginally-landed-as: 305413.1065@safari-7624.5-branch (e186258f7967). rdar://185367736\nCanonical link: https://commits.webkit.org/319666@main","order":0,"repository_id":"webkit","timestamp":1787519843},{"author":{"emails":["ddkilzer@webkit.org","ddkilzer@apple.com"],"name":"David Kilzer"},"branch":"main","hash":"2df698f59386b2ffccd45c7ef28422b69eba8c44","identifier":"319667@main","message":"Heap-use-after-free of RemoteLayerTreeEventDispatcher's RunLoop::Timer on the scrolling thread\n<https://bugs.webkit.org/show_bug.cgi?id=315533>\n<rdar://177889453>\n\nReviewed by Simon Fraser.\n\n`RemoteLayerTreeEventDispatcher::scheduleDelayedRenderingUpdateDetectionTimer()`\nlazily creates `m_delayedRenderingUpdateDetectionTimer` on the\nscrolling thread, against the scrolling thread's run loop.  When\nthe owning page is closed,\n`RemoteScrollingCoordinatorProxyMac::~RemoteScrollingCoordinatorProxyMac()`\nruns on the main thread, calls\n`RemoteLayerTreeEventDispatcher::invalidate()`, and then drops the\nlast reference, destroying the dispatcher (and the timer) on the\nmain thread.\n\n`CFRunLoopTimerInvalidate()` called from `~TimerBase()` on the main\nthread does not synchronize with a CFRunLoopTimer callback that the\nscrolling thread's run loop has already begun dispatching, so the\ncallback can read the freed `TimerBase` via its raw context\npointer.  ASan reports this as a heap-use-after-free in\n`RunLoop::TimerBase::start()::$_0::__invoke` on the scrolling\nthread.\n\nFix by destroying `m_delayedRenderingUpdateDetectionTimer` on the\nscrolling thread from `invalidate()`, holding a strong reference to\nthe dispatcher across the dispatch so it outlives the timer.\nBecause the dispatch and the timer callback both run serially on\nthe scrolling thread's run loop, the timer is either destroyed\nbefore the callback fires, or after the callback has returned.\nThis mirrors the equivalent fix in\n`ThreadedScrollingTree::invalidate()` (225114@main).\n\nThe dispatch is performed after `m_scrollingTree` has been cleared\nso any in-flight or subsequently queued `didRefreshDisplay()`\nreturns early and cannot recreate the timer.\n\nAlso reorder the ASSERTs in `~RemoteLayerTreeEventDispatcher` to\nmatch the declaration order of the asserted members.\n\nTest: fast/scrolling/mac/event-dispatcher-timer-close-crash.html\n\n* LayoutTests/fast/scrolling/mac/event-dispatcher-timer-close-crash-expected.txt: Add.\n* LayoutTests/fast/scrolling/mac/event-dispatcher-timer-close-crash.html: Add.\n* Source/WebKit/UIProcess/RemoteLayerTree/mac/RemoteLayerTreeEventDispatcher.mm:\n(WebKit::RemoteLayerTreeEventDispatcher::~RemoteLayerTreeEventDispatcher):\n(WebKit::RemoteLayerTreeEventDispatcher::invalidate):\n\nOriginally-landed-as: 305413.1021@safari-7624.5-branch (fb7f8555bdf0). rdar://185368389\nCanonical link: https://commits.webkit.org/319667@main","order":0,"repository_id":"webkit","timestamp":1787521365},{"author":{"emails":["zalan@apple.com","zbujtas@gmail.com"],"name":"Alan Baradlay"},"branch":"main","hash":"5178278df2e968475df523946dd4caf468069d57","identifier":"319668@main","message":"[cleanup] Ask whether a document is fully active rather than whether it has a render tree\nhttps://bugs.webkit.org/show_bug.cgi?id=322292\n<rdar://problem/185534759>\n\nReviewed by Antti Koivisto.\n\nThese call sites checked whether a document had a render tree when what they meant was whether it can ever render, which is what separates a\ndocument in a page from one made by DOMParser or held by a template. The spec calls that fully active, and its \"Updating the image data\"\nalgorithm names it directly. A non-rendered placeholder is fully active yet never gets a render tree, so Document::canEverRender() asks\nboth.\n\nhttps://html.spec.whatwg.org/multipage/images.html#updating-the-image-data\n\nTest: imported/w3c/web-platform-tests/css/cssom/stylesheets-in-non-rendered-document.html\n\n* Source/WebCore/dom/Document.h:\n* Source/WebCore/dom/Document.cpp:\n(WebCore::Document::canEverRender const):\n* Source/WebCore/dom/Node.cpp:\n(WebCore::Node::computeEditabilityWithStyle const):\n* Source/WebCore/loader/FrameLoader.cpp:\n(WebCore::FrameLoader::clear):\n* Source/WebCore/loader/HistoryController.cpp:\n(WebCore::HistoryController::saveDocumentState):\n* Source/WebCore/loader/ImageLoader.cpp:\n(WebCore::ImageLoader::updateFromElement):\n(WebCore::ImageLoader::dispatchPendingBeforeLoadEvent):\n(WebCore::ImageLoader::dispatchPendingLoadEvent):\n(WebCore::ImageLoader::dispatchPendingErrorEvent):\n* Source/WebCore/style/StyleScope.cpp:\n(WebCore::Style::Scope::updateActiveStyleSheets):\n(WebCore::Style::Scope::styleSheetsForStyleSheetList):\n* LayoutTests/imported/w3c/web-platform-tests/css/cssom/stylesheets-in-non-rendered-document.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/cssom/stylesheets-in-non-rendered-document-expected.txt: Added.\n\nCanonical link: https://commits.webkit.org/319668@main","order":0,"repository_id":"webkit","timestamp":1787524804},{"author":{"emails":["ysuzuki@apple.com","yusukesuzuki@slowstart.org","utatane.tea@gmail.com"],"name":"Yusuke Suzuki"},"branch":"main","hash":"8283d4f1273add66f659b203baaae8e56c4fc3f2","identifier":"319669@main","message":"[JSC] DFG Uint32Array load should consider about Int32 speculation path\nhttps://bugs.webkit.org/show_bug.cgi?id=319112\nrdar://176792844\n\nReviewed by Mark Lam.\n\nDFG Uint32Array GetByVal may have Int32 result with speculation. But the\ncurrent code is always using boxed-double for boxed result. We should\nuse boxed-int32 when this speculation is set. The same thing is already\ndone in FTL.\n\nTest: JSTests/stress/uint32-array-result-int32-dfg.js\n\n* JSTests/stress/uint32-array-result-int32-dfg.js: Added.\n* Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:\n(JSC::DFG::SpeculativeJIT::setIntTypedArrayLoadResult):\n\nOriginally-landed-as: 305413.1114@safari-7624.5-branch (2bc65ac3560e). rdar://185368553\nCanonical link: https://commits.webkit.org/319669@main","order":0,"repository_id":"webkit","timestamp":1787526892},{"author":{"emails":["ahmad.saleem792@gmail.com","ahmad.saleem792+github@gmail.com","ahmad_saleem@apple.com"],"name":"Ahmad Saleem"},"branch":"main","hash":"69387ce22018858ece19528bd2b8255e5ae0db32","identifier":"319670@main","message":"canDrawText() refs both the fill and stroke gradient when only one is used\nhttps://bugs.webkit.org/show_bug.cgi?id=322288\nrdar://185524314\n\nReviewed by Gerald Squelart.\n\ncanDrawText() rejects text draws whose paint is a zero-size gradient, but which\ngradient matters depends on whether the caller is filling or stroking. The check\nwas written as two unconditional RefPtr assignments with the fill/stroke test\nfolded into each if-condition, so every fillText() and strokeText() call queried\nboth GraphicsContext::strokeGradient() and GraphicsContext::fillGradient() and\npaid a ref/deref pair for each - both accessors return a raw Gradient*, so the\nRefPtr construction is a real refcount round trip - when by construction one of\nthe two results is discarded unused.