[{"author":{"emails":["eric.carlson@apple.com"],"name":"Eric Carlson"},"branch":"main","hash":"e5439f454fea7c3e56f167b4e55d66c8289b7024","identifier":"316483@main","message":"[CoreIPC] [GPUP] off-main-thread ~CDMSessionAVContentKeySession mutates unlocked LegacyCDMPrivateAVFObjC::m_sessions Vector\nhttps://bugs.webkit.org/show_bug.cgi?id=314134\nrdar://175519844\n\nReviewed by Jean-Yves Avenard.\n\nCDMSessionAVContentKeySession is ThreadSafeRefCountedAndCanMakeThreadSafeWeakPtr\nwith the default DestructionThread::Any. Its WebCDMSessionAVContentKeySessionDelegate\nruns on a per-session background WorkQueue and holds a strong RefPtr to the session\nfor the duration of -contentKeySession:didProvideContentKeyRequest:. If the main\nthread drops its last Ref while that background RefPtr is live, the destructor runs\non the background queue.\n\n~CDMSessionAVContentKeySession then resolves a non-thread-safe\nWeakPtr<LegacyCDMPrivateAVFObjC> and calls invalidateSession(this) ->\nm_sessions.removeAll(this) on the unlocked Vector<CDMSessionAVContentKeySession*>,\nracing main-thread createSession() -> m_sessions.append(). Under ASan this surfaces\nas container-overflow in Vector::reserveCapacity. Taking RefPtr cdm = m_cdm.get()\noff-main also performs non-atomic ref()/deref() on LegacyCDM via\nLegacyCDMPrivateAVFObjC::ref().\n\nPin destruction to the main thread with WTF::DestructionThread::Main so the\ndestructor (and therefore the WeakPtr resolution, the LegacyCDM ref/deref, and\ninvalidateSession) always run on the main thread. Add main-thread asserts to the\ndestructor and to LegacyCDMPrivateAVFObjC::createSession/invalidateSession to\ndocument and enforce the invariant.\n\nTest: ipc/legacy-cdm-session-avcontentkeysession-destruction-race.html\n\n* LayoutTests/ipc/legacy-cdm-session-avcontentkeysession-destruction-race-expected.txt: Added.\n* LayoutTests/ipc/legacy-cdm-session-avcontentkeysession-destruction-race.html: Added.\n* LayoutTests/platform/glib/TestExpectations:\n* Source/WebCore/platform/graphics/avfoundation/LegacyCDMPrivateAVFObjC.mm:\n(WebCore::LegacyCDMPrivateAVFObjC::createSession):\n(WebCore::LegacyCDMPrivateAVFObjC::invalidateSession):\n* Source/WebCore/platform/graphics/avfoundation/objc/CDMSessionAVContentKeySession.h:\n* Source/WebCore/platform/graphics/avfoundation/objc/CDMSessionAVContentKeySession.mm:\n(WebCore::CDMSessionAVContentKeySession::~CDMSessionAVContentKeySession):\n\nOriginally-landed-as: 305413.856@safari-7624-branch (190b07df83bc). rdar://180429393\nCanonical link: https://commits.webkit.org/316483@main","order":0,"repository_id":"webkit","timestamp":1783092162},{"author":{"emails":["youennf@gmail.com","youenn@apple.com","yfablet@apple.com"],"name":"Youenn Fablet"},"branch":"main","hash":"d4b40e10edf70074195fa76e9ffdc52962a3f04b","identifier":"316484@main","message":"[WebKit] Cross-thread use-after-free in RemoteSampleBufferDisplayLayer via off-main layerErrorDidChange() from FlushAndRemoveImage @catch\nrdar://176482856\n\nReviewed by Jean-Yves Avenard.\n\nLocalSampleBufferDisplayLayer::flushAndRemoveImage() dispatches onto m_processingQueue,\nand the @catch branch called layerErrorDidChange() directly on that background queue.\nlayerErrorDidChange() dereferences the non-thread-safe WeakPtr<SampleBufferDisplayLayerClient> m_client\nand invokes virtual methods on its RemoteSampleBufferDisplayLayer client,\nwhile RemoteSampleBufferDisplayLayerManager::releaseLayer() is dropping the last Ref on the main runloop.\n\nBounce the @catch handler to the main runloop via callOnMainThread so layerErrorDidChange() runs on the expected thread.\n\n* LayoutTests/ipc/LocalSampleBufferDisplayLayer-flushAndRemoveImage-cross-thread-uaf-expected.txt: Added.\n\nPatch mostly done by Simon Lewis.\n* LayoutTests/ipc/LocalSampleBufferDisplayLayer-flushAndRemoveImage-cross-thread-uaf.html: Added.\n* LayoutTests/platform/glib/TestExpectations:\n* Source/WebCore/platform/graphics/avfoundation/objc/LocalSampleBufferDisplayLayer.mm:\n(WebCore::LocalSampleBufferDisplayLayer::flushAndRemoveImage):\nHop to the main thread before calling layerErrorDidChange().\n\nOriginally-landed-as: 305413.884@safari-7624-branch (150ce323b07b). rdar://180437609\nCanonical link: https://commits.webkit.org/316484@main","order":0,"repository_id":"webkit","timestamp":1783092269},{"author":{"emails":["rniwa@webkit.org","rniwa@apple.com"],"name":"Ryosuke Niwa"},"branch":"main","hash":"b1a42efa6ce00e8d6cabcf8faff005e734a54190","identifier":"316485@main","message":"Data race in JSStyleSheet::visitAdditionalChildren during GC leading to use-after-free\nhttps://bugs.webkit.org/show_bug.cgi?id=312540\nrdar://174207086\n\nReviewed by Antti Koivisto.\n\nJSStyleSheet::visitAdditionalChildren is called by the JSC garbage collector on a GC thread.\nIt calls addWebCoreOpaqueRoot(visitor, wrapped()) with root(StyleSheet*), which reads\nstyleSheet->ownerNode() and styleSheet->ownerRule(). Both are WeakPtr member variables on\nCSSStyleSheet or XSLStyleSheet with .get() returning a raw pointer with no ref count increment,\nand the backing WeakPtrImpl can be freed by the main thread between the read and the subsequent\ndereference, causing a heap use-after-free.\n\nThe same root(StyleSheet*) function is the convergence point for JSCSSRule's\nvisitAdditionalChildren and JSCSSStyleDeclaration's visitAdditionalChildren, so all three GC\nvisitor paths are affected.\n\nTo address this bug, this PR adds a pure virtual opaqueRootForGCThread() to so root(StyleSheet*)\nbecomes a single virtual dispatch, eliminating the unsafe inline chain traversal. This function\nthen uses a newly added lock (m_opaqueRootLockForGC in CSSStyleSheet and XSLStyleSheet) to\nguard against m_ownerNode being modified while the main thread is mutating it.\n\nIn addition, we had a GC correctness bug that @import child stylesheets (which have m_ownerRule\nbut no m_ownerNode) would not keep its parent stylesheet's JS wrapper alive even though it's\naccessible via parentStyleSheet property.\n\nTo implement these changes and to avoid thread safety issues, this PR changes the type of\nm_ownerNode and m_ownerRule in CSSStyleSheet and XSLStyleSheet from WeakPtr to CheckedPtr since\nWeakPtr loads the pointee address via WeakPtrImpl, which may be concurrently free'ed in the main\nthread while we're accessing it in a GC thread. Note that all owner element destructors\n(HTMLStyleElement, HTMLLinkElement, SVGStyleElement, ProcessingInstruction) call clearOwnerNode()\nbefore the Node base-class destructor, so the CheckedPtr count reaches zero in time. Similarly,\nlearOwnerRule() is called from the CSSImportRule and StyleRuleImport destructors before\nCSSImportRule is freed so CheckedPtr's assertion should not fire.\n\nNo new tests for the data race issue itself since there is no reliable way of testing it.\n\nTest: fast/dom/StyleSheet/gc-import-rule-stylesheet.html\n\n* LayoutTests/fast/dom/StyleSheet/gc-import-rule-stylesheet-expected.txt: Added.\n* LayoutTests/fast/dom/StyleSheet/gc-import-rule-stylesheet.html: Added.\n* Source/WebCore/bindings/js/JSStyleSheetCustom.h:\n(WebCore::root):\n* Source/WebCore/css/CSSImportRule.cpp:\n(WebCore::CSSImportRule::~CSSImportRule):\n* Source/WebCore/css/CSSImportRule.h:\n* Source/WebCore/css/CSSStyleSheet.cpp:\n(WebCore::CSSStyleSheet::clearOwnerNode):\n(WebCore::CSSStyleSheet::opaqueRootForGCThread):\n(WebCore::CSSStyleSheet::clearOwnerRule):\n* Source/WebCore/css/CSSStyleSheet.h:\n* Source/WebCore/css/StyleSheet.h:\n* Source/WebCore/xml/XSLStyleSheet.h:\n* Source/WebCore/xml/XSLStyleSheetLibxslt.cpp:\n(WebCore::XSLStyleSheet::XSLStyleSheet):\n(WebCore::XSLStyleSheet::clearOwnerNode):\n(WebCore::XSLStyleSheet::opaqueRootForGCThread):\n* Source/WebKitLegacy/mac/DOM/DOMCSSImportRule.mm:\n(-[DOMCSSImportRule media]):\n(-[DOMCSSImportRule styleSheet]):\n\nOriginally-landed-as: 305413.691@safari-7624-branch (f41030176464). rdar://180436921\nCanonical link: https://commits.webkit.org/316485@main","order":0,"repository_id":"webkit","timestamp":1783095285},{"author":{"emails":["achristensen@apple.com","achristensen@webkit.org","alex.christensen@flexsim.com"],"name":"Alex Christensen"},"branch":"main","hash":"1664fa80ae9d3be41518ad14952f4bb72d7912a5","identifier":"316486@main","message":"Include vector header for its use in RefTrackerMixin.cpp\nhttps://bugs.webkit.org/show_bug.cgi?id=318495\nrdar://181280080\n\nReviewed by Justin Michaud.\n\nI came across an interesting and simple build failure.  We use std::vector\nbut we don't include <vector> in a certain build configuration.\n\n* Source/WTF/wtf/RefTrackerMixin.cpp:\n\nCanonical link: https://commits.webkit.org/316486@main","order":0,"repository_id":"webkit","timestamp":1783096641},{"author":{"emails":["a_panta@apple.com"],"name":"Anuj Panta"},"branch":"main","hash":"e39ba8bbd23c8b2d6c0166ce1ec6eb3ac4dd9b7a","identifier":"316487@main","message":"Web Inspector: FrameDOMAgent inline style invalidation issues one DOM.getAttributes command per node instead of batching per tick\nhttps://bugs.webkit.org/show_bug.cgi?id=316416\nrdar://178830496\n\nReviewed by Qianlang Chen.\n\n_frameTargetInlineStyleInvalidated fired one DOM.getAttributes command per\ninvalidated node, every tick. Mirror the page-target _inlineStyleInvalidated:\naccumulate the node IDs and flush once per tick via a deferred callback.\n\nThe page target keeps this state on the manager; frame targets need it\nper-target since node IDs are scoped (targetId:nodeId) and each frame has its\nown DOMAgent, so attributeLoadNodeIds/loadNodeAttributesTimeout live on the\nper-target record. Unlike the page target, a frame can be torn down mid-tick,\nso _cleanupFrameTarget cancels any pending flush.\n\n* Source/WebInspectorUI/UserInterface/Controllers/DOMManager.js:\n(WI.DOMManager.prototype._initializeFrameTarget):\n(WI.DOMManager.prototype._cleanupFrameTarget):\n(WI.DOMManager.prototype._frameTargetInlineStyleInvalidated):\n(WI.DOMManager.prototype._loadFrameTargetNodeAttributes):\n\nCanonical link: https://commits.webkit.org/316487@main","order":0,"repository_id":"webkit","timestamp":1783097129},{"author":{"emails":["ahmad.saleem792@gmail.com","ahmad.saleem792+github@gmail.com","ahmad_saleem@apple.com"],"name":"Ahmad Saleem"},"branch":"main","hash":"34c12d7629562b966ace148545471e3c3a696e51","identifier":"316489@main","message":"[Web Inspector] didChangeCanvasSize/didChangeCanvasMemory have a vestigial always-true null check on inspectorCanvas\nhttps://bugs.webkit.org/show_bug.cgi?id=318559\nrdar://181331996\n\nReviewed by Devin Rousso.\n\nInspectorCanvasAgent::didChangeCanvasSize() and didChangeCanvasMemory()\neach declared a null RefPtr<InspectorCanvas> and then guarded the\nfindInspectorCanvas() lookup behind `if (!inspectorCanvas)`, which is\nunconditionally true since the variable was just default-constructed to\nnull. Assign the lookup result directly, matching the surrounding\ncanvasChanged() and canvasDestroyed() methods. No change in behavior.\n\n* Source/WebCore/inspector/agents/InspectorCanvasAgent.cpp:\n(WebCore::InspectorCanvasAgent::didChangeCanvasSize):\n(WebCore::InspectorCanvasAgent::didChangeCanvasMemory):\n\nCanonical link: https://commits.webkit.org/316489@main","order":0,"repository_id":"webkit","timestamp":1783098757},{"author":{"emails":["ahmad.saleem792@gmail.com","ahmad.saleem792+github@gmail.com","ahmad_saleem@apple.com"],"name":"Ahmad Saleem"},"branch":"main","hash":"30dcf5d1c9402dea5a26158e103f7e4333a7eac2","identifier":"316490@main","message":"[Web Inspector] Null InspectorStyleSheet dereference in InspectorCSSAgent::setActiveStyleSheetsForDocument when removing a stylesheet\nhttps://bugs.webkit.org/show_bug.cgi?id=318537\nrdar://181307890\n\nReviewed by Devin Rousso.\n\nWhen processing removed stylesheets, InspectorCSSAgent dereferenced the\nresult of m_cssStyleSheetToInspectorStyleSheet.get() without a null check\nto read id(), unlike its twin FrameCSSAgent::setActiveStyleSheetsForDocument\nwhich guards the same access. Add the missing null check to match.\n\n* Source/WebCore/inspector/agents/InspectorCSSAgent.cpp:\n(WebCore::InspectorCSSAgent::setActiveStyleSheetsForDocument):\n\nCanonical link: https://commits.webkit.org/316490@main","order":0,"repository_id":"webkit","timestamp":1783100693},{"author":{"emails":["a_panta@apple.com"],"name":"Anuj Panta"},"branch":"main","hash":"e1679b539c6174f7b2628eda2b25fb21cba830be","identifier":"316491@main","message":"Web Inspector: [SI] add per-frame FrameDOMStorageAgent (enable/disable)\nhttps://bugs.webkit.org/show_bug.cgi?id=316799\nrdar://179249922\n\nReviewed by BJ Burg.\n\nIntroduce FrameDOMStorageAgent, the per-frame DOMStorage agent for Site\nIsolation. Each LocalFrame's FrameInspectorController creates one, and\nit registers itself as the enabled per-frame DOMStorage agent on its\nframe's InstrumentingAgents.\n\nThis patch is enablement only: enable/disable are functional, and the\nDOMStorage domain now advertises the \"frame\" target type so a frame\ntarget exposes DOMStorageAgent to the frontend. The storage commands are\npresent as \"Not supported on frame targets\" stubs and are implemented in\na follow-up.\n\nenable() is idempotent: unlike the page-level InspectorDOMStorageAgent\n(which errors on a redundant enable), a repeat enable for the same agent\nis treated as a no-op, matching the sibling Frame* agents (e.g.\nFrameCSSAgent).\n\n* Source/JavaScriptCore/inspector/protocol/DOMStorage.json:\n* Source/WebCore/Sources.txt:\n* Source/WebCore/WebCore.xcodeproj/project.pbxproj:\n* Source/WebCore/inspector/FrameInspectorController.cpp:\n(WebCore::FrameInspectorController::createLazyAgents):\n* Source/WebCore/inspector/InstrumentingAgents.h:\n* Source/WebCore/inspector/agents/frame/FrameDOMStorageAgent.cpp: Added.\n(WebCore::FrameDOMStorageAgent::FrameDOMStorageAgent):\n(WebCore::m_inspectedFrame):\n(WebCore::FrameDOMStorageAgent::didCreateFrontendAndBackend):\n(WebCore::FrameDOMStorageAgent::willDestroyFrontendAndBackend):\n(WebCore::FrameDOMStorageAgent::enable):\n(WebCore::FrameDOMStorageAgent::disable):\n(WebCore::FrameDOMStorageAgent::getDOMStorageItems):\n(WebCore::FrameDOMStorageAgent::setDOMStorageItem):\n(WebCore::FrameDOMStorageAgent::removeDOMStorageItem):\n(WebCore::FrameDOMStorageAgent::clearDOMStorageItems):\n* Source/WebCore/inspector/agents/frame/FrameDOMStorageAgent.h: Added.\n\nCanonical link: https://commits.webkit.org/316491@main","order":0,"repository_id":"webkit","timestamp":1783102827},{"author":{"emails":["lmoura@igalia.com","lauro.neto@openbossa.org"],"name":"Lauro Moura"},"branch":"main","hash":"86ec57b01ddf525c5efdaf84479a6df1af9f258a","identifier":"316492@main","message":"[Soup] Null deref in NetworkStorageSession::stopListeningForCookieChangeNotifications when a host is absent from m_cookieChangeObservers\nhttps://bugs.webkit.org/show_bug.cgi?id=318463\n\nReviewed by Patrick Griffis.\n\nSafely ignore a given host if it's not found in m_cookieChangeObservers,\navoiding a potential null deref. This mirrors the Cocoa port's release\nbehavior. For debug builds, as the ASSERT_UNUSED(removed, removed) in\nNetworkConnectionToWebProcess::unsubscribeFromCookieChangeNotifications\nwould have triggered earlier, we're also removing the redundant ASSERT.\n\nThis scenario can happen after a previous NetworkProcess with cookie\nlisteners crashes. As currently the WebCookieJar is not notified of such\ncrashes, it does not tell the replacement process's NetworkStorageSession\nabout the existing listeners. Then, when the WebCookieJar sends an\nunsubscribe request, we hit the assertion or trigger the null deref on\nthe empty map on the storage session.\n\n* Source/WebCore/platform/network/soup/NetworkStorageSessionSoup.cpp:\n(WebCore::NetworkStorageSession::stopListeningForCookieChangeNotifications):\n\nCanonical link: https://commits.webkit.org/316492@main","order":0,"repository_id":"webkit","timestamp":1783103412},{"author":{"emails":["emw@apple.com"],"name":"Elliott Williams"},"branch":"main","hash":"7768ef95fbb7da97cc764fa81978681994ce8c74","identifier":"316493@main","message":"[Build] Reenable JSC and WebCore module verifier on public SDK builds\nhttps://bugs.webkit.org/show_bug.cgi?id=317876\nrdar://177493372\n\nReviewed by Richard Robinson.\n\nReland of 316413@main with a fix for the SaferCPP EWS build, which still\nuses Xcode 26.2.\n\nOur `AvailabilityProhibitedInternal.h` injected header does not work\nwhen building with modules. Modules are by design self-contained, and\nthe `os_availability` modulemap in the SDK compiles without finding and\nincluding our injected header.\n\nWe need to silence availability errors in the public build in order to\nbind to SPI on the platform that is otherwise marked API_UNAVAILABLE.\n\nInstead, replace the technique with a new approach based on stubbing out\nthe entire Availability library, replacing <Availability.h> and\n<os/availability.h> with our own versions of the headers.\n\nThe OS modulemap containing the availability project has other headers\nin it too, so we can't just ship our own modulemap referencing the\nstubs. Instead, generate a VFS overlay which maps our headers onto the\ncorrect SDK paths.\n\n* Configurations/CommonBase.xcconfig:\n* Configurations/SDKAdditions.xcconfig:\n* Source/JavaScriptCore/Configurations/JavaScriptCore.xcconfig:\n\nIn third-party code, add \"Setup\" targets to Xcode projects which depend\non the overlay YAML bring produced. These gate compilation of any of the\nthird-party libraries until bmalloc has run and WTF has staged public\nSDK headers.\n\n(In CMake, we're able to generate the overlay at configure time without\ndisturbing the dependency graph, so this issue does not exist.)\n\n* Source/ThirdParty/ANGLE/ANGLE.xcodeproj/project.pbxproj:\n* Source/ThirdParty/gmock/gmock.xcodeproj/project.pbxproj:\n* Source/ThirdParty/gtest/xcode/gtest.xcodeproj/project.pbxproj:\n* Source/ThirdParty/libwebrtc/libwebrtc.xcodeproj/project.pbxproj:\n* Source/WTF/Configurations/WTF.xcconfig:\n* Source/WebCore/Configurations/WebCore.xcconfig:\n* Source/WebCore/PAL/Configurations/PAL.xcconfig:\n* Source/WebCore/inspector/agents/frame/FrameCSSAgent.cpp:\n(WebCore::FrameCSSAgent::detectOrigin):\n* Source/WebGPU/Configurations/WebGPU.xcconfig:\n* Source/WebKit/Configurations/WebKit.xcconfig:\n* Source/bmalloc/Configurations/bmalloc.xcconfig:\n* Source/bmalloc/bmalloc.xcodeproj/project.pbxproj: Call\n  generate-overlay before bmalloc builds. It needs to happen very early\n  in the build, before any target that includes CommonBase.xcconfig\n  starts compiling.\n* Source/cmake/OptionsCocoa.cmake:\n* WebKitLibraries/AvailabilityOverlay/generate-overlay.py: Added.\n* WebKitLibraries/AvailabilityOverlay/usr/include/Availability.h: Added.\n* WebKitLibraries/AvailabilityOverlay/usr/include/os/availability.h: Added.\n\nDelete all the old AvailabilityProhibitedInternal.h headers:\n\n* WebKitLibraries/SDKs/appletvos18.0-additions.sdk/usr/local/include/AvailabilityProhibitedInternal.h: Removed.\n* WebKitLibraries/SDKs/appletvos26.0-additions.sdk/usr/local/include/AvailabilityProhibitedInternal.h: Removed.\n* WebKitLibraries/SDKs/appletvsimulator18.0-additions.sdk/usr/local/include/AvailabilityProhibitedInternal.h: Removed.\n* WebKitLibraries/SDKs/appletvsimulator26.0-additions.sdk/usr/local/include/AvailabilityProhibitedInternal.h: Removed.\n* WebKitLibraries/SDKs/iphoneos18.0-additions.sdk/usr/local/include/AvailabilityProhibitedInternal.h: Removed.\n* WebKitLibraries/SDKs/iphoneos26.0-additions.sdk/usr/local/include/AvailabilityProhibitedInternal.h: Removed.\n* WebKitLibraries/SDKs/iphonesimulator18.0-additions.sdk/usr/local/include/AvailabilityProhibitedInternal.h: Removed.\n* WebKitLibraries/SDKs/iphonesimulator26.0-additions.sdk/usr/local/include/AvailabilityProhibitedInternal.h: Removed.\n* WebKitLibraries/SDKs/macosx14.0-additions.sdk/usr/local/include/AvailabilityProhibitedInternal.h: Removed.\n* WebKitLibraries/SDKs/macosx15.0-additions.sdk/usr/local/include/AvailabilityProhibitedInternal.h: Removed.\n* WebKitLibraries/SDKs/macosx26.0-additions.sdk/usr/local/include/AvailabilityProhibitedInternal.h: Removed.\n* WebKitLibraries/SDKs/watchos11.0-additions.sdk/usr/local/include/AvailabilityProhibitedInternal.h: Removed.\n* WebKitLibraries/SDKs/watchos26.0-additions.sdk/usr/local/include/AvailabilityProhibitedInternal.h: Removed.\n* WebKitLibraries/SDKs/watchsimulator11.0-additions.sdk/usr/local/include/AvailabilityProhibitedInternal.h: Removed.\n* WebKitLibraries/SDKs/watchsimulator26.0-additions.sdk/usr/local/include/AvailabilityProhibitedInternal.h: Removed.\n* WebKitLibraries/SDKs/xros2.0-additions.sdk/usr/local/include/AvailabilityProhibitedInternal.h: Removed.\n* WebKitLibraries/SDKs/xros26.0-additions.sdk/usr/local/include/AvailabilityProhibitedInternal.h: Removed.\n* WebKitLibraries/SDKs/xrsimulator2.0-additions.sdk/usr/local/include/AvailabilityProhibitedInternal.h: Removed.\n* WebKitLibraries/SDKs/xrsimulator26.0-additions.sdk/usr/local/include/AvailabilityProhibitedInternal.h: Removed.\n\nCanonical link: https://commits.webkit.org/316493@main","order":0,"repository_id":"webkit","timestamp":1783106729},{"author":{"emails":["marcosc@apple.com","marcos@marcosc.com"],"name":"Marcos Caceres"},"branch":"main","hash":"bab1bc1f7610146c5ae0ad963cbcd3b743ab0a11","identifier":"316494@main","message":"Digital Credentials: aborting navigator.credentials.get() can leave the document picker stuck on screen\n\nrdar://180812397\nhttps://bugs.webkit.org/show_bug.cgi?id=318013\n\nReviewed by Abrar Rahman Protyasha.\n\nWKIdentityDocumentPresentmentController.cancelRequest() only cancelled\nperformRequestTask. When the abort arrived before the asynchronous\nperform(request:) had assigned performRequestTask, the optional-chained\ncancel was a no-op, so Identity Document Services was never told to dismiss\nand the picker stayed on screen.\n\nTrack cancellation in an isCancelled flag set by cancelRequest().\nperform(request:) throws without presenting when cancellation was already\nrequested; a cancel that arrives once the request is in flight is delivered\nthrough performRequestTask as before. Map a CancellationError to .cancelled\nso the request rejects with AbortError rather than UnknownError.\n\nThe controller is single-use: the picker creates a fresh instance per\nrequest and discards it on dismiss, so isCancelled is terminal and never\nreset. A hasStartedRequest guard makes that contract explicit, rejecting\nreuse with requestInProgress rather than a stale cancelled state.\n\nThe repeated get()/abort path is exercised by the \"Aborted Digital\nCredentials get() requests do not leave a subsequent request stuck in an\ninvalid state\" subtest in get-non-fully-active.https.html; a hermetic\nregression test depends on the digital-credentials test automation in\nbug 306292.\n\n* Source/WebKit/WebKitSwift/IdentityDocumentServices/WKIdentityDocumentPresentmentController.swift:\n(Base.perform(_:)): Throw before presenting if cancellation was already\nrequested, reject reuse of a single-use controller, and map a\nCancellationError to a cancelled error.\n(Base.cancelRequest): Record that cancellation was requested.\n\nCanonical link: https://commits.webkit.org/316494@main","order":0,"repository_id":"webkit","timestamp":1783108124},{"author":{"emails":["annevk@annevk.nl","annevk@apple.com"],"name":"Anne van Kesteren"},"branch":"main","hash":"748f060a3b77ae67930d9c71ff5c3f159ab51c9a","identifier":"316495@main","message":":last-child and friends should not gate on parser state outside style resolution\nhttps://bugs.webkit.org/show_bug.cgi?id=315904\n\nReviewed by Antti Koivisto.\n\nSelectorChecker and the selector JIT forced :last-child, :last-of-type,\n:only-child, :only-of-type, :nth-last-child, and :nth-last-of-type to\nreturn false whenever the candidate's parent had not yet finished\nparsing children. While matching Chromium as an optimization for\nstyle-resolution, it does not for querySelector().\n\nThis is the real reason a subtest in\nimported/w3c/web-platform-tests/shadow-dom/untriaged/shadow-trees/upper-boundary-encapsulation/test-009.html\nfails. Bug 315847 also addresses it by fixing a different bug, but does\nnot fix the root cause.\n\nTest: imported/w3c/web-platform-tests/css/selectors/child-indexed-during-parse.html\n\nUpstream: https://github.com/web-platform-tests/wpt/pull/60294\nCanonical link: https://commits.webkit.org/316495@main","order":0,"repository_id":"webkit","timestamp":1783110723},{"author":{"emails":["ysuzuki@apple.com","yusukesuzuki@slowstart.org","utatane.tea@gmail.com"],"name":"Yusuke Suzuki"},"branch":"main","hash":"ba9b3ab164f77b23b1dbfa862f7b498b2b3f4a0f","identifier":"316496@main","message":"[JSC] IntlLegacyConstructedSymbol should be per-realm\nhttps://bugs.webkit.org/show_bug.cgi?id=318421\nrdar://181203630\n\nReviewed by Yijia Huang.\n\nIntlLegacyConstructedSymbol symbol should be per-realm[1].\n\n> The Intl object has an internal slot, [[FallbackSymbol]],\n> which is a new %Symbol% in the current realm with the\n> [[Description]] \"IntlLegacyConstructedSymbol\".\n\n[1]: https://tc39.es/proposal-intl-enumeration/#intl-object\n\n* JSTests/test262/expectations.yaml:\n* Source/JavaScriptCore/builtins/BuiltinNames.cpp:\n(JSC::BuiltinNames::BuiltinNames):\n* Source/JavaScriptCore/builtins/BuiltinNames.h:\n(JSC::BuiltinNames::polyProtoName const):\n(JSC::BuiltinNames::intlLegacyConstructedSymbol const): Deleted.\n* Source/JavaScriptCore/runtime/CommonIdentifiers.h:\n* Source/JavaScriptCore/runtime/IntlObjectInlines.h:\n(JSC::constructIntlInstanceWithWorkaroundForLegacyIntlConstructor):\n(JSC::unwrapForLegacyIntlConstructor):\n* Source/JavaScriptCore/runtime/JSGlobalObject.cpp:\n(JSC::JSGlobalObject::JSGlobalObject):\n* Source/JavaScriptCore/runtime/JSGlobalObject.h:\n(JSC::JSGlobalObject::intlLegacyConstructedSymbol const):\n\nCanonical link: https://commits.webkit.org/316496@main","order":0,"repository_id":"webkit","timestamp":1783111098},{"author":{"emails":["ysuzuki@apple.com","yusukesuzuki@slowstart.org","utatane.tea@gmail.com"],"name":"Yusuke Suzuki"},"branch":"main","hash":"b9008f390e5fac6686348939a08b8d265f265fce","identifier":"316497@main","message":"[JSC] Make CodeBlock::updateAllNonLazyValueProfilePredictionsAndCountLiveness tight\nhttps://bugs.webkit.org/show_bug.cgi?id=314984\nrdar://177291111\n\nReviewed by Yijia Huang and Dan Hecht.\n\nThis code is extremely hot when we have large function (e.g. Air).\nThis patch avoids three independent profile.numberOfSamples(),\nprofile.isSampledBefore(), profile.computeUpdatedPrediction() calls\nand combine them into one computeUpdatedPrediction.\n\n* Source/JavaScriptCore/bytecode/CodeBlock.cpp:\n(JSC::CodeBlock::updateAllNonLazyValueProfilePredictionsAndCountLiveness):\n\nCanonical link: https://commits.webkit.org/316497@main","order":0,"repository_id":"webkit","timestamp":1783111233},{"author":{"emails":["yijia_huang@apple.com","hyjorc1@gmail.com"],"name":"Yijia Huang"},"branch":"main","hash":"a0433cfeb9ab17a6b63150f4eec507b660541b7b","identifier":"316498@main","message":"[JSC][Temporal] Polish Temporal.PlainDateTime: spec alignment, constructor and round() fixes\nhttps://bugs.webkit.org/show_bug.cgi?id=318454\nrdar://181253131\n\nReviewed by Yusuke Suzuki.