)]}'
{
  "log": [
    {
      "commit": "cc84d838c54ffb5a424cbea22c15f3fe1ac09cf1",
      "tree": "e32420be17ca8f44d9945ffd265436d7325571a9",
      "parents": [
        "83683abb036df547c679bd13ee7bca7ff64df9f9"
      ],
      "author": {
        "name": "Abrar Rahman Protyasha",
        "email": "a_protyasha@apple.com",
        "time": "Sat Sep 05 09:44:01 2026"
      },
      "committer": {
        "name": "Abrar Rahman Protyasha",
        "email": "a_protyasha@apple.com",
        "time": "Sat Sep 05 09:44:01 2026"
      },
      "message": "[Swift Testing] WebPage.mouseMove(to:) does not deliver mouse moves to the page\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323489\nrdar://186724077\n\nReviewed by Richard Robinson.\n\nIn 312960@main, we taught WebPage.mouseMove(to:) to send -mouseMoved: to\nthe backing web view, but WKWebView does not override that selector.\nInstead, WKWebView utilizes tracking areas to drive mouseMove events,\nwhich rendered the helper a no-op. To work around this, we simply re-use\nthe established precedent of _simulateMouseMove:, which calls directly\ninto WebViewImpl::mouseMoved(), and is used by other test harness code.\n\nTest:\n  WebPageMouseEventsTests/mouseMoveFiresMouseMoveHandler\n  WebPageMouseEventsTests/sendingMouseMovedToWebViewDoesNotReachPage\n\n* Tools/TestWebKitAPI/Helpers/cocoa/WebPage+Extras.swift:\n(mouseMove(to:flags:)):\n* Tools/TestWebKitAPI/Tests/WebKit/WebPage/WebPageMouseEventsTests.swift:\n(KeyWindow.isKeyWindow):\nTo facilitate testing mouse move delivery, we need the web view to be\nin a window that is key. We introduce `KeyWindow`, a helper NSWindow\nsubclass, to facilitate this, by having this class unconditionally\nclaim key status (a la TestWKWebViewHostWindow).\n\n(WebPageMouseEventsTests.mouseMoveFiresMouseMoveHandler):\n(WebPageMouseEventsTests.sendingMouseMovedToWebViewDoesNotReachPage):\n(WebPageMouseEventsTests.loadMouseMoveRecorder):\n(WebPageMouseEventsTests.recordedMoves):\n\nCanonical link: https://commits.webkit.org/320560@main\n"
    },
    {
      "commit": "83683abb036df547c679bd13ee7bca7ff64df9f9",
      "tree": "c44e04af4e379acd4d952ec0d5f26d54e2b429de",
      "parents": [
        "549955d9979c99de1d9fa22a9d281629cedca59d"
      ],
      "author": {
        "name": "Sosuke Suzuki",
        "email": "sosuke@bun.sh",
        "time": "Sat Sep 05 08:44:36 2026"
      },
      "committer": {
        "name": "Sosuke Suzuki",
        "email": "sosuke@bun.com",
        "time": "Sat Sep 05 08:44:36 2026"
      },
      "message": "[JSC] Inline `RegExp#test` for unicode patterns and patterns with a Yarr frame\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d322949\n\nReviewed by Yusuke Suzuki.\n\nRegExpTestInline emits the Yarr matcher for 8-bit strings directly into\nDFG/FTL code, but it refuses any pattern whose terms need Yarr frame slots for\nbacktracking. That is every quantifier and alternation and, with the u or v\nflag, every character class, so almost no real pattern is inlined. The Yarr\nframe is addressed relative to the frame pointer, which only works inside\nYarr\u0027s own function frame, and the u/v flags are excluded on top of that even\nthough the 8-bit matcher does not decode surrogate pairs.\n\nThe inlined matcher calls nothing, so the outgoing-argument area at the bottom\nof the DFG/FTL frame is free while it runs. This patch places the Yarr frame\nthere: DFG and FTL reserve the frame size in that area, and in\nExecutionMode::InlineTest the frame is addressed relative to the stack pointer.\nThe function\u0027s own stack check covers the reservation, so the inlined code\nneither moves the stack pointer nor checks the stack limit. With frames\navailable, the unicode exclusions are dropped.\n\n                                          Baseline                  Patched\n\nregexp-test-inline-quantifier         18.6940+-0.1085     ^     10.7594+-0.1545        ^ definitely 1.7375x faster\nregexp-test-inline-unicode-sets       18.8223+-0.0938     ^     11.6284+-0.1800        ^ definitely 1.6186x faster\nregexp-test-inline-unicode            18.6505+-0.1107     ^     10.9138+-0.1957        ^ definitely 1.7089x faster\n\nTests: JSTests/microbenchmarks/regexp-test-inline-quantifier.js\n       JSTests/microbenchmarks/regexp-test-inline-unicode-sets.js\n       JSTests/microbenchmarks/regexp-test-inline-unicode.js\n       JSTests/stress/regexp-test-inline-frame-in-outgoing-argument-area.js\n       JSTests/stress/regexp-test-inline-unicode-and-quantifiers.js\n\n* JSTests/microbenchmarks/regexp-test-inline-quantifier.js: Added.