\n\nSelect the gradient with the fill flag first and take a single reference. No\nbehavior change: filling still consults only the fill gradient and stroking only\nthe stroke gradient.\n\n* Source/WebCore/html/canvas/CanvasRenderingContext2DBase.cpp:\n(WebCore::CanvasRenderingContext2DBase::canDrawText):\n\nCanonical link: https://commits.webkit.org/319670@main","order":0,"repository_id":"webkit","timestamp":1787527733},{"author":{"emails":["richard_robinson2@apple.com"],"name":"Richard Robinson"},"branch":"main","hash":"481130961bd0575670ae8fb824890f0da610fa9a","identifier":"319671@main","message":"Refactor `WebPage{Proxy}::selectWithGesture` to have its result as a struct instead of separate values\nhttps://bugs.webkit.org/show_bug.cgi?id=322360\nrdar://185646930\n\nReviewed by Abrar Rahman Protyasha.\n\nJust a small refactoring to make things a bit simpler.\n\nThis will also help for future Swift-Cxx interop changes now that the completion handler is 1-arity.\n\n* Source/WebKit/Scripts/webkit/messages.py:\n(headers_for_type):\n* Source/WebKit/Shared/Cocoa/GestureTypes.h:\n* Source/WebKit/Shared/Cocoa/GestureTypes.serialization.in:\n* Source/WebKit/UIProcess/Cocoa/WebPageProxyCocoa.mm:\n(WebKit::WebPageProxy::selectWithGesture):\n* Source/WebKit/UIProcess/WebPageProxy.h:\n* Source/WebKit/UIProcess/WebPageProxy.swift:\n* Source/WebKit/UIProcess/ios/WKContentViewInteraction.mm:\n(-[WKContentView changeSelectionWithGestureAt:withGesture:withState:withFlags:]):\n* Source/WebKit/WebProcess/WebPage/Cocoa/WebPageCocoa.mm:\n(WebKit::WebPage::selectWithGesture):\n* Source/WebKit/WebProcess/WebPage/WebPage.h:\n* Source/WebKit/WebProcess/WebPage/WebPage.messages.in:\n\nCanonical link: https://commits.webkit.org/319671@main","order":0,"repository_id":"webkit","timestamp":1787529547},{"author":{"emails":["cdumez@apple.com","dchris@gmail.com","ch.dumez@samsung.com","ch.dumez@sta.samsung.com","ch.dumez@sisa.samsung.com","ch.dumez@partner.samsung.com","christophe.dumez@intel.com"],"name":"Chris Dumez"},"branch":"main","hash":"6e03d62f11e65f04577b3acd403b8d3e21b1c4e4","identifier":"319672@main","message":"Stop logging the Launch Services check-in info dictionary on every WebContent process launch\nhttps://bugs.webkit.org/show_bug.cgi?id=322261\n\nReviewed by Per Arne Vollan.\n\nNetworkConnectionToWebProcess::checkInWebProcess() runs once per WebContent\nprocess launch and logged the whole Launch Services info dictionary at default\nlevel each time. The dictionary is a copy of the com.apple.WebKit.WebContent.xpc\nInfo.plist plus a few fixed keys, so it is identical for every process; in the\nfield it serializes to 1162 bytes per launch.\n\nWhen WebContent processes launch at a high rate that is enough for\nlibsystem_trace to quarantine the NetworkProcess (\"QUARANTINED DUE TO HIGH\nLOGGING VOLUME\"), after which it stops logging altogether -- precisely when the\nlog is needed.\n\nLog the dictionary once per NetworkProcess instead. Also report the two check-in\nfailure paths as errors, consistent with the existing failure paths in the same\nfunction.\n\n* Source/WebKit/NetworkProcess/mac/NetworkConnectionToWebProcessMac.mm:\n(WebKit::NetworkConnectionToWebProcess::checkInWebProcess):\n\nCanonical link: https://commits.webkit.org/319672@main","order":0,"repository_id":"webkit","timestamp":1787530452},{"author":{"emails":["jean-yves.avenard@apple.com","jya@apple.com","jyavenard@gmail.com"],"name":"Jean-Yves Avenard"},"branch":"main","hash":"bc9f76805019f00c439c5b5cc4fa197b5fc4cc1a","identifier":"319673@main","message":"[cmake] Provide ability to run Safari with webkit built by cmake\nhttps://bugs.webkit.org/show_bug.cgi?id=322249\nrdar://185482522\n\nReviewed by Zak Ridouh.\n\nMake --cmake option given to run-safari works.\nCouple of issues with the cmake webkit build that prevented Safari to start:\n- compatibility version returned was 0.0.0 instead of the required 1.0.0\n- Some swift overlays were missing from the cmake files, so some symbols loaded by Safari were missing.\n\nThe macOS Swift module staging target is named WebKit_StageSwiftModuleMac, as the\niOS family section of PlatformCocoa.cmake already defines WebKit_StageSwiftModule.\n\nManually tested with run-safari --release --cmake\n\n* Source/JavaScriptCore/PlatformCocoa.cmake:\n* Source/WebCore/PlatformCocoa.cmake:\n* Source/WebGPU/WebGPU/CMakeLists.txt:\n* Source/WebKit/PlatformCocoa.cmake:\n* Source/WebKitLegacy/PlatformCocoa.cmake:\n* Source/cmake/OptionsCocoa.cmake:\n* Tools/Scripts/webkitdirs.pm:\n(determineArchitecture):\n(argumentsForConfiguration):\n(xcodeConfigurationProductDir): Where Xcode builds for the current configuration; also used by determineConfigurationProductDir so the two can't drift.\n(determineConfigurationProductDir):\n(safariPath):\n(printHelpAndExitForRunAndDebugWebKitAppIfNeeded):\n(prependMacWebKitDyldPaths):\n(setupMacWebKitEnvironment):\n(dyldFrameworkPathsForMacWebKitApp):\n(runMacWebKitApp):\n(execMacWebKitAppForDebugging): Use the same framework path list as runMacWebKitApp, so debug-safari --cmake finds Safari's own frameworks too.\n\nCanonical link: https://commits.webkit.org/319673@main","order":0,"repository_id":"webkit","timestamp":1787531316},{"author":{"emails":["cdumez@apple.com","dchris@gmail.com","ch.dumez@samsung.com","ch.dumez@sta.samsung.com","ch.dumez@sisa.samsung.com","ch.dumez@partner.samsung.com","christophe.dumez@intel.com"],"name":"Chris Dumez"},"branch":"main","hash":"52e6da77b135861b49039098e00873cf895b9c18","identifier":"319674@main","message":"AudioBufferSourceNode ignores the start() offset for a negative playbackRate\nhttps://bugs.webkit.org/show_bug.cgi?id=320870\nrdar://184484940\n\nReviewed by Darin Adler.\n\nadjustGrainParameters() placed the initial playhead at the *end* of the grain\nwhen the playback rate was negative, at offset + duration - 1, rather than at\noffset. With no explicit duration, m_grainDuration defaults to the remainder of\nthe buffer, so the playhead always landed on the last frame of the buffer and\nthe caller's offset had no effect at all: start(0, 2 / sampleRate) on an\n8-frame buffer at rate -1 played 8,7,6,5,4,3,2,1 instead of 3,2,1.\n\nThe spec places the playhead at offset regardless of the sign of the rate, then\nclamps it only in the direction playback is heading:\n\n    if (loop && computedPlaybackRate >= 0 && offset >= actualLoopEnd)\n        offset = actualLoopEnd;\n    if (computedPlaybackRate < 0 && loop && offset < actualLoopStart)\n        offset = actualLoopStart;\n\nhttps://webaudio.github.io/web-audio-api/#playback-AudioBufferSourceNode\n\nBlink already implements exactly this, and this patch brings us in line with it.