\n\nFix two spec-conformance bugs, remove dead code, and align spec-step\ncomments across Temporal.PlainDateTime.\n\nThe constructor previously accepted NaN on time args (silently coercing\nto 0) and skipped trailing arguments; ToIntegerWithTruncation now\nthrows RangeError on any non-finite value per spec.\n\nTemporal.PlainDateTime.prototype.round dropped a non-ISO calendar\nbecause tryCreateIfValid couldn't carry one. create() and\ntryCreateIfValid() now take an optional CalendarID and every\n\"tryCreateIfValid + setCalendarID\" callsite is collapsed accordingly.\n\nDead code removed: the never-called TemporalPlainDateTime::with()\nimpl, unreachable inherits<TPDT/PD/ZDT> branches inside fromImpl, the\nundefined String&& constructor, the setCalendarID/setCalendarId\naccessors, and the duplicated inherits<TPDT> fast-path in\ntemporalPlainDateTimeConstructorFuncFrom.\n\nTests:\nJSTests/stress/temporal-plain-datetime-ctor-nan-infinity.js\nJSTests/stress/temporal-plain-datetime-round.js\n\nCanonical link: https://commits.webkit.org/316498@main","order":0,"repository_id":"webkit","timestamp":1783115007},{"author":{"emails":["com.webkit.iidmsa@gmail.com","com.idmsa@gmail.com"],"name":"Fady Farag"},"branch":"main","hash":"efbd319f18f43ed9525759ed8a6d4c294281f538","identifier":"316499@main","message":"Move Forwarding Reference in `IPC/Connection.h`\nhttps://bugs.webkit.org/show_bug.cgi?id=318393\nrdar://181179683\n\nReviewed by Darin Adler and Chris Dumez.\n\nForwarding references should be passed to std::forward() not WTF::move().\n\n* Source/WebKit/Platform/IPC/Connection.h:\n(IPC::CompletionHandler<void):\n* Source/WebKit/UIProcess/Media/RemoteMediaSessionCoordinatorProxy.cpp:\n(WebKit::RemoteMediaSessionCoordinatorProxy::seekSessionToTime):\n(WebKit::RemoteMediaSessionCoordinatorProxy::playSession):\n(WebKit::RemoteMediaSessionCoordinatorProxy::pauseSession):\n(WebKit::RemoteMediaSessionCoordinatorProxy::setSessionTrack):\n* Source/WebKit/UIProcess/WebPageProxy.cpp:\n(WebKit::WebPageProxy::getSelectionOrContentsAsString):\n* Source/WebKit/WebProcess/GPU/graphics/WebGPU/RemoteBufferProxy.h:\n* Source/WebKit/WebProcess/GPU/graphics/WebGPU/RemoteDeviceProxy.h:\n* Source/WebKit/WebProcess/GPU/graphics/WebGPU/RemoteGPUProxy.h:\n* Source/WebKit/WebProcess/GPU/graphics/WebGPU/RemoteQueueProxy.h:\n* Source/WebKit/WebProcess/GPU/graphics/WebGPU/RemoteShaderModuleProxy.h:\n* Source/WebKit/WebProcess/WebPage/WebPage.cpp:\n(WebKit::WebPage::showMediaControlsContextMenu):\n\nCanonical link: https://commits.webkit.org/316499@main","order":0,"repository_id":"webkit","timestamp":1783118861},{"author":{"emails":["rniwa@webkit.org","rniwa@apple.com"],"name":"Ryosuke Niwa"},"branch":"main","hash":"7b7429195b075c5c4332d5a436cf605516912c23","identifier":"316500@main","message":"Use-after-free in LocalFrameView::scrollToAnchorFragment via NavigateEvent:finish\nhttps://bugs.webkit.org/show_bug.cgi?id=313606\n\nReviewed by Anne van Kesteren and Rupin Mittal.\n\nDeployed more smart pointers to fix the bug.\n\nTest: navigation-api/navigation-api-fragment-intercept-crash.html\n\n* LayoutTests/navigation-api/navigation-api-fragment-intercept-crash-expected.txt: Added.\n* LayoutTests/navigation-api/navigation-api-fragment-intercept-crash.html: Added.\n* LayoutTests/navigation-api/resources/navigation-api-fragment-intercept-crash-inner.html: Added.\n\nOriginally-landed-as: 305413.777@safari-7624-branch (0e113df3124c). rdar://180428609\nCanonical link: https://commits.webkit.org/316500@main","order":0,"repository_id":"webkit","timestamp":1783122190},{"author":{"emails":["a_panta@apple.com"],"name":"Anuj Panta"},"branch":"main","hash":"766b2065d561c89048a43428f23826a0463bd75c","identifier":"316501@main","message":"Web Inspector: [SI] implement DOMStorage storage commands on FrameDOMStorageAgent\nhttps://bugs.webkit.org/show_bug.cgi?id=316800\nrdar://179249711\n\nReviewed by BJ Burg.\n\nImplement getDOMStorageItems, setDOMStorageItem, removeDOMStorageItem,\nand clearDOMStorageItems on FrameDOMStorageAgent, replacing the stubs.\n\nUnlike the page-level InspectorDOMStorageAgent, which searches the frame\ntree by security origin (and so cannot reach cross-origin out-of-process\nframes), the frame agent resolves its storage area directly from its own\nm_inspectedFrame's document via the page's StorageNamespaceProvider.\nsecurityOrigin is therefore not needed to locate the area; a mismatch\nagainst the frame's own origin is asserted (debug only) but the command\nstill proceeds on this frame's storage.\n\n* Source/WebCore/inspector/agents/frame/FrameDOMStorageAgent.cpp:\n(WebCore::FrameDOMStorageAgent::getDOMStorageItems):\n(WebCore::FrameDOMStorageAgent::setDOMStorageItem):\n(WebCore::FrameDOMStorageAgent::removeDOMStorageItem):\n(WebCore::FrameDOMStorageAgent::clearDOMStorageItems):\n(WebCore::FrameDOMStorageAgent::findStorageArea): Resolve the StorageArea\nfrom the inspected frame's document, no origin-based frame-tree lookup.\n* Source/WebCore/inspector/agents/frame/FrameDOMStorageAgent.h:\n\nCanonical link: https://commits.webkit.org/316501@main","order":0,"repository_id":"webkit","timestamp":1783134918},{"author":{"emails":["ysuzuki@apple.com","yusukesuzuki@slowstart.org","utatane.tea@gmail.com"],"name":"Yusuke Suzuki"},"branch":"main","hash":"f0df03efe38c9dacfdb67ec002251ee110d7939f","identifier":"316502@main","message":"[JSC] Tweak number of GC threads for Apple platforms\nhttps://bugs.webkit.org/show_bug.cgi?id=318534\nrdar://181304464\n\nReviewed by Tadeu Zagallo.\n\nWith our recent GC throughput optimizations etc.[1], GC scalability gets\nimproved and now we are seeing the best GC thread numbers are changed\nfrom the previous static number \"4\" on Apple platforms. This patch\ntweaks the heuristics based on P0 core and P1 core counts. The best\nnumbers are selected with A/B testing with various benchmarks on various\ndevices, and summarizing the characteristics and selecting the # of\nthreads based on that with the current JSC implementation. It is\npossible that the number may be changed with the future JSC\ndevelopment, so the formula and numbers are current snapshot.\n\n[1]: https://commits.webkit.org/316327@main\n\n* Source/JavaScriptCore/assembler/CPU.cpp:\n(JSC::hwPerfLevelPhysicalCPUMax):\n(JSC::hwNumberOfP0Cores):\n(JSC::hwNumberOfP1Cores):\n(JSC::hwNumberOfP2Cores):\n* Source/JavaScriptCore/assembler/CPU.h:\n* Source/JavaScriptCore/runtime/Options.cpp:\n(JSC::overrideDefaults):\n\nCanonical link: https://commits.webkit.org/316502@main","order":0,"repository_id":"webkit","timestamp":1783135753},{"author":{"emails":["wenson_hsieh@apple.com","whsieh@berkeley.edu"],"name":"Wenson Hsieh"},"branch":"main","hash":"732ab0a8407576cbca271ee19d278a6088ace703","identifier":"316503@main","message":"[Text Extraction] Include human-readable query parameters and fragments for links that navigate within the same page\nhttps://bugs.webkit.org/show_bug.cgi?id=318582\nrdar://181349810\n\nReviewed by Abrar Rahman Protyasha.\n\nAdjust the URL shortening heuristic: for links that navigate to the same URL as the current page\n(ignoring query and fragment), we currently omit the URL from the text extraction entirely. Instead,\nadd the query only if there's only one human-readable (`isProbablyHumanReadable`) key/value pair,\nand fall back to the fragment only if it's human-readable.\n\nThis prevents us from losing information about links in some cases, where the rendered text alone\ndoesn't provide enough context.\n\n* LayoutTests/fast/text-extraction/debug-text-extraction-shorten-urls-expected.txt:\n* LayoutTests/fast/text-extraction/debug-text-extraction-shorten-urls.html:\n* Source/WebCore/page/text-extraction/TextExtraction.cpp:\n(WebCore::TextExtraction::extractItemData):\n* Source/WebCore/page/text-extraction/TextExtractionTypes.h:\n* Source/WebKit/Shared/TextExtractionToStringConversion.cpp:\n(WebKit::TextExtractionAggregator::shortenedURLStringForLink):\n(WebKit::addPartsForItem):\n(WebKit::addTextRepresentationRecursive):\n* Source/WebKit/Shared/WebCoreArgumentCoders.serialization.in:\n\nCanonical link: https://commits.webkit.org/316503@main","order":0,"repository_id":"webkit","timestamp":1783140537},{"author":{"emails":["richard_robinson2@apple.com"],"name":"Richard Robinson"},"branch":"main","hash":"dd186f5a3502de386ee96ceba7dfd3202d5c3466","identifier":"316504@main","message":"[CMake] Fix the CMake build after 316448@main\nhttps://bugs.webkit.org/show_bug.cgi?id=318590\nrdar://181368662\n\nReviewed by Pascoe.\n\n316448@main moved DeferredWorkTimer::create() into an inline definition in\nthe class body of DeferredWorkTimer.h (the JSC-internal DeferredWorkTimerInlines.h\nwas deleted). create() calls the out-of-line, non-exported private constructor\nDeferredWorkTimer(VM&).\n\nBecause create() is now inline in a header included across the JSC/WebKit dylib\nboundary, the CMake build emits a definition of create() into the shared\nprecompiled-header object (WebKitUIProcess_pch_obj.cpp.o, produced via clang's\n-building-pch-with-obj codegen mode). That definition references the constructor,\nwhich is hidden (local) in the JavaScriptCore dylib, so linking WebKitUIProcess\nfails with:\n\nUndefined symbols for architecture arm64:\n    \"JSC::DeferredWorkTimer::DeferredWorkTimer(JSC::VM&)\", referenced from:\n        JSC::DeferredWorkTimer::create(JSC::VM&) in WebKitUIProcess_pch_obj.cpp.o\n\nThe Xcode build is unaffected because it does not use the shared PCH-object\ncodegen mode, so create() is only emitted where it is actually used (VM.cpp,\ninside JSC).\n\nMark the constructor JS_EXPORT_PRIVATE so the exported symbol is available to\nthe header-inlined create() outside the JavaScriptCore dylib.\n\n* Source/JavaScriptCore/runtime/DeferredWorkTimer.h:\n\nCanonical link: https://commits.webkit.org/316504@main","order":0,"repository_id":"webkit","timestamp":1783150568},{"author":{"emails":["ahmad.saleem792@gmail.com","ahmad.saleem792+github@gmail.com","ahmad_saleem@apple.com"],"name":"Ahmad Saleem"},"branch":"main","hash":"c9187f7abc1eadd352b2107727aa043ea4134b7e","identifier":"316505@main","message":"[Web Inspector] selectorsForCSSStyleRule computes the split-rule list twice\nhttps://bugs.webkit.org/show_bug.cgi?id=318541\nrdar://181312162\n\nReviewed by Devin Rousso.\n\nInspectorStyleSheet::selectorsForCSSStyleRule() called\ncssStyleRulesSplitFromSameRule() into a local `rules` vector that was\nnever read, then called it a second time in the range-for header,\nrecomputing the identical result. Each call runs ensureFlatRules() plus\na find() and two scans over m_flatRules, so the split was done twice for\nno benefit. The loop variable also shadowed the `rule` parameter.\n\nCall cssStyleRulesSplitFromSameRule() once directly in the range-for\nheader so its result is bound to the loop rather than kept alive for the\nwhole function,. No change in behavior.\n\n* Source/WebCore/inspector/InspectorStyleSheet.cpp:\n(WebCore::InspectorStyleSheet::selectorsForCSSStyleRule):\n\nCanonical link: https://commits.webkit.org/316505@main","order":0,"repository_id":"webkit","timestamp":1783156242},{"author":{"emails":["ahmad.saleem792@gmail.com","ahmad.saleem792+github@gmail.com","ahmad_saleem@apple.com"],"name":"Ahmad Saleem"},"branch":"main","hash":"44975cdcef67f525328f49e337221201f6c3148b","identifier":"316506@main","message":"PlatformKeyboardEvent::syntheticEventFromText fails to synthesize \"{\" due to trailing space in lookup table key\nhttps://bugs.webkit.org/show_bug.cgi?id=318573\nrdar://181341300\n\nReviewed by Abrar Rahman Protyasha and Wenson Hsieh.\n\nThe \"{\" entry in nonAlphaNumericKeys() was keyed under \"{ \" (trailing\nspace) in both the map key and the text field, unlike every neighboring\npunctuation entry. As a result, a \"{\" lookup missed the table, fell\nthrough the alphanumeric branches, and returned nullopt, so the key\ncould never be synthesized (this is the only client of the table, used\nby the TextExtraction key-press interaction).\n\nDrop the stray space so the key and inserted text are both \"{\".\n\nTest: Tools/TestWebKitAPI/Tests/WebKit/WKWebView/TextExtractionTests.mm\n\n* Source/WebCore/platform/PlatformKeyboardEvent.cpp:\n(WebCore::nonAlphaNumericKeys):\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/TextExtractionTests.mm:\n(TestWebKitAPI::(TextExtractionTests, KeyPressInsertsCharactersInOrder)):\n(TestWebKitAPI::(TextExtractionTests, KeyPressInsertsBracketCharacters)):\n\nCanonical link: https://commits.webkit.org/316506@main","order":0,"repository_id":"webkit","timestamp":1783157691},{"author":{"emails":["ahmad.saleem792@gmail.com","ahmad.saleem792+github@gmail.com","ahmad_saleem@apple.com"],"name":"Ahmad Saleem"},"branch":"main","hash":"b13f9879ad3ca87db952d919932d0f31e52b38ea","identifier":"316507@main","message":"NullMedia.buffered/played/seekable throw ReferenceError due to unqualified EmptyRanges reference\nhttps://bugs.webkit.org/show_bug.cgi?id=318284\nrdar://problem/181072571\n\nReviewed by Jean-Yves Avenard.\n\nThe buffered, played, and seekable getters of MediaController.NullMedia\nreturn a bare `EmptyRanges`, which is not in scope inside the object literal\n-- the field is the static MediaController.EmptyRanges -- so accessing them\nthrows \"ReferenceError: Can't find variable: EmptyRanges\". Latent because\nNullMedia is only returned once the media weak reference is collected.\n\n* Source/WebCore/Modules/modern-media-controls/media/media-controller.js:\n(MediaController.NullMedia.prototype.get buffered):\n(MediaController.NullMedia.prototype.get played):\n(MediaController.NullMedia.prototype.get seekable):\n* LayoutTests/media/modern-media-controls/media-controller/media-controller-null-media-ranges-expected.txt: Added.\n* LayoutTests/media/modern-media-controls/media-controller/media-controller-null-media-ranges.html: Added.\n\nCanonical link: https://commits.webkit.org/316507@main","order":0,"repository_id":"webkit","timestamp":1783161709},{"author":{"emails":["achristensen@apple.com","achristensen@webkit.org","alex.christensen@flexsim.com"],"name":"Alex Christensen"},"branch":"main","hash":"2e5d042491f325b2df778dbba97c48d66bf2d395","identifier":"316509@main","message":"Upstream some internal PlatformHave macros\nhttps://bugs.webkit.org/show_bug.cgi?id=318479\nrdar://181271876\n\nReviewed by Richard Robinson.\n\n* Source/WTF/wtf/PlatformHave.h:\n\nCanonical link: https://commits.webkit.org/316509@main","order":0,"repository_id":"webkit","timestamp":1783164695},{"author":{"emails":["sosuke@bun.com","sosuke@bun.sh","aosukeke@gmail.com"],"name":"Sosuke Suzuki"},"branch":"main","hash":"95b9bdf57cef88c958a1182e8a6a687e7ae8ccfa","identifier":"316510@main","message":"[Wasm] Don't move a failed streaming Wasm plan back to Compiled\nhttps://bugs.webkit.org/show_bug.cgi?id=318411\n\nReviewed by Yusuke Suzuki.\n\nWhen a function body fails validation during streaming compilation,\nPlan::fail moves the plan to Completed on the worklist thread. The last\nStreamingPlan's completion callback then unconditionally moved the plan\nback to Compiled, breaking the monotonic state machine and hitting\n\"ASSERTION FAILED: state >= m_state\" on assertion-enabled builds. Guard\nthe transition with hasWork(), as the non-streaming path already does.\n\n* JSTests/wasm/stress/streaming-compile-invalid-function-body.js: Added.\n* Source/JavaScriptCore/wasm/WasmIPIntPlan.cpp:\n(JSC::Wasm::IPIntPlan::didCompileFunctionInStreaming):\n\nCanonical link: https://commits.webkit.org/316510@main","order":0,"repository_id":"webkit","timestamp":1783170075},{"author":{"emails":["sosuke@bun.com","sosuke@bun.sh","aosukeke@gmail.com"],"name":"Sosuke Suzuki"},"branch":"main","hash":"8e15aeeee3bc2d5257fec145a08f5532ae7447d7","identifier":"316511@main","message":"[JSC] Improve exception unwinding performance\nhttps://bugs.webkit.org/show_bug.cgi?id=318292\n\nReviewed by Yusuke Suzuki.\n\nI noticed that JSC is significantly slower than V8 at unwinding when an\nexception is thrown from a deep call stack. Profiling shows that most of\nthe time is spent in per-frame callee-save bookkeeping during\nInterpreter::unwind.\n\nThis patch applies three independent optimizations:\n\n1. Make StackVisitor::Frame::calleeSaveRegistersForUnwinding() return\n   const RegisterAtOffsetList* instead of std::optional<RegisterAtOffsetList>.\n   Every list it returns is a long-lived object, so there is no need to\n   heap-allocate and free a copy for every unwound frame.\n\n2. Add an m_vmEntryRecord field to UnwindFunctorBase, computed once in the\n   constructor, instead of calling vmEntryRecord() on every call to\n   copyCalleeSavesToEntryFrameCalleeSavesBuffer.\n\n3. Use a prebuilt table (RegisterSet::vmCalleeSaveBufferSlotsByRegIndex())\n   that maps Reg::index() to the register's slot in the entry frame\n   callee-save buffer, instead of doing a binary search per register.\n   This turns each lookup from O(log n) into O(1).\n\n                                                   Baseline                  Patched\n\nthrow-new-error-from-deep-frames              176.5424+-0.9251     ^    129.7769+-1.6492        ^ definitely 1.3604x faster\nthrow-preallocated-error-from-deep-frames\n                                              265.7363+-2.6056     ^    175.6531+-2.0253        ^ definitely 1.5128x faster\nthrow-sentinel-from-deep-frames               266.3385+-1.5604     ^    176.2640+-1.5277        ^ definitely 1.5110x faster\n\nTests: JSTests/microbenchmarks/throw-new-error-from-deep-frames.js\n       JSTests/microbenchmarks/throw-preallocated-error-from-deep-frames.js\n       JSTests/microbenchmarks/throw-sentinel-from-deep-frames.js\n\n* JSTests/microbenchmarks/throw-new-error-from-deep-frames.js: Added.\n(thrower):\n(i.catch):\n* JSTests/microbenchmarks/throw-preallocated-error-from-deep-frames.js: Added.\n(thrower):\n(i.catch):\n* JSTests/microbenchmarks/throw-sentinel-from-deep-frames.js: Added.\n(thrower):\n(i.catch):\n* Source/JavaScriptCore/interpreter/Interpreter.h:\n(JSC::UnwindFunctorBase::UnwindFunctorBase): Deleted.\n* Source/JavaScriptCore/interpreter/InterpreterInlines.h:\n(JSC::UnwindFunctorBase::UnwindFunctorBase):\n(JSC::UnwindFunctorBase::copyCalleeSavesToEntryFrameCalleeSavesBuffer const):\n* Source/JavaScriptCore/interpreter/StackVisitor.cpp:\n(JSC::StackVisitor::Frame::calleeSaveRegistersForUnwinding):\n* Source/JavaScriptCore/interpreter/StackVisitor.h:\n* Source/JavaScriptCore/jit/RegisterSet.cpp:\n(JSC::RegisterSet::vmCalleeSaveBufferSlotsByRegIndex):\n* Source/JavaScriptCore/jit/RegisterSet.h:\n\nCanonical link: https://commits.webkit.org/316511@main","order":0,"repository_id":"webkit","timestamp":1783173121},{"author":{"emails":["ahmad.saleem792@gmail.com","ahmad.saleem792+github@gmail.com","ahmad_saleem@apple.com"],"name":"Ahmad Saleem"},"branch":"main","hash":"f10517f502fc202bebdd637ceab9a3cf92315201","identifier":"316512@main","message":"Remove duplicate #include directives in Source/WebCore\nhttps://bugs.webkit.org/show_bug.cgi?id=318594\nrdar://181378579\n\nReviewed by Alan Baradlay.\n\nSeveral source files include the same header twice: once unconditionally\nand again inside a platform/feature #if block that is already covered by\nthe unconditional include. Remove the redundant copies, and drop the\nnow-empty #if/#endif guards where the duplicate was the only entry.\n\nNo change in behavior.\n\n* Source/WebCore/Modules/webaudio/AudioScheduledSourceNode.cpp:\n* Source/WebCore/dom/Document.cpp:\n* Source/WebCore/editing/InsertIntoTextNodeCommand.cpp:\n* Source/WebCore/html/HTMLCanvasElement.cpp:\n* Source/WebCore/html/HTMLMediaElement.cpp:\n* Source/WebCore/page/LocalFrameView.cpp:\n* Source/WebCore/page/Page.cpp:\n* Source/WebCore/platform/network/NetworkStorageSession.h:\n* Source/WebCore/rendering/RenderImage.cpp:\n\nCanonical link: https://commits.webkit.org/316512@main","order":0,"repository_id":"webkit","timestamp":1783175140},{"author":{"emails":["ddkilzer@webkit.org","ddkilzer@apple.com"],"name":"David Kilzer"},"branch":"main","hash":"a4734252959df8cd532e70b8f6afbe7009ab2035","identifier":"316514@main","message":"TestWebKitAPIBundle visionOS build intermittently fails to resolve _Testing_CoreTransferable cross-import overlay\n<https://bugs.webkit.org/show_bug.cgi?id=318544>\n<rdar://181316388>\n\nUnreviewed build fix.\n\nFollow-on to 315261@main, which fixed this failure for the\n`TestWebKitAPI` target by adding the \"Embed Testing.framework\" phase.\n\n`TestWebKitAPIBundle` fails intermittently in the same way, so it\nneeds to depend on the same workaround:\n\nerror: Unable to resolve module dependency: '_Testing_CoreTransferable' (in target 'TestWebKitAPIBundle' from project 'TestWebKitAPI')\n  note: A dependency of main module '_TestWebKitAPIBundle-CrossImportOverlays'\n\nMove the phase to a new \"Testing.framework Overlays\" aggregate target\nthat both `TestWebKitAPI` and `TestWebKitAPIBundle` depend on, so the\noverlays are always dittoed before either target's Swift scan.\n\n* Tools/TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:\n\nCanonical link: https://commits.webkit.org/316514@main","order":0,"repository_id":"webkit","timestamp":1783182176},{"author":{"emails":["hi@devinrousso.com"],"name":"Devin Rousso"},"branch":"main","hash":"080d15ac450c9264e900ac141810ce8e71f39cca","identifier":"316515@main","message":"Web Inspector: 'arguments' should be accessible from the console\nhttps://bugs.webkit.org/show_bug.cgi?id=121208\n<rdar://problem/14972198>\n\nReviewed by Keith Miller.\n\n* Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp:\n(JSC::BytecodeGenerator::BytecodeGenerator):\nForce `arguments` to be created even if it's not used when the debugger is enabled.\n\n* LayoutTests/inspector/debugger/breakpoint-scope-expected.txt:\n* LayoutTests/inspector/debugger/paused-scopes-expected.txt:\n* LayoutTests/inspector/debugger/tail-deleted-frames/tail-deleted-frames-scopes-expected.txt:\n* LayoutTests/inspector/debugger/tail-deleted-frames/tail-deleted-frames-vm-entry-expected.txt:\n* LayoutTests/inspector/model/scope-chain-node-expected.txt:\n\nCanonical link: https://commits.webkit.org/316515@main","order":0,"repository_id":"webkit","timestamp":1783190163},{"author":{"emails":["richard_robinson2@apple.com"],"name":"Richard Robinson"},"branch":"main","hash":"26455eaa4d9bc90285fc2d78d95f45f65f78d8c2","identifier":"316516@main","message":"[CMake] Produce the Swift module and interface for WebKit.framework\nhttps://bugs.webkit.org/show_bug.cgi?id=318591\nrdar://181374997\n\nReviewed by Pascoe.\n\nThis allows Swift code to actually consume WebKit, for example:\n\n```\necho 'import WebKit' | xcrun swiftc -typecheck -target arm64-apple-macosx27.0 -F WebKitBuild/cmake-mac/Debug -\n```\n\nby actually producing the WebKit Swift module and its Swift interface and copying\nit to the right location, mirroring what Xcode does.\n\nThis also produces the WebKit's public and private Clang module, and its SwiftUI\ncross-import overlay file, like Xcode.\n\nAlso, add support for WebKit's custom Swift availability attributes.\n\nAll of this is a prerequisite for adding support for building `_WebKit_SwiftUI`\nand consequently TestWebKitAPI's Swift support, and SwiftBrowser.\n\nCurrently, most of WebKit's Swift files still aren't compiled. This won't be possible\nuntil the CMake build moves to having actual proper framework directories so that\nit's possible for Swift files to import WebKit's public and private clang modules.\n\n* Source/WebKit/PlatformCocoa.cmake:\n\n* Source/WebKit/PlatformMac.cmake:\n\n- Build WebKit's Swift with library evolution and emit module interfaces\n- Give the generated -define-availability flags to swiftc\n- Add the WebKit_StageModules target that reproduces Xcode's Modules/ layout after WebKit is linked\n- Creates the top-level WebKit.framework/Modules symlink.\n\n* Source/cmake/OptionsMac.cmake:\n\n- Add WEBKIT_SWIFT_MODULE_TRIPLE beside CMAKE_Swift_COMPILER_TARGET\n\nCanonical link: https://commits.webkit.org/316516@main","order":0,"repository_id":"webkit","timestamp":1783192132},{"author":{"emails":["richard_robinson2@apple.com"],"name":"Richard Robinson"},"branch":"main","hash":"c973837a1ce5afd395dda139c3c8e4fb5fcdca20","identifier":"316517@main","message":"[Swift Testing] Allow tests that require NSApplications to be run in automation\nhttps://bugs.webkit.org/show_bug.cgi?id=318585\nrdar://181352028\n\nReviewed by Abrar Rahman Protyasha.\n\nPreviously, such tests could only be ran manually since TestWebKitAPIBundle used a real\nNSApplication, but TestWebKitAPI didn't. Fix by imbuing the latter with an NSApplication\nand an AppKit event loop to allow these tests to run in EWS.\n\n* Tools/TestWebKitAPI/Helpers/cocoa/AppKit+Extras.swift:\n(NSApplication.waitForActivation):\n* Tools/TestWebKitAPI/Runner/TestWebKitAPI.swift:\n(TestWebKitAPI.run):\n(TestWebKitAPI.main):\n* Tools/TestWebKitAPI/Tests/WebKit/WebPage/AppKit Gesture Tests/BasicAppKitGesturesTests.swift:\n(AppKitGesturesTests.singleClickFiresPointerMouseAndClickEvents(_:)):\n(AppKitGesturesTests.updatingTextRangeSelectionByUserInteractionUpdatesEditorState(_:)):\n(AppKitGesturesTests.draggingSelectionToWindowEdgeAutoscrolls(_:)):\n(AppKitGesturesTests.holdingSelectionDragNearEdgeKeepsScrolling):\n(AppKitGesturesTests.holdingSelectionDragMidContentDoesNotAutoscroll):\n(AppKitGesturesTests.selectionAutoscrollStopsAfterGestureEnds):\n(AppKitGesturesTests.draggingSelectionToTopEdgeScrollsUp):\n(AppKitGesturesTests.selectionOriginatingNearEdgeWithShortDragDoesNotAutoscroll):\n(AppKitGesturesTests.selectionOriginatingNearEdgeAutoscrollsAfterDraggingPastThreshold):\n(AppKitGesturesTests.clickingOnSelectedWordOpensContextMenu(_:)):\n(AppKitGesturesTests.clickingAndHoldingOnEmptyContentOpensContextMenu(_:)):\n(AppKitGesturesTests.longPressOverTextSelectsWordAndDoesNotOpenContextMenu):\n(AppKitGesturesTests.scrollingDoesNotRemoveTextSelection):\n(AppKitGesturesTests.doubleClickingInWordSelectsWord(_:clickHandler:)):\n(AppKitGesturesTests.tripleClickingInPDFSelectsLine):\n(AppKitGesturesTests.clickingInWordChangesSelection(_:)):\n(AppKitGesturesTests.scrollingChangesScrollPosition(_:)):\n(AppKitGesturesTests.interruptingDeceleratingScrollDoesNotFollowLink):\n* Tools/TestWebKitAPI/Tests/WebKit/WebPage/AppKit Gesture Tests/EmbeddedAppKitGesturesTests.swift:\n(AppKitGesturesTests.scrollOverNonScrollableWebViewPropagatesToEnclosingScrollView):\n(AppKitGesturesTests.pressDragOverTextInWebViewInsideEnclosingScrollViewCreatesSelection):\n(AppKitGesturesTests.quickDragOverTextInWebViewInsideEnclosingScrollViewScrolls):\n(AppKitGesturesTests.doubleClickingSelectsWordWhenScrolledToTopWithObscuredContentInset):\n\nCanonical link: https://commits.webkit.org/316517@main","order":0,"repository_id":"webkit","timestamp":1783193152},{"author":{"emails":["ahmad.saleem792@gmail.com","ahmad.saleem792+github@gmail.com","ahmad_saleem@apple.com"],"name":"Ahmad Saleem"},"branch":"main","hash":"a4e6363db4707922c4b17923b65516c67abd123b","identifier":"316518@main","message":"Fix incorrect debug-output strings in RenderStyleConstants.cpp operator<< overloads\nhttps://bugs.webkit.org/show_bug.cgi?id=318608\nrdar://181402749\n\nReviewed by Abrar Rahman Protyasha.