\n(isLowerAlpha):\n* JSTests/microbenchmarks/regexp-test-inline-unicode-sets.js: Added.\n(isLowerLetter):\n* JSTests/microbenchmarks/regexp-test-inline-unicode.js: Added.\n(isLowerAlpha):\n* JSTests/stress/regexp-test-inline-frame-in-outgoing-argument-area.js: Added.\n(shouldBe):\n(callee):\n(test):\n* JSTests/stress/regexp-test-inline-unicode-and-quantifiers.js: Added.\n(shouldBe):\n(makeTest):\n* Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp:\n(JSC::DFG::SpeculativeJIT::compileRegExpTestInline):\n* Source/JavaScriptCore/dfg/DFGStrengthReductionPhase.cpp:\n(JSC::DFG::StrengthReductionPhase::handleNode):\n* Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:\n(JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):\n* Source/JavaScriptCore/runtime/StackAlignment.h:\n(JSC::argumentCountForStackSize): Deleted.\n* Source/JavaScriptCore/yarr/YarrJIT.cpp:\n(JSC::Yarr::jitCompileInlinedTest):\n* Source/JavaScriptCore/yarr/YarrJIT.h:\n\nCanonical link: https://commits.webkit.org/320559@main\n"
    },
    {
      "commit": "549955d9979c99de1d9fa22a9d281629cedca59d",
      "tree": "749965db65b31b0d90b2347efd8fa27e433ae862",
      "parents": [
        "b091600bcaa79c67577a8c0ea40d40dcda916d4a"
      ],
      "author": {
        "name": "Sosuke Suzuki",
        "email": "sosuke@bun.sh",
        "time": "Sat Sep 05 08:42:51 2026"
      },
      "committer": {
        "name": "Sosuke Suzuki",
        "email": "sosuke@bun.com",
        "time": "Sat Sep 05 08:42:51 2026"
      },
      "message": "[YARR] Keep the terms of lookbehinds in match order in YarrPattern\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323421\n\nReviewed by Daniel Liu.\n\nThis is the last step of the plan in 319067@main.\n\nSince 319067@main and 320492@main, the JIT and the interpreter match a\nlookbehind from a copy of its disjunction in which the terms of each backward\nalternative are reversed and inputPosition is counted in that order. The copy\nwas needed because YarrPatternConstructor kept the terms in pattern order.\n\nYarrPatternConstructor now reverses the terms of the backward alternatives\nwhen a lookbehind is closed, right after its forward references are resolved,\nand setupAlternativeOffsets() counts the disjunction of a lookahead inside a\nlookbehind from 0, as the copy did. Both tiers use the pattern as it is, and\ncopyDisjunctionInMatchOrder() is removed. The bytecode and the JIT ops are the\nsame as before, except that frame slots are now also numbered in match order.\n\n* Source/JavaScriptCore/yarr/YarrInterpreter.cpp:\n(JSC::Yarr::ByteCompiler::emitDisjunction):\n* Source/JavaScriptCore/yarr/YarrJIT.cpp:\n* Source/JavaScriptCore/yarr/YarrPattern.cpp:\n(JSC::Yarr::YarrPatternConstructor::atomParenthesesEnd):\n(JSC::Yarr::YarrPatternConstructor::putTermsInMatchOrder):\n(JSC::Yarr::YarrPatternConstructor::setupAlternativeOffsets):\n(JSC::Yarr::YarrPattern::copyDisjunctionInMatchOrder): Deleted.\n* Source/JavaScriptCore/yarr/YarrPattern.h:\n\nCanonical link: https://commits.webkit.org/320558@main\n"
    },
    {
      "commit": "b091600bcaa79c67577a8c0ea40d40dcda916d4a",
      "tree": "385f610ebad66e5730384988cd3c1c8145e504dc",
      "parents": [
        "e2f1a867ae69cfe07c4fe23b51b24186b32ab991"
      ],
      "author": {
        "name": "Fady Farag",
        "email": "com.webkit.iidmsa@gmail.com",
        "time": "Sat Sep 05 08:41:01 2026"
      },
      "committer": {
        "name": "Yusuke Suzuki",
        "email": "ysuzuki@apple.com",
        "time": "Sat Sep 05 08:41:01 2026"
      },
      "message": "[JSC] Use named enums for register enums\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323455\nrdar://186684831\n\nReviewed by Yusuke Suzuki.\n\n* Source/JavaScriptCore/assembler/ARM64Assembler.h:\n* Source/JavaScriptCore/assembler/RISCV64Assembler.h:\n* Source/JavaScriptCore/assembler/X86Assembler.h:\n\nCanonical link: https://commits.webkit.org/320557@main\n"
    },
    {
      "commit": "e2f1a867ae69cfe07c4fe23b51b24186b32ab991",
      "tree": "d511659f16a634d17283f6ddb1dabba605eba265",
      "parents": [
        "2c42