\nEvery change below matches the structure of Blink's\nAudioBufferSourceHandler::RenderFromBuffer(), which splits the playhead setup\ninto an explicit \"directional playhead setup\" with a forward branch and a\nreverse branch.\n\nrenderFromBuffer() applied only the forward half of the spec's clamping,\nwrapping to loopStart whenever the playhead was at or past virtualMaxFrame. For\na negative rate that is the wrong direction: an offset past loopEnd should\ndescend into the loop from above, not jump to the loop start. The forward wrap\nis now forward-only and the reverse path gets the clamp the spec asks for, the\nsame split Blink makes between its \"Forward Loop Clamping\" and \"Reverse Loop\nClamping\" cases. Because skipping the forward wrap also removes its implicit\nend-of-buffer guard, a reverse playhead starting at or past the end of the\nbuffer now returns false so process() zeroes the output bus instead of leaving\nit partially written.\n\nTwo smaller bugs in the reverse path fell out of the above. The sub-quantum\nstartFrameOffset adjustment advanced the playhead forward for both signs of the\nrate, moving a reverse playhead away from where it was about to read; it now\nsubtracts for a negative rate, as Blink's \"Reverse Start Time Adjustment\" does.\nThe pitchRate == -1 fast path clamped the read index down to loopEnd, which\ndefeats the point of not clamping the offset, and now only bounds it by the\nbuffer length.\n\nThe offset is converted with a new timeToFractionalSampleFrame() helper rather\nthan AudioUtilities::timeToSampleFrame(). The latter rounds to whole frames,\nwhich would quantize away a genuine sub-sample offset; the helper keeps the\nsub-sample position but still snaps values that differ from a whole frame only\nby floating-point round-off, preserving the existing property that playback of a\nwhole-frame offset at |rate| == 1 is a straight copy of the PCM data rather than\nan interpolation. Blink splits these two cases apart instead, rounding only when\nthe rate is exactly 1 and the detune is 0 and multiplying raw otherwise; the\nhelper gets the same result for both without branching on the rate.\n\nThis fixes 3 of the 6 failing subtests in the WPT test: an offset inside the\nloop, an offset past loopEnd, and sub-sample interpolation backwards. The\nremaining 3 are unrelated to the offset handling and stay in the rebaselined\nexpectation. Two are out-of-bounds offsets, which Blink handles with a reverse\nout-of-bounds catch-up loop that renders silence until the playhead descends\ninto the buffer. The third is a negative loopStart, where we implement the\nalgorithm's guard and so fall back to looping the entire buffer, while the test\nasserts the attribute definition's clamp to [0, loopEnd). The spec contradicted\nitself here; the Audio WG resolved in\nhttps://github.com/WebAudio/web-audio-api/issues/2689 to make the algorithm\nclamp the loop points before validating them, which is what Blink already does\nin UpdateEffectiveLoopPoints(). Both are larger changes than the offset fix and\nare left for follow-up.\n\nThe prose describing offset in the spec still states the negative-rate condition\nbackwards, saying an offset *greater* than loopStart is clamped. That is a\ntranscription error, not a second normative rule; the Audio WG resolved to\ncorrect the prose to match the algorithm in\nhttps://github.com/WebAudio/web-audio-api/issues/2690. This patch follows the\nalgorithm, as Blink does.\n\n* LayoutTests/imported/w3c/web-platform-tests/webaudio/the-audio-api/the-audiobuffersourcenode-interface/audiobuffersource-playbackrate-negative-expected.txt:\nRebaselined: 3 subtests now pass.\n\n* LayoutTests/webaudio/audiobuffersource-negative-playbackrate.html:\n* LayoutTests/webaudio/audiobuffersource-negative-playbackrate-interpolated.html:\n* LayoutTests/webaudio/audiobuffersource-negative-playbackrate-loop.html:\n* LayoutTests/webaudio/audiobuffersource-negative-playbackrate-interpolated-loop.html:\nThese called start(0) or start(0, loopStart) with a negative rate and depended\non the playhead jumping to the end of the buffer or loop. Under the spec that\nstarts playback at frame 0 or at loopStart, which immediately runs off the front\nand renders silence. Each now passes the explicit offset it relied on\nimplicitly, so they keep testing what they were written to test rather than\nbeing rebaselined to the new output.\n\n* Source/WebCore/Modules/webaudio/AudioBufferSourceNode.cpp:\n(WebCore::timeToFractionalSampleFrame):\n(WebCore::AudioBufferSourceNode::renderFromBuffer):\n(WebCore::AudioBufferSourceNode::adjustGrainParameters):\n\nCanonical link: https://commits.webkit.org/319674@main","order":0,"repository_id":"webkit","timestamp":1787533846},{"author":{"emails":["ahmad.saleem792@gmail.com","ahmad.saleem792+github@gmail.com","ahmad_saleem@apple.com"],"name":"Ahmad Saleem"},"branch":"main","hash":"5fb77d6068fb458d3b75048ea19c074eb8970cf2","identifier":"319675@main","message":"2D canvas beginLayer() resets shadowColor to opaque black and re-parses constant strings\nhttps://bugs.webkit.org/show_bug.cgi?id=322172\nrdar://185404307\n\nReviewed by Gerald Squelart.\n\nbeginLayer() reset the layer rendering state by calling the public setters with\nconstant strings. That was both wrong and expensive.\n\nWrong: setShadowColor(\"black\") parses to opaque black, but the initial value of\nshadowColor -- and the value beginLayer() is specified to reset to -- is\ntransparent black. Any shadowBlur or shadowOffset set inside the layer therefore\npainted a shadow that should not exist, and ctx.shadowColor read back \"#000000\"\ninstead of \"rgba(0, 0, 0, 0)\". Separately, setFilterString() gives up when the\ncanvas has no computed style, so a non-rendered canvas kept its filter inside the\nlayer and applied it twice.\n\nExpensive: setGlobalCompositeOperation() and setShadowColor() parse before\nchecking whether the value changed, so every beginLayer() ran a composite\noperator parse and a full CSS color parse. setFilterString() goes through\nsetFilterStringWithoutUpdatingStyle(), which calls Document::updateStyleIfNeeded()\n-- a synchronous style recalc in the middle of beginLayer().\n\nSet the state fields directly instead, and push only what the layer's\nGraphicsContext needs: the transparency-layer switcher draws into the destination\ncontext, so alpha, composite operator and shadow still have to be applied there.