\n\nSeveral TextStream operator<< overloads emitted wrong strings due to\ncopy-paste errors, producing misleading logging output. These are debug-only\nstrings, so there is no behavior change.\n\n* Source/WebCore/rendering/style/RenderStyleConstants.cpp:\n(WebCore::operator<<):\n\nCanonical link: https://commits.webkit.org/316518@main","order":0,"repository_id":"webkit","timestamp":1783208138},{"author":{"emails":["hi@devinrousso.com"],"name":"Devin Rousso"},"branch":"main","hash":"3df7f122b6c75b2cc4f0e4dfb4022d2351d5bc8a","identifier":"316519@main","message":"Web Inspector: JavaScript breakpoint on a line with just a semicolon doesn't get triggered\nhttps://bugs.webkit.org/show_bug.cgi?id=272916\n<rdar://problem/126707973>\n\nReviewed by Keith Miller.\n\nDon't add a pause location for empty statements as there's nothing to execute.\n\n* Source/JavaScriptCore/parser/Parser.cpp:\n(JSC::Parser<LexerType>::parseStatement):\n\n* LayoutTests/inspector/debugger/breakpoint-empty-statement.html: Added.\n* LayoutTests/inspector/debugger/breakpoint-empty-statement-expected.txt: Added.\n* LayoutTests/inspector/debugger/resources/empty-statement.js: Added.\n\nCanonical link: https://commits.webkit.org/316519@main","order":0,"repository_id":"webkit","timestamp":1783210140},{"author":{"emails":["ahmad.saleem792@gmail.com","ahmad.saleem792+github@gmail.com","ahmad_saleem@apple.com"],"name":"Ahmad Saleem"},"branch":"main","hash":"2417e75e90ef6465ea092cae6095f5df58bd769e","identifier":"316520@main","message":"[Web Inspector] DataLoader constructor takes RefPtr<IDBKeyRange> by value instead of by rvalue-reference\nhttps://bugs.webkit.org/show_bug.cgi?id=318607\nrdar://181402256\n\nReviewed by Devin Rousso.\n\nDataLoader::create() takes its IDBKeyRange as an rvalue-reference and\nforwards it with WTF::move, and the sole call site passes an owned\ntemporary, but the private DataLoader constructor took the parameter by\nvalue. This forced a redundant move-construction of the parameter before\nit was moved into m_idbKeyRange. Take it by rvalue-reference for\nconsistency and to avoid the extra move.\n\n* Source/WebCore/inspector/agents/InspectorIndexedDBAgent.cpp:\n(WebCore::DataLoader::DataLoader):\n\nCanonical link: https://commits.webkit.org/316520@main","order":0,"repository_id":"webkit","timestamp":1783214998},{"author":{"emails":["ysuzuki@apple.com","yusukesuzuki@slowstart.org","utatane.tea@gmail.com"],"name":"Yusuke Suzuki"},"branch":"main","hash":"fd544a668a1b7f1b72dc9fe3b15a87693874687a","identifier":"316521@main","message":"[JSC] Propagate block's frequency in B3LowerMacros\nhttps://bugs.webkit.org/show_bug.cgi?id=314612\nrdar://176852750\n\nReviewed by Justin Michaud.\n\nPropagate block's frequency correctly to the newly created\nblocks in B3LowerMacros (and B3MathExtras's graph generation).\n\n* Source/JavaScriptCore/b3/B3LowerMacros.cpp:\n* Source/JavaScriptCore/b3/B3MathExtras.cpp:\n\nCanonical link: https://commits.webkit.org/316521@main","order":0,"repository_id":"webkit","timestamp":1783215825},{"author":{"emails":["richard_robinson2@apple.com"],"name":"Richard Robinson"},"branch":"main","hash":"fbd1ff7b1fa573f055c0d17af1133a7e8a30846d","identifier":"316522@main","message":"[CMake] clangd sometimes produces incorrect diagnostics for .mm, .m, and .h files\nhttps://bugs.webkit.org/show_bug.cgi?id=318615\nrdar://181408485\n\nReviewed by Pascoe.\n\nclangd was reporting some incorrect diagnostics like \"called object type 'const char[75]' is not\na function or function pointer\", \"expected ')'\".\n\nThe root cause is a force-include ordering bug. WebKitPrefix.h ends by \"poisoning\" new/delete so\nthat accidental new/delete usage without config.h is caught. config.h is what #undefs that.\nWebKitPrefix.h is force-included by the frontend (via -Xclang -include via the PCH prefix header),\nbut the clangd config force-included config.h at the driver level (--include=config.h). The driver\ninjects its includes before frontend includes, so config.h's #undefs ran before the poison macros\nwere even defined. Force-including config.h also marked it as already-seen, so the body's own\n\nFix by (a) removing \"--include=config.h\" from the .mm/.m customizations, since that was pointless\nanyways since those files already include it, and (b) for headers, inject the include via the\nfrontend instead of the driver to fix the ordering issue.\n\n* Tools/clangd/clangd-config.yaml.tpl:\n\nCanonical link: https://commits.webkit.org/316522@main","order":0,"repository_id":"webkit","timestamp":1783219304},{"author":{"emails":["hi@devinrousso.com"],"name":"Devin Rousso"},"branch":"main","hash":"7c9b3a28260f813e33d0a601c4d00a957347905e","identifier":"316523@main","message":"Web Inspector: Allow redefinition of let and const in REPL\nhttps://bugs.webkit.org/show_bug.cgi?id=285757\n<rdar://problem/143140659>\n\nReviewed by Keith Miller.\n\n* Source/JavaScriptCore/runtime/VM.h:\n(JSC::VM::setAllowRedeclaringSymbols): Added.\n(JSC::VM::allowRedeclaringSymbols const): Added.\n* Source/JavaScriptCore/runtime/ProgramExecutable.cpp:\n(JSC::ProgramExecutable::initializeGlobalProperties):\n* Source/JavaScriptCore/inspector/JSInjectedScriptHost.cpp:\n(Inspector::JSInjectedScriptHost::evaluateWithScopeExtension):\n\n* Source/JavaScriptCore/jsc.cpp:\n(runInteractive):\nDrive-by: also add this for `jsc`.\n\n* LayoutTests/inspector/runtime/evaluate-CommandLineAPI.html:\n* LayoutTests/inspector/runtime/evaluate-CommandLineAPI-expected.txt:\n* LayoutTests/inspector/runtime/repl-redeclaration.html: Added.\n* LayoutTests/inspector/runtime/repl-redeclaration-expected.txt: Added.\n\nCanonical link: https://commits.webkit.org/316523@main","order":0,"repository_id":"webkit","timestamp":1783226145},{"author":{"emails":["saku@email.sakupi01.com"],"name":"sakupi01"},"branch":"main","hash":"7f655a4e9f5df4f6278acbe61596f8e641b06d83","identifier":"316524@main","message":"Extend CSS::CustomIdent to support an unresolved ident() function alternative\nhttps://bugs.webkit.org/show_bug.cgi?id=284895\n\nReviewed by Tim Nguyen.\n\nChange CSS::CustomIdent's representation from a plain AtomString to\nVariant<AtomString, IdentFunction>, where IdentFunction models\n<ident()> = ident( <ident-arg>+ ), <ident-arg> = <string> | <integer> | <ident>\n(https://drafts.csswg.org/css-values-5/#ident). Arguments are stored\nunmerged so that the specified value serializes back in function form,\nas required by WPT. Resolution happens in ToStyle<CSS::CustomIdent>,\nwhich evaluates <integer> arguments (including math functions) with\nBuilderState context and concatenates the argument codepoints.\n\nRemove CustomIdent::tryResolved(), as no call site needs eager\nresolution. The @counter-style/@view-transition descriptor converters\nuse only the plain identifier alternative, since ident() is invalid in\ndescriptors per the CSSWG resolution \"ident() is only valid within an\nelement context\" (https://github.com/w3c/csswg-drafts/issues/12219); a\nFIXME in consumeUnresolvedCustomIdent() records the parser-side\nrejection needed once ident() parsing lands.\nShorthandSerializer::valueIDIncludingCustomIdent() likewise checks only\nthe plain identifier alternative, because the animation-name\ndisambiguation is about lexical ambiguity of the serialized text, which\nthe ident() function form can never cause. The deprecated CSSOM string\naccessors return the plain identifier, falling back to the\nfunction-form serialization.\n\nNo behavior change: nothing constructs the new alternative yet. All\ncode that read CustomIdent's string directly was updated to handle the\nunresolved alternative explicitly.\nAlso add a CSSCustomIdentValue case to\nCSSValue::collectComputedStyleDependencies so that a future ident()\nwith computed-value-time dependencies is correctly rejected in\ncomputationally independent contexts (@property initial values).\n\n* Source/WebCore/css/CSSCounterStyleDescriptors.cpp:\n(WebCore::symbolFromCSSValue):\n(WebCore::fallbackNameFromCSSValue):\n(WebCore::extendsSystemAndFirstSymbolValueFromStyleProperties):\n* Source/WebCore/css/CSSCounterValue.cpp:\n(WebCore::CSSCounterValue::customCSSText):\n* Source/WebCore/css/CSSCustomIdentValue.cpp:\n(WebCore::CSSCustomIdentValue::stringValue):\n* Source/WebCore/css/CSSValue.cpp:\n(WebCore::CSSValue::collectComputedStyleDependencies):\n* Source/WebCore/css/CSSValueKeywords.in:\n* Source/WebCore/css/CSSViewTransitionRule.cpp:\n(WebCore::StyleRuleViewTransition::StyleRuleViewTransition):\n* Source/WebCore/css/DeprecatedCSSOMPrimitiveValue.cpp:\n(WebCore::DeprecatedCSSOMPrimitiveValue::getStringValue):\n(WebCore::DeprecatedCSSOMPrimitiveValue::getCounterValue):\n* Source/WebCore/css/ShorthandSerializer.cpp:\n(WebCore::ShorthandSerializer::valueIDIncludingCustomIdent):\n* Source/WebCore/css/calc/CSSCalcTree+Serialization.cpp:\n(WebCore::CSSCalc::serializeMathFunctionArguments):\n(WebCore::CSSCalc::serializeCalculationTree):\n* Source/WebCore/css/parser/CSSPropertyParserConsumer+Ident.cpp:\n(WebCore::CSSPropertyParserHelpers::consumeUnresolvedCustomIdent):\n(WebCore::CSSPropertyParserHelpers::consumeUnresolvedCustomIdentExcluding):\n(WebCore::CSSPropertyParserHelpers::consumeUnresolvedDashedIdent):\n* Source/WebCore/css/parser/CSSPropertyParserConsumer+ViewTransition.cpp:\n(WebCore::CSSPropertyParserHelpers::consumeViewTransitionTypes):\n* Source/WebCore/css/typedom/CSSStyleValueFactory.cpp:\n(WebCore::CSSStyleValueFactory::reifyValue):\n* Source/WebCore/css/values/primitives/CSSCustomIdent.cpp:\n(WebCore::CSS::CustomIdent::isNull):\n(WebCore::CSS::CustomIdent::startsWith):\n(WebCore::CSS::CustomIdent::operator==):\n(WebCore::CSS::Serialize<IdentFunctionIdent>::operator()):\n(WebCore::CSS::Serialize<CustomIdent>::operator()):\n(WebCore::CSS::ComputedStyleDependenciesCollector<CustomIdent>::operator()):\n(WebCore::CSS::CSSValueChildrenVisitor<CustomIdent>::operator()):\n(WebCore::CSS::operator<<):\n(WebCore::CSS::add):\n* Source/WebCore/css/values/primitives/CSSCustomIdent.h:\n* Source/WebCore/style/StyleBuilder.cpp:\n(WebCore::Style::Builder::applyProperty):\n* Source/WebCore/style/values/primitives/StyleCustomIdent.cpp:\n(WebCore::Style::ToStyle<CSS::CustomIdent>::operator()):\n\nCanonical link: https://commits.webkit.org/316524@main","order":0,"repository_id":"webkit","timestamp":1783236164},{"author":{"emails":["sosuke@bun.com","sosuke@bun.sh","aosukeke@gmail.com"],"name":"Sosuke Suzuki"},"branch":"main","hash":"8f27e23da3f50ea65b0eac233f4a84069cf17459","identifier":"316525@main","message":"[JSC] `TypedArray.from()` spuriously throws when `mapFn` detaches or shrinks\nhttps://bugs.webkit.org/show_bug.cgi?id=318596\n\nReviewed by Yusuke Suzuki.\n\nThe guards added in 316137@main stop writing when mapFn detaches or shrinks\nthe source/result typed array, but they consult @typedArrayLength before\n(or instead of) checking out-of-bounds-ness, and @typedArrayLength throws a\nTypeError for detached or out-of-bounds views. As a result,\n\n    const rab = new ArrayBuffer(32, { maxByteLength: 64 });\n    const source = new Int32Array(rab, 0, 8);\n    source[Symbol.iterator] = null;\n    Int32Array.from(source, (v, k) => { if (k === 4) rab.resize(16); return v; });\n\nthrows a TypeError where the spec requires Get/Set on the now out-of-bounds\nview to be silent. The same happens when mapFn detaches the result's buffer,\nwhere the intended @isDetached(result) operand was unreachable dead code.\n\nThis change adds a non-throwing @isTypedArrayOutOfBounds private function\nexposing JSArrayBufferView::isOutOfBounds() (the spec's\nIsArrayBufferViewOutOfBounds, which also covers detached views) and makes\nboth guards check it before calling @typedArrayLength.\n\nTest: JSTests/stress/typedarray-from-oob-not-detached.js\n\n* JSTests/stress/typedarray-from-oob-not-detached.js: Added.\n(shouldBe):\n(testResultShrunkOutOfBounds.FixedLengthOnResizable):\n(testResultShrunkOutOfBounds):\n(testResultDetached.ViewOnTransferableBuffer):\n(testResultDetached):\n* Source/JavaScriptCore/builtins/BuiltinNames.h:\n* Source/JavaScriptCore/builtins/TypedArrayConstructor.js:\n(from):\n* Source/JavaScriptCore/bytecode/LinkTimeConstant.h:\n* Source/JavaScriptCore/runtime/JSGlobalObject.cpp:\n(JSC::JSGlobalObject::init):\n* Source/JavaScriptCore/runtime/JSTypedArrayViewPrototype.cpp:\n(JSC::JSC_DEFINE_HOST_FUNCTION):\n* Source/JavaScriptCore/runtime/JSTypedArrayViewPrototype.h:\n\nCanonical link: https://commits.webkit.org/316525@main","order":0,"repository_id":"webkit","timestamp":1783236411},{"author":{"emails":["ysuzuki@apple.com","yusukesuzuki@slowstart.org","utatane.tea@gmail.com"],"name":"Yusuke Suzuki"},"branch":"main","hash":"0d5d36b5f94e2b3c92f3ac1787b6359141fa84f7","identifier":"316526@main","message":"[JSC] Add RegExpExecSticky DFG node\nhttps://bugs.webkit.org/show_bug.cgi?id=318538\nrdar://181311597\n\nReviewed by Sosuke Suzuki.\n\nThis patch adds DFG RegExpExecSticky tailored path which handles sticky,\nbut not global RegExp, avoiding RegExp reload etc. by using watchpoint.\n\n* Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h:\n(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):\n* Source/JavaScriptCore/dfg/DFGClobberize.h:\n(JSC::DFG::clobberize):\n* Source/JavaScriptCore/dfg/DFGDoesGC.cpp:\n(JSC::DFG::doesGC):\n* Source/JavaScriptCore/dfg/DFGFixupPhase.cpp:\n(JSC::DFG::FixupPhase::fixupNode):\n* Source/JavaScriptCore/dfg/DFGMayExit.cpp:\n* Source/JavaScriptCore/dfg/DFGNode.cpp:\n(JSC::DFG::Node::convertToRegExpExecStickyWithoutChecks):\n* Source/JavaScriptCore/dfg/DFGNode.h:\n(JSC::DFG::Node::hasHeapPrediction):\n(JSC::DFG::Node::hasCellOperand):\n* Source/JavaScriptCore/dfg/DFGNodeType.h:\n* Source/JavaScriptCore/dfg/DFGOperations.cpp:\n(JSC::DFG::JSC_DEFINE_JIT_OPERATION):\n* Source/JavaScriptCore/dfg/DFGOperations.h:\n* Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp:\n* Source/JavaScriptCore/dfg/DFGSafeToExecute.h:\n(JSC::DFG::safeToExecute):\n* Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:\n* Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h:\n* Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp:\n(JSC::DFG::SpeculativeJIT::compile):\n* Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp:\n(JSC::DFG::SpeculativeJIT::compile):\n* Source/JavaScriptCore/dfg/DFGStrengthReductionPhase.cpp:\n(JSC::DFG::StrengthReductionPhase::handleNode):\n* Source/JavaScriptCore/ftl/FTLCapabilities.cpp:\n(JSC::FTL::canCompile):\n* Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:\n(JSC::FTL::DFG::LowerDFGToB3::compileNode):\n(JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):\n\nCanonical link: https://commits.webkit.org/316526@main","order":0,"repository_id":"webkit","timestamp":1783245699},{"author":{"emails":["ahmad.saleem792@gmail.com","ahmad.saleem792+github@gmail.com","ahmad_saleem@apple.com"],"name":"Ahmad Saleem"},"branch":"main","hash":"2706eb5a681558f5385b06356786b694a9a8c36e","identifier":"316527@main","message":"Remove dead decodeURLEscapeSequences() call in SecurityOrigin::create()\nhttps://bugs.webkit.org/show_bug.cgi?id=318606\nrdar://181402358\n\nReviewed by Alan Baradlay.\n\nSecurityOrigin::create(protocol, host, port) computed a `decodedHost`\nlocal via PAL::decodeURLEscapeSequences(host) but never used it: the URL\nwas built from the raw `host` instead. The value has been discarded\nsince the local was introduced, with no observed effect, because\nURLParser::parseHostAndPort() already percent-decodes (and applies IDNA\nto) the host component for special schemes. Manually pre-decoding and\nre-embedding the host into a string to be reparsed would in fact be\nincorrect -- e.g. a \"%2F\" host would decode to \"/\" and corrupt the\nauthority -- so deferring decoding to the URL parser is the correct\nbehavior.\n\nDelete the dead store and the now-unused <pal/text/TextEncoding.h>\ninclude. No change in behavior.\n\n* Source/WebCore/page/SecurityOrigin.cpp:\n(WebCore::SecurityOrigin::create):\n\nCanonical link: https://commits.webkit.org/316527@main","order":0,"repository_id":"webkit","timestamp":1783261651},{"author":{"emails":["jean-yves.avenard@apple.com","jya@apple.com","jyavenard@gmail.com"],"name":"Jean-Yves Avenard"},"branch":"main","hash":"0f366de9b96d578965afac64a8db342121b91f0f","identifier":"316528@main","message":"imported/w3c/web-platform-tests/media-source/mediasource-seek-beyond-duration.html is a permanent failure\nhttps://bugs.webkit.org/show_bug.cgi?id=303468\nrdar://165752722\n\nReviewed by Jer Noble and Philippe Normand.\n\nThe completion of a seek was assumed to occur once the MediaPlayerPrivate\nissued a timeChanged(). There was no specific tracking of a seek operation\nand we couldn't distinguish whichever came first: a seek completing or\nplayback reaching the end.\nThis lead to the `seeked` event often being fired after the `ended` event\nwhen we seeked to the end or after the end of the video contrary to the spec.\n\nWe now track each MediaPlayer's seeking operation by having\nMediaPlayer::seekToTarget returns a NativePromise.\nThe logic to issue the `seeked` event is now made to occur when this seeking\npromise is resolved.\n\nNote that the MediaPlayerPrivateAVFoundation isn't in full spec compliance\nhttps://html.spec.whatwg.org/multipage/media.html#seeking\nstep 12. Wait until the user agent has established whether or not the media data for the new playback position is available, and, if it is, until it has decoded enough data to play back that position.\nwhich would change the readyState accordingly\nfiring the seeked event being the last step:\nstep 17. Queue a media element task given the media element to fire an event named seeked at the element.\n\nstep 12 isn't happening, and the readyState doesn't change. This will be\nhandled in a future change and is tracked in webkit.org/b/303528\n\nFly-By: When the AVSampleBufferRenderSynchronizer started with a negative audio we used to\nrelease the startup gate immediately. As the time was negative the currentTime and effective rate were\nset at 0. The prevented the time from ever progressing until another operation was performed.\nWe now only release the startup gate when it has moved from 0 or the last seek time.\n\nRe-enabling test, covered by existing tests.\n\n* LayoutTests/platform/mac/TestExpectations:\n* Source/WebCore/html/HTMLMediaElement.cpp:\n(WebCore::HTMLMediaElement::setReadyState):\n(WebCore::HTMLMediaElement::seekTask):\n(WebCore::HTMLMediaElement::finishSeek):\n(WebCore::HTMLMediaElement::mediaPlayerTimeChanged):\n(WebCore::HTMLMediaElement::mediaPlayerSeeked): Deleted.\n* Source/WebCore/html/HTMLMediaElement.h:\n* Source/WebCore/platform/LogMessages.in:\n* Source/WebCore/platform/graphics/MediaPlayer.cpp:\n(WebCore::MediaPlayer::seekToTarget):\n(WebCore::MediaPlayer::seeked): Deleted.\n(WebCore::MediaPlayer::seeking const): Deleted.\n* Source/WebCore/platform/graphics/MediaPlayer.h:\n* Source/WebCore/platform/graphics/MediaPlayerPrivate.h:\n* Source/WebCore/platform/graphics/MediaPlayerPrivateWirelessPlayback.cpp:\n(WebCore::MediaPlayerPrivateWirelessPlayback::seekToTarget):\n(WebCore::MediaPlayerPrivateWirelessPlayback::playbackPositionDidChange):\n* Source/WebCore/platform/graphics/MediaPlayerPrivateWirelessPlayback.h:\n* Source/WebCore/platform/graphics/avfoundation/AudioVideoRendererAVFObjC.mm:\n(WebCore::AudioVideoRendererAVFObjC::handleEffectiveRateChanged):\n* Source/WebCore/platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.cpp:\n(WebCore::MediaPlayerPrivateAVFoundation::seekToTarget):\n(WebCore::MediaPlayerPrivateAVFoundation::seekInternal):\n(WebCore::MediaPlayerPrivateAVFoundation::setReadyState):\n(WebCore::MediaPlayerPrivateAVFoundation::seekCompleted):\n(WebCore::MediaPlayerPrivateAVFoundation::resolveSeekPromiseIfNeeded):\n* Source/WebCore/platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.h:\n* Source/WebCore/platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaSourceAVFObjC.h:\n* Source/WebCore/platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaSourceAVFObjC.mm:\n(WebCore::MediaPlayerPrivateMediaSourceAVFObjC::seekToTarget):\n(WebCore::MediaPlayerPrivateMediaSourceAVFObjC::seekInternal):\n(WebCore::MediaPlayerPrivateMediaSourceAVFObjC::completeSeek):\n(WebCore::MediaPlayerPrivateMediaSourceAVFObjC::seeking const):\n* Source/WebCore/platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaStreamAVFObjC.h:\n* Source/WebCore/platform/graphics/cocoa/MediaPlayerPrivateWebM.h:\n* Source/WebCore/platform/graphics/cocoa/MediaPlayerPrivateWebM.mm:\n(WebCore::MediaPlayerPrivateWebM::seekToTarget):\n(WebCore::MediaPlayerPrivateWebM::completeSeek):\n(WebCore::MediaPlayerPrivateWebM::didProvideMediaDataForTrackId):\n* Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:\n(WebCore::MediaPlayerPrivateGStreamer::seekToTarget):\n(WebCore::MediaPlayerPrivateGStreamer::prepareSeek):\n(WebCore::MediaPlayerPrivateGStreamer::timeChanged):\n(WebCore::MediaPlayerPrivateGStreamer::finishSeek):\n(WebCore::MediaPlayerPrivateGStreamer::didEnd):\n* Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h:\n* Source/WebCore/platform/graphics/gstreamer/mse/MediaPlayerPrivateGStreamerMSE.cpp:\n(WebCore::MediaPlayerPrivateGStreamerMSE::seekToTarget):\n(WebCore::MediaPlayerPrivateGStreamerMSE::propagateReadyStateToPlayer):\n(WebCore::MediaPlayerPrivateGStreamerMSE::didPreroll):\n* Source/WebCore/platform/graphics/gstreamer/mse/MediaPlayerPrivateGStreamerMSE.h:\n* Source/WebCore/platform/graphics/holepunch/MediaPlayerPrivateHolePunch.h:\n* Source/WebCore/platform/graphics/win/MediaPlayerPrivateMediaFoundation.cpp:\n(WebCore::MediaPlayerPrivateMediaFoundation::seekToTarget):\n(WebCore::MediaPlayerPrivateMediaFoundation::onSessionStarted):\n(WebCore::MediaPlayerPrivateMediaFoundation::seeking const): Deleted.\n* Source/WebCore/platform/graphics/win/MediaPlayerPrivateMediaFoundation.h:\n* Source/WebCore/platform/mock/mediasource/MockMediaPlayerMediaSource.cpp:\n(WebCore::MockMediaPlayerMediaSource::seekToTarget):\n(WebCore::MockMediaPlayerMediaSource::seeking const): Deleted.\n* Source/WebCore/platform/mock/mediasource/MockMediaPlayerMediaSource.h:\n* Source/WebKit/GPUProcess/media/RemoteMediaPlayerProxy.cpp:\n(WebKit::timeUpdateData):\n(WebKit::RemoteMediaPlayerProxy::seekToTarget):\n(WebKit::RemoteMediaPlayerProxy::mediaPlayerSeeked): Deleted.\n* Source/WebKit/GPUProcess/media/RemoteMediaPlayerProxy.h:\n* Source/WebKit/GPUProcess/media/RemoteMediaPlayerProxy.messages.in:\n* Source/WebKit/WebProcess/GPU/media/MediaPlayerPrivateRemote.cpp:\n(WebKit::MediaPlayerPrivateRemote::seekToTarget):\n(WebKit::MediaPlayerPrivateRemote::seeked): Deleted.\n(WebKit::MediaPlayerPrivateRemote::seeking const): Deleted.\n* Source/WebKit/WebProcess/GPU/media/MediaPlayerPrivateRemote.h:\n* Source/WebKit/WebProcess/GPU/media/MediaPlayerPrivateRemote.messages.in:\n\nCanonical link: https://commits.webkit.org/316528@main","order":0,"repository_id":"webkit","timestamp":1783267080},{"author":{"emails":["hi@devinrousso.com"],"name":"Devin Rousso"},"branch":"main","hash":"2833205e84d545e12f74cc83737b51913848cedb","identifier":"316529@main","message":"Web Inspector: No stack trace for mime type errors, very difficult to debug\nhttps://bugs.webkit.org/show_bug.cgi?id=306218\n<rdar://problem/169396940>\n\nReviewed by Yusuke Suzuki.\n\n* Source/WebCore/bindings/js/ScriptModuleLoader.cpp:\n(WebCore::ScriptModuleLoader::notifyFinished):\n\n* LayoutTests/http/tests/security/module-incorrect-mime-types-expected.txt:\n* LayoutTests/http/tests/security/module-no-mime-type-expected.txt:\n* LayoutTests/platform/gtk/http/tests/security/module-no-mime-type-expected.txt:\n* LayoutTests/http/tests/wasm/wasm-esm-disabled-with-setting-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/fetch/api/request/destination/fetch-destination.https-expected.txt:\n* LayoutTests/platform/ios/imported/w3c/web-platform-tests/fetch/api/request/destination/fetch-destination.https-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-script-element/css-module/import-css-module-dynamic-expected.txt:\n* LayoutTests/js/dom/modules/missing-exception-check-for-import.html:\n* LayoutTests/js/dom/modules/missing-exception-check-for-import-expected.txt:\n* LayoutTests/webaudio/worklet-crash-expected.txt:\n\nCanonical link: https://commits.webkit.org/316529@main","order":0,"repository_id":"webkit","timestamp":1783271224},{"author":{"emails":["dpino@igalia.com"],"name":"Diego Pino Garcia"},"branch":"main","hash":"b3d9e3b7f0081a5ea673a12e1256e9660f4e126b","identifier":"316530@main","message":"[GLIB] Unreviewed layout test gardening\n\nGardened tests passing and crashes.\n\n* LayoutTests/platform/glib/TestExpectations:\n\nCanonical link: https://commits.webkit.org/316530@main","order":0,"repository_id":"webkit","timestamp":1783282237},{"author":{"emails":["zakr@apple.com"],"name":"Zak Ridouh"},"branch":"main","hash":"402dc1b3bf265f5afd15d1b68374ef0885824299","identifier":"316531@main","message":"Use modern Xcode Folders for SwiftBrowser xcodeproj\nhttps://bugs.webkit.org/show_bug.cgi?id=317620\nrdar://180349185\n\nReviewed by Richard Robinson.\n\nConvert some Xcode Groups to modern Xcode buildable folders\nfor some SwiftBrowser folders.\n\n* Tools/SwiftBrowser/SwiftBrowser.xcodeproj/project.pbxproj:\n\nCanonical link: https://commits.webkit.org/316531@main","order":0,"repository_id":"webkit","timestamp":1783297003},{"author":{"emails":["sam@webkit.org"],"name":"Sam Weinig"},"branch":"main","hash":"31871cbfb029cd2dc2389d87b70af72876ef52ec","identifier":"316532@main","message":"Fix issues with DOMMatrix/IntersectionObserver absolute length unit requirements\nhttps://bugs.webkit.org/show_bug.cgi?id=318632\n\nReviewed by Darin Adler.\n\nAdds a new off by default bit to `CSS::PropertyParserState` called `absoluteLengthUnitsOnly`\nto make it parse error to consume length units that are not absolute (e.g. font/viewport/container\nrelative units). Uses this for the `DOMMatrix` (`parseTransformRaw`) and `IntersectionObserver`\n(`parseMargin`) parsers.\n\nAdditionally, added support for using a `CSS::{primitive}Raw` type in the MetaConsumer, indicating\nthat the parse should not allow `calc()`. Uses this to remove the post parse check in the\n`IntersectionObserver` (`parseMargin`) parser.\n\nAdded a test for non-px, but still absolute units in IntersectionObserver and updated a failing\nDOMMatrix test result.\n\nTest: imported/w3c/web-platform-tests/intersection-observer/root-margin-scroll-margin-units.html\n* LayoutTests/imported/w3c/web-platform-tests/css/geometry/DOMMatrix-001-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/intersection-observer/root-margin-scroll-margin-units-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/intersection-observer/root-margin-scroll-margin-units.html: Added.