\n\n* LayoutTests/imported/w3c/web-platform-tests/html/canvas/element/layers/2d.layer.layer-rendering-state-reset-in-layer-expected.txt: Progression\n* Source/WebCore/html/canvas/CanvasRenderingContext2DBase.cpp:\n(WebCore::CanvasRenderingContext2DBase::beginLayer):\n\nCanonical link: https://commits.webkit.org/319675@main","order":0,"repository_id":"webkit","timestamp":1787534562},{"author":{"emails":["aestes@apple.com"],"name":"Andy Estes"},"branch":"main","hash":"d08f00e761db2577ddcc30db998dc5f46424e4a2","identifier":"319676@main","message":"[iOS] MediaPlayerPrivateWirelessPlayback does not correctly issue fast seeks\nhttps://bugs.webkit.org/show_bug.cgi?id=322293\nrdar://185535803\n\nReviewed by Jean-Yves Avenard.\n\n-seekToPosition:tolerance: on AVPlaybackUserInterfaceControllable is documented to expect\nkCMTimeZero for a precise seek and kCMTimePositiveInfinity for a fast seek. However, WebKit was\nalways passing kCMTimeZero. Fixed this by using the SeekTarget passed to\nMediaPlayerPrivateWirelessPlayback::seekToTarget to compute the appropriate argument.\n\nTest: media/wireless-playback-media-player/seek-tolerance.html\n\n* LayoutTests/media/wireless-playback-media-player/seek-tolerance-expected.txt: Added.\n* LayoutTests/media/wireless-playback-media-player/seek-tolerance.html: Added.\n* Source/WebCore/platform/audio/ios/MediaDeviceRoute.h:\n* Source/WebCore/platform/audio/ios/MediaDeviceRoute.mm:\n(WebCore::convert):\n(WebCore::MediaDeviceRoute::seekToPosition):\n(WebCore::MediaDeviceRoute::setPlaybackPosition): Deleted.\n* Source/WebCore/platform/graphics/MediaPlayerPrivateWirelessPlayback.cpp:\n(WebCore::seekTolerance):\n(WebCore::MediaPlayerPrivateWirelessPlayback::seekToTarget):\n* Source/WebCore/testing/MockMediaDeviceRoute.h:\n* Source/WebCore/testing/MockMediaDeviceRoute.idl:\n* Source/WebCore/testing/MockMediaDeviceRoute.mm:\n(WebCore::MockMediaDeviceRoute::lastSeekTolerance const):\n* Source/WebCore/testing/cocoa/WebMockMediaDeviceRoute.h:\n* Source/WebCore/testing/cocoa/WebMockMediaDeviceRoute.mm:\n(-[WebMockMediaDeviceRoute init]):\n(-[WebMockMediaDeviceRoute lastSeekTolerance]):\n(-[WebMockMediaDeviceRoute seekToPosition:tolerance:]):\n\nCanonical link: https://commits.webkit.org/319676@main","order":0,"repository_id":"webkit","timestamp":1787536588},{"author":{"emails":["aestes@apple.com"],"name":"Andy Estes"},"branch":"main","hash":"16c6a9971daca74d3b6bdddba6daf8d2c4c57d8c","identifier":"319677@main","message":"REGRESSION (319455@main): media/wireless-playback-media-player/route-deactivate-pauses-playback.html fails\nhttps://bugs.webkit.org/show_bug.cgi?id=322323\nrdar://185565496\n\nReviewed by Jean-Yves Avenard.\n\nWhen the active route changes to local, MediaSessionHelper pauses playback. When\nMediaPlayerPrivateWirelessPlayback::pause() is called, the playing property on the route is set to\nfalse. Later, MediaDeviceRoute receives a KVO notification of this change and notifies the MediaPlayer\nand its client via rateChanged() and playbackStateChanged(). However, since a route change is\noccurring, the route may have been cleared from MediaPlayerPrivateWirelessPlayback prior to the KVO\nnotification being received. As a result, the HTMLMediaElement thinks the media should still be\nplaying despite MediaSessionHelper attempting to pause it.\n\n319455@main did not introduce this bug, but it changed the timing of how route changes are\npropagated to the media player such that it exposed this underlying issue.\n\nResolved this by dispatching rateChanged() and playbackStateChanged() when\nMediaPlayerPrivateWirelessPlayback loses its route, and changing\nMediaPlayerPrivateWirelessPlayback::paused() to return true when there is no route.\n\nNo new tests. Covered by existing tests.\n\n* Source/WebCore/platform/graphics/MediaPlayerPrivateWirelessPlayback.cpp:\n(WebCore::MediaPlayerPrivateWirelessPlayback::setWirelessPlaybackTarget):\n(WebCore::MediaPlayerPrivateWirelessPlayback::setShouldPlayToPlaybackTarget):\n(WebCore::MediaPlayerPrivateWirelessPlayback::notifyRateAndPlaybackStateChanged):\n(WebCore::MediaPlayerPrivateWirelessPlayback::hasRoute const):\n(WebCore::MediaPlayerPrivateWirelessPlayback::paused const):\n* Source/WebCore/platform/graphics/MediaPlayerPrivateWirelessPlayback.h:\n\nCanonical link: https://commits.webkit.org/319677@main","order":0,"repository_id":"webkit","timestamp":1787536640},{"author":{"emails":["mark.lam@apple.com","menlodorian@outlook.com"],"name":"Mark Lam"},"branch":"main","hash":"97df94ead028cddcfc21e48ec6f2f72d25ec1662","identifier":"319678@main","message":"Handle overflows in UnlinkedMetadataTable::finalize().\nhttps://bugs.webkit.org/show_bug.cgi?id=317632\nrdar://172794625\n\nReviewed by Dan Hecht.\n\nIf the number of opcodes (with metadata of substantive size) is large, the 32-bit unsigned\ncomputed buffer offsets in UnlinkedMetadataTable::finalize() can overflow.  This patch\napplies the use of CheckedArithmetic to detect and handle any potential overflows.  In the\nevent of a detected overflow, we'll propagate the failure to allocate the bytecode metadata\nup to the BytecodeGenerator, and treat its as an OOM error during parsing.\n\nTest: JSTests/stress/unlinked-metadata-table-finalize-overflow.js\n\n* JSTests/stress/unlinked-metadata-table-finalize-overflow.js: Added.\n(try.f):\n(catch):\n* Source/JavaScriptCore/bytecode/UnlinkedCodeBlockGenerator.cpp:\n(JSC::UnlinkedCodeBlockGenerator::finalize):\n* Source/JavaScriptCore/bytecode/UnlinkedCodeBlockGenerator.h:\n* Source/JavaScriptCore/bytecode/UnlinkedMetadataTable.cpp:\n(JSC::UnlinkedMetadataTable::finalize):\n* Source/JavaScriptCore/bytecode/UnlinkedMetadataTable.h:\n* Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp:\n(JSC::BytecodeGenerator::generate):\n\nOriginally-landed-as: 305413.1022@safari-7624.5-branch (9343a9521f58). rdar://185367993\nCanonical link: https://commits.webkit.org/319678@main","order":0,"repository_id":"webkit","timestamp":1787538302},{"author":{"emails":["ahmad.saleem792@gmail.com","ahmad.saleem792+github@gmail.com","ahmad_saleem@apple.com"],"name":"Ahmad Saleem"},"branch":"main","hash":"6743d4ebb647587a2b5b6ae8df4041490b87eb54","identifier":"319679@main","message":"cssCanvasClients() returns a set of raw Element pointers\nhttps://bugs.webkit.org/show_bug.cgi?id=322363\nrdar://185651379\n\nReviewed by Chris Dumez.\n\nCanvasBase::cssCanvasClients() and InspectorCanvas::cssCanvasClientNodes() were\nthe last HashSet<Element*> in WebCore; every other Element set in the tree is a\nHashSet<Ref<Element>> or a WeakHashSet<Element>. Nothing misbehaves today \u2014\nthe set is built and drained inside a single synchronous inspector call, with no\nscript or layout in between \u2014 but the uncounted container has no reason to exist\nhere: the producer already holds a RefPtr to each element, and both consumers\nimmediately re-ref every entry.\n\nReturn HashSet<Ref<Element>> instead and let the callers iterate Refs directly.\n\n* Source/WebCore/html/CanvasBase.cpp:\n(WebCore::CanvasBase::cssCanvasClients const):\n(WebCore:: const): Deleted.