\n* Source/WebCore/css/calc/CSSCalcTree+Parser.cpp:\n* Source/WebCore/css/parser/CSSPropertyParserConsumer+AngleDefinitions.h:\n* Source/WebCore/css/parser/CSSPropertyParserConsumer+AnglePercentageDefinitions.h:\n* Source/WebCore/css/parser/CSSPropertyParserConsumer+FlexDefinitions.h:\n* Source/WebCore/css/parser/CSSPropertyParserConsumer+FrequencyDefinitions.h:\n* Source/WebCore/css/parser/CSSPropertyParserConsumer+IntegerDefinitions.h:\n* Source/WebCore/css/parser/CSSPropertyParserConsumer+LengthDefinitions.h:\n* Source/WebCore/css/parser/CSSPropertyParserConsumer+LengthPercentageDefinitions.h:\n* Source/WebCore/css/parser/CSSPropertyParserConsumer+NumberDefinitions.h:\n* Source/WebCore/css/parser/CSSPropertyParserConsumer+PercentageDefinitions.h:\n* Source/WebCore/css/parser/CSSPropertyParserConsumer+ResolutionDefinitions.h:\n* Source/WebCore/css/parser/CSSPropertyParserConsumer+TimeDefinitions.h:\n* Source/WebCore/css/parser/CSSPropertyParserConsumer+Transform.cpp:\n* Source/WebCore/css/parser/CSSPropertyParserState.h:\n* Source/WebCore/page/IntersectionObserver.cpp:\n\nCanonical link: https://commits.webkit.org/316532@main","order":0,"repository_id":"webkit","timestamp":1783300091},{"author":{"emails":["kkinnunen@apple.com"],"name":"Kimmo Kinnunen"},"branch":"main","hash":"6115059613eff0e204bf87b7f2531a57e9c545ea","identifier":"316533@main","message":"Update ANGLE to 2026-06-29 (a32d31d2f1230711f398ff4cbfc272bdcca72a5e)\nhttps://bugs.webkit.org/show_bug.cgi?id=318431\nrdar://181217130\n\nReviewed by Dan Glastonbury\n\nContains upstream commits:\na32d31d2f123 Manual Roll vulkan-deps from f2b9fece7c67 to 0af4fee9206d\n6dab7c7e742b Capture/Replay: Include inactive resources when retracing\ne0580dcb02d8 Refactor ValidateTexStorage\n88921cc5ab0b Roll Chromium from 82de21bc9ada to 9513633ed143 (930 revisions)\n5fbcc75bac96 Roll VK-GL-CTS from 93834259e350 to 06ae3bf12ae5 (21 revisions)\n98dab44d9cd2 Vulkan: Add initializeColorAttachmentWithWhite for app workaround\n79053f47bd64 Use standard enums for 64-bit types\nbb1024656d39 IR Validation: add pointer validation for operands and results\na4eea1fbedac Vulkan: Fix layer index/count for update from FBO\n09c7bd10a9c1 Increase size of buffer pool for argument buffers.\nc740e731ac92 Consolidate common arch flags\n6e65aeaa7006 [translator] Fix cloning switch case nodes without a condition\n4a0e6eecaa9a Vulkan: Fix Uninitialized GPU memory leak in reinitImageAsRenderable\n093a0d8f75a2 Split EGL_PLATFORM_ANGLE_DISPLAY_KEY_ANGLE into a new ext\n51afe011d316 vulkan: Fix UAF in VertexArrayVk\nde05d95e714f Fix incorrect null check in removeDrawFramebufferBinding\n8350b506968c Move the ownership of the Metal backend to lehoangquyen@google.com.\ndc89a1293bdd Remove unreachable texture validation code\nfc6b2b8a4985 Adds new pragma for disabling hlsl warnings.\n46a0234b977a Metal: only allocate native texture storage for defined levels.\nae75b852f8d6 Unsuppress fixed deqp test\n3afccdedc1ec Refactor CompressedTexSubImage validation\na5d77662738d Roll SwiftShader from 0255eccc9824 to f3e464b1e567 (1 revision)\n13e5114ff61c Roll vulkan-deps from 4cd4bfcf818e to f2b9fece7c67 (11 revisions)\n15d26b7d15b0 Roll Chromium from 4d151fce616e to 82de21bc9ada (750 revisions)\nc8313f42e1d7 [WGPU] Don't destroy wgpu::Texture in ImageHelper::resetImage\n44ba9d57ecb1 Put paletted texture formats at end of list.\nf998b0379cca Introduce additional flat array for lock-free handle path\nc073400b3d7c Vulkan: Refactor EGL image glCopyTex*Image paths\n38cac5971fef D3D11: Remove remaining Feature Level 9_3 remnants\n9884b41def85 Vulkan: Refactor EGL image draw paths\nd4c975d917a6 Rename angle_v2 recipes\n1466aafdb807 Fix ValidateDamageRegion test not assume triple buffer behavior\n82a623fafe0b D3D: Handle uniforms that are optimized out by TranslatorHLSL\n2601ce62a53c Clear all level's image descs when binding a pbuffer.\n6d0f0d10ffda Use separate types for texture's own and source level/layer/index\n4dc260a39474 Roll SwiftShader from 2843cbcc714f to 0255eccc9824 (1 revision)\n89847bfb9850 Unconditionally apply BaseInstanceOverflow validation\nedebbb70cb88 Roll vulkan-deps from 5481b8c77757 to 4cd4bfcf818e (13 revisions)\n45a14602dff9 Roll Chromium from 3ebaa3a7d74a to 4d151fce616e (643 revisions)\nb9aa07e9d122 Vulkan: Fix the bug related to queue family global priority\nd97a65839d09 Vulkan: Disable supportsGlobalPriority feature for all\n21c3abd8d941 Generate gn_isolate_map.pyl\nafb8744a126e MSL/AST: Handle non-unary/binary expr in loop-forward-progress\n7d1617f8c78d Roll vulkan-deps from e73c8345b94e to 5481b8c77757 (9 revisions)\nff11ff01d6ba Roll Chromium from e23ff548502b to 3ebaa3a7d74a (745 revisions)\n195369f6675e Track EGL image source image index in renderbuffer too\n796483ddbf0e Vulkan: Improve appBasedFeatureOverrides\ne0f321c3f28f D3D11: Remove additional non-shader Feature Level 9_3 code\n3e7c372c7b6d Switch Android/arm64/Perf to test trigger CAS\n4f7183076c33 Remove legacy Win/x64/ASan test specs\n86faae9a382f Switch Win/x64/Perf to test trigger CAS\nd0c30d112691 Switch Win/x64/ASan to test trigger CAS\n1f047a0aca4a Switch Win/x86/Release to test trigger CAS\n4f505b04635f Tests: Add more tests for MSRTT with framebuffer fetch\nb54d36331810 Switch Linux/x64/TSan to test trigger CAS\n79137f56be40 Switch Linux/x64/ASan to test trigger CAS\n1285539522b7 [Tests] Add macros for -Wunsafe-buffer-usage in ANGLE\nd462b0275178 Fix robust-init bypass in glClearBufferfi\n74622ea206bd Fix clamping indices to gl_FragData vs dual source blending\nabcbf90919e8 Refactor CompressedTexImage validation\nb7473852da1f Don't use component build on Android ANGLE bots.\n0bde2f8e6d4d Roll vulkan-deps from fac28bbc554e to e73c8345b94e (18 revisions)\n\nCanonical link: https://commits.webkit.org/316533@main","order":0,"repository_id":"webkit","timestamp":1783306138},{"author":{"emails":["ysuzuki@apple.com","yusukesuzuki@slowstart.org","utatane.tea@gmail.com"],"name":"Yusuke Suzuki"},"branch":"main","hash":"23903f1a1cc7fa0b403cd150387669c8ecb3a6ad","identifier":"316534@main","message":"[JSC] Add AtomString Array loop in DFG / FTL\nhttps://bugs.webkit.org/show_bug.cgi?id=318642\nrdar://181445937\n\nReviewed by Yijia Huang.\n\nThis patch adds fast path for indexOf / includes with AtomString arrays.\nIf Array is an AtomString array and input is JSString with AtomString,\nwe do pointer comparison loop. Also we use compare32 to clean up result\ngeneration in DFG code, which becomes branchless and faster. FTL already\nachieves it due to B3's conversion.\n\nTests: JSTests/stress/array-indexof-includes-cow-atom-strings.js\n       JSTests/stress/array-indexof-includes-result-boundaries.js\n\n* JSTests/stress/array-indexof-includes-cow-atom-strings.js: Added.\n(shouldBe):\n(idxFrom):\n(inc):\n(idxEmptyAndSingle):\n* JSTests/stress/array-indexof-includes-result-boundaries.js: Added.\n(shouldBe):\n(i32Includes):\n(i32IncludesFrom):\n(dblIndex):\n(dblIncludes):\n(strIndex):\n(strIncludes):\n* Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:\n* Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:\n(JSC::FTL::DFG::LowerDFGToB3::compileArrayIndexOfOrArrayIncludes):\n\nCanonical link: https://commits.webkit.org/316534@main","order":0,"repository_id":"webkit","timestamp":1783306203},{"author":{"emails":["ysuzuki@apple.com","yusukesuzuki@slowstart.org","utatane.tea@gmail.com"],"name":"Yusuke Suzuki"},"branch":"main","hash":"7b3dbc197b140fa6c1b7383e6770bb3f1cb9be7b","identifier":"316535@main","message":"[JSC] Skip LowerEntrySwitch and SimplifyCFG if possible\nhttps://bugs.webkit.org/show_bug.cgi?id=318640\nrdar://181445350\n\nReviewed by Yijia Huang.\n\n1. Have usesEntrySwitch flag to avoid scanning the graph in Air::lowerEntrySwitch.\n   EntrySwitch is not frequently used, thus we can remember when it is\n   added.\n2. Record whether simplifyCFG can be beneficial and run it only it can\n   make code changed.\n\n* Source/JavaScriptCore/b3/B3LowerToAir.cpp:\n* Source/JavaScriptCore/b3/B3Procedure.h:\n(JSC::B3::Procedure::setUsesEntrySwitch):\n(JSC::B3::Procedure::usesEntrySwitch const):\n* Source/JavaScriptCore/b3/air/AirGenerate.cpp:\n(JSC::B3::Air::prepareForGeneration):\n* Source/JavaScriptCore/b3/air/AirLowerEntrySwitch.cpp:\n(JSC::B3::Air::lowerEntrySwitch):\n* Source/JavaScriptCore/b3/air/AirLowerEntrySwitch.h:\n* Source/JavaScriptCore/b3/air/AirReportUsedRegisters.cpp:\n(JSC::B3::Air::reportUsedRegisters):\n* Source/JavaScriptCore/b3/air/AirReportUsedRegisters.h:\n\nCanonical link: https://commits.webkit.org/316535@main","order":0,"repository_id":"webkit","timestamp":1783306710},{"author":{"emails":["yijia_huang@apple.com","hyjorc1@gmail.com"],"name":"Yijia Huang"},"branch":"main","hash":"b8fd555bffe2b1ed0a6d9dd3c8c948b76d3d378a","identifier":"316536@main","message":"[JSC] Add dumpBytecodeProfile\nhttps://bugs.webkit.org/show_bug.cgi?id=318649\nrdar://181454253\n\nReviewed by Yusuke Suzuki.\n\nExposes Profiler::Database::save() as dumpBytecodeProfile(path). Lets JS\ncallers write the profiler state mid-run instead of only at atexit, which\ncan be used to dump iteration-0 bytecode profile data in JS3 \u2014 counters\nare monotonic, so a snapshot at end of iteration 0 captures iter-0-only\nexecution counts.\n\nNo-op when jsc is run without `-p`.\n\nCanonical link: https://commits.webkit.org/316536@main","order":0,"repository_id":"webkit","timestamp":1783306993},{"author":{"emails":["ahmad.saleem792@gmail.com","ahmad.saleem792+github@gmail.com","ahmad_saleem@apple.com"],"name":"Ahmad Saleem"},"branch":"main","hash":"c1dbbbee21268435cb02a16d1dc354d11a79f338","identifier":"316537@main","message":"anchor-center in a vertical writing mode is not scroll-adjusted along the block axis\nhttps://bugs.webkit.org/show_bug.cgi?id=318618\nrdar://181413103\n\nReviewed by Simon Fraser.\n\nIn AnchorScrollAdjuster, the block-axis (Y) scroll-adjustment check for\nanchor-center read alignSelf().isAnchorCenter() in both the horizontal and\nvertical writing-mode arms of the ternary. The horizontal-axis (X) check\ncorrectly pairs justify-self/align-self per axis, but the vertical arm of the\nY check was a copy-paste of the horizontal arm.\n\nFor a vertical containing writing mode, the block (Y) axis is controlled by\njustify-self, not align-self, so an abspos box using anchor-center never set\nm_needsYAdjustment. As a result it was not compensated for its anchor's scroll\noffset and drifted away from the anchor after scrolling.\n\nPair the vertical arm with justifySelf().isAnchorCenter(), matching the\nper-axis logic already used by the position-area block above.\n\nTests: imported/w3c/web-platform-tests/css/css-anchor-position/anchor-center-scroll-horizontal-wm-001.html\n       imported/w3c/web-platform-tests/css/css-anchor-position/anchor-center-scroll-vertical-wm-001.html\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-anchor-position/anchor-center-scroll-horizontal-wm-001-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-anchor-position/anchor-center-scroll-horizontal-wm-001-ref.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-anchor-position/anchor-center-scroll-horizontal-wm-001.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-anchor-position/anchor-center-scroll-vertical-wm-001-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-anchor-position/anchor-center-scroll-vertical-wm-001-ref.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-anchor-position/anchor-center-scroll-vertical-wm-001.html: Added.\n* Source/WebCore/style/AnchorPositionEvaluator.cpp:\n(WebCore::AnchorScrollAdjuster::AnchorScrollAdjuster):\n\nCanonical link: https://commits.webkit.org/316537@main","order":0,"repository_id":"webkit","timestamp":1783309071},{"author":{"emails":["sosuke@bun.com","sosuke@bun.sh","aosukeke@gmail.com"],"name":"Sosuke Suzuki"},"branch":"main","hash":"752e7e8b0d05a5b13ce3d573bb75e7e8c86ad019","identifier":"316538@main","message":"[JSC] Convert `HasOwnProperty` on the current for-in property name to `EnumeratorHasOwnProperty`\nhttps://bugs.webkit.org/show_bug.cgi?id=318528\n\nReviewed by Yusuke Suzuki.\n\nObject.prototype.hasOwnProperty.call(o, p) is a common guard inside `for (p in o)`\n(eslint's no-prototype-builtins rewrites o.hasOwnProperty(p) into this form).\nHowever, op_enumerator_has_own_property is not emitted for it: the recognition\nhappens only in the parser, which matches the exact syntactic form\n`o.hasOwnProperty(p)`, so the .call spelling (and Object.hasOwn) falls back to\nthe generic HasOwnProperty node that hashes the key on every iteration.\n\nThis patch additionally converts HasOwnProperty to EnumeratorHasOwnProperty in\nDFG strength reduction, when the key is the EnumeratorNextUpdatePropertyName of\nan enumeration whose GetPropertyEnumerator base is the same node as the object.\nThis makes the guard a structure ID comparison regardless of spelling.\n\n                                                   Baseline                  Patched\n\nobject-has-own-for-in-loop                      4.7828+-0.0548     ^      4.0638+-0.0909        ^ definitely 1.1769x faster\nhas-own-property-call-for-in-loop              12.0470+-0.2778     ^      9.5166+-0.2442        ^ definitely 1.2659x faster\n\nTests: JSTests/microbenchmarks/has-own-property-call-for-in-loop.js\n       JSTests/stress/for-in-has-own-property-call-edge-cases.js\n       JSTests/stress/for-in-has-own-property-call.js\n\n* JSTests/microbenchmarks/has-own-property-call-for-in-loop.js: Added.\n(assert):\n(test1.count):\n(test1):\n* JSTests/stress/for-in-has-own-property-call-edge-cases.js: Added.\n(assert):\n(oracle):\n(deleteCurrent):\n(deleteCurrentHasOwn):\n(clobber):\n(guardAfterClobber):\n(differential):\n(reassign):\n(nested):\n(proxyGuard):\n(proxyThrow):\n(polyBase):\n(makeLarge):\n(i.assert.guardAfterClobber):\n(i.assert):\n(i.p.string_appeared_here.Object.setPrototypeOf):\n(i.assert.nested):\n(i.assert.polyBase):\n(i.assert.polyBase.Object.freeze):\n* JSTests/stress/for-in-has-own-property-call.js: Added.\n(assert):\n(countOwn):\n(countHasOwn):\n(crossCheck):\n(deleteDuring):\n(countIndexed):\n* Source/JavaScriptCore/dfg/DFGNode.cpp:\n(JSC::DFG::Node::convertToEnumeratorHasOwnProperty):\n* Source/JavaScriptCore/dfg/DFGNode.h:\n* Source/JavaScriptCore/dfg/DFGStrengthReductionPhase.cpp:\n(JSC::DFG::StrengthReductionPhase::handleNode):\n\nCanonical link: https://commits.webkit.org/316538@main","order":0,"repository_id":"webkit","timestamp":1783310327},{"author":{"emails":["sosuke@bun.com","sosuke@bun.sh","aosukeke@gmail.com"],"name":"Sosuke Suzuki"},"branch":"main","hash":"1cdf1c9f02aa1592b606dd986e6bd9e5b1e03efc","identifier":"316539@main","message":"[JSC] Remove DFG TryGetById node\nhttps://bugs.webkit.org/show_bug.cgi?id=318603\n\nReviewed by Yusuke Suzuki.\n\nNow that op_try_get_by_id and the @tryGetById builtin intrinsic are gone,\nthe DFG TryGetById node is only created by the ByteCodeParser for a handful\nof intrinsics, where it performs a runtime \"is this property still the\nprimordial one\" check:\n\n- RegExpTestIntrinsic / RegExpSearchIntrinsic / RegExpMatchIntrinsic /\n  RegExpSplitIntrinsic verify that the RegExp object's \"exec\" is the\n  primordial RegExp.prototype.exec.\n- PromisePrototypeCatchIntrinsic verifies that the promise's \"then\" is the\n  primordial Promise.prototype.then.\n\nThese checks can be expressed as a watchpoint plus a CheckStructure against\nthe primordial structure instead (subclass instances now take the generic\npath, like the other RegExp intrinsics already do). Do that, and delete the\nnode along with the IC layer's TryGetById support, which was only reachable\nfrom DFG / FTL.\n\n* JSTests/stress/promise-catch-own-then.js: Added.\n* JSTests/stress/regexp-test-exec-watchpoint-invalidation.js: Added.\n* JSTests/stress/regexp-test-own-exec.js: Added.\n* JSTests/stress/regexp-test-subclass-exec.js: Added.\n* Source/JavaScriptCore/bytecode/InlineCacheCompiler.cpp:\n(JSC::InlineCacheCompiler::generateSlowPathCode):\n(JSC::InlineCacheCompiler::compileOneAccessCaseHandler):\n* Source/JavaScriptCore/bytecode/PropertyInlineCache.cpp:\n(JSC::PropertyInlineCache::reset):\n* Source/JavaScriptCore/bytecode/PropertyInlineCache.h:\n(JSC::appropriateGetByIdOptimizeFunction):\n(JSC::appropriateGetByIdGenericFunction):\n(JSC::hasConstantIdentifier):\n* Source/JavaScriptCore/bytecode/Repatch.cpp:\n(JSC::appropriateGetByOptimizeFunction):\n(JSC::appropriateGetByGaveUpFunction):\n(JSC::tryCacheGetBy):\n* Source/JavaScriptCore/bytecode/Repatch.h:\n* Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h:\n(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):\n* Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp:\n(JSC::DFG::ByteCodeParser::handleIntrinsicCall):\n(JSC::DFG::ByteCodeParser::handleGetById):\n* Source/JavaScriptCore/dfg/DFGClobberize.h:\n(JSC::DFG::clobberize):\n* Source/JavaScriptCore/dfg/DFGClobbersExitState.cpp:\n(JSC::DFG::clobbersExitState):\n* Source/JavaScriptCore/dfg/DFGDoesGC.cpp:\n(JSC::DFG::doesGC):\n* Source/JavaScriptCore/dfg/DFGFixupPhase.cpp:\n(JSC::DFG::FixupPhase::fixupNode):\n* Source/JavaScriptCore/dfg/DFGGraph.h:\n(JSC::DFG::Graph::isWatchingPromiseThenWatchpoint):\n* Source/JavaScriptCore/dfg/DFGNode.h:\n(JSC::DFG::Node::hasCacheableIdentifier):\n(JSC::DFG::Node::cacheableIdentifier):\n(JSC::DFG::Node::hasGetByIdData const):\n* Source/JavaScriptCore/dfg/DFGNodeType.h:\n* Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp:\n* Source/JavaScriptCore/dfg/DFGSafeToExecute.h:\n(JSC::DFG::safeToExecute):\n* Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp:\n(JSC::DFG::SpeculativeJIT::compile):\n(JSC::DFG::SpeculativeJIT::compileGetById):\n* Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp:\n(JSC::DFG::SpeculativeJIT::compile):\n(JSC::DFG::SpeculativeJIT::compileGetById):\n* Source/JavaScriptCore/ftl/FTLCapabilities.cpp:\n(JSC::FTL::canCompile):\n* Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:\n(JSC::FTL::DFG::LowerDFGToB3::compileNode):\n(JSC::FTL::DFG::LowerDFGToB3::compileGetById):\n* Source/JavaScriptCore/jit/JITOperations.cpp:\n* Source/JavaScriptCore/jit/JITOperations.h:\n\nCanonical link: https://commits.webkit.org/316539@main","order":0,"repository_id":"webkit","timestamp":1783311030},{"author":{"emails":["hi@devinrousso.com"],"name":"Devin Rousso"},"branch":"main","hash":"401e156fe3e88acc612597a6c68358b534c7ccd2","identifier":"316540@main","message":"Web Inspector: Crash when opened with CSS Variable @keyframes Animation\nhttps://bugs.webkit.org/show_bug.cgi?id=283981\n<rdar://problem/140880870>\n\nReviewed by Antoine Quint.\n\nCustom properties in a keyframe should be serialized from the keyframe's own style instead of the current computed style.\n\n* Source/WebCore/inspector/agents/InspectorAnimationAgent.cpp:\n(WebCore::buildObjectForKeyframes):\n\n* LayoutTests/inspector/animation/keyframes-custom-property.html: Added.\n* LayoutTests/inspector/animation/keyframes-custom-property-expected.txt: Added.\n\nCanonical link: https://commits.webkit.org/316540@main","order":0,"repository_id":"webkit","timestamp":1783322807},{"author":{"emails":["ahmad.saleem792@gmail.com","ahmad.saleem792+github@gmail.com","ahmad_saleem@apple.com"],"name":"Ahmad Saleem"},"branch":"main","hash":"74a12b6a1be8da6d70333bc4f407e49127205edf","identifier":"316541@main","message":"PannerNode orientation-only changes don't update the directional cone gain\nhttps://bugs.webkit.org/show_bug.cgi?id=318619\nrdar://181413407\n\nReviewed by Jean-Yves Avenard.\n\nPannerNode::invalidateCachedPropertiesIfNecessary() stored position()\ninto m_lastOrientation instead of orientation(), so hasOrientationChanged\nwas computed as an alias of hasPositionChanged. As a result, rotating a\npanner in place (changing orientation while leaving position unchanged)\nnever invalidated m_cachedConeGain, and the directional cone attenuation\nstayed stale until some other property forced a recompute.\n\nThis only affects the cached (non sample-accurate) cone-gain path; the\nsample-accurate path recomputes the cone gain every render quantum, so\nthe bug was masked whenever any panner or listener position/orientation\nAudioParam was a-rate.\n\nFix the typo so orientation-only changes correctly drop the cached cone\ngain.\n\nTest: imported/w3c/web-platform-tests/webaudio/the-audio-api/the-pannernode-interface/panner-orientation-cone-gain-changes.html\n\n* LayoutTests/imported/w3c/web-platform-tests/webaudio/the-audio-api/the-pannernode-interface/panner-orientation-cone-gain-changes-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/webaudio/the-audio-api/the-pannernode-interface/panner-orientation-cone-gain-changes.html: Added.\n* Source/WebCore/Modules/webaudio/PannerNode.cpp:\n(WebCore::PannerNode::invalidateCachedPropertiesIfNecessary):\n\nCanonical link: https://commits.webkit.org/316541@main","order":0,"repository_id":"webkit","timestamp":1783323108},{"author":{"emails":["rbuis@igalia.com","rwlbuis@gmail.com","rwlbuis@webkit.org","rob.buis@samsung.com","rbuis@blackberry.com","rbuis@rim.com"],"name":"Rob Buis"},"branch":"main","hash":"8be3ba5c9f04cadf8636e69450309fa1c6eeedb1","identifier":"316542@main","message":"[LBSE] Adjust test expectations after 315946@main\nhttps://bugs.webkit.org/show_bug.cgi?id=318106\n\nReviewed by Nikolas Zimmermann.\n\nAdjust test expectations after 315946@main, this is a progression.\n\n* LayoutTests/platform/mac-tahoe-wk2-lbse-text/imported/w3c/web-platform-tests/svg/geometry/parsing/height-computed-expected.txt:\n* LayoutTests/platform/mac-tahoe-wk2-lbse-text/imported/w3c/web-platform-tests/svg/geometry/parsing/width-computed-expected.txt:\n\nCanonical link: https://commits.webkit.org/316542@main","order":0,"repository_id":"webkit","timestamp":1783330368},{"author":{"emails":["zimmermann@kde.org","zimmermann@physik.rwth-aachen.de","zimmermann@webkit.org","nzimmermann@blackberry.com","nzimmermann@rim.com","nzimmermann@igalia.com"],"name":"Nikolas Zimmermann"},"branch":"main","hash":"8b35ecea6411bb80f91177f032958dcd174302ff","identifier":"316543@main","message":"[LBSE] Cache the concatenated SVG transform attribute matrix\nhttps://bugs.webkit.org/show_bug.cgi?id=318661\n\nReviewed by Rob Buis.\n\nSVGTransformList::concatenate() walks the transform list and multiplies every\nitem on each read ~ 3 times per animation frame: updateHasSVGTransformFlags ->\nhasTransformRelatedAttributes, updateLocalTransform via applySVGTransform,\nand computeRendererTransformForSVG. The result only changes when the transform\nlist mutates, which always routes through SVGGraphicsElement::svgAttributeChanged.\n\nCache it on SVGGraphicsElement and flush it in svgAttributeChanged, to fix that.\nCovered by existing tests.\n\n* Source/WebCore/rendering/RenderLayerModelObject.cpp:\n(WebCore::RenderLayerModelObject::applySVGTransform const):\n* Source/WebCore/svg/SVGGraphicsElement.cpp:\n(WebCore::SVGGraphicsElement::animatedLocalTransform const):\n(WebCore::SVGGraphicsElement::svgAttributeChanged):\n* Source/WebCore/svg/SVGGraphicsElement.h:\n(WebCore::SVGGraphicsElement::concatenatedTransform const):\n(WebCore::SVGGraphicsElement::invalidateConcatenatedTransformCache const):\n(WebCore::SVGGraphicsElement::hasTransformRelatedAttributes const):\n\nCanonical link: https://commits.webkit.org/316543@main","order":0,"repository_id":"webkit","timestamp":1783330541},{"author":{"emails":["zimmermann@kde.org","zimmermann@physik.rwth-aachen.de","zimmermann@webkit.org","nzimmermann@blackberry.com","nzimmermann@rim.com","nzimmermann@igalia.com"],"name":"Nikolas Zimmermann"},"branch":"main","hash":"74a7d27a4cc3b9285e775856a3e642ed966df371","identifier":"316544@main","message":"[LBSE] Reuse cached m_localTransform at paint instead of re-resolving from style\nhttps://bugs.webkit.org/show_bug.cgi?id=318662\n\nReviewed by Rob Buis.\n\ncomputeRendererTransformForSVG() re-resolved the SVG transform from style on every\npaint (applyTransform: concatenate + transform-origin + matrix multiplies), even\nthough a non-layer SVG renderer already caches that transform in m_localTransform,\njust with a different transform-origin, aligned for the nominal layer paint code\npath. We can easily compute the desired paint transform: translate(nominal) *\nm_localTransform * translate(-nominal), to save the recomputation.\n\nCovered by existing tests.\n\n* Source/WebCore/rendering/RenderLayerSVGAdditions.cpp:\n(WebCore::RenderLayer::computeRendererTransformForSVG const):\n\nCanonical link: https://commits.webkit.org/316544@main","order":0,"repository_id":"webkit","timestamp":1783332191},{"author":{"emails":["zimmermann@kde.org","zimmermann@physik.rwth-aachen.de","zimmermann@webkit.org","nzimmermann@blackberry.com","nzimmermann@rim.com","nzimmermann@igalia.com"],"name":"Nikolas Zimmermann"},"branch":"main","hash":"8c0c37ea12f307d85187524b5d7266b02a4f7b1b","identifier":"316545@main","message":"[LBSE] Cache the SVG viewport size used for the transform reference box\nhttps://bugs.webkit.org/show_bug.cgi?id=318546\n\nReviewed by Rob Buis.\n\ncurrentViewportSizeExcludingZoom() resolves to the SVG root's content box on\nevery call, but the viewport is constant after layout. The default SVG\ntransform-box is view-box, so every transformed shape's reference box re-queried\nit per frame -- from both updateLocalTransform() and during paint in\ncomputeRendererTransformForSVG().\n\nCache it on SVGSVGElement - flush in RenderSVGRoot::layout() and\nRenderSVGViewportContainer::updateLayoutSizeIfNeeded(), which run on\nresize/zoom/viewBox changes.\n\nCovered by existing tests.\n\n* Source/WebCore/rendering/svg/RenderSVGRoot.cpp:\n(WebCore::RenderSVGRoot::layout):\n* Source/WebCore/rendering/svg/RenderSVGViewportContainer.cpp:\n(WebCore::RenderSVGViewportContainer::updateLayoutSizeIfNeeded):\n* Source/WebCore/svg/SVGSVGElement.cpp:\n(WebCore::SVGSVGElement::currentViewportSizeExcludingZoom const):\n(WebCore::SVGSVGElement::computeCurrentViewportSizeExcludingZoom const):\n* Source/WebCore/svg/SVGSVGElement.h:\n\nCanonical link: https://commits.webkit.org/316545@main","order":0,"repository_id":"webkit","timestamp":1783332292},{"author":{"emails":["youennf@gmail.com","youenn@apple.com","yfablet@apple.com"],"name":"Youenn Fablet"},"branch":"main","hash":"a48d2303546c4bb4cce553fc3d8158d1d8e6a4d0","identifier":"316546@main","message":"Make sure that MicrotaskQueue::drainImpl cannot have its micro task dispatcher being GCed while running\nhttps://bugs.webkit.org/show_bug.cgi?id=318667\nrdar://179017690\n\nReviewed by Yusuke Suzuki.\n\nWhen the dispatcher runs, GC can happen, which could destroy the JS microtask dispatcher and its internal dispatcher.\nTo prevent this, we keep the JS micro task dispatcher alive with EnsureStillAliveScope.\n\nTest: streams/tee-byob-microtask-gc-crash.html\n\n* LayoutTests/streams/tee-byob-microtask-gc-crash-expected.txt: Added.\n* LayoutTests/streams/tee-byob-microtask-gc-crash.html: Added.\n* Source/JavaScriptCore/runtime/MicrotaskQueue.cpp:\n(JSC::MicrotaskQueue::drainImpl):\n\nCanonical link: https://commits.webkit.org/316546@main","order":0,"repository_id":"webkit","timestamp":1783337025},{"author":{"emails":["marcosc@apple.com","marcos@marcosc.com"],"name":"Marcos Caceres"},"branch":"main","hash":"c4630c75c34ce74a2fcb8d788d78fc4afbd8c422","identifier":"316547@main","message":"Relocate ISO 18013 mdoc tests to internal identity tests\n\nrdar://181218068\nhttps://bugs.webkit.org/show_bug.cgi?id=318432\n\nReviewed by Anne van Kesteren.\n\nVerifying ISO 18013 conformance is out of scope for the Digital Credentials\nAPI specification, so these mdoc-format tests were removed upstream from\nweb-platform-tests in https://github.com/web-platform-tests/wpt/pull/61038 and\nshould no longer be imported into WebKit. Rather than lose the coverage, they\nare moved out of the imported web-platform-tests digital-credentials suite and\nmaintained as WebKit-internal tests under http/wpt/identity/formats/ISO18013/,\nwhere a future WPT re-import will not duplicate them. Their shared helper.js\nand iframe.html support files are copied alongside, and the module and iframe\npaths are updated for the new location. The three tests that require the\nWebDriver BiDi virtual-wallet testdriver extension remain skipped\n(webkit.org/b/306292).\n\nCanonical link: https://commits.webkit.org/316547@main","order":0,"repository_id":"webkit","timestamp":1783345975},{"author":{"emails":["wenson_hsieh@apple.com","whsieh@berkeley.edu"],"name":"Wenson Hsieh"},"branch":"main","hash":"363d0afe5c5de177b384d85a2e72caa18030d544","identifier":"316548@main","message":"[Text Extraction] Apply the latest set of `replacementStrings` to interaction descriptions\nhttps://bugs.webkit.org/show_bug.cgi?id=318646\nrdar://181448617\n\nReviewed by Abrar Rahman Protyasha and Richard Robinson.\n\nCache the latest `replacementStrings` upon extracting text, and use it to sanitize interaction\ndescription strings retrieved using `-debugDescriptionInWebView:completionHandler:`.\n\nTest: TextExtractionTests.ReplacementStringsAppliedToInteractionDescription\n\n* Source/WebKit/Shared/TextExtractionToStringConversion.cpp:\n(WebKit::foldForReplacement):\n(WebKit::applyReplacements):\n(WebKit::TextExtractionAggregator::applyReplacements):\n* Source/WebKit/Shared/TextExtractionToStringConversion.h:\n* Source/WebKit/UIProcess/API/Cocoa/WKWebView.mm:\n(-[WKWebView _extractDebugTextWithConfigurationWithoutUpdatingFilterRules:assertionScope:completionHandler:]):\n(-[WKWebView _describeInteraction:inFrame:nodeIdentifier:staleNodeNote:shouldResolveStaleNodeIdentifier:completionHandler:]):\n* Source/WebKit/UIProcess/API/Cocoa/WKWebViewInternal.h:\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/TextExtractionTests.mm:\n(TestWebKitAPI::TEST(TextExtractionTests, ReplacementStringsAppliedToInteractionDescription)):\n\nCanonical link: https://commits.webkit.org/316548@main","order":0,"repository_id":"webkit","timestamp":1783347422},{"author":{"emails":["gsnedders@apple.com","me@gsnedders.com"],"name":"Sam Sneddon"},"branch":"main","hash":"3f489e1231c6100cba425d7828e3cc211b30047b","identifier":"316549@main","message":"resultsdbpy: run-tests must add webkitcorepy to sys.path\nhttps://bugs.webkit.org/show_bug.cgi?id=318274\nrdar://181066799\n\nReviewed by Elliott Williams.\n\nThen, with the AutoInstaller available, we can register webkitbugspy\nas a local package.\n\n* Tools/Scripts/libraries/resultsdbpy/run-tests:\n(_maybe_add_webkitcorepy_path):\n\nCanonical link: https://commits.webkit.org/316549@main","order":0,"repository_id":"webkit","timestamp":1783350589},{"author":{"emails":["gsnedders@apple.com","me@gsnedders.com"],"name":"Sam Sneddon"},"branch":"main","hash":"32e492d4320ee92b65bd4e056b4eb5d8fe6d1839","identifier":"316550@main","message":"WPT clone should use same protocol as WebKit\nhttps://bugs.webkit.org/show_bug.cgi?id=277452\nrdar://133417147\n\nReviewed by Elliott Williams.\n\nUse the same protocol (SSH or HTTPS) as the WebKit repository instead of\nalways HTTPS. This avoids authentication friction when exporting W3C tests\nand matches how webkitscmpy handles fork remotes.\n\n* Tools/Scripts/webkitpy/w3c/test_downloader.py:\n(TestDownloader.__init__):\n(TestDownloader._get_webkit_remote_url):\n(TestDownloader):\n(TestDownloader._protocol_from_url):\n(TestDownloader._normalize_url_protocol):\n(TestDownloader.checkout_test_repository):\n* Tools/Scripts/webkitpy/w3c/test_downloader_unittest.py: Added.\n(TestDownloaderProtocolTest):\n(TestDownloaderProtocolTest.test_protocol_from_url_https):\n(TestDownloaderProtocolTest.test_protocol_from_url_http):\n(TestDownloaderProtocolTest.test_protocol_from_url_git):\n(TestDownloaderProtocolTest.test_protocol_from_url_ssh_scheme):\n(TestDownloaderProtocolTest.test_protocol_from_url_scp_like):\n(TestDownloaderProtocolTest.test_protocol_from_url_scp_like_with_user):\n(TestDownloaderProtocolTest.test_protocol_from_url_ftp):\n(TestDownloaderProtocolTest.test_protocol_from_url_ftps):\n(TestDownloaderProtocolTest.test_protocol_from_url_file):\n(TestDownloaderProtocolTest.test_protocol_from_url_local_path):\n(TestDownloaderProtocolTest.test_normalize_url_protocol_https_to_https):\n(TestDownloaderProtocolTest.test_normalize_url_protocol_ssh_to_ssh):\n(TestDownloaderProtocolTest.test_normalize_url_protocol_https_to_ssh):\n(TestDownloaderProtocolTest.test_normalize_url_protocol_ssh_to_https):\n(TestDownloaderProtocolTest.test_normalize_url_protocol_git_to_https):\n(TestDownloaderProtocolTest.test_normalize_url_protocol_ssh_scheme_to_https):\n(TestDownloaderProtocolTest.test_normalize_url_protocol_preserves_path):\n(TestDownloaderProtocolTest.test_normalize_url_protocol_no_change_needed):\n\nCanonical link: https://commits.webkit.org/316550@main","order":0,"repository_id":"webkit","timestamp":1783350694},{"author":{"emails":["koivisto@iki.fi","antti@apple.com","antti.j.koivisto@nokia.com"],"name":"Antti Koivisto"},"branch":"main","hash":"5732b008eeaebce67a602a047966d8339b101c20","identifier":"316551@main","message":"[css-mixins-1] Evaluate container queries inside @function\nhttps://bugs.webkit.org/show_bug.cgi?id=318668\nrdar://181471414\n\nReviewed by Alan Baradlay.\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/function-conditionals-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/function-container-dynamic-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/function-container-self-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/function-shadow-container-expected.txt:\n* Source/WebCore/style/CustomFunctionRegistry.cpp:\n(WebCore::Style::CustomFunction::CustomFunction):\n(WebCore::Style::CustomFunctionRegistry::registerFunction):\n\nInstead of smashing all StyleRuleFunctionDeclarations together eagerly during registration\nwe now pair them with their associated container queries so we can resolve them at\ncomputed style time.\n\n* Source/WebCore/style/CustomFunctionRegistry.h:\n* Source/WebCore/style/RuleSetBuilder.cpp:\n(WebCore::Style::RuleSetBuilder::addChildRule):\n(WebCore::Style::RuleSetBuilder::addMutatingRulesToResolver):\n* Source/WebCore/style/RuleSetBuilder.h:\n* Source/WebCore/style/StyleSubstitutionResolver.cpp:\n(WebCore::Style::SubstitutionResolver::substituteDashedFunction):\n\nEvaluate any container queries to determine which properties to apply in function body.\n\n* Source/WebCore/style/RuleSet.h:\n(WebCore::Style::RuleSet::containerQueryForIdentifier):\n(WebCore::Style::RuleSet::containerQueryChainFor):\n(WebCore::Style::RuleSet::containerQueriesFor):\n* Source/WebCore/style/ElementRuleCollector.cpp:\n(WebCore::Style::ElementRuleCollector::containerQueriesMatch):\n\nAdd helpers for resolving a container query identifier to its wrapping rule chain.\ncontainerQueriesFor now returns the container rules rather than the queries.\n\nCanonical link: https://commits.webkit.org/316551@main","order":0,"repository_id":"webkit","timestamp":1783351861},{"author":{"emails":["ahmad.saleem792@gmail.com","ahmad.saleem792+github@gmail.com","ahmad_saleem@apple.com"],"name":"Ahmad Saleem"},"branch":"main","hash":"9979b0bec00592fa0ce4c217ec9c7326ddf460c9","identifier":"316552@main","message":"Tautological self-assignment in HTMLMediaElement::setMutedInternal\nhttps://bugs.webkit.org/show_bug.cgi?id=318202\nrdar://181005869\n\nReviewed by Jean-Yves Avenard.\n\nInside the `if (!m_explicitlyMuted && !implicitlyMuted())` branch, the\nassignment `m_explicitlyMuted = !m_explicitlyMuted && !implicitlyMuted();`\nre-evaluates a condition that is necessarily true, so it always assigns\ntrue. Replace it with a direct assignment to make the intent clear.\n\n* Source/WebCore/html/HTMLMediaElement.cpp:\n(WebCore::HTMLMediaElement::setMutedInternal):\n\nCanonical link: https://commits.webkit.org/316552@main","order":0,"repository_id":"webkit","timestamp":1783352122},{"author":{"emails":["zimmermann@kde.org","zimmermann@physik.rwth-aachen.de","zimmermann@webkit.org","nzimmermann@blackberry.com","nzimmermann@rim.com","nzimmermann@igalia.com"],"name":"Nikolas Zimmermann"},"branch":"main","hash":"445fc56126c968d0560904ebcb5c9f56b841ff89","identifier":"316553@main","message":"[LBSE] Update two LBSE baselines\nhttps://bugs.webkit.org/show_bug.cgi?id=318683\n\nUnreviewed.\n\nUpdate two baselines, that are passing in LBSE just have a different dump (omitting text nodes\nin dump, and a render tree dump that shows an additional layer).\n\n* LayoutTests/imported/w3c/web-platform-tests/svg/types/SameObject-identity-expected.txt:\n* LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/filters/feImage-remove-target-expected.txt: Added.\n\nCanonical link: https://commits.webkit.org/316553@main","order":0,"repository_id":"webkit","timestamp":1783352372},{"author":{"emails":["a_panta@apple.com"],"name":"Anuj Panta"},"branch":"main","hash":"eb7c162108e248d2a63d561d3c3ccbb7aaa71407","identifier":"316554@main","message":"Web Inspector: [SI] AutoFill / user-script sources missing in Sources tab\nhttps://bugs.webkit.org/show_bug.cgi?id=318471\nrdar://181254900\n\nReviewed by Sihui Liu.\n\nUnder Site Isolation, user scripts (e.g. AutoFill) run in isolated worlds but\nFrameDebugger only attached to the frame's main world, so their sources were\nnever reported. Attach to every world, matching FrameRuntimeAgent.\n\n* Source/WebCore/inspector/FrameDebugger.cpp:\n(WebCore::FrameDebugger::attachDebugger):\n* Source/WebCore/inspector/agents/frame/FrameDebuggerAgent.cpp:\n(WebCore::FrameDebuggerAgent::didClearWindowObjectInWorld):\n\nCanonical link: https://commits.webkit.org/316554@main","order":0,"repository_id":"webkit","timestamp":1783353004},{"author":{"emails":["ysuzuki@apple.com","yusukesuzuki@slowstart.org","utatane.tea@gmail.com"],"name":"Yusuke Suzuki"},"branch":"main","hash":"674917cb5f4d588c52ba90f416b2388af80b237b","identifier":"316555@main","message":"[JSC] Compact Air::Arg size\nhttps://bugs.webkit.org/show_bug.cgi?id=318671\nrdar://181480616\n\nReviewed by Tadeu Zagallo.\n\nSince valid FPImm128 is always u64x2[0] == u64x2[1], only uint64_t is\nenough to hold to represent. This patch drops m_additional and shrinking\nthe size from 32 to 24.\n\n* Source/JavaScriptCore/b3/air/AirArg.cpp:\n(JSC::B3::Air::Arg::jsHash const):\n* Source/JavaScriptCore/b3/air/AirArg.h:\n(JSC::B3::Air::Arg::fpImm128):\n(JSC::B3::Air::Arg::isValidFPImm128Form):\n(JSC::B3::Air::Arg::asV128 const):\n\nCanonical link: https://commits.webkit.org/316555@main","order":0,"repository_id":"webkit","timestamp":1783354246},{"author":{"emails":["youennf@gmail.com","youenn@apple.com","yfablet@apple.com"],"name":"Youenn Fablet"},"branch":"main","hash":"66f5f999eb8546baa1c80ca28ed7b00427dc2f26","identifier":"316556@main","message":"Remove SFrame transform current implementation\nrdar://180389539\nhttps://bugs.webkit.org/show_bug.cgi?id=317641\n\nReviewed by Jean-Yves Avenard.\n\nThe implementation is out of sync with the spec and was never enabled.\nWe can remove it and we will restart from scratch using the updated specification.\n\n* LayoutTests/http/tests/webrtc/sframe-transform-write-expected.txt: Removed.\n* LayoutTests/http/tests/webrtc/sframe-transform-write.html: Removed.\n* LayoutTests/http/wpt/webrtc/sframe-transform-error-expected.txt: Removed.\n* LayoutTests/http/wpt/webrtc/sframe-transform-error-worker.js: Removed.\n* LayoutTests/http/wpt/webrtc/sframe-transform-error.html: Removed.\n* LayoutTests/http/wpt/webrtc/sframe-transform-expected.txt: Removed.\n* LayoutTests/http/wpt/webrtc/sframe-transform-in-worker-expected.txt: Removed.\n* LayoutTests/http/wpt/webrtc/sframe-transform-readable-crash-expected.txt: Removed.\n* LayoutTests/imported/w3c/web-platform-tests/webrtc-encoded-transform/RTCEncodedFrame-copy-construction.https-expected.txt:\n* LayoutTests/platform/glib/TestExpectations:\n* LayoutTests/platform/mac-wk2/TestExpectations:\n* LayoutTests/platform/win/TestExpectations:\n* LayoutTests/streams/writable-stream-create-within-multiple-workers-crash-expected.txt: Removed.\n* LayoutTests/streams/writable-stream-create-within-multiple-workers-crash.html: Removed.\n* LayoutTests/webrtc/audio-sframe-expected.txt: Removed.\n* LayoutTests/webrtc/audio-sframe.html: Removed.\n* LayoutTests/webrtc/sframe-keys-expected.txt: Removed.\n* LayoutTests/webrtc/sframe-keys.html: Removed.\n* LayoutTests/webrtc/sframe-test-vectors-expected.txt: Removed.\n* LayoutTests/webrtc/sframe-test-vectors.html: Removed.\n* LayoutTests/webrtc/sframe-transform-buffer-source-expected.txt: Removed.\n* LayoutTests/webrtc/sframe-transform-buffer-source.html: Removed.\n* LayoutTests/webrtc/video-sframe-expected.txt: Removed.\n* LayoutTests/webrtc/video-sframe.html: Removed.\n* Source/WebCore/CMakeLists.txt:\n* Source/WebCore/DerivedSources-input.xcfilelist:\n* Source/WebCore/DerivedSources-output.xcfilelist:\n* Source/WebCore/DerivedSources.make:\n* Source/WebCore/Headers.cmake:\n* Source/WebCore/Modules/mediastream/RTCRtpReceiver+Transform.idl:\n* Source/WebCore/Modules/mediastream/RTCRtpReceiver.cpp:\n(WebCore::RTCRtpReceiver::transform):\n* Source/WebCore/Modules/mediastream/RTCRtpReceiver.h:\n* Source/WebCore/Modules/mediastream/RTCRtpReceiverWithTransform.h:\n(WebCore::RTCRtpReceiverWithTransform::transform):\n(WebCore::RTCRtpReceiverWithTransform::setTransform):\n* Source/WebCore/Modules/mediastream/RTCRtpSFrameTransform.cpp: Removed.\n* Source/WebCore/Modules/mediastream/RTCRtpSFrameTransform.h: Removed.\n* Source/WebCore/Modules/mediastream/RTCRtpSFrameTransform.idl: Removed.\n* Source/WebCore/Modules/mediastream/RTCRtpSFrameTransformer.cpp: Removed.\n* Source/WebCore/Modules/mediastream/RTCRtpSFrameTransformer.h: Removed.\n* Source/WebCore/Modules/mediastream/RTCRtpSFrameTransformerCocoa.cpp: Removed.\n* Source/WebCore/Modules/mediastream/RTCRtpSFrameTransformerOpenSSL.cpp: Removed.\n* Source/WebCore/Modules/mediastream/RTCRtpSender+Transform.idl:\n* Source/WebCore/Modules/mediastream/RTCRtpSender.cpp:\n(WebCore::RTCRtpSender::transform):\n* Source/WebCore/Modules/mediastream/RTCRtpSender.h:\n* Source/WebCore/Modules/mediastream/RTCRtpSenderWithTransform.h:\n(WebCore::RTCRtpSenderWithTransform::transform):\n(WebCore::RTCRtpSenderWithTransform::setTransform):\n* Source/WebCore/Modules/mediastream/RTCRtpTransform.cpp:\n(WebCore::RTCRtpTransform::from):\n(WebCore::RTCRtpTransform::isAttached const):\n(WebCore::RTCRtpTransform::attachToReceiver):\n(WebCore::RTCRtpTransform::attachToSender):\n(WebCore::RTCRtpTransform::backendTransferedToNewTransform):\n(WebCore::RTCRtpTransform::clearBackend):\n(WebCore::operator==):\n* Source/WebCore/Modules/mediastream/RTCRtpTransform.h:\n* Source/WebCore/SaferCPPExpectations/UncountedCallArgsCheckerExpectations:\n* Source/WebCore/Sources.txt:\n* Source/WebCore/SourcesCocoa.txt:\n* Source/WebCore/WebCore.xcodeproj/project.pbxproj:\n* Source/WebCore/bindings/js/JSRTCRtpSFrameTransformCustom.cpp: Removed.\n* Source/WebCore/bindings/js/WebCoreBuiltinNames.h:\n* Source/WebCore/crypto/cocoa/CryptoUtilitiesCocoa.h:\n* Source/WebCore/dom/EventTargetFactory.in:\n* Source/WebCore/platform/SourcesGStreamer.txt:\n* Source/WebCore/testing/Internals.cpp:\n(WebCore::Internals::setSFrameCounter): Deleted.\n(WebCore::Internals::sframeCounter): Deleted.\n(WebCore::Internals::sframeKeyId): Deleted.\n* Source/WebCore/testing/Internals.h:\n* Source/WebCore/testing/Internals.idl:\n* Tools/TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:\n* Tools/TestWebKitAPI/Tests/WebCore/RTCRtpSFrameTransformerTests.cpp: Removed.\n\nCanonical link: https://commits.webkit.org/316556@main","order":0,"repository_id":"webkit","timestamp":1783355632},{"author":{"emails":["taher_ali@apple.com"],"name":"Taher Ali"},"branch":"main","hash":"eb617fc2899ad5c540d73f03d27f00963203b843","identifier":"316557@main","message":"SVGProperty::contextElement after stopAnimation drops m_animVal without detach()\nhttps://bugs.webkit.org/show_bug.cgi?id=318365\nrdar://177599904\n\nReviewed by Simon Fraser.\n\nSVGAnimatedValueProperty<T>::ensureAnimVal() creates the animVal SVGProperty\nwith |this| as the raw SVGProperty::m_owner back-pointer. The destructor clears\nit via detach(), but stopAnimation() and instanceStopAnimationImpl() set\nm_animVal = nullptr without detaching first. Since the animVal is exposed to script via\nSVGAnimatedLength.animVal and the JS wrapper holds an independent Ref, it can\noutlive the SVGAnimatedValueProperty, leaving m_owner dangling. A later\nlen.value read reaches SVGProperty::contextElement() through freed memory.\n\nSVGAnimatedPropertyList<T> has the identical pattern and is fixed the same way.\n\nDetach m_animVal before releasing or overwriting it, via a detachAnimVal()\nhelper that mirrors the destructor.\n\nTest: svg/animations/animVal-detach-after-stopAnimation-crash.html\n\n* LayoutTests/svg/animations/animVal-detach-after-stopAnimation-crash-expected.txt: Added.\n* LayoutTests/svg/animations/animVal-detach-after-stopAnimation-crash.html: Added.\n* Source/WebCore/svg/properties/SVGAnimatedPropertyList.h:\n(WebCore::SVGAnimatedPropertyList::detachAnimVal):\n* Source/WebCore/svg/properties/SVGAnimatedValueProperty.h:\n(WebCore::SVGAnimatedValueProperty::detachAnimVal):\n\nCanonical link: https://commits.webkit.org/316557@main","order":0,"repository_id":"webkit","timestamp":1783355928},{"author":{"emails":["ahmad.saleem792@gmail.com","ahmad.saleem792+github@gmail.com","ahmad_saleem@apple.com"],"name":"Ahmad Saleem"},"branch":"main","hash":"6cda38154aafc2d06ab324d18ae19610c4330053","identifier":"316558@main","message":"Extract duplicated reflection/replica layer update into RenderLayerBacking::updateReflectionLayer()\nhttps://bugs.webkit.org/show_bug.cgi?id=318609\nrdar://181403209\n\nReviewed by Simon Fraser.\n\nRenderLayerBacking::updateConfigurationAfterStyleChange() and\nRenderLayerBacking::updateConfiguration() each contained an identical six-line\nblock that wires up (or clears) the replica GraphicsLayer for a reflection.\nFactor it into a single updateReflectionLayer() helper and call it from both\nsites. No behavior change.\n\n* Source/WebCore/rendering/RenderLayerBacking.cpp:\n(WebCore::RenderLayerBacking::updateReflectionLayer):\n(WebCore::RenderLayerBacking::updateConfigurationAfterStyleChange):\n(WebCore::RenderLayerBacking::updateConfiguration):\n* Source/WebCore/rendering/RenderLayerBacking.h:\n\nCanonical link: https://commits.webkit.org/316558@main","order":0,"repository_id":"webkit","timestamp":1783357143},{"author":{"emails":["charliew@apple.com"],"name":"Charlie Wolfe"},"branch":"main","hash":"b88fdb90af4d3363fb018f3e9140bfdc57ce5afb","identifier":"316559@main","message":"Suppress duplicate CSP reports for speculative preloads\nhttps://bugs.webkit.org/show_bug.cgi?id=318371\nrdar://181161362\n\nReviewed by Ryan Reno.\n\nSpeculative preloads and the subsequent parser-driven load both run CSP checks, causing blocked\nresources to emit duplicate violation reports and events.\n\nDisable all CSP reporting during speculative preloads, while preserving normal reporting for\n`<link rel=preload>`. The parser-driven load still performs the authoritative CSP check and reports\neach violation once.\n\n* LayoutTests/imported/w3c/web-platform-tests/content-security-policy/reporting-api/reporting-api-report-to-only-sends-reports-to-first-endpoint.https.sub-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/content-security-policy/reporting/report-multiple-violations-01-expected.txt:\n* Source/WebCore/loader/cache/CachedResourceLoader.cpp:\n(WebCore::CachedResourceLoader::allowedByContentSecurityPolicy const):\n* Source/WebCore/page/csp/ContentSecurityPolicy.h:\n\nCanonical link: https://commits.webkit.org/316559@main","order":0,"repository_id":"webkit","timestamp":1783357484},{"author":{"emails":["aakash_jain@apple.com","aj355@cornell.edu"],"name":"Aakash Jain"},"branch":"main","hash":"e91c6d086e046c43736bb61a471e214a19b3a4ee","identifier":"316560@main","message":"Set explicit allowed_origins for Buildbot www configuration\nhttps://bugs.webkit.org/show_bug.cgi?id=318580\nrdar://problem/180322016\n\nReviewed by Ryan Haddad.\n\nReplace the wildcard allowed_origins with an explicit list.\n\n* Tools/CISupport/build-webkit-org-webserver/master.cfg:\n* Tools/CISupport/ews-build-webserver/master.cfg:\n* Tools/CISupport/ews-build/master.cfg:\n\nCanonical link: https://commits.webkit.org/316560@main","order":0,"repository_id":"webkit","timestamp":1783359468},{"author":{"emails":["mwyrzykowski@apple.com"],"name":"Mike Wyrzykowski"},"branch":"main","hash":"7acb7e51d3a86bbbf7bebcf52abf3f3d28a59e93","identifier":"316561@main","message":"\"Pipeline layout is invalid\" opening grenzwert.net/wasm-modules/MedicalViewer/MedicalViewe\nhttps://bugs.webkit.org/show_bug.cgi?id=318576\nrdar://181343044\n\nReviewed by Dan Glastonbury.\n\nSite works in Chrome but was failing in Safari since it assumed enabling\nall features also enabled texture-formaters-tier2, which is supported on all\nApple hardware, but we didn't report it as supported.\n\nAdding support fixes the site error.\n\n* Source/WebCore/Modules/WebGPU/GPUAdapter.cpp:\n(WebCore::convertFeatureNameToEnum):\n* Source/WebCore/Modules/WebGPU/GPUFeatureName.h:\n(WebCore::convertToBacking):\n* Source/WebCore/Modules/WebGPU/GPUFeatureName.idl:\n* Source/WebCore/Modules/WebGPU/Implementation/WebGPUAdapterImpl.cpp:\n(WebCore::WebGPU::AdapterImpl::requestDevice):\n* Source/WebCore/Modules/WebGPU/Implementation/WebGPUConvertToBackingContext.cpp:\n(WebCore::WebGPU::ConvertToBackingContext::convertToBacking):\n* Source/WebCore/Modules/WebGPU/InternalAPI/WebGPUFeatureName.h:\n* Source/WebGPU/WebGPU/HardwareCapabilities.mm:\n(WebGPU::baseFeatures):\n* Source/WebGPU/WebGPU/ShaderModule.mm:\n(wgpuAdapterFeatureName):\n* Source/WebGPU/WebGPU/Texture.mm:\n(WebGPU::Texture::hasStorageBindingCapability):\n* Source/WebGPU/WebGPU/WebGPU.h:\n* Source/WebKit/Shared/WebGPU/WebGPUFeatureName.serialization.in:\n\nCanonical link: https://commits.webkit.org/316561@main","order":0,"repository_id":"webkit","timestamp":1783359889},{"author":{"emails":["achristensen@apple.com","achristensen@webkit.org","alex.christensen@flexsim.com"],"name":"Alex Christensen"},"branch":"main","hash":"ed59e5db11a87df7a4b2718067a42b657e32850f","identifier":"316562@main","message":"Add missing serialization.in enum values\nhttps://bugs.webkit.org/show_bug.cgi?id=318504\nrdar://181285283\n\nReviewed by Alexey Proskuryakov.\n\nWhen receiving an integer over IPC that is supposed to be an enum,\nif it isn't a valid enum value from a serialization.in file, we assume\nthe process is compromised and terminate it.  That means we need to have\nall valid values in serialization.in files.\n\nThis adds the missing values, and removes the default from the generated\nswitch statement so we see a warning if we have missed any.\n\n* Source/WebKit/NetworkProcess/PrivateClickMeasurement/PrivateClickMeasurementManagerInterface.serialization.in:\n* Source/WebKit/Scripts/generate-serializers.py:\n(generate_impl):\n* Source/WebKit/Scripts/webkit/tests/GeneratedSerializers.cpp:\n(WTF::isValidEnum<EnumNamespace::BoolEnumType>):\n(WTF::isValidEnum<EnumWithoutNamespace>):\n(WTF::isValidEnum<EnumNamespace::EnumType>):\n(WTF::isValidEnum<EnumNamespace::InnerEnumType>):\n(WTF::isValidEnum<EnumNamespace::InnerBoolType>):\n* Source/WebKit/Shared/JavaScriptCore.serialization.in:\n* Source/WebKit/Shared/WebCoreArgumentCoders.serialization.in:\n* Source/WebKit/Shared/WebCoreArgumentCodersMedia.serialization.in:\n* Source/WebKit/Shared/WebCoreArgumentCodersPlatform.serialization.in:\n\nCanonical link: https://commits.webkit.org/316562@main","order":0,"repository_id":"webkit","timestamp":1783359974},{"author":{"emails":["jespinal23@apple.com"],"name":"Jetzel Espinal"},"branch":"main","hash":"e6c2d2e32f7e69667ab8a17ddfa1a52939a40ec8","identifier":"316563@main","message":"[GARDENING] TestIPC.IPCSerialization.SecTrustRef (api-test) is constant fail on Tahoe x86_64.\nhttps://bugs.webkit.org/show_bug.cgi?id=318586\nrdar://181355011\n\nUnreviewed test gardening.\n\n* TestExpectations/apitests:\n\nCanonical link: https://commits.webkit.org/316563@main","order":0,"repository_id":"webkit","timestamp":1783360498},{"author":{"emails":["aestes@apple.com"],"name":"Andy Estes"},"branch":"main","hash":"957798604e6f9a4a4b4948dda7e29773f00a72f1","identifier":"316564@main","message":"[iOS] -activateWithError: and -suspendWithError: are deprecated\nhttps://bugs.webkit.org/show_bug.cgi?id=318694\nrdar://181509401\n\nUnreviewed build fix. Silenced deprecation warnings.\n\n* Source/WebKit/UIProcess/Cocoa/ExtensionCapabilityGranter.mm:\n(WebKit::ExtensionCapabilityGranter::setMediaCapabilityActive):\n\nCanonical link: https://commits.webkit.org/316564@main","order":0,"repository_id":"webkit","timestamp":1783361154},{"author":{"emails":["ryanhaddad@apple.com"],"name":"Ryan Haddad"},"branch":"main","hash":"d0e78ef619435010cd969e67eee1655e992bb3f7","identifier":"316565@main","message":"[webkit-bot] Support the --issue flag and handle errors when reverting with git-webkit\nhttps://bugs.webkit.org/show_bug.cgi?id=318275\nrdar://181067423\n\nReviewed by Aakash Jain.\n\nCredit goes to Brianna Fan for the first draft of these changes.\n\nThe most important changes are adding support for the --issue flag (so a\nrevert can reuse an existing Bugzilla bug) and handling git-webkit errors\nand merge conflicts. There are also a handful of smaller fixes. All of the\ngit-webkit revert behavior remains gated behind the USE_GIT_WEBKIT_REVERT\nenvironment variable.\n\n* Tools/WebKitBot/src/WebKitBot.mjs:\n- buildGitWebkitRevertCommand: New shared helper for building git-webkit revert args.\n- extractTextIfMentioned: Strip Slack auto-linked URLs.\n- postMessage: New wrapper to disable link unfurling on all messages.\n- revertCommand / revertWithPRCommand: Support bug URLs as the --issue argument; handle\n  merge conflicts (list files, mention the created bug) and already-reverted errors.\n- dryRevertCommand: Support bug URLs as the --issue argument; preview the git-webkit\n  command when the feature flag is enabled.\n- generateRevertingPatchWithGitWebkit: Switch from execFileAsync to spawn for real-time output.\n- execInWebKitDirectorySimple: Fix locale warnings by passing PATH, HOME, LC_ALL, LANG.\n- cleanUpWorkingCopy: Clean up leftover branches.\n\nCanonical link: https://commits.webkit.org/316565@main","order":0,"repository_id":"webkit","timestamp":1783362980},{"author":{"emails":["ryanhaddad@apple.com"],"name":"Ryan Haddad"},"branch":"main","hash":"842b183cf9826a4df6246e83e0ede733f03de195","identifier":"316566@main","message":"[EWS] iOS-26-Simulator-WPT-WK2-Tests-EWS `run-layout-tests-without-change` step ran all tests instead of only the failing ones\nhttps://bugs.webkit.org/show_bug.cgi?id=317963\nrdar://180755064\n\nReviewed by Aakash Jain.\n\nThe iOS WPT EWS builders scope themselves to running the tests in `imported/w3c/web-platform-tests`\nby passing along that path via  `additionalArguments` in config.json. For the\n`run-layout-tests-without-change` step we append `--skipped=always` plus the subset of tests\nthat failed in the prior runs in order to only re-run those on the clean tree. However, the\ndirectory path contributed by `additionalArguments` was left on the command line, so run-webkit-tests\nran the union of the whole directory and the subset, defeating the optimization and running the full suite.