\n* Source/WebCore/html/CanvasBase.h:\n* Source/WebCore/inspector/InspectorCanvas.cpp:\n(WebCore::InspectorCanvas::cssCanvasClientNodes const):\n* Source/WebCore/inspector/InspectorCanvas.h:\n* Source/WebCore/inspector/agents/page/PageCanvasAgent.cpp:\n(WebCore::PageCanvasAgent::requestCSSCanvasClientNodes):\n\nCanonical link: https://commits.webkit.org/319679@main","order":0,"repository_id":"webkit","timestamp":1787544232},{"author":{"emails":["djg@apple.com"],"name":"Dan Glastonbury"},"branch":"main","hash":"60eee3f8f2c5bd21389fedb90964c8e78942800e","identifier":"319680@main","message":"Avoid an out-of-line call per stream IPC send to check whether signposts are enabled\nhttps://bugs.webkit.org/show_bug.cgi?id=322260\nrdar://185491104\n\nReviewed by Kimmo Kinnunen.\n\nStreamClientConnection::send() called emitSendSignpost() unconditionally on every\nmessage, and both it and signpostsEnabled() were defined out-of-line in the .cpp\nwhile send<T>() is a header template. Without LTO, which local Release builds\ndisable, the compiler could not inline the enabled check, so every send paid a\ncall just to read a static bool. ENABLE_CORE_IPC_SIGNPOSTS is unconditionally 1\non Cocoa, so release builds paid it too.\n\nMove the fast path inline and guard the emitSendSignpost() call on it, leaving\nonly the one-time preference read out-of-line in signpostsEnabledSlow().\n\n* Source/WebKit/Platform/IPC/StreamClientConnection.cpp:\n(IPC::StreamClientConnection::forceEnableSignposts):\n(IPC::StreamClientConnection::signpostsEnabledSlow):\n* Source/WebKit/Platform/IPC/StreamClientConnection.h:\n(IPC::StreamClientConnection::signpostsEnabled):\n(IPC::StreamClientConnection::send):\n\nCanonical link: https://commits.webkit.org/319680@main","order":0,"repository_id":"webkit","timestamp":1787546710},{"author":{"emails":["richard_robinson2@apple.com"],"name":"Richard Robinson"},"branch":"main","hash":"0c7e7ad97b9c50e549387914d31ecc2908ae0171","identifier":"319681@main","message":"[WTF] Use std::expected instead of our own std::experimental::expected implementation\nhttps://bugs.webkit.org/show_bug.cgi?id=322297\nrdar://185536453\n\nReviewed by Ryan Reno, Alex Christensen, Abrar Rahman Protyasha, and Cole Carley.\n\nSwitch to using the normal `std::expected` type instead of our own implementation based on an\noutdated version.\n\nSince `std::expected` is stricter than ours was, several fixes are needed:\n\n1. It has no non-template constructor taking `const T&`, only `template<class U = T> expected(U&&)`.\n`U` cannot be deduced through a braced-init-list, so it falls back to `U = T` and the parameter\nbecomes `T&&`, which will not bind to an lvalue. Consequently `return { { someLvalue } }` no longer\ncompiles, and the extra braces are dropped. This only affected the cases where the inner element was\nan lvalue of type `T`.\n\n2. Its assignment operators require `is_nothrow_move_constructible_v<T> || is_nothrow_move_constructible_v<E>`,\nwhere ours were unconditional. Neither `Exception` nor `String` qualified, because `RefPtr`'s move\nconstructor was never marked `noexcept`, and that propagated up through `String`'s defaulted move\nconstructor. The result was that copy and move assignment were silently deleted for nearly every\n`ExceptionOr<T>` and `Expected<T, String>` use.\n\nFix by marking the `Ref` and `RefPtr` move constructors `noexcept`. Since it makes `String` and\ntherefore `Exception` nothrow-move-constructible, it satisfies the requirement for every `Expected`\nusing them as the error type, whatever the value type is.\n\n3. `value()` requires `is_copy_constructible_v<E>`, since it throws `bad_expected_access<E>` when\nthere is no value, which breaks move-only reject types in `NativePromise`. Use `operator*` instead,\nwhich doesn't have this requirement and whose only requirement is already guaranteed by the enclosing\n`if (result)`.\n\n4. Fix `BidiBrowsingContextAgent::getTree` to forward its result instead of unwrapping and\nrewrapping it, which was discarding the error case.\n\nTest: Tools/TestWebKitAPI/Tests/WTF/NativePromise.cpp\n\n* Source/WTF/wtf/Expected.h:\n(): Deleted.\n(std::experimental::fundamentals_v3::bad_expected_access<void>::bad_expected_access): Deleted.\n(std::experimental::fundamentals_v3::bad_expected_access::bad_expected_access): Deleted.\n(std::experimental::fundamentals_v3::bad_expected_access::error): Deleted.\n(std::experimental::fundamentals_v3::bad_expected_access::error const): Deleted.\n(std::experimental::fundamentals_v3::__expected_detail::__expected_terminate): Deleted.\n(std::experimental::fundamentals_v3::__expected_detail::base::base): Deleted.\n(std::experimental::fundamentals_v3::__expected_detail::voidbase::voidbase): Deleted.\n(std::experimental::fundamentals_v3::expected::expected): Deleted.\n(std::experimental::fundamentals_v3::expected::operator=): Deleted.\n(std::experimental::fundamentals_v3::expected::swap): Deleted.\n(std::experimental::fundamentals_v3::expected::operator bool const): Deleted.\n(std::experimental::fundamentals_v3::expected::has_value const): Deleted.\n(std::experimental::fundamentals_v3::expected::value_or const): Deleted.\n(std::experimental::fundamentals_v3::expected::value_or): Deleted.\n(std::experimental::fundamentals_v3::operator==): Deleted.\n(std::experimental::fundamentals_v3::swap): Deleted.\n* Source/WTF/wtf/Forward.h:\n* Source/WTF/wtf/NativePromise.h:\n* Source/WTF/wtf/Ref.h:\n* Source/WTF/wtf/RefPtr.h:\n* Source/WTF/wtf/TypeTraits.h:\n* Source/WebGPU/WGSL/ConstantFunctions.h:\n(WGSL::CONSTANT_FUNCTION):\n* Source/WebKit/UIProcess/Automation/BidiBrowsingContextAgent.cpp:\n(WebKit::BidiBrowsingContextAgent::getTree):\n* Tools/TestWebKitAPI/Tests/WTF/NativePromise.cpp:\n(TestWebKitAPI::TEST(NativePromise, MoveOnlyType)):\n\nCanonical link: https://commits.webkit.org/319681@main","order":0,"repository_id":"webkit","timestamp":1787547888},{"author":{"emails":["ahmad.saleem792@gmail.com","ahmad.saleem792+github@gmail.com","ahmad_saleem@apple.com"],"name":"Ahmad Saleem"},"branch":"main","hash":"f2faeb01517c97a8ee551309aa97c3c9a4d7d271","identifier":"319682@main","message":"CanvasNoiseInjection dirty rect is never cleared when the dirty region is fully transparent\nhttps://bugs.webkit.org/show_bug.cgi?id=322367\nrdar://185653414\n\nReviewed by Gerald Squelart.\n\npostProcessPixelBufferResults() only sets wasPixelBufferModified after the\n`if (!alphaChannel) continue;` guard, so it returns false when every pixel in the\ndirty rect is transparent. postProcessDirtyCanvasBuffer() gated both the\nputPixelBuffer() write-back and the `m_postProcessDirtyRect = { }` reset on that\nreturn value, so the dirty rect survived the readback. Nothing else clears it:\nCanvasBase::didDraw() only calls clearDirtyRect() for a whole-canvas draw with\nShouldApplyPostProcessingToDirtyRect::No.