\n\n* Tools/CISupport/ews-build/steps.py:\n(RunWebKitTestsWithoutChange.setLayoutTestCommand):\n(RunWebKitTestsWithoutChange.positional_test_paths_from_additional_arguments): Strip the\npositional test paths that came from `additionalArguments` before appending the failing subset,\nwhile preserving flags such as `--child-processes` and `--site-isolation-enabled-by-default`\nas well as the value passed to `--exclude-tests`.\n* Tools/CISupport/ews-build/steps_unittest.py: Add unit tests.\n(TestRunWebKitTestsWithoutChange.test_run_subtest_tests_success):\n(TestRunWebKitTestsWithoutChange):\n(TestRunWebKitTestsWithoutChange.test_run_subtest_tests_strips_wpt_directory_from_additional_arguments):\n(TestRunWebKitTestsWithoutChange.test_run_subtest_tests_preserves_flags_and_exclude_value):\n\nCanonical link: https://commits.webkit.org/316566@main","order":0,"repository_id":"webkit","timestamp":1783363096},{"author":{"emails":["sabouhallawa@apple.com","said@apple.com"],"name":"Said Abou-Hallawa"},"branch":"main","hash":"aa5d33136b6fe84d175361947adbd3c8d9dec6df","identifier":"316567@main","message":"FilterRenderingOption::FastAndLowQuality should be added to serialization.in\nhttps://bugs.webkit.org/show_bug.cgi?id=318560\nrdar://181335254\n\nReviewed by Alex Christensen.\n\nFastAndLowQuality was added to the enum FilterRenderingOption In 313563@main. The\nmain purpose of adding it was to make snapshot for page color sampling fast. This snapshotting happens in WebContent process right now so it does not need to be\nserialized to GPUProcess.\n\nBut in the future we may move this snapshotting to GPUProcess, like for site-\nisolation for example. Or other uses for FastAndLowQuality are discovered.\n\n* Source/WebKit/Shared/WebCoreArgumentCodersPlatform.serialization.in:\n\nCanonical link: https://commits.webkit.org/316567@main","order":0,"repository_id":"webkit","timestamp":1783363205},{"author":{"emails":["rkonda2@apple.com","ruthvikkonda@gmail.com"],"name":"Ruthvik Konda"},"branch":"main","hash":"0181991daacad1d59eb2207a50070c8f487772bb","identifier":"316568@main","message":"RemoteMediaPlayerProxy::createAudioSourceProvider should reject duplicate IPC\nhttps://bugs.webkit.org/show_bug.cgi?id=313571\nrdar://175035393\n\nReviewed by Eric Carlson.\n\nA well-behaved WebContent process sends CreateAudioSourceProvider at most once per\nRemoteMediaPlayerProxy. A second message reaches AudioSourceProviderAVFObjC's\nsetConfigureAudioStorageCallback / setAudioCallback, which overwrite the callbacks\nwithout taking tapStorage->lock while a MediaToolbox thread may be invoking them\nunder that lock, freeing the captured RemoteAudioSourceProviderProxy mid-use.\nReject the duplicate message with a MESSAGE_CHECK.\n\n* LayoutTests/ipc/create-audio-source-provider-twice-expected.txt: Added.\n* LayoutTests/ipc/create-audio-source-provider-twice.html: Added.\n* Source/WebKit/GPUProcess/media/RemoteMediaPlayerProxy.cpp:\n(WebKit::RemoteMediaPlayerProxy::createAudioSourceProvider):\n\nOriginally-landed-as: 305413.810@safari-7624-branch (c5c267219314). rdar://180429279\nCanonical link: https://commits.webkit.org/316568@main","order":0,"repository_id":"webkit","timestamp":1783363551},{"author":{"emails":["ahmad.saleem792@gmail.com","ahmad.saleem792+github@gmail.com","ahmad_saleem@apple.com"],"name":"Ahmad Saleem"},"branch":"main","hash":"7e532f6ae20014b45fc62f2c3b246878236d9e3f","identifier":"316569@main","message":"MediaUsageInfo::outsideOfFullscreen is inverted, reporting media inside fullscreen as outside (and vice versa)\nhttps://bugs.webkit.org/show_bug.cgi?id=318204\nrdar://181007466\n\nReviewed by Brent Fulgham.\n\nMediaElementSession::updateMediaUsageIfChanged() computes the\noutsideOfFullscreen flag as `element->isDescendantOf(*fullscreenElement)`,\nwhich is true when the media element is *inside* the fullscreen element --\nthe opposite of what the flag name and its consumer mean. The value flows\nthrough MediaUsageInfo::outsideOfFullscreen to the USVideoMetadataKeyOutsideOfFullscreen\nkey consumed by the UsageTracking (ScreenTime) framework, so ScreenTime was\nfed inverted fullscreen metadata.\n\nThe negation was present when the flag was introduced (210518) and matches\nthe sibling idiom in canShowControlsManager() (\"Elements which are not\ndescendants of the current fullscreen element cannot be main content\"), but\nthe `!` was dropped in 273330@main during the mechanical refactor that\nwrapped the access in fullscreenManagerIfExists().\n\nRestore the negation so the flag is true exactly when the media element is\nnot nested within the current fullscreen element. Added test case so we don't\nregress this in future.\n\nTest: media/media-usage-outside-fullscreen.html\n\n* LayoutTests/media/media-usage-outside-fullscreen-expected.txt: Added.\n* LayoutTests/media/media-usage-outside-fullscreen.html: Added.\n* Source/WebCore/html/MediaElementSession.cpp:\n(WebCore::MediaElementSession::updateMediaUsageIfChanged):\n\nCanonical link: https://commits.webkit.org/316569@main","order":0,"repository_id":"webkit","timestamp":1783363843},{"author":{"emails":["gsnedders@apple.com","me@gsnedders.com"],"name":"Sam Sneddon"},"branch":"main","hash":"d2cf4fa3541de9571c70aee9c67fedbb6a90b0e2","identifier":"316570@main","message":"Remove `TestShard` `pack`/`unpack` path-prefix compression\nhttps://bugs.webkit.org/show_bug.cgi?id=318242\nrdar://181048883\n\nReviewed by Elliott Williams.\n\n`TestShard.pack` reconstructed each `TestInput` while substituting the\nshard name prefix into every string field via shorten/expand. The\ndump+load round-trip for the full layout-tests suite takes ~2.1s\nlocally with pack and ~0.46s without (pickling within a single\nprocess). This dwarfs the cost of a few MB of IPC it saves.\n\nAdditionally, the `TestShard` `__getstate__`/`__setstate__` requires\nupdates for every new field added to the underlying model classes, but\nwe cannot declare `__getstate__`/`__setstate__` on `TestInput` and\n`Test` because it requires the context of the `TestShard`'s name, thus\nmaking it easy to forget, and easy to lose data as a result of this.\n\nWith that downside, and with the lack of a performance upside, we\nsimply drop this \"optimisation\" generally.\n\n* Tools/Scripts/webkitpy/layout_tests/controllers/layout_test_runner.py:\n(TestShard.shorten): Deleted.\n(TestShard.expand): Deleted.\n(TestShard.pack): Deleted.\n(TestShard.__getstate__): Deleted.\n(TestShard.__setstate__): Deleted.\n* Tools/Scripts/webkitpy/layout_tests/controllers/layout_test_runner_unittest.py:\n(ShardTests): Deleted.\n(ShardTests.test_pickle): Deleted.\n\nCanonical link: https://commits.webkit.org/316570@main","order":0,"repository_id":"webkit","timestamp":1783364584},{"author":{"emails":["ntim@apple.com","ntim.bugs@gmail.com"],"name":"Tim Nguyen"},"branch":"main","hash":"0b85f13185f5720036900ad6ae7ffe726c47a98c","identifier":"316571@main","message":"REGRESSION (Safari 18.x): Copy main menu item is enabled with no selection in the web page\nhttps://bugs.webkit.org/show_bug.cgi?id=313835\nrdar://176061974\n\nReviewed by Megan Gardner and Wenson Hsieh.\n\n288559@main changed Editor::canCopy to return true for carets in non-editable\npositions so that document.execCommand(\"copy\") would fire copy events even\nwithout a range selection. This regressed the Copy menu item, which is now\nenabled whenever the caret was anywhere on a non-editable page.\n\nFix by reverting canCopy to require a range selection (restoring the correct\nmenu item state), and instead preserving 288559@main's execCommand behavior\nvia allowExecutionWhenDisabledCopyCut: when the copy/cut command is disabled\nfrom a DOM source, allow execution anyway if clipboard access is currently\npermitted (i.e. there is a user gesture or JavaScriptCanAccessClipboard is\ntrue). This lets oncopy handlers fire from user-gesture-driven execCommand\ncalls on pages without a selection, while keeping programmatic calls without\na user gesture fully blocked (including suppressing the copy event).\n\nAlso, return the actual copy/cut success from executeCopy/executeCut instead\nof always returning true, and only beep on failed copy/cut when the call\noriginates from the menu or a key binding.\n\n* LayoutTests/editing/execCommand/enabling-and-selection-2-expected.txt:\n* LayoutTests/editing/execCommand/enabling-and-selection-2.html:\n* LayoutTests/editing/execCommand/enabling-and-selection-expected.txt:\n* LayoutTests/editing/execCommand/enabling-and-selection.html:\n* LayoutTests/imported/w3c/web-platform-tests/editing/other/exec-command-without-editable-element.tentative-expected.txt:\n* LayoutTests/platform/glib/imported/w3c/web-platform-tests/editing/other/paste-clipboard-change.tentative_id=contenteditable-expected.txt:\n* LayoutTests/platform/glib/imported/w3c/web-platform-tests/editing/other/paste-clipboard-change.tentative_id=text-expected.txt:\n* LayoutTests/platform/gtk/imported/w3c/web-platform-tests/editing/other/exec-command-without-editable-element.tentative-expected.txt:\n* LayoutTests/platform/wpe/imported/w3c/web-platform-tests/editing/other/paste-in-list-with-inline-style.tentative-expected.txt:\n* LayoutTests/platform/wpe/imported/w3c/web-platform-tests/editing/other/paste-text-after-collapsible-white-space-whose-container-remove-non-first-children-expected.txt:\n* Source/WTF/wtf/MainThread.h:\n* Source/WTF/wtf/ThreadAssertions.h:\n* Source/WTF/wtf/cocoa/MainThreadCocoa.mm:\n(WTF::isMainThread):\n* Source/WebCore/dom/UserGestureIndicator.h:\n* Source/WebCore/editing/Editor.cpp:\n(WebCore::Editor::canCopy const):\n(WebCore::Editor::cut):\n(WebCore::Editor::copy):\n* Source/WebCore/editing/EditorCommand.cpp:\n(WebCore::executeCopy):\n(WebCore::executeCut):\n(WebCore::allowCopyCutFromDOM):\n(WebCore::allowExecutionWhenDisabledCopyCut):\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/WKWebViewEditActions.mm:\n(TestWebKitAPI::TEST(WKWebViewEditActions, CopyMenuItemDisabledWithNoSelection)):\n\nCanonical link: https://commits.webkit.org/316571@main","order":0,"repository_id":"webkit","timestamp":1783365159},{"author":{"emails":["mcatanzaro@gnome.org","mcatanzaro@redhat.com","mcatanzaro@igalia.com"],"name":"Michael Catanzaro"},"branch":"main","hash":"e284f1e3e8e49d65a150675ec79b1dd8fca9cd75","identifier":"316572@main","message":"Update to PDF.js v6.1.200\nhttps://bugs.webkit.org/show_bug.cgi?id=273435\n\nReviewed by Tim Nguyen.\n\nThis update notably fixes CVE-2024-4367.\n\nI've added new instructions for deleting prebuilt wasm content, so we\ncan resolve bug 273435.\n\n* Source/ThirdParty/pdfjs/PdfJSFiles.cmake:\n* Source/ThirdParty/pdfjs/README.webkit:\n* Source/ThirdParty/pdfjs/build/pdf.mjs:\n* Source/ThirdParty/pdfjs/build/pdf.sandbox.mjs:\n* Source/ThirdParty/pdfjs/build/pdf.worker.mjs:\n* Source/ThirdParty/pdfjs/web/debugger.css:\n(#PDFBug):\n(.pdfBugGroupsLayer):\n(.showDebugBoxes &):\n(.showDebugBoxes):\n* Source/ThirdParty/pdfjs/web/debugger.mjs:\n* Source/ThirdParty/pdfjs/web/iccs/CGATS001Compat-v2-micro.icc: Added.\n* Source/ThirdParty/pdfjs/web/iccs/LICENSE: Added.\n* Source/ThirdParty/pdfjs/web/images/altText_disclaimer.svg: Added.\n* Source/ThirdParty/pdfjs/web/images/altText_spinner.svg: Added.\n* Source/ThirdParty/pdfjs/web/images/altText_warning.svg: Added.\n* Source/ThirdParty/pdfjs/web/images/checkmark.svg: Added.\n* Source/ThirdParty/pdfjs/web/images/comment-actionsButton.svg: Added.\n* Source/ThirdParty/pdfjs/web/images/comment-closeButton.svg: Added.\n* Source/ThirdParty/pdfjs/web/images/comment-editButton.svg: Added.\n* Source/ThirdParty/pdfjs/web/images/comment-popup-editButton.svg: Added.\n* Source/ThirdParty/pdfjs/web/images/editor-toolbar-edit.svg: Added.\n* Source/ThirdParty/pdfjs/web/images/messageBar_closingButton.svg: Added.\n* Source/ThirdParty/pdfjs/web/images/messageBar_info.svg: Added.\n* Source/ThirdParty/pdfjs/web/images/messageBar_warning.svg: Added.\n* Source/ThirdParty/pdfjs/web/images/pages_closeButton.svg: Added.\n* Source/ThirdParty/pdfjs/web/images/pages_selected.svg: Added.\n* Source/ThirdParty/pdfjs/web/images/pages_viewArrow.svg: Added.\n* Source/ThirdParty/pdfjs/web/images/pages_viewButton.svg: Added.\n* Source/ThirdParty/pdfjs/web/images/toolbarButton-editorSignature.svg: Added.\n* Source/ThirdParty/pdfjs/web/images/toolbarButton-viewsManagerToggle.svg: Renamed from Source/ThirdParty/pdfjs/web/images/toolbarButton-sidebarToggle.svg.\n* Source/ThirdParty/pdfjs/web/locale/ach/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/af/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/an/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/ar/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/ast/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/az/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/be/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/bg/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/bn/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/bo/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/bqi/viewer.ftl: Added.\n* Source/ThirdParty/pdfjs/web/locale/br/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/brx/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/bs/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/ca/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/cak/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/ckb/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/cs/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/cy/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/da/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/de/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/dsb/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/el/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/en-CA/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/en-GB/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/en-US/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/eo/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/es-AR/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/es-CL/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/es-ES/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/es-MX/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/et/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/eu/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/fa/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/ff/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/fi/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/fr/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/fur/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/fy-NL/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/ga-IE/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/gd/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/gl/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/gn/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/gu-IN/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/he/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/hi-IN/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/hr/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/hsb/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/hu/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/hy-AM/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/hye/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/ia/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/id/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/is/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/it/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/ja/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/ka/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/kab/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/kk/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/km/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/kn/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/ko/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/lij/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/lo/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/locale.json:\n* Source/ThirdParty/pdfjs/web/locale/lt/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/ltg/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/lv/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/meh/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/mk/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/ml/viewer.ftl: Added.\n* Source/ThirdParty/pdfjs/web/locale/mr/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/ms/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/my/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/nb-NO/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/ne-NP/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/nl/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/nn-NO/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/oc/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/pa-IN/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/pl/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/pt-BR/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/pt-PT/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/rm/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/ro/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/ru/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/sat/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/sc/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/scn/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/sco/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/si/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/sk/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/skr/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/sl/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/son/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/sq/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/sr/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/sv-SE/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/szl/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/ta/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/te/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/tg/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/th/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/tl/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/tr/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/trs/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/uk/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/ur/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/uz/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/vi/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/wo/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/xh/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/zh-CN/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/zh-TW/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/viewer.css:\n(.messageBar):\n(display:flex;):\n(button):\n(.closeButton):\n(&:is(:hover, :active, :focus)::before):\n(&:hover):\n(&:active):\n(&:focus):\n(> span):\n(#editorUndoBar):\n(position:fixed;):\n(#editorUndoBarUndoButton):\n(> div):\n(.dialog):\n(@media screen and (forced-colors: active) --dialog-bg-color:Canvas;):\n(@media screen and (forced-colors: active) font:message-box;):\n(@media screen and (forced-colors: active) .title):\n(.dialogSeparator):\n(.dialogButtonsGroup):\n(.radio):\n(&:checked):\n(> .radioLabel):\n(button:not(:is(.toggle-button, .closeButton, .clearInputButton))):\n(&.secondaryButton):\n(&:disabled):\n(&.primaryButton):\n(a):\n(textarea):\n(input[type=\"text\"]):\n(align-self:stretch;):\n(.description):\n(.toggler):\n(.textLayer):\n(:is(span, br)):\n(--min-font-size:1;):\n(.markedContent):\n(span[role=\"img\"]):\n(.highlight):\n(margin:-1px;):\n(&.begin):\n(&.end):\n(&.middle):\n(&.selected):\n(::-moz-selection):\n(::selection):\n(&.selectionRendering):\n(br::-moz-selection):\n(br::selection):\n(.endOfContent):\n(&.selecting .endOfContent):\n(.textLayerImages):\n(.annotationLayer):\n(.linkAnnotation):\n(& > a:hover):\n(.popupAnnotation .popup):\n(.highlightArea:hover::after):\n(.popupAnnotation.focused .popup):\n(position:absolute;):\n(&[data-main-rotation=\"180\"] .norotate):\n(&[data-main-rotation=\"270\"] .norotate):\n(&.disabled):\n(.annotationContent):\n(section):\n(.overlaidText):\n(.hasOwnCanvas:not(.sandboxModified) :is(input, textarea)):\n(.hasOwnCanvas.sandboxModified canvas.annotationContent):\n(.textLayer.selecting ~ & section):\n(:is(.linkAnnotation, .buttonWidgetAnnotation.pushButton) > a):\n(:is(.linkAnnotation, .buttonWidgetAnnotation.pushButton):not(.hasBorder)):\n(.linkAnnotation.hasBorder:hover):\n(.hasBorder):\n(.textAnnotation img):\n(.textWidgetAnnotation :is(input, textarea),):\n(.textWidgetAnnotation :is(input, textarea):required,):\n(.choiceWidgetAnnotation select option):\n(.textWidgetAnnotation textarea):\n(.textWidgetAnnotation :is(input, textarea)[disabled],):\n(.textWidgetAnnotation :is(input, textarea):hover,):\n(.textWidgetAnnotation :is(input, textarea):focus,):\n(.buttonWidgetAnnotation:is(.checkBox, .radioButton) :focus):\n(.buttonWidgetAnnotation.checkBox :focus):\n(.buttonWidgetAnnotation.radioButton :focus):\n(.buttonWidgetAnnotation:is(.checkBox, .radioButton)):\n(&:focus-within [data-canvas-name]):\n([data-canvas-name=\"checked\"]):\n(&:has(~ input:not(:checked))):\n([data-canvas-name=\"unchecked\"]):\n(.textWidgetAnnotation input.comb):\n(.textWidgetAnnotation input.comb:focus):\n(.buttonWidgetAnnotation:is(.checkBox, .radioButton) input):\n(.buttonWidgetAnnotation:is(.checkBox, .radioButton):has():\n(.fileAttachmentAnnotation .popupTriggerArea):\n(.mediaAnnotation):\n(video.mediaContent):\n(audio.mediaContent):\n(.mediaPlayButton):\n(.popupAnnotation):\n(.popup):\n(.popup *):\n(.popup > .header):\n(.popup > .header > .title):\n(.popup > .header .popupDate):\n(.popupContent):\n(.richText > *):\n(.popupTriggerArea):\n(section svg):\n(.annotationTextContent):\n(svg.quadrilateralsContainer):\n(:root):\n(@media screen and (forced-colors: active) :root):\n(@media screen and (forced-colors: active) .xfaLayer *:required):\n(.xfaLayer):\n(.xfaLayer .highlight):\n(.xfaLayer .highlight.appended):\n(.xfaLayer .highlight.begin):\n(.xfaLayer .highlight.end):\n(.xfaLayer .highlight.middle):\n(.xfaLayer .highlight.selected):\n(.xfaPage):\n(.xfaContentarea):\n(.xfaPrintOnly):\n(.xfaLayer *):\n(.xfaLayer *:required):\n(.xfaLayer div,):\n(.xfaLayer a):\n(.xfaRich li):\n(.xfaFont):\n(.xfaCaption):\n(.xfaCaptionForCheckButton):\n(.xfaLabel):\n(.xfaLeft):\n(.xfaRight):\n(:is(.xfaLeft, .xfaRight) > :is(.xfaCaption, .xfaCaptionForCheckButton)):\n(.xfaTop):\n(.xfaBottom):\n(:is(.xfaTop, .xfaBottom) > :is(.xfaCaption, .xfaCaptionForCheckButton)):\n(.xfaBorder):\n(.xfaWrapped):\n(:is(.xfaTextfield, .xfaSelect):focus):\n(:is(.xfaCheckbox, .xfaRadio):focus):\n(.xfaTextfield,):\n(.xfaSelect):\n(:is(.xfaTop, .xfaBottom) > :is(.xfaTextfield, .xfaSelect)):\n(.xfaButton):\n(.xfaLink):\n(.xfaCheckbox,):\n(.xfaRich):\n(.xfaImage):\n(.xfaLrTb,):\n(.xfaLr):\n(.xfaRl):\n(.xfaTb > div):\n(.xfaPosition):\n(.xfaArea):\n(.xfaValignMiddle):\n(.xfaTable):\n(.xfaTable .xfaRow):\n(.xfaTable .xfaRlRow):\n(.xfaTable .xfaRlRow > div):\n(:is(.xfaNonInteractive, .xfaDisabled, .xfaReadOnly) :is(input, textarea)):\n(@media print .xfaTextfield,):\n(@media print .xfaSelect):\n(.canvasWrapper):\n(&.highlight,):\n(&[data-main-rotation=\"180\"]):\n(&[data-main-rotation=\"270\"]):\n(&.draw):\n(&[data-draw-rotation=\"180\"]):\n(&[data-draw-rotation=\"270\"]):\n(&.highlight):\n(&.highlightOutline):\n(.secondaryOutline):\n(&.free):\n(.toggle-button):\n(&:enabled:hover):\n(&:enabled:hover:active):\n(&::before):\n(.toggle-button[aria-pressed=\"true\"]):\n(&:enabled:hover::before,):\n(&:-moz-locale-dir(rtl)::before,):\n(@media (prefers-reduced-motion: no-preference) .toggle-button::before):\n(@media (prefers-contrast) .toggle-button:enabled:hover):\n(@media (prefers-contrast) .toggle-button:enabled:hover:active):\n(@media (prefers-contrast) .toggle-button[aria-pressed=\"true\"]:enabled):\n(.toggle-button:enabled:hover::before,):\n(@media (forced-colors) .toggle-button):\n(@media (forced-colors) .toggle-button[aria-pressed=\"true\"]:enabled::after):\n(@media (forced-colors) .toggle-button[aria-pressed=\"true\"]:enabled:hover:active::after):\n(.signatureDialog):\n(width:570px;):\n(.title):\n(.inputWithClearButton):\n(.clearInputButton):\n(#addSignatureDialog):\n(@media screen and (forced-colors: active) --secondary-color:ButtonText;):\n(@media screen and (forced-colors: active) #addSignatureDialogLabel):\n(@media screen and (forced-colors: active) &.waiting::after):\n(@media screen and (forced-colors: active) .mainContainer):\n(@media screen and (forced-colors: active) &:focus-visible):\n(@media screen and (forced-colors: active) &[aria-selected=\"true\"]):\n(#addSignatureActionContainer):\n(&#addSignatureTypeContainer):\n(&::placeholder):\n(&#addSignatureDrawContainer):\n(> svg):\n(#thickness):\n(> input):\n(&::-webkit-slider-thumb,):\n(border-radius:4.5px;):\n(&#addSignatureImageContainer):\n(#addSignatureImagePlaceholder):\n(#addSignatureFilePicker):\n(&[data-selected=\"type\"] > #addSignatureTypeContainer,):\n(#addSignatureControls):\n(> label):\n(#clearSignatureButton):\n(&:focus-visible):\n(#addSignatureSaveContainer):\n(&:not(.fullStorage) #addSignatureSaveWarning):\n(&.fullStorage #addSignatureSaveWarning):\n(#editSignatureDescriptionDialog):\n(#editSignatureDescriptionAndView):\n(#editorSignatureParamsToolbar):\n(.deleteButton):\n(.toolbarAddSignatureButton):\n(&:is(:hover, :active) > svg):\n(&:is([disabled=\"disabled\"], [disabled])):\n(.editDescription.altText):\n(.commentPopup,):\n(#commentManagerDialog):\n(#commentManagerTextInput):\n(.annotationLayer.disabled :is(.annotationCommentButton)):\n(:is(.annotationLayer, .annotationEditorLayer)):\n(#editorCommentsSidebar,):\n(#editorCommentsSidebar):\n(#editorCommentsSidebarCount):\n(#editorCommentsSidebarCloseButton):\n(#editorCommentsSidebarListContainer):\n(filter:var(--comment-hover-filter);):\n(filter:var(--comment-active-filter);):\n(&:is(:focus, :focus-visible) time::after):\n(time::after):\n(.sidebarCommentText):\n(&.noComments):\n(time):\n(.commentPopup):\n(&.dragging):\n(&:not(.selected) .commentPopupButtons):\n(hr):\n(.commentPopupTop):\n(.commentPopupButtons):\n(&.commentPopupEdit::before):\n(&.commentPopupDelete::before):\n(.commentPopupText):\n(.commentPopupText,):\n(> *):\n(span):\n(&.free span):\n(.page:has(.annotationEditorLayer.nonEditing)):\n(#viewerContainer.pdfPresentationMode:fullscreen,):\n(@media (min-resolution: 1.1dppx) :root):\n([data-editor-rotation=\"90\"]):\n([data-editor-rotation=\"180\"]):\n([data-editor-rotation=\"270\"]):\n(.annotationEditorLayer):\n(&.drawing *):\n(&.getElements):\n(.annotationEditorLayer.waiting):\n(.annotationEditorLayer.disabled):\n(.annotationEditorLayer.freetextEditing):\n(.annotationEditorLayer.inkEditing):\n(.annotationEditorLayer .draw):\n(&.selectedEditor):\n(&:hover:not(.selectedEditor)):\n(&:has(:focus-visible)):\n(&:dir(ltr)):\n(&:dir(rtl)):\n(.buttons):\n(.divider):\n(.basic):\n(&:hover::before):\n(&.highlightButton::before):\n(&.commentButton::before):\n(&.deleteButton::before):\n(> :not(.divider)):\n(.altText):\n(&.done::before):\n(&.new):\n(&.done):\n(.tooltip):\n(display:inline-flex;):\n(.comment):\n(.annotationEditorLayer .freeTextEditor):\n(.annotationEditorLayer .freeTextEditor .internal):\n(.annotationEditorLayer .freeTextEditor .overlay):\n(.annotationEditorLayer freeTextEditor .overlay.enabled):\n(.annotationEditorLayer .freeTextEditor .internal:empty::before):\n(.annotationEditorLayer .freeTextEditor .internal:focus):\n(.annotationEditorLayer .inkEditor):\n(.annotationEditorLayer .inkEditor.editing):\n(.annotationEditorLayer .inkEditor .inkEditorCanvas):\n(.annotationEditorLayer .stampEditor):\n(.noAltTextBadge):\n(& > .resizer):\n(&.topMiddle):\n(&.topRight):\n(&.middleRight):\n(&.bottomRight):\n(&.bottomMiddle):\n(&.bottomLeft):\n(&.middleLeft):\n(&[data-main-rotation=\"0\"]):\n(&.topMiddle,):\n(&.topRight,):\n(&.middleRight,):\n(&):\n(.dialog.altText):\n(&.positioned):\n(& #altTextContainer):\n(& .title):\n(& #addDescription):\n(& #buttons):\n(.dialog.newAltText):\n(width:80%;):\n(&.aiInstalling):\n(#newAltTextDownloadModel):\n(&.error):\n(#newAltTextCancel):\n(&:not(.error) #newAltTextError):\n(#newAltTextContainer):\n(#descriptionInstruction):\n(.altTextSpinner):\n(&.loading):\n(textarea::placeholder):\n(#newAltTextDescription):\n(#newAltTextDisclaimer):\n(#newAltTextImagePreview):\n(.colorPicker):\n(.swatch):\n(button:is(:hover, .selected) > .swatch):\n(.basicColorPicker):\n(&::-webkit-color-swatch):\n(&[data-main-rotation=\"90\"]):\n(.highlightEditor):\n(.internal):\n(&.disabled .internal):\n(.editToolbar):\n(&:hover::after):\n(&:has(.dropdown:not(.hidden))):\n(.dropdown):\n(> .swatch):\n(&[aria-selected=\"true\"] > .swatch):\n(&:is(:hover, :active, :focus-visible) > .swatch):\n(.editorParamsToolbar:has(#highlightParamsToolbarContainer)):\n(#highlightParamsToolbarContainer):\n(&:is(:active, :focus-visible)):\n(#editorHighlightThickness):\n(.thicknessPicker):\n(:is(& > .editorParamsSlider[disabled])):\n(&::before,):\n(&::after):\n(.editorParamsSlider):\n(#editorHighlightVisibility):\n(margin-block:4px;):\n(#altTextSettingsDialog):\n(#aiModelSettings):\n(#automaticAltText,):\n(#createModelDescription,):\n(#automaticSettings):\n(button.hasPopupMenu):\n(&[aria-expanded=\"false\"] + menu):\n(.popupMenu):\n(> button):\n(&:not(.noIcon)::before):\n(&:not(:disabled)):\n(&.selected::after):\n(.treeView):\n(position:relative;):\n(~ .treeItems):\n(&:hover + a,):\n(> .treeItem,):\n(&#layersView .treeItem > a):\n(.treeItem):\n(&.selected > a):\n(#outerContainer):\n(&.viewsManagerOpen):\n(#viewerContainer:not(.pdfPresentationMode)):\n(&.viewsManagerResizing :is(#sidebarContainer, #viewerContainer, #loadingBar)):\n(#viewsManager):\n(.viewsManagerButton):\n(&.viewsCloseButton):\n(#viewsManagerHeader):\n(#viewsManagerTitle):\n(#viewsManagerSelector):\n(> .popupMenu):\n(&#outlinesViewMenu::before):\n(&#attachmentsViewMenu::before):\n(&#layersViewMenu::before):\n(#viewsManagerAddFileButton):\n(#viewsManagerCurrentOutlineButton):\n(#viewsManagerStatus):\n(.viewsManagerStatusLabel):\n(#viewsManagerStatusAction):\n(@media screen and (forced-colors: active) border-radius:2px;):\n(@media screen and (forced-colors: active) &:hover):\n(&#viewsManagerStatusActionDeselectButton:focus-visible):\n(#actionSelector):\n(&:active::after):\n(#viewsManagerStatusUndo):\n(#viewsManagerStatusWarning):\n(#viewsManagerStatusWaiting):\n(#viewsManagerContent):\n(#thumbnailsView):\n(&.isDragging > .dragMarker,):\n(&.pasteMode):\n(> .thumbnailPasteButton):\n(&:not(.pasteMode) > .thumbnail > .thumbnailPasteButton):\n(> .thumbnail):\n(&:not(.isDragging) > .thumbnailImageContainer::after):\n(&:has([aria-current=\"page\"]):not(.isDragging)):\n(&.isDragging > input):\n(> .thumbnailImageContainer):\n(&.missingThumbnailImage):\n(@media screen and (forced-colors: active) box-shadow:none;):\n(&[aria-current=\"page\"]):\n(&.placeholder):\n(&.draggingThumbnail):\n(#attachmentsView):\n(.sidebar):\n(border-radius:var(--sidebar-border-radius);):\n(&.resizing):\n(.sidebarResizer):\n(.newBadge):\n(.pdfViewer):\n(&.copyAll):\n(&.detailView):\n(.selection):\n(.pdfViewer .page):\n(:root:dir(rtl)):\n(@keyframes progressIndeterminate):\n(100%):\n(html):\n(&[data-toolbar-density=\"touch\"]):\n(body):\n(.visuallyHidden):\n(.hidden,):\n(.pdfPresentationMode:fullscreen):\n(#mainContainer):\n(#sidebarContent):\n(#viewerContainer):\n(#sidebarContainer :is(input, button, select)):\n(.toolbar):\n(#toolbarSidebar):\n(#viewOutline::before):\n(#viewAttachments::before):\n(#viewLayers::before):\n(#toolbarSidebarRight):\n(.doorHanger,):\n(.doorHangerRight):\n(.doorHanger):\n(.dialogButton):\n(.dialogButton:is(:hover, :focus-visible)):\n(.dialogButton:is(:hover, :focus-visible) > span):\n(.splitToolbarButtonSeparator):\n(#viewsManagerToggleButton::before):\n(#secondaryToolbarToggleButton::before):\n(#previous::before):\n(#next::before):\n(#zoomOutButton::before):\n(#zoomInButton::before):\n(#editorCommentButton::before):\n(#editorFreeTextButton::before):\n(#editorHighlightButton::before):\n(#editorInkButton::before):\n(#editorStampButton::before):\n(#editorSignatureButton::before):\n(#printButton::before):\n(#downloadButton::before):\n(#currentOutlineItem::before):\n(#viewFindButton::before):\n(.pdfSidebarNotification::after):\n(.verticalToolbarSeparator):\n(.horizontalToolbarSeparator):\n(.toggleButton):\n(&:is(:hover, :has(> input:focus-visible))):\n(& > input):\n(.toolbarField):\n(#pageNumber):\n(.loadingInput:has(> &.loading)::after):\n(.loadingInput):\n(&.start::after):\n(&.end::after):\n(#outlineOptionsContainer):\n(dialog):\n(dialog::backdrop):\n(dialog > .row):\n(dialog > .row > *):\n(dialog .toolbarField):\n(dialog .separator):\n(dialog .buttonRow):\n(dialog :link):\n(#passwordDialog):\n(#passwordDialog .toolbarField):\n(#documentPropertiesDialog):\n(#documentPropertiesDialog .row > *):\n(#documentPropertiesDialog .row > span):\n(#documentPropertiesDialog .row > p):\n(#documentPropertiesDialog .buttonRow):\n(#printServiceDialog):\n(.grab-to-pan-grab):\n(.grab-to-pan-grab:active,):\n(.grab-to-pan-grabbing):\n(.toolbarButton):\n(&.toggled):\n(&:is(:hover, :focus-visible)):\n(&.labeled):\n(.toolbarButtonWithContainer):\n(.menu):\n(.menuContainer):\n(.editorParamsToolbar):\n(.editorParamsLabel):\n(button:is(:hover, :focus-visible) .editorParamsLabel):\n(.editorParamsToolbarContainer):\n(.editorParamsColor):\n(&::-webkit-slider-runnable-track,):\n(#secondaryToolbar):\n(#secondaryPrint::before):\n(#secondaryDownload::before):\n(#presentationMode::before):\n(#viewBookmark::before):\n(#firstPage::before):\n(#lastPage::before):\n(#pageRotateCcw::before):\n(#pageRotateCw::before):\n(#cursorSelectTool::before):\n(#cursorHandTool::before):\n(#scrollPage::before):\n(#scrollVertical::before):\n(#scrollHorizontal::before):\n(#scrollWrapped::before):\n(#spreadNone::before):\n(#spreadOdd::before):\n(#spreadEven::before):\n(#imageAltTextSettings::before):\n(#documentProperties::before):\n(#findbar):\n(#findInputContainer):\n(#findNextButton::before):\n(#findInput):\n(.loadingInput:has(> &[data-status=\"pending\"])::after):\n(&[data-status=\"notFound\"]):\n(#findbarMessageContainer):\n(#findResultsCount):\n(#findMsg):\n(&:empty):\n(&.wrapContainers):\n(.visibleMediumView):\n(.toolbarLabel):\n(.toolbarHorizontalGroup):\n(.dropdownToolbarButton):\n(> select):\n(&:is(:hover, :focus-visible, :active)::after):\n(#toolbarContainer):\n(input):\n(.toolbarButtonSpacer):\n(#toolbarViewerLeft):\n(#loadingBar):\n(&.indeterminate .progress):\n(@media all and (max-width: 840px) #outerContainer.viewsManagerOpen #viewerContainer):\n(@media all and (max-width: 750px) #outerContainer .hiddenMediumView):\n(@media all and (max-width: 750px) #outerContainer .visibleMediumView:not(.hidden, [hidden])):\n(@media all and (max-width: 690px) .hiddenSmallView,):\n(@media all and (max-width: 690px) #toolbarContainer #toolbarViewer .toolbarButtonSpacer):\n(.textLayer.highlighting): Deleted.\n(.textLayer :is(span, br)): Deleted.\n(.textLayer span.markedContent): Deleted.\n(.textLayer .highlight): Deleted.\n(@media screen and (forced-colors: active) .textLayer .highlight): Deleted.\n(.textLayer .highlight.appended): Deleted.\n(.textLayer .highlight.begin): Deleted.\n(.textLayer .highlight.end): Deleted.\n(.textLayer .highlight.middle): Deleted.\n(.textLayer .highlight.selected): Deleted.\n(.textLayer ::-moz-selection): Deleted.\n(.textLayer ::selection): Deleted.\n(.textLayer br::-moz-selection): Deleted.\n(.textLayer br::selection): Deleted.\n(.textLayer .endOfContent): Deleted.\n(.textLayer .endOfContent.active): Deleted.\n(@media screen and (forced-colors: active) .annotationLayer): Deleted.\n(@media screen and (forced-colors: active) .annotationLayer .textWidgetAnnotation :is(input, textarea):required, .annotationLayer .choiceWidgetAnnotation select:required, .annotationLayer .buttonWidgetAnnotation:is(.checkBox, .radioButton) input:required): Deleted.\n(@media screen and (forced-colors: active) .annotationLayer .linkAnnotation): Deleted.\n(@media screen and (forced-colors: active) .annotationLayer .linkAnnotation:hover): Deleted.\n(@media screen and (forced-colors: active) .annotationLayer .linkAnnotation > a:hover): Deleted.\n(@media screen and (forced-colors: active) .annotationLayer .popupAnnotation .popup): Deleted.\n(@media screen and (forced-colors: active) .annotationLayer .highlightArea:hover::after): Deleted.\n(@media screen and (forced-colors: active) .annotationLayer .popupAnnotation.focused .popup): Deleted.\n(.annotationLayer[data-main-rotation=\"90\"] .norotate): Deleted.\n(.annotationLayer[data-main-rotation=\"180\"] .norotate): Deleted.\n(.annotationLayer[data-main-rotation=\"270\"] .norotate): Deleted.\n(.annotationLayer.disabled section,): Deleted.\n(.annotationLayer canvas): Deleted.\n(.annotationLayer section): Deleted.\n(.annotationLayer :is(.linkAnnotation, .buttonWidgetAnnotation.pushButton) > a): Deleted.\n(.annotationLayer :is(.linkAnnotation, .buttonWidgetAnnotation.pushButton):not(.hasBorder)): Deleted.\n(.annotationLayer .linkAnnotation.hasBorder:hover): Deleted.\n(.annotationLayer .hasBorder): Deleted.\n(.annotationLayer .textAnnotation img): Deleted.\n(.annotationLayer .textWidgetAnnotation :is(input, textarea), .annotationLayer .choiceWidgetAnnotation select, .annotationLayer .buttonWidgetAnnotation:is(.checkBox, .radioButton) input): Deleted.\n(.annotationLayer .textWidgetAnnotation :is(input, textarea):required, .annotationLayer .choiceWidgetAnnotation select:required, .annotationLayer .buttonWidgetAnnotation:is(.checkBox, .radioButton) input:required): Deleted.\n(.annotationLayer .choiceWidgetAnnotation select option): Deleted.\n(.annotationLayer .buttonWidgetAnnotation.radioButton input): Deleted.\n(.annotationLayer .textWidgetAnnotation textarea): Deleted.\n(.annotationLayer .textWidgetAnnotation [disabled]:is(input, textarea), .annotationLayer .choiceWidgetAnnotation select[disabled], .annotationLayer .buttonWidgetAnnotation:is(.checkBox, .radioButton) input[disabled]): Deleted.\n(.annotationLayer .textWidgetAnnotation :is(input, textarea):hover, .annotationLayer .choiceWidgetAnnotation select:hover, .annotationLayer .buttonWidgetAnnotation:is(.checkBox, .radioButton) input:hover): Deleted.\n(.annotationLayer .textWidgetAnnotation :is(input, textarea):hover, .annotationLayer .choiceWidgetAnnotation select:hover, .annotationLayer .buttonWidgetAnnotation.checkBox input:hover): Deleted.\n(.annotationLayer .textWidgetAnnotation :is(input, textarea):focus, .annotationLayer .choiceWidgetAnnotation select:focus): Deleted.\n(.annotationLayer .buttonWidgetAnnotation:is(.checkBox, .radioButton) :focus): Deleted.\n(.annotationLayer .buttonWidgetAnnotation.checkBox :focus): Deleted.\n(.annotationLayer .buttonWidgetAnnotation.radioButton :focus): Deleted.\n(.annotationLayer .buttonWidgetAnnotation.checkBox input:checked::before,): Deleted.\n(.annotationLayer .buttonWidgetAnnotation.checkBox input:checked::before): Deleted.\n(.annotationLayer .buttonWidgetAnnotation.checkBox input:checked::after): Deleted.\n(.annotationLayer .buttonWidgetAnnotation.radioButton input:checked::before): Deleted.\n(.annotationLayer .textWidgetAnnotation input.comb): Deleted.\n(.annotationLayer .textWidgetAnnotation input.comb:focus): Deleted.\n(.annotationLayer .buttonWidgetAnnotation:is(.checkBox, .radioButton) input): Deleted.\n(.annotationLayer .fileAttachmentAnnotation .popupTriggerArea): Deleted.\n(.annotationLayer .popupAnnotation): Deleted.\n(.annotationLayer .popup): Deleted.\n(.annotationLayer .popupAnnotation.focused .popup): Deleted.\n(.annotationLayer .popup *): Deleted.\n(.annotationLayer .popup > .header): Deleted.\n(.annotationLayer .popup > .header h1): Deleted.\n(.annotationLayer .popup > .header .popupDate): Deleted.\n(.annotationLayer .popupContent): Deleted.\n(.annotationLayer .richText > *): Deleted.\n(.annotationLayer .popupTriggerArea): Deleted.\n(.annotationLayer section svg): Deleted.\n(.annotationLayer .annotationTextContent): Deleted.\n(.annotationLayer .annotationTextContent span): Deleted.\n(.annotationLayer svg.quadrilateralsContainer): Deleted.\n(.canvasWrapper svg): Deleted.\n(.canvasWrapper svg[data-main-rotation=\"90\"] mask,): Deleted.\n(.canvasWrapper svg[data-main-rotation=\"180\"] mask,): Deleted.\n(.canvasWrapper svg[data-main-rotation=\"270\"] mask,): Deleted.\n(.canvasWrapper svg.highlight): Deleted.\n(@media screen and (forced-colors: active) .canvasWrapper svg.highlight): Deleted.\n(.canvasWrapper svg.highlight:not(.free)): Deleted.\n(.canvasWrapper svg.highlightOutline): Deleted.\n(.canvasWrapper svg.highlightOutline.hovered:not(.free):not(.selected)): Deleted.\n(.canvasWrapper svg.highlightOutline.selected:not(.free) .mainOutline): Deleted.\n(.canvasWrapper svg.highlightOutline.selected:not(.free) .secondaryOutline): Deleted.\n(.canvasWrapper svg.highlightOutline.free.hovered:not(.selected)): Deleted.\n(.canvasWrapper svg.highlightOutline.free.selected .mainOutline): Deleted.\n(.canvasWrapper svg.highlightOutline.free.selected .secondaryOutline): Deleted.\n(@media (prefers-color-scheme: dark) :where(html:not(.is-light)) .toggle-button): Deleted.\n(:where(html.is-dark) .toggle-button): Deleted.\n(@media (forced-colors: active) .toggle-button): Deleted.\n(.toggle-button:focus-visible): Deleted.\n(.toggle-button:enabled:hover): Deleted.\n(.toggle-button:enabled:active): Deleted.\n(.toggle-button[aria-pressed=\"true\"]:enabled:hover): Deleted.\n(.toggle-button[aria-pressed=\"true\"]:enabled:active): Deleted.\n(.toggle-button::before): Deleted.\n(.toggle-button[aria-pressed=\"true\"]::before): Deleted.\n(.toggle-button[aria-pressed=\"true\"]:enabled:hover::before,): Deleted.\n([dir=\"rtl\"] .toggle-button[aria-pressed=\"true\"]::before): Deleted.\n(@media (prefers-contrast) .toggle-button:enabled:active): Deleted.\n(@media (prefers-contrast) .toggle-button[aria-pressed=\"true\"]:enabled:hover,): Deleted.\n(@media (prefers-contrast) .toggle-button[aria-pressed=\"true\"]:enabled:active): Deleted.\n(@media (prefers-contrast) .toggle-button:hover::before,): Deleted.\n(@media (forced-colors) .toggle-button[aria-pressed=\"true\"]:enabled:active::after): Deleted.\n(.textLayer.highlighting:not(.free) span): Deleted.\n(.textLayer.highlighting.free span): Deleted.\n(@media (-webkit-min-device-pixel-ratio: 1.1), (min-resolution: 1.1dppx) :root): Deleted.\n(.annotationEditorLayer :is(.freeTextEditor, .inkEditor, .stampEditor)): Deleted.\n(.annotationEditorLayer .draggable.selectedEditor:is(.freeTextEditor, .inkEditor, .stampEditor)): Deleted.\n(.annotationEditorLayer .moving:is(.freeTextEditor, .inkEditor, .stampEditor)): Deleted.\n(.annotationEditorLayer .selectedEditor:is(.freeTextEditor, .inkEditor, .stampEditor)): Deleted.\n(.annotationEditorLayer .selectedEditor:is(.freeTextEditor, .inkEditor, .stampEditor)::before): Deleted.\n(.annotationEditorLayer :is(.freeTextEditor, .inkEditor, .stampEditor):hover:not(.selectedEditor)): Deleted.\n(.annotationEditorLayer :is(.freeTextEditor, .inkEditor, .stampEditor):hover:not(.selectedEditor)::before): Deleted.\n(:is(.annotationEditorLayer): Deleted.\n(@media (prefers-color-scheme: dark) :where(html:not(.is-light)) :is(.annotationEditorLayer): Deleted.\n(:where(html.is-dark) :is(.annotationEditorLayer): Deleted.\n(@media screen and (forced-colors: active) :is(.annotationEditorLayer): Deleted.\n([dir=\"ltr\"] :is(.annotationEditorLayer): Deleted.\n([dir=\"rtl\"] :is(.annotationEditorLayer): Deleted.\n(.annotationEditorLayer .stampEditor canvas): Deleted.\n(.annotationEditorLayer :is(.freeTextEditor, .inkEditor, .stampEditor) > .resizers): Deleted.\n(.annotationEditorLayer :is(.freeTextEditor, .inkEditor, .stampEditor) > .resizers.hidden): Deleted.\n(.annotationEditorLayer :is(.freeTextEditor, .inkEditor, .stampEditor) > .resizers > .resizer): Deleted.\n(.annotationEditorLayer :is(.freeTextEditor, .inkEditor, .stampEditor) > .resizers > .resizer.topLeft): Deleted.\n(.annotationEditorLayer :is(.freeTextEditor, .inkEditor, .stampEditor) > .resizers > .resizer.topMiddle): Deleted.\n(.annotationEditorLayer :is(.freeTextEditor, .inkEditor, .stampEditor) > .resizers > .resizer.topRight): Deleted.\n(.annotationEditorLayer :is(.freeTextEditor, .inkEditor, .stampEditor) > .resizers > .resizer.middleRight): Deleted.\n(.annotationEditorLayer :is(.freeTextEditor, .inkEditor, .stampEditor) > .resizers > .resizer.bottomRight): Deleted.\n(.annotationEditorLayer :is(.freeTextEditor, .inkEditor, .stampEditor) > .resizers > .resizer.bottomMiddle): Deleted.\n(.annotationEditorLayer :is(.freeTextEditor, .inkEditor, .stampEditor) > .resizers > .resizer.bottomLeft): Deleted.\n(.annotationEditorLayer :is(.freeTextEditor, .inkEditor, .stampEditor) > .resizers > .resizer.middleLeft): Deleted.\n(.annotationEditorLayer[data-main-rotation=\"0\"]): Deleted.\n([dir=\"ltr\"] .annotationEditorLayer): Deleted.\n([dir=\"rtl\"] .annotationEditorLayer): Deleted.\n(#altTextDialog): Deleted.\n(@media (prefers-color-scheme: dark) :where(html:not(.is-light)) #altTextDialog): Deleted.\n(:where(html.is-dark) #altTextDialog): Deleted.\n(@media screen and (forced-colors: active) #altTextDialog): Deleted.\n(#altTextDialog::backdrop): Deleted.\n(#altTextDialog.positioned): Deleted.\n(#altTextDialog #altTextContainer): Deleted.\n(#altTextDialog #altTextContainer *:focus-visible): Deleted.\n(#altTextDialog #altTextContainer .radio): Deleted.\n(#altTextDialog #altTextContainer .radio .radioButton): Deleted.\n(#altTextDialog #altTextContainer .radio .radioButton input): Deleted.\n(#altTextDialog #altTextContainer .radio .radioButton input:hover): Deleted.\n(#altTextDialog #altTextContainer .radio .radioButton input:checked): Deleted.\n(#altTextDialog #altTextContainer .radio .radioLabel): Deleted.\n(#altTextDialog #altTextContainer .radio .radioLabel span): Deleted.\n(#altTextDialog #altTextContainer #overallDescription): Deleted.\n(#altTextDialog #altTextContainer #overallDescription span): Deleted.\n(#altTextDialog #altTextContainer #overallDescription .title): Deleted.\n(#altTextDialog #altTextContainer #addDescription): Deleted.\n(#altTextDialog #altTextContainer #addDescription .descriptionArea): Deleted.\n(#altTextDialog #altTextContainer #addDescription .descriptionArea textarea): Deleted.\n(#altTextDialog #altTextContainer #addDescription .descriptionArea textarea:focus): Deleted.\n(#altTextDialog #altTextContainer #addDescription .descriptionArea textarea:disabled): Deleted.\n(#altTextDialog #altTextContainer #buttons): Deleted.\n(#altTextDialog #altTextContainer #buttons button): Deleted.\n(#altTextDialog #altTextContainer #buttons button:hover): Deleted.\n(#altTextDialog #altTextContainer #buttons button#altTextCancel): Deleted.\n(#altTextDialog #altTextContainer #buttons button#altTextCancel:hover): Deleted.\n(#altTextDialog #altTextContainer #buttons button#altTextSave): Deleted.\n(#altTextDialog #altTextContainer #buttons button#altTextSave:hover): Deleted.\n(@media (prefers-color-scheme: dark) :where(html:not(.is-light)) .colorPicker): Deleted.\n(:where(html.is-dark) .colorPicker): Deleted.\n(@media screen and (forced-colors: active) .colorPicker): Deleted.\n(.colorPicker .swatch): Deleted.\n(.colorPicker button:is(:hover, .selected) > .swatch): Deleted.\n(.annotationEditorLayer[data-main-rotation=\"0\"] .highlightEditor:not(.free) > .editToolbar): Deleted.\n(.annotationEditorLayer[data-main-rotation=\"90\"] .highlightEditor:not(.free) > .editToolbar): Deleted.\n(.annotationEditorLayer[data-main-rotation=\"180\"] .highlightEditor:not(.free) > .editToolbar): Deleted.\n(.annotationEditorLayer[data-main-rotation=\"270\"] .highlightEditor:not(.free) > .editToolbar): Deleted.\n(.annotationEditorLayer .highlightEditor): Deleted.\n(.annotationEditorLayer .highlightEditor:not(.free)): Deleted.\n(.annotationEditorLayer .highlightEditor .internal): Deleted.\n(.annotationEditorLayer .highlightEditor.disabled .internal): Deleted.\n(.annotationEditorLayer .highlightEditor.selectedEditor .internal): Deleted.\n(.annotationEditorLayer .highlightEditor .editToolbar): Deleted.\n(.annotationEditorLayer .highlightEditor .editToolbar .buttons .colorPicker): Deleted.\n(.annotationEditorLayer .highlightEditor .editToolbar .buttons .colorPicker::after): Deleted.\n(.annotationEditorLayer .highlightEditor .editToolbar .buttons .colorPicker:hover::after): Deleted.\n(.annotationEditorLayer .highlightEditor .editToolbar .buttons .colorPicker:has(.dropdown:not(.hidden))): Deleted.\n(.annotationEditorLayer .highlightEditor .editToolbar .buttons .colorPicker:has(.dropdown:not(.hidden))::after): Deleted.\n(.annotationEditorLayer .highlightEditor .editToolbar .buttons .colorPicker .dropdown): Deleted.\n(.annotationEditorLayer .highlightEditor .editToolbar .buttons .colorPicker .dropdown button): Deleted.\n(.annotationEditorLayer .highlightEditor .editToolbar .buttons .colorPicker .dropdown button:is(:active, :focus-visible)): Deleted.\n(.annotationEditorLayer .highlightEditor .editToolbar .buttons .colorPicker .dropdown button > .swatch): Deleted.\n(.annotationEditorLayer .highlightEditor .editToolbar .buttons .colorPicker .dropdown button[aria-selected=\"true\"] > .swatch): Deleted.\n(.annotationEditorLayer .highlightEditor .editToolbar .buttons .colorPicker .dropdown button:is(:hover, :active, :focus-visible) > .swatch): Deleted.\n(#highlightParamsToolbarContainer .editorParamsLabel): Deleted.\n(#highlightParamsToolbarContainer .colorPicker): Deleted.\n(#highlightParamsToolbarContainer .colorPicker .dropdown): Deleted.\n(#highlightParamsToolbarContainer .colorPicker .dropdown button): Deleted.\n(#highlightParamsToolbarContainer .colorPicker .dropdown button .swatch): Deleted.\n(#highlightParamsToolbarContainer .colorPicker .dropdown button:is(:active, :focus-visible)): Deleted.\n(#highlightParamsToolbarContainer .colorPicker .dropdown button[aria-selected=\"true\"] > .swatch): Deleted.\n(#highlightParamsToolbarContainer .colorPicker .dropdown button:is(:hover, :active, :focus-visible) > .swatch): Deleted.\n(#highlightParamsToolbarContainer #editorHighlightThickness): Deleted.\n(#highlightParamsToolbarContainer #editorHighlightThickness .editorParamsLabel): Deleted.\n(#highlightParamsToolbarContainer #editorHighlightThickness .thicknessPicker): Deleted.\n(@media (prefers-color-scheme: dark) :where(html:not(.is-light)) #highlightParamsToolbarContainer #editorHighlightThickness .thicknessPicker): Deleted.\n(:where(html.is-dark) #highlightParamsToolbarContainer #editorHighlightThickness .thicknessPicker): Deleted.\n(@media screen and (forced-colors: active) #highlightParamsToolbarContainer #editorHighlightThickness .thicknessPicker): Deleted.\n(:is(#highlightParamsToolbarContainer #editorHighlightThickness .thicknessPicker > .editorParamsSlider[disabled])): Deleted.\n(#highlightParamsToolbarContainer #editorHighlightThickness .thicknessPicker::before,): Deleted.\n(#highlightParamsToolbarContainer #editorHighlightThickness .thicknessPicker::after): Deleted.\n(#highlightParamsToolbarContainer #editorHighlightThickness .thicknessPicker .editorParamsSlider): Deleted.\n(#highlightParamsToolbarContainer #editorHighlightVisibility): Deleted.\n(#highlightParamsToolbarContainer #editorHighlightVisibility .divider): Deleted.\n(@media (prefers-color-scheme: dark) :where(html:not(.is-light)) #highlightParamsToolbarContainer #editorHighlightVisibility .divider): Deleted.\n(:where(html.is-dark) #highlightParamsToolbarContainer #editorHighlightVisibility .divider): Deleted.\n(@media screen and (forced-colors: active) #highlightParamsToolbarContainer #editorHighlightVisibility .divider): Deleted.\n(#highlightParamsToolbarContainer #editorHighlightVisibility .toggler): Deleted.\n(#hiddenCopyElement,): Deleted.\n(@media screen and (forced-colors: active) .pdfViewer): Deleted.\n(.pdfViewer .canvasWrapper): Deleted.\n(.pdfViewer .page canvas): Deleted.\n(.pdfViewer .page canvas .structTree): Deleted.\n(.pdfViewer .page canvas[hidden]): Deleted.\n(.pdfViewer .page canvas[zooming]): Deleted.\n([dir=\"rtl\"]:root): Deleted.\n(@media (prefers-color-scheme: dark) :root:where(:not(.is-light))): Deleted.\n(:root:where(.is-dark)): Deleted.\n(*): Deleted.\n(#viewerContainer.pdfPresentationMode:-webkit-full-screen): Deleted.\n(.pdfPresentationMode:-webkit-full-screen section:not([data-internal-link])): Deleted.\n(.pdfPresentationMode:fullscreen section:not([data-internal-link])): Deleted.\n(.pdfPresentationMode:-webkit-full-screen .textLayer span): Deleted.\n(#sidebarContainer): Deleted.\n(#outerContainer:is(.sidebarMoving, .sidebarOpen) #sidebarContainer): Deleted.\n(#outerContainer.sidebarOpen #sidebarContainer): Deleted.\n(#outerContainer.sidebarOpen #viewerContainer:not(.pdfPresentationMode)): Deleted.\n(:is(.toolbar, .editorParamsToolbar, .findbar, #sidebarContainer)): Deleted.\n(#sidebarResizer): Deleted.\n(#toolbarContainer,): Deleted.\n(#toolbarViewer): Deleted.\n(#outerContainer.sidebarOpen #loadingBar): Deleted.\n(#loadingBar .progress): Deleted.\n(#loadingBar.indeterminate .progress): Deleted.\n(#loadingBar.indeterminate .progress .glimmer): Deleted.\n(#outerContainer.sidebarResizing): Deleted.\n(.findbar,): Deleted.\n(.findbar): Deleted.\n(.findbar > div): Deleted.\n(.findbar > div#findbarInputContainer): Deleted.\n(.findbar.wrapContainers > div,): Deleted.\n(.findbar.wrapContainers > div#findbarMessageContainer): Deleted.\n(.findbar input[type=\"checkbox\"]): Deleted.\n(.findbar label): Deleted.\n(.findbar label:hover,): Deleted.\n(.findbar .toolbarField[type=\"checkbox\"]:checked + .toolbarLabel): Deleted.\n(#findInput::-moz-placeholder): Deleted.\n(#findInput::placeholder): Deleted.\n(.loadingInput:has(> #findInput[data-status=\"pending\"])::after): Deleted.\n(#findInput[data-status=\"notFound\"]): Deleted.\n(.secondaryToolbar,): Deleted.\n(.editorParamsToolbarContainer > .editorParamsSetter): Deleted.\n(.editorParamsToolbarContainer .editorParamsLabel): Deleted.\n(.editorParamsToolbarContainer .editorParamsColor): Deleted.\n(.editorParamsToolbarContainer .editorParamsSlider): Deleted.\n(.editorParamsToolbarContainer .editorParamsSlider::-moz-range-progress): Deleted.