\n\nThe stale rect makes every subsequent getImageData()/toDataURL()/toBlob() redo an\nunpremultiplied RGBA8 getPixelBuffer() over it and throw the result away, and\nleaves havePendingCanvasNoiseInjection() permanently true, forcing\ndrawImage(thatCanvas, ...) down the post-processing didDraw() path.\n\nSkipping the write-back when nothing changed is still correct, so decouple the\ntwo: reset the dirty rect once the pixel buffer has been processed, and only write\nback when a pixel actually changed. The early returns for a missing image buffer\nor a failed readback still preserve the rect.\n\nOnly reachable with a non-zero noise salt; salt 0 is the testing path and returns\ntrue before the loop, which is why canvas-noise-injection.html misses this.\n\nTest: fast/canvas/canvas-noise-injection-transparent-dirty-rect.html\n\n* LayoutTests/fast/canvas/canvas-noise-injection-transparent-dirty-rect-expected.txt: Added.\n* LayoutTests/fast/canvas/canvas-noise-injection-transparent-dirty-rect.html: Added.\n* Source/WebCore/html/CanvasNoiseInjection.cpp:\n(WebCore::CanvasNoiseInjection::postProcessDirtyCanvasBuffer):\n\nCanonical link: https://commits.webkit.org/319682@main","order":0,"repository_id":"webkit","timestamp":1787552305},{"author":{"emails":["lily_spiniolas@apple.com"],"name":"Lily Spiniolas"},"branch":"main","hash":"729c8c6ccb67f59c290dab45953c2b53eb603b34","identifier":"319683@main","message":"Spin buttons for input type=\"number\" do not repaint when window active state changes\nhttps://bugs.webkit.org/show_bug.cgi?id=322353\nrdar://185625389\n\nReviewed by Wenson Hsieh and Abrar Rahman Protyasha.\n\nUpdate `RenderThemeCocoa::controlSupportsTints` to return true for\nspin buttons, thus causing them to be repainted when the window active\nstate changes.\n\nTests: fast/forms/form-control-refresh/spinbutton-window-inactive-state-dark-mode.html\n       fast/forms/form-control-refresh/spinbutton-window-inactive-state-light-mode.html\n\n* LayoutTests/fast/forms/form-control-refresh/spinbutton-window-inactive-state-dark-mode-expected-mismatch.html: Added.\n* LayoutTests/fast/forms/form-control-refresh/spinbutton-window-inactive-state-dark-mode.html: Added.\n* LayoutTests/fast/forms/form-control-refresh/spinbutton-window-inactive-state-light-mode-expected-mismatch.html: Added.\n* LayoutTests/fast/forms/form-control-refresh/spinbutton-window-inactive-state-light-mode.html: Added.\n* LayoutTests/platform/ios/TestExpectations:\n* LayoutTests/platform/visionos/TestExpectations:\n* Source/WebCore/rendering/cocoa/RenderThemeCocoa.mm:\n(WebCore::RenderThemeCocoa::controlSupportsTints const):\n\nCanonical link: https://commits.webkit.org/319683@main","order":0,"repository_id":"webkit","timestamp":1787553561},{"author":{"emails":["youennf@gmail.com","youenn@apple.com","yfablet@apple.com"],"name":"Youenn Fablet"},"branch":"main","hash":"e84a219c82ccc42cbd8d829807976ea7b1c7e502","identifier":"319684@main","message":"Resync libyuv up to M152\nrdar://185207783\nhttps://bugs.webkit.org/show_bug.cgi?id=322017\n\nReviewed by Jean-Yves Avenard.\n\n* Source/ThirdParty/libwebrtc/Source/third_party/libyuv: Resynced.\n\nCanonical link: https://commits.webkit.org/319684@main","order":0,"repository_id":"webkit","timestamp":1787557647},{"author":{"emails":["youennf@gmail.com","youenn@apple.com","yfablet@apple.com"],"name":"Youenn Fablet"},"branch":"main","hash":"0703907b1d4a2b3e546023865c5c3174637a3dca","identifier":"319685@main","message":"Resync boringssl to M152\nrdar://185207703\nhttps://bugs.webkit.org/show_bug.cgi?id=322015\n\nReviewed by Jean-Yves Avenard.\n\n* Source/ThirdParty/libwebrtc/Source/third_party/boringssl: Resynced.\n\nCanonical link: https://commits.webkit.org/319685@main","order":0,"repository_id":"webkit","timestamp":1787557851},{"branch":"main","hash":"7da1609eab539eb3a0b1b7416d5a9c96fe9e27ef","identifier":"319686@main","order":0,"repository_id":"webkit","timestamp":1787557984},{"author":{"emails":["djg@apple.com"],"name":"Dan Glastonbury"},"branch":"main","hash":"8d5de0127f134360c3326ee52ceb6b6aa30d887d","identifier":"319687@main","message":"Avoid a redundant matrix multiply in SVGTransformList::concatenate()\nhttps://bugs.webkit.org/show_bug.cgi?id=322258\nrdar://185490497\n\nReviewed by Mike Wyrzykowski.\n\nconcatenate() started from an identity AffineTransform and multiplied every item\ninto it, so the first iteration always performed a full 2x3 multiply against\nidentity. Seed the accumulator from the first item instead and multiply in the\nremaining ones, which removes one AffineTransform::multiply() per call regardless\nof list length.\n\n* Source/WebCore/svg/SVGTransformList.cpp:\n(WebCore::SVGTransformList::concatenate const):\n\nCanonical link: https://commits.webkit.org/319687@main","order":0,"repository_id":"webkit","timestamp":1787558471},{"author":{"emails":["zimmermann@kde.org","zimmermann@physik.rwth-aachen.de","zimmermann@webkit.org","nzimmermann@blackberry.com","nzimmermann@rim.com","nzimmermann@igalia.com"],"name":"Nikolas Zimmermann"},"branch":"main","hash":"9e4acd3a3813fa7bbeb453f8d7349a65fb310ba7","identifier":"319688@main","message":"[LBSE] non-scaling-stroke uses the wrong reference coordinate system\nhttps://bugs.webkit.org/show_bug.cgi?id=322340\n\nReviewed by Rob Buis.\n\nThe reference coordinate system for a non-scaling stroke is the one of the\noutermost <svg>. It holds all SVG internal transforms and nothing above them.\nPage zoom is not part of it either, because zoom scales the whole rendering,\nthe stroke included. We are currently using getScreenCTM() which includes\nall transformations up to RenderView, which is incorrect.\n\nFix: Introduce computeTransformToSVGRoot() to accumulates up to and including\nthe anonymous RenderSVGViewportContainer, which caries the outermost 'viewBox'\ntransform and stop there. This is the correct coordinate system for\nnon-scaling-stroke.\n\nFixes three non-scaling-stroke tests in LBSE.\n\n* LayoutTests/platform/mac-tahoe-wk2-lbse-text/TestExpectations:\n* Source/WebCore/rendering/svg/RenderSVGShape.cpp:\n(WebCore::RenderSVGShape::nonScalingStrokeTransform const):\n* Source/WebCore/rendering/svg/SVGTransformComputation.h:\n(WebCore::SVGTransformComputation::computeAccumulatedTransform const):\n(WebCore::SVGTransformComputation::computeTransformToSVGRoot const):\n\nCanonical link: https://commits.webkit.org/319688@main","order":0,"repository_id":"webkit","timestamp":1787558692},{"author":{"emails":["karlcow@apple.com","karl+webkit@la-grange.net"],"name":"Karl Dubost"},"branch":"main","hash":"4bf9d2cf94e5a07bdcb977203ddc27f3752ecaf7","identifier":"319689@main","message":"Extend WPT coverage for svgview() fragment identifiers\nhttps://bugs.webkit.org/show_bug.cgi?id=322178\nrdar://185410830\n\nReviewed by Nikolas Zimmermann.