\n(.editorParamsToolbarContainer .editorParamsSlider::-webkit-slider-runnable-track,): Deleted.\n(.editorParamsToolbarContainer .editorParamsSlider::-webkit-slider-thumb,): Deleted.\n(#secondaryToolbarButtonContainer): Deleted.\n(#editorStampParamsToolbar): Deleted.\n(#editorInkParamsToolbar): Deleted.\n(#editorFreeTextParamsToolbar): Deleted.\n(#editorHighlightParamsToolbar): Deleted.\n(#editorStampAddImage::before): Deleted.\n(:is(.doorHanger, .doorHangerRight)::after,): Deleted.\n(.doorHanger::after): Deleted.\n(.doorHangerRight::after): Deleted.\n(:is(.doorHanger, .doorHangerRight)::before): Deleted.\n(.doorHanger::before): Deleted.\n(.doorHangerRight::before): Deleted.\n(#findMsg[data-status=\"notFound\"]): Deleted.\n(:is(#findResultsCount, #findMsg):empty): Deleted.\n(#toolbarViewerMiddle): Deleted.\n(#toolbarViewerLeft,): Deleted.\n(#toolbarViewerRight,): Deleted.\n(#toolbarViewerLeft > *,): Deleted.\n(#toolbarViewerRight): Deleted.\n(.splitToolbarButton): Deleted.\n(.splitToolbarButton > .toolbarButton): Deleted.\n(.toolbarButton,): Deleted.\n(.toolbarButton > span): Deleted.\n(:is(.toolbarButton, .secondaryToolbarButton, .dialogButton)[disabled]): Deleted.\n(.splitToolbarButton > .toolbarButton:is(:hover, :focus-visible),): Deleted.\n(#toolbarSidebar .splitToolbarButton > .toolbarButton): Deleted.\n(.toolbarButton:is(:hover, :focus-visible)): Deleted.\n(.secondaryToolbarButton:is(:hover, :focus-visible)): Deleted.\n(:is(.toolbarButton, .secondaryToolbarButton).toggled,): Deleted.\n(:is(.toolbarButton, .secondaryToolbarButton).toggled:hover,): Deleted.\n(:is(.toolbarButton, .secondaryToolbarButton).toggled::before): Deleted.\n(:is(.toolbarButton, .secondaryToolbarButton).toggled:hover:active,): Deleted.\n(.dropdownToolbarButton::after): Deleted.\n(.dropdownToolbarButton > select): Deleted.\n(.dropdownToolbarButton > select:is(:hover, :focus-visible)): Deleted.\n(.dropdownToolbarButton > select > option): Deleted.\n(:is(.toolbarButton, .secondaryToolbarButton, .treeItemToggler)::before,): Deleted.\n(.dropdownToolbarButton:is(:hover, :focus-visible, :active)::after): Deleted.\n(.toolbarButton::before): Deleted.\n(.toolbarButton:is(:hover, :focus-visible)::before,): Deleted.\n(.secondaryToolbarButton::before): Deleted.\n(#sidebarToggle::before): Deleted.\n(#secondaryToolbarToggle::before): Deleted.\n(#findPrevious::before): Deleted.\n(#findNext::before): Deleted.\n(#zoomOut::before): Deleted.\n(#zoomIn::before): Deleted.\n(#editorFreeText::before): Deleted.\n(#editorHighlight::before): Deleted.\n(#editorInk::before): Deleted.\n(#editorStamp::before): Deleted.\n(:is(#print, #secondaryPrint)::before): Deleted.\n(#secondaryOpenFile::before): Deleted.\n(:is(#download, #secondaryDownload)::before): Deleted.\n(a.secondaryToolbarButton): Deleted.\n(a:is(.toolbarButton, .secondaryToolbarButton)[href=\"#\"]): Deleted.\n(#viewThumbnail::before): Deleted.\n(#viewFind::before): Deleted.\n(.secondaryToolbarButton): Deleted.\n(.secondaryToolbarButton > span): Deleted.\n(.toolbarField[type=\"checkbox\"]): Deleted.\n(#pageNumber::-webkit-inner-spin-button): Deleted.\n(.loadingInput:has(> #pageNumber.loading)::after): Deleted.\n(.loadingInput::after): Deleted.\n(.loadingInput.start::after): Deleted.\n(.loadingInput.end::after): Deleted.\n(.toolbarField:focus): Deleted.\n(#numPages.toolbarLabel): Deleted.\n(#thumbnailView,): Deleted.\n(#thumbnailView): Deleted.\n(#thumbnailView > a:is(:active, :focus)): Deleted.\n(.thumbnail): Deleted.\n(#thumbnailView > a:last-of-type > .thumbnail): Deleted.\n(a:focus > .thumbnail,): Deleted.\n(.thumbnail.selected): Deleted.\n(.thumbnailImage): Deleted.\n(a:focus > .thumbnail > .thumbnailImage,): Deleted.\n(.thumbnail.selected > .thumbnailImage): Deleted.\n(.thumbnail:not([data-loaded]) > .thumbnailImage): Deleted.\n(.treeWithDeepNesting > .treeItem,): Deleted.\n(.treeItem > a): Deleted.\n(#layersView .treeItem > a *): Deleted.\n(#layersView .treeItem > a > label): Deleted.\n(#layersView .treeItem > a > label > input): Deleted.\n(.treeItemToggler): Deleted.\n(.treeItemToggler::before): Deleted.\n(.treeItemToggler.treeItemsHidden::before): Deleted.\n(.treeItemToggler.treeItemsHidden ~ .treeItems): Deleted.\n(.treeItem.selected > a): Deleted.\n(.treeItemToggler:hover,): Deleted.\n(#sidebarContainer:has(#outlineView:not(.hidden)) #outlineOptionsContainer): Deleted.\n(@media all and (max-width: 900px) #toolbarViewerMiddle): Deleted.\n(@media all and (max-width: 840px) #outerContainer.sidebarOpen #viewerContainer): Deleted.\n(@media all and (max-width: 750px) :root): Deleted.\n(@media all and (max-width: 750px) #outerContainer .visibleMediumView): Deleted.\n(@media all and (max-width: 690px) .toolbarButtonSpacer): Deleted.\n(@media all and (max-width: 690px) .findbar): Deleted.\n* Source/ThirdParty/pdfjs/web/viewer.html:\n* Source/ThirdParty/pdfjs/web/viewer.mjs:\n* Source/ThirdParty/pdfjs/web/wasm/LICENSE_JBIG2: Added.\n* Source/ThirdParty/pdfjs/web/wasm/LICENSE_OPENJPEG: Added.\n* Source/ThirdParty/pdfjs/web/wasm/LICENSE_PDFJS_JBIG2: Added.\n* Source/ThirdParty/pdfjs/web/wasm/LICENSE_PDFJS_OPENJPEG: Added.\n* Source/ThirdParty/pdfjs/web/wasm/LICENSE_PDFJS_QCMS: Added.\n* Source/ThirdParty/pdfjs/web/wasm/LICENSE_QCMS: Added.\n* Source/ThirdParty/pdfjs/web/wasm/jbig2_nowasm_fallback.js: Added.\n(async JBig2):\n(async JBig2.):\n* Source/ThirdParty/pdfjs/web/wasm/openjpeg_nowasm_fallback.js: Added.\n(async OpenJPEG):\n(async OpenJPEG.):\n* Source/ThirdParty/pdfjs/web/wasm/quickjs-eval.js: Added.\n(async QuickJS):\n(async QuickJS.):\n* Tools/glib/generate-pdfjs-resource-manifest.py:\n\nCanonical link: https://commits.webkit.org/316572@main","order":0,"repository_id":"webkit","timestamp":1783366531},{"author":{"emails":["zimmermann@kde.org","zimmermann@physik.rwth-aachen.de","zimmermann@webkit.org","nzimmermann@blackberry.com","nzimmermann@rim.com","nzimmermann@igalia.com"],"name":"Nikolas Zimmermann"},"branch":"main","hash":"ed517e412084a29ec14c7952131f6d3462ca381c","identifier":"316573@main","message":"Zero-initialize CSSParserToken union to fix valgrind uninitialised value error\nhttps://bugs.webkit.org/show_bug.cgi?id=311013\n\nReviewed by Michael Catanzaro.\n\nThe CSSParserToken union (8 bytes) was left partially or fully uninitialized\nby several constructors. When tokens were copied into a CSSVariableData Vector\nbuffer, the uninitialized bytes propagated. During style resolution, inlined\nsubstitution resolution code in resolveSubstitutionFunctions() read from these\ntoken bytes, triggering a valgrind \"Conditional jump or move depends on\nuninitialised value(s)\" error.\n\nValgrind trace:\n  ==1187609== Conditional jump or move depends on uninitialised value(s)\n  ==1187609==    at 0x9B8181E: WebCore::Style::Builder::resolveSubstitutionFunctions(...)\n  ==1187609==    by 0x9B80CDF: WebCore::Style::Builder::applyProperty(...)\n  ==1187609==    by 0x9B7F63B: WebCore::Style::Builder::applyCascadeProperty(...)\n  ==1187609==    by 0x9B7F0FC: WebCore::Style::Builder::applyHighPriorityProperties()\n  ==1187609==  Uninitialised value was created by a heap allocation\n  ==1187609==    at 0x4846828: malloc\n  ==1187609==    at ...: bmalloc_allocate_auxiliary_impl_casual_case(...)\n  ==1187609==    at 0x8841600: WebCore::CSSVariableReferenceValue::create(...)\n  ==1187609==    at 0x88D6DE7: WebCore::consumeStyleProperty(...)\n\nTo fix, add a { 0 } default initializer to double m_numericValue (the largest\nunion member, 8 bytes), ensuring all union bytes are zero-initialized for\nconstructors that don't explicitly set a different member.\n\nCovered by existing tests.\n\n* Source/WebCore/css/parser/CSSParserToken.cpp:\n(WebCore::CSSParserToken::CSSParserToken):\n* Source/WebCore/css/parser/CSSParserToken.h:\n\nCanonical link: https://commits.webkit.org/316573@main","order":0,"repository_id":"webkit","timestamp":1783367588},{"author":{"emails":["jespinal23@apple.com"],"name":"Jetzel Espinal"},"branch":"main","hash":"224e18252c85499c71ee5f09d49c778a00cb1237","message":"[GARDENING]REGRESSION(316540@main) inspector/animation/lifecycle-web-animation.html (layout-tests) is a constant text failure on macOS.\nhttps://bugs.webkit.org/show_bug.cgi?id=318697\nrdar://181513166\n\nUnreviewed test gardening.\n\n* LayoutTests/platform/mac-wk2/TestExpectations:\n\nCanonical link: https://commits.webkit.org/316574@main","order":0,"repository_id":"webkit","timestamp":1783367780},{"author":{"emails":["jer.noble@apple.com"],"name":"Jer Noble"},"branch":"main","hash":"10b3e30fc7f7d57ab315b5c0017e86b3bfaa4d0f","identifier":"316575@main","message":"[iOS] Restoring Fullscreen from PiP on YouTube results in wrongly sized video\nrdar://180962053\nhttps://bugs.webkit.org/show_bug.cgi?id=318490\n\nReviewed by Eric Carlson.\n\nWhen PiP is exited, we immediately call setVideoFullscreenMode() with VideoFullscreenModeNone,\nand when computeAcceleratedRenderingStateAndUpdateMediaPlayer() is subsequently called, it\nbelieves the element is not visible, even though the exit pip animation has only just started.\n\nMark the element as visible if the fullscreen mode is changing, which requires a recalculation\nwhen that state changes. Since many things can now contribute to the visibility state changing,\ndo so in the next run loop to coalesce requests that all occur at once.\n\n* Source/WebCore/html/HTMLMediaElement.cpp:\n(WebCore::HTMLMediaElement::didDetachRenderers):\n(WebCore::HTMLMediaElement::scheduleUpdateAcceleratedRenderingState):\n(WebCore::HTMLMediaElement::cancelPendingTasks):\n(WebCore::HTMLMediaElement::enterFullscreen):\n(WebCore::HTMLMediaElement::exitFullscreen):\n(WebCore::HTMLMediaElement::didBecomeFullscreenElement):\n(WebCore::HTMLMediaElement::didStopBeingFullscreenElement):\n(WebCore::HTMLMediaElement::setFullscreenMode):\n(WebCore::HTMLMediaElement::setChangingVideoFullscreenMode):\n* Source/WebCore/html/HTMLMediaElement.h:\n(WebCore::HTMLMediaElement::setChangingVideoFullscreenMode): Deleted.\n* Source/WebCore/html/HTMLVideoElement.cpp:\n(WebCore::HTMLVideoElement::acceleratedRenderingStateChanged):\n(WebCore::HTMLVideoElement::mediaPlayerRenderingModeChanged):\n(WebCore::HTMLVideoElement::computeAcceleratedRenderingStateAndUpdateMediaPlayer):\n(WebCore::HTMLVideoElement::viewportIntersectionChanged):\n\nCanonical link: https://commits.webkit.org/316575@main","order":0,"repository_id":"webkit","timestamp":1783368273},{"author":{"emails":["andresg_22@apple.com"],"name":"Andres Gonzalez"},"branch":"main","hash":"5fd9a4304b881e29883ec2d31858386440f7e39a","identifier":"316576@main","message":"AX: A text-stitch-group representative's text marker range is truncated to its first run\nhttps://bugs.webkit.org/show_bug.cgi?id=318529\n<rdar://problem/181299126>\n\nReviewed by Dominic Mazzoni.\n\nWhen accessibility text stitching merges adjacent text runs into a single static-text\nrepresentative, the representative's value spans all of its members, but its text marker\nrange did not. On the isolated tree, AXIsolatedObject::textMarkerRange() used the stitch\ngroup only to pick a stop boundary and then derived the range endpoints by walking the\naccessibility tree, a walk that stops at the representative's own run. As a result\nAXTextMarkerRangeForUIElement, and the string, attributed-string, and length APIs derived\nfrom that range, returned only the first run (e.g. \"By\" of a stitched \"By JOHN GRUBER\")\nrather than the full stitched text, so a client that reads an element's text through its\nmarker range got truncated content that disagreed with the element's value.\n\nBuild the representative's range directly from its stitch-group members, from the first\nthrough the last member that has text runs, mirroring the main-thread\nAccessibilityObject::simpleRange(). This spans the full stitched text and is consistent\nwith stringValue() and relativeFrame(), which already iterate the members.\n\nTest: accessibility/mac/stitched-text-marker-range-for-ui-element.html\n\n* LayoutTests/accessibility/mac/stitched-text-marker-range-for-ui-element-expected.txt: Added.\n* LayoutTests/accessibility/mac/stitched-text-marker-range-for-ui-element.html: Added.\n* Source/WebCore/accessibility/isolatedtree/mac/AXIsolatedObjectMac.mm:\n(WebCore::AXIsolatedObject::textMarkerRange const): Build a stitch-group representative's\nrange from its members instead of a tree walk that stops at the first run.\n\nCanonical link: https://commits.webkit.org/316576@main","order":0,"repository_id":"webkit","timestamp":1783369015},{"author":{"emails":["ahmad.saleem792@gmail.com","ahmad.saleem792+github@gmail.com","ahmad_saleem@apple.com"],"name":"Ahmad Saleem"},"branch":"main","hash":"0cfd238e978672f45c8c2070725693aa01a5041f","identifier":"316577@main","message":"TextTrackList::invalidateTrackIndexesAfterTrack only invalidates the first track's index\nhttps://bugs.webkit.org/show_bug.cgi?id=318198\nrdar://181003146\n\nReviewed by Brent Fulgham.\n\ninvalidateTrackIndexesAfterTrack() is meant to clear the cached index of\nthe given track and every track following it, since inserting or removing\na track shifts all subsequent positions. The loop advanced its counter\nfrom the found index to the end of the vector, but the body indexed with\nthe loop-invariant `index` instead of the loop variable, so it repeatedly\ninvalidated only the first track and left every following track with a\nstale cached index.\n\nFix the indexing, and while here rewrite the loop as a range-for over\nVector::subspan(index) to remove the manual counter.\n\n* Source/WebCore/html/track/TextTrackList.cpp:\n(WebCore::TextTrackList::invalidateTrackIndexesAfterTrack):\n\nCanonical link: https://commits.webkit.org/316577@main","order":0,"repository_id":"webkit","timestamp":1783370719},{"author":{"emails":["eric.carlson@apple.com"],"name":"Eric Carlson"},"branch":"main","hash":"525dd980ce78d4d809d726478919965cb2cd05f2","identifier":"316578@main","message":"[MediaStream] OverconstrainedError does not inherit from DOMException and has no code attribute\nhttps://bugs.webkit.org/show_bug.cgi?id=318127\nrdar://180728516\n\nReviewed by Andy Estes.\n\nThe MediaCapture-Main specification defines OverconstrainedError as\n`interface OverconstrainedError : DOMException`, with the `name`\n\"OverconstrainedError\" and `code` of 0 (no legacy DOMException code\nmapping). WebKit's implementation was a standalone RefCounted interface\nthat did not inherit from DOMException and exposed no `code` attribute,\nwhich caused several spec-compliance failures, including\n`new OverconstrainedError(\"x\") instanceof DOMException` returning false\nand `OverconstrainedError.length` being 0 instead of 1.\n\nThis patch makes OverconstrainedError inherit from DOMException, the\nsame pattern already used by RTCError, WebTransportError, and\nGPUPipelineError. The two constructors now delegate to DOMException\nwith legacyCode = 0 and name \"OverconstrainedError\", giving instances\nthe expected `.code`, `.name`, and DOMException prototype chain for\nfree. The IDL constructor signature is also tightened to match the\nspec: `constructor(DOMString constraint, optional DOMString message = \"\")`.\n\nA new OverconstrainedError.cpp is added to host the constructors and\nthe lazy constraint() conversion (previously inline in the header),\nand is wired into the unified-sources build and the Xcode project.\n\nLayout test baselines are updated where the new behavior changes\nPASS/FAIL state, and fast/events/constructors/overconstrained-error-event-constructor.html\nis adjusted to pass the now-required `constraint` argument.\n\nNo new tests, existing tests updated.\n\n* LayoutTests/fast/events/constructors/overconstrained-error-event-constructor-expected.txt:\n* LayoutTests/fast/events/constructors/overconstrained-error-event-constructor.html:\n* LayoutTests/fast/mediastream/mediastream-onaddtrack-and-overconstrainederror-code-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/mediacapture-streams/idlharness.https.window-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/mediacapture-streams/overconstrained_error.https-expected.txt:\n* Source/WebCore/Modules/mediastream/OverconstrainedError.cpp: Copied from Source/WebCore/Modules/mediastream/OverconstrainedError.idl.\n(WebCore::OverconstrainedError::OverconstrainedError):\n(WebCore::OverconstrainedError::constraint const):\n* Source/WebCore/Modules/mediastream/OverconstrainedError.h:\n(isType):\n(WebCore::OverconstrainedError::create): Deleted.\n(WebCore::OverconstrainedError::message const): Deleted.\n(WebCore::OverconstrainedError::name const): Deleted.\n(WebCore::OverconstrainedError::OverconstrainedError): Deleted.\n(WebCore::OverconstrainedError::constraint const): Deleted.\n* Source/WebCore/Modules/mediastream/OverconstrainedError.idl:\n* Source/WebCore/Sources.txt:\n* Source/WebCore/WebCore.xcodeproj/project.pbxproj:\n* Source/WebCore/dom/DOMException.h:\n\nCanonical link: https://commits.webkit.org/316578@main","order":0,"repository_id":"webkit","timestamp":1783370775},{"author":{"emails":["jespinal23@apple.com"],"name":"Jetzel Espinal"},"branch":"main","hash":"0c3a0a165f1454f8a3615e350b4e298f1b8178cc","identifier":"316579@main","message":"[GARDENING][ macOS DEBUG x86_64 ] TestWebKitAPI.EvaluateJavaScript.Serialization (api-test) is a flaky timeout.\nhttps://bugs.webkit.org/show_bug.cgi?id=318713\nrdar://181524436\n\nUnreviewed test gardening.\n\n* TestExpectations/apitests:\n\nCanonical link: https://commits.webkit.org/316579@main","order":0,"repository_id":"webkit","timestamp":1783371385},{"author":{"emails":["richard_robinson2@apple.com"],"name":"Richard Robinson"},"branch":"main","hash":"e4ab9e83a9991a18367c3c7317d6fed8c42f1fd1","identifier":"316580@main","message":"[Swift in WebKit] Build Swift on watchOS and tvOS public builds\nhttps://bugs.webkit.org/show_bug.cgi?id=318593\nrdar://181377652\n\nReviewed by Tim Horton.\n\n* Source/WebKit/Configurations/WebKit.xcconfig:\n* Source/WebKit/UIProcess/API/Cocoa/WebKitSwiftOverlay.swift:\n\nCanonical link: https://commits.webkit.org/316580@main","order":0,"repository_id":"webkit","timestamp":1783371853},{"author":{"emails":["richard_robinson2@apple.com"],"name":"Richard Robinson"},"branch":"main","hash":"414dedf1e400764bc4fe8fc5de266c5dac0f5c37","identifier":"316581@main","message":"[AppKit Gestures] Improve logging output for gestures\nhttps://bugs.webkit.org/show_bug.cgi?id=318666\nrdar://181469935\n\nReviewed by Abrar Rahman Protyasha.\n\nMore verbose than previously, but less verbose than the default logging output.\n\n* Source/WebKit/UIProcess/mac/WKAppKitGestureController.h:\n* Source/WebKit/UIProcess/mac/WKAppKitGestureController.mm:\n(gestureLogName):\n(-[WKAppKitGestureController panGestureRecognized:]):\n(-[WKAppKitGestureController singleClickGestureRecognized:]):\n(-[WKAppKitGestureController doubleClickGestureRecognized:]):\n(-[WKAppKitGestureController secondaryClickGestureRecognized:]):\n(-[WKAppKitGestureController mouseTrackingGestureRecognized:]):\n(-[WKAppKitGestureController dragPressGestureRecognized:]):\n* Source/WebKit/UIProcess/mac/WKAppKitGestureController.swift:\n(WKAppKitGestureController.loggingDescription(for:)):\n(NSGestureRecognizer.name):\n\nCanonical link: https://commits.webkit.org/316581@main","order":0,"repository_id":"webkit","timestamp":1783371946},{"author":{"emails":["darbinyan@apple.com"],"name":"Marta Darbinyan"},"branch":"main","hash":"80e4aa1b557b7782517dca6205c8176b93d3d894","identifier":"316582@main","message":"[Gardening]: [DEBUG] REGRESSION(315848@main): ipc/networksessioncocoa-empty-resource-request.html is constant text failure\nhttps://bugs.webkit.org/show_bug.cgi?id=318382\nrdar://181170547\n\nUnreviewed test gardening\n\n* LayoutTests/platform/ios/TestExpectations:\n* LayoutTests/platform/mac-wk2/TestExpectations:\n\nCanonical link: https://commits.webkit.org/316582@main","order":0,"repository_id":"webkit","timestamp":1783372591},{"author":{"emails":["aestes@apple.com"],"name":"Andy Estes"},"branch":"main","hash":"e240526ac582e5f58ab171e07343eb76aeaf55ba","identifier":"316583@main","message":"[iOS] WKAVContentSource should conform to AVPlaybackUserInterfaceVideoControllable\nhttps://bugs.webkit.org/show_bug.cgi?id=318727\nrdar://181531817\n\nReviewed by Jer Noble.\n\nMigrated WKAVContentSource conformance from AVInterfaceVideoPlaybackControllable to\nAVPlaybackUserInterfaceVideoControllable, as the former is deprecated.\n\n* Source/WebKit/Platform/ios/PlaybackSessionInterfaceAVKit.mm:\n(WebKit::PlaybackSessionInterfaceAVKit::durationChanged):\n(WebKit::PlaybackSessionInterfaceAVKit::currentTimeChanged):\n(WebKit::mediaSelectionOptionSource):\n* Source/WebKit/Platform/ios/WKAVContentSource.h:\n* Source/WebKit/Platform/ios/WKAVContentSource.mm:\n(emptyTimelineSegment):\n(playbackPosition):\n(-[WKAVContentSource initWithModel:]):\n(-[WKAVContentSource setSupportedSeekCapabilities:]):\n(-[WKAVContentSource setAudioOptions:]):\n(-[WKAVContentSource setLegibleOptions:]):\n(-[WKAVContentSource setMetadata:]):\n(-[WKAVContentSource setPlaybackPositionInternal:hostTime:]):\n(-[WKAVContentSource playbackPosition]):\n(-[WKAVContentSource seekToPosition:tolerance:]):\n(-[WKAVContentSource segments]):\n(-[WKAVContentSource currentSegment]):\n(-[WKAVContentSource state]):\n(-[WKAVContentSource setState:]):\n(-[WKAVContentSource supportedSeekCapabilities]):\n(-[WKAVContentSource error]):\n(-[WKAVContentSource currentAudioOption]):\n(-[WKAVContentSource setCurrentAudioOption:]):\n(-[WKAVContentSource currentAudioDescriptionOption]):\n(-[WKAVContentSource setCurrentAudioDescriptionOption:]):\n(-[WKAVContentSource currentLegibleOption]):\n(-[WKAVContentSource setCurrentLegibleOption:]):\n(-[WKAVContentSource audioOptions]):\n(-[WKAVContentSource audioDescriptionOptions]):\n(-[WKAVContentSource legibleOptions]):\n(-[WKAVContentSource metadata]):\n(createPlatformMetadata):\n(-[WKAVContentSource setCurrentPlaybackPositionInternal:]): Deleted.\n(-[WKAVContentSource currentValue]): Deleted.\n(-[WKAVContentSource setCurrentValue:]): Deleted.\n(-[WKAVContentSource currentPlaybackPosition]): Deleted.\n(-[WKAVContentSource setCurrentPlaybackPosition:]): Deleted.\n(-[WKAVContentSource playbackError]): Deleted.\n\nCanonical link: https://commits.webkit.org/316583@main","order":0,"repository_id":"webkit","timestamp":1783378515},{"author":{"emails":["ahmad.saleem792@gmail.com","ahmad.saleem792+github@gmail.com","ahmad_saleem@apple.com"],"name":"Ahmad Saleem"},"branch":"main","hash":"f0adce087927aedb358889dc066681d9dc3b40df","identifier":"316584@main","message":"IDBObjectStore.openKeyCursor() with a key value returns a value-carrying cursor instead of a key-only cursor\nhttps://bugs.webkit.org/show_bug.cgi?id=318654\nrdar://181463337\n\nReviewed by Sihui Liu.\n\nThis patch aligns WebKit with Gecko / Firefox and Blink / Chromium.\n\nIDBObjectStore::openKeyCursor(JSGlobalObject&, JSValue, IDBCursorDirection),\nthe overload taking a single key value, incorrectly routed through\ndoOpenCursor() (which creates a CursorType::KeyAndValue cursor) instead of\ndoOpenKeyCursor() (CursorType::KeyOnly). As a result,\nstore.openKeyCursor(someKey) returned an IDBCursorWithValue that fetched the\nfull record value, rather than a key-only cursor exposing only key and\nprimaryKey.\n\nOnly this JSValue overload was affected; the RefPtr<IDBKeyRange> and no-argument\npaths already routed to doOpenKeyCursor(). Chrome and Firefox already return a\nkey-only cursor here, so this aligns WebKit with the other engines and the\nIndexedDB specification.\n\nTest: storage/indexeddb/openkeycursor-key-only.html\n\n* LayoutTests/storage/indexeddb/openkeycursor-key-only-expected.txt: Added.\n* LayoutTests/storage/indexeddb/openkeycursor-key-only.html: Added.\n* LayoutTests/storage/indexeddb/resources/openkeycursor-key-only.js: Added.\n(prepareDatabase):\n(testKeyOnlyCursor.request.onsuccess):\n(testKeyOnlyCursor):\n* Source/WebCore/Modules/indexeddb/IDBObjectStore.cpp:\n(WebCore::IDBObjectStore::openKeyCursor):\n\nCanonical link: https://commits.webkit.org/316584@main","order":0,"repository_id":"webkit","timestamp":1783379275},{"author":{"emails":["g_squelart@apple.com"],"name":"Gerald Squelart"},"branch":"main","hash":"be4009feb0c469264698b51c4e48757a8327df12","message":"Worker OffscreenCanvas crashes in a page-less worker process\nhttps://bugs.webkit.org/show_bug.cgi?id=318403\nrdar://173713514\n\nReviewed by Dan Glastonbury.\n\nA 2D OffscreenCanvas used by a shared or service worker that was running\nin its own process was backed by a local accelerated IOSurface ImageBuffer\nin that worker's WebContent process.\nReading that canvas back (convertToBlob/getImageData) flushed deferred\nCoreAnimation draws in-process, but The WebContent sandbox denies the\ncom.apple.MTLCompilerService calls, so CoreAnimation aborted and the\nprocess crashed at CA::OGL::MetalContext::create_fragment_shader.\n\nFix GPUProcessWebWorkerClient::createImageBuffer to return an\nunaccelerated ImageBuffer instead of nullptr when the buffer cannot be\nremoted to the GPU process. This keeps the worker from ever creating a\nlocal IOSurface-backed canvas, so no in-process CoreAnimation/Metal work\nis triggered.\n\n(This change here just removes the crash; A future change could instead\nremote worker canvases to the GPU process to retain acceleration, see\nbug 318656.)\n\n* LayoutTests/fast/canvas/offscreencanvas-in-dedicated-worker-readback-expected.txt: Added.\n* LayoutTests/fast/canvas/offscreencanvas-in-dedicated-worker-readback.html: Added.\n* LayoutTests/fast/canvas/offscreencanvas-in-shared-worker-readback-expected.txt: Added.\n* LayoutTests/fast/canvas/offscreencanvas-in-shared-worker-readback.html: Added.\n* LayoutTests/fast/canvas/resources/offscreencanvas-readback-shared-worker.js: Added.\n* LayoutTests/fast/canvas/resources/offscreencanvas-readback-worker.js: Added.\n* LayoutTests/http/wpt/service-workers/offscreencanvas-in-separate-service-worker-process-cpu-fallback.https-expected.txt: Added.\n* LayoutTests/http/wpt/service-workers/offscreencanvas-in-separate-service-worker-process-cpu-fallback.https.html: Added.\n* LayoutTests/http/wpt/service-workers/offscreencanvas-in-separate-service-worker-process-worker.js: Added.\n* LayoutTests/http/wpt/service-workers/offscreencanvas-in-separate-service-worker-process.https-expected.txt: Added.\n* LayoutTests/http/wpt/service-workers/offscreencanvas-in-separate-service-worker-process.https.html: Added.\n* LayoutTests/platform/win/TestExpectations:\n* Source/WebCore/html/CanvasBase.cpp:\n(WebCore::CanvasBase::makeRenderingResultsAvailable):\n* Source/WebCore/platform/graphics/ImageBuffer.cpp:\n(WebCore::ImageBuffer::isRemoteImageBufferProxy const):\n* Source/WebCore/platform/graphics/ImageBuffer.h:\n* Source/WebCore/testing/ServiceWorkerInternals.cpp:\n(WebCore::ServiceWorkerInternals::effectiveRenderingModeOfNewlyCreatedAcceleratedCanvasBuffer):\n* Source/WebCore/testing/ServiceWorkerInternals.h:\n* Source/WebCore/testing/ServiceWorkerInternals.idl:\n* Source/WebKit/WebProcess/GPU/graphics/RemoteImageBufferProxy.h:\n* Source/WebKit/WebProcess/WebCoreSupport/WebWorkerClient.cpp:\n(WebKit::GPUProcessWebWorkerClient::createImageBuffer const):\n\nCanonical link: https://commits.webkit.org/316585@main","order":0,"repository_id":"webkit","timestamp":1783379660}]