\n\nAdds coverage for svgView() on an img element, preserveAspectRatio(), transform(),\nattribute order, the order attributes are applied in, a percent-encoded separator,\nand a trailing time segment.\n\nsvgview-and-xywh.html and its reference loaded sprite4.svg, which does not exist.\nThe support file is support/squares.svg. Both sides showed a missing image and\nmatched, so it passed without testing anything. Fixed, and now fails: WebKit and\nBlink honour the svgView() prefix where the test expects the whole fragment to be\nignored. Marked ImageOnlyFailure.\n\nsvgview-spaces.html and svgview-spaces-around-semicolon.html assert that spaces are\nallowed in a fragment specification, which SVG 2 says and no engine does. Marked\nImageOnlyFailure.\n\n* LayoutTests/TestExpectations:\n* LayoutTests/imported/w3c/web-platform-tests/svg/linking/reftests/svgview-and-xywh-expected.html:\n* LayoutTests/imported/w3c/web-platform-tests/svg/linking/reftests/svgview-and-xywh-ref.html:\n* LayoutTests/imported/w3c/web-platform-tests/svg/linking/reftests/svgview-and-xywh.html:\n* LayoutTests/imported/w3c/web-platform-tests/svg/linking/reftests/svgview-attribute-order-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/linking/reftests/svgview-attribute-order.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/linking/reftests/svgview-escaped-semicolon-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/linking/reftests/svgview-escaped-semicolon.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/linking/reftests/svgview-img-element-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/linking/reftests/svgview-img-element-ref.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/linking/reftests/svgview-img-element.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/linking/reftests/svgview-preserveaspectratio-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/linking/reftests/svgview-preserveaspectratio-meet-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/linking/reftests/svgview-preserveaspectratio-meet-ref.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/linking/reftests/svgview-preserveaspectratio-meet.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/linking/reftests/svgview-preserveaspectratio.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/linking/reftests/svgview-spaces-around-semicolon-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/linking/reftests/svgview-spaces-around-semicolon.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/linking/reftests/svgview-spaces-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/linking/reftests/svgview-spaces.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/linking/reftests/svgview-teal-100x50-ref.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/linking/reftests/svgview-terracotta-100x100-ref.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/linking/reftests/svgview-timesegment-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/linking/reftests/svgview-timesegment.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/linking/reftests/svgview-transform-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/linking/reftests/svgview-transform.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/linking/reftests/svgview-viewbox-then-transform-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/linking/reftests/svgview-viewbox-then-transform.html: Added.\n\nCanonical link: https://commits.webkit.org/319689@main","order":0,"repository_id":"webkit","timestamp":1787559904},{"branch":"main","hash":"d40f4efab0e0cee61e29c8540abff5285bf5275d","identifier":"319690@main","order":0,"repository_id":"webkit","timestamp":1787562714},{"author":{"emails":["ddkilzer@webkit.org","ddkilzer@apple.com"],"name":"David Kilzer"},"branch":"main","hash":"588e0f8ae8a0b21c73c10ad185fd125624b06d4c","identifier":"319691@main","message":"REGRESSION (319410@main): WebCore::ISOOriginalFormatBox::parse() is no longer exported from WebCore\n<https://bugs.webkit.org/show_bug.cgi?id=322380>\n<rdar://185663612>\n\nUnreviewed build fix.\n\nAdd `WEBCORE_EXPORT` to `ISOOriginalFormatBox::parse()`.  319410@main\nchanged the ISO box `parse()` methods to take `const ByteView&` and, in\nthat same change, dropped the class-level `WEBCORE_EXPORT` from\n`ISOOriginalFormatBox`, re-adding it only to the constructor and\ndestructor.  The `parse()` override was left un-exported, so code\noutside WebCore that links against the framework and calls it fails\nwith an undefined symbol.  The sibling ISO box classes stay reachable\nthrough their own class-level or per-member `WEBCORE_EXPORT`, so\n`ISOOriginalFormatBox` was the only one affected.\n\nNo new tests since this change is not directly testable.\n\n* Source/WebCore/platform/graphics/iso/ISOOriginalFormatBox.h:\n(WebCore::ISOOriginalFormatBox::parse):\n\nCanonical link: https://commits.webkit.org/319691@main","order":0,"repository_id":"webkit","timestamp":1787568098},{"author":{"emails":["ddkilzer@webkit.org","ddkilzer@apple.com"],"name":"David Kilzer"},"branch":"main","hash":"b58727688abaf30310e8962431b0ce109f083555","identifier":"319692@main","message":"MESSAGE_CHECK failure in WebLockRegistryProxy::requestLock for a worker registered by a third-party frame\n<https://bugs.webkit.org/show_bug.cgi?id=322329>\n<rdar://179508210>\n\nReviewed by Chris Dumez.\n\n`WebLockRegistryProxy` validates the incoming `ClientOrigin` with\n`WebProcessProxy::hasCommittedClientOrigin()`. For a WebProcess that\nonly hosts remote workers there is no committed load, so that predicate\nfell back to comparing both halves of the `ClientOrigin` against\n`WebProcessProxy::m_site`.\n\nThat comparison is wrong. `m_site` of a remote worker process is the\n*top* site, because `SWServer` and `WebSharedWorkerServer` ask for a\ncontext connection with `SWServerWorker::topSite()` /\n`WebSharedWorker::topSite()`, i.e. with the storage partition rather\nthan with the worker's own origin. A service worker or a shared worker\nregistered by a third-party frame has a client origin on a different\nsite than its partition, so `Site { clientOrigin.clientOrigin }` never\nmatched `m_site`, the `MESSAGE_CHECK` fired an `EXC_GUARD` fault and the\nworker process was killed. Web Locks were therefore unreachable from any\nthird-party worker, which is legitimate content: the lock registry\nitself is keyed by the full `ClientOrigin` and partitions such a worker\ncorrectly.\n\nUse new `WebProcessProxy::m_remoteWorkerSites` to track the storage\npartitions for which a process has been made a remote worker host, and\nvalidate the top origin of the incoming `ClientOrigin` against that set.\nThis is the tightest granularity the UI process actually possesses: it\nis never told the origins of the workers running in a context process,\nonly the partitions the process was established for. A forged\n`ClientOrigin` whose top origin is on another site is still rejected, so\n`LayoutTests/ipc/weblock-registry-origin.html` keeps failing the check.\n\nThe set only ever grows so that a message which was already in flight\nwhen `disableRemoteWorkers()` ran is still considered valid. A\nWorker-only process has an empty `m_committedClientOrigins` and would\notherwise fail the check during that teardown window.\n\nTests: http/tests/web-locks/web-lock-in-third-party-serviceworker.html\n       http/tests/web-locks/web-lock-in-third-party-serviceworker-site-isolation.html\n       http/tests/web-locks/web-lock-in-third-party-sharedworker.html\n       http/tests/web-locks/web-lock-in-third-party-sharedworker-site-isolation.html\n\n* LayoutTests/http/tests/web-locks/resources/third-party-service-worker.js: Added.\n* LayoutTests/http/tests/web-locks/resources/third-party-serviceworker-frame.html: Added.\n* LayoutTests/http/tests/web-locks/resources/third-party-sharedworker-frame.html: Added.\n* LayoutTests/http/tests/web-locks/web-lock-in-third-party-serviceworker-expected.txt: Added.\n* LayoutTests/http/tests/web-locks/web-lock-in-third-party-serviceworker-site-isolation-expected.txt: Added.\n* LayoutTests/http/tests/web-locks/web-lock-in-third-party-serviceworker-site-isolation.html: Added.\n* LayoutTests/http/tests/web-locks/web-lock-in-third-party-serviceworker.html: Added.\n* LayoutTests/http/tests/web-locks/web-lock-in-third-party-sharedworker-expected.txt: Added.\n* LayoutTests/http/tests/web-locks/web-lock-in-third-party-sharedworker-site-isolation-expected.txt: Added.\n* LayoutTests/http/tests/web-locks/web-lock-in-third-party-sharedworker-site-isolation.html: Added.\n* LayoutTests/http/tests/web-locks/web-lock-in-third-party-sharedworker.html: Added.\n* Source/WebKit/UIProcess/WebProcessPool.cpp:\n(WebKit::WebProcessPool::establishRemoteWorkerContextConnectionToNetworkProcess):\n- Record the storage partition on a reused remote-worker host process.\n* Source/WebKit/UIProcess/WebProcessProxy.cpp:\n(WebKit::WebProcessProxy::createForRemoteWorkers):\n(WebKit::WebProcessProxy::hasCommittedClientOrigin const):\n(WebKit::WebProcessProxy::didBecomeRemoteWorkerHostForSite):\n* Source/WebKit/UIProcess/WebProcessProxy.h:\n- Move `m_isEligibleForWebProcessCache` so the new `m_remoteWorkerSites`\n  member variable does not grow `WebProcessProxy` into a larger\n  allocation bucket: it stays at 1424 bytes.\n\nCanonical link: https://commits.webkit.org/319692@main","order":0,"repository_id":"webkit","timestamp":1787568552},{"author":{"emails":["aakash_jain@apple.com","aj355@cornell.edu"],"name":"Aakash Jain"},"branch":"main","hash":"da99882cd45a9e6af0c31d960c39e0a7f5d4f46b","identifier":"319693@main","message":"[webkit-patch] Remove Bugzilla patch workflow support from webkit-patch - Part 3\nhttps://bugs.webkit.org/show_bug.cgi?id=322264\n<rdar://problem/185499346>\n\nReviewed by Ryan Haddad.\n\nPatches are deprecated, so no new attachment is tested by EWS and\nupdate-test-expectations-from-bugzilla only applies to attachments from before the\nswitch, whose results are far too old to rebaseline against. update-test-expectations\nkeeps working for a pull request, and EWS keeps serving the results it already recorded\nfor old attachments.\n\nAlso removes two files which nothing referenced any more: the deprecated-command stub\nand a ChangeLog analysis page.\n\n* Tools/Scripts/update-test-expectations-from-bugzilla: Removed.\n* Tools/Scripts/webkitpy/common/net/bugzilla/results_fetcher.py:\n* Tools/Scripts/webkitpy/common/net/bugzilla/results_fetcher_unittest.py:\n* Tools/Scripts/webkitpy/common/net/bugzilla/test_expectation_updater.py:\n* Tools/Scripts/webkitpy/common/net/bugzilla/test_expectation_updater_unittest.py:\n* Tools/Scripts/webkitpy/tool/commands/data/summary.html: Removed.\n* Tools/Scripts/webkitpy/tool/commands/deprecatedcommand.py: Removed.\n\nCanonical link: https://commits.webkit.org/319693@main","order":0,"repository_id":"webkit","timestamp":1787568669},{"branch":"main","hash":"e1e984506198419c3141b726ab5b9338103e270e","identifier":"319694@main","order":0,"repository_id":"webkit","timestamp":1787570069},{"author":{"emails":["csaavedra@igalia.com"],"name":"Claudio Saavedra"},"branch":"main","hash":"1fec4985d1794c782ff12e2aefc088b76023ba16","identifier":"319695@main","message":"Require GCC 13.1.0 and remove dead checks for older GCC versions\nhttps://bugs.webkit.org/show_bug.cgi?id=317724\n\nReviewed by Yusuke Suzuki and Michael Catanzaro.\n\n312858@main (relanded in 315305@main) uses C++23 std::format in WTF,\nwhich libstdc++ first provides in GCC 13.1. Raise the minimum required\nGCC version in WebKitCommon.cmake from 12.2.0 to 13.1.0 to match.\n\nWith that minimum, version guards that no supported compiler can satisfy\nare now dead and are removed:\n\n- WebKitCompilerFlags.cmake disabled -Wno-uninitialized and\n  -Wno-mismatched-new-delete only for GCC < 12.0.0 (already unreachable\n  under the previous 12.2.0 minimum).\n- JIT.h worked around a GCC < 12.3.0 ICE on using-enum in templates.\n\n* Source/JavaScriptCore/jit/JIT.h:\n* Source/cmake/WebKitCommon.cmake:\n* Source/cmake/WebKitCompilerFlags.cmake:\n\nCanonical link: https://commits.webkit.org/319695@main","order":0,"repository_id":"webkit","timestamp":1787573736},{"author":{"emails":["zalan@apple.com"],"name":"Alan Baradlay"},"branch":"main","hash":"2f6829bc0e9b663bb2c26bcb544560787a27b137","message":"[anon-block-removal] Adjoining margins do not collapse when the container's first child is a float or an out-of-flow box\nhttps://bugs.webkit.org/show_bug.cgi?id=322332\n<rdar://problem/185591842>\n\nReviewed by Antti Koivisto.\n\nRenderTreeBuilder::Block::attach decides childrenInline from the first child but skips that when the child is\nfloating or out-of-flow, so a leading float or out-of-flow box leaves the parent non-empty and the first in-flow\nchild never reaches the branch that would turn the flag off. A container whose in-flow children are all block\nlevel then runs an inline formatting context, which leaves adjoining margins between those boxes uncollapsed,\nmoves out-of-flow static positions and changes what align-content aligns. Ask whether an in-flow child has\narrived rather than whether the box is empty, skipping floats, out-of-flow boxes and an excluded marker.\n\n* Source/WebCore/rendering/updating/RenderTreeBuilderBlock.cpp:\n(WebCore::RenderTreeBuilder::Block::attach):\n* LayoutTests/imported/w3c/web-platform-tests/css/CSS2/normal-flow/margin-collapse-after-float-001.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/CSS2/normal-flow/margin-collapse-after-float-001-ref.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/CSS2/normal-flow/margin-collapse-after-float-001-expected.html: Added.\n\nCanonical link: https://commits.webkit.org/319696@main","order":0,"repository_id":"webkit","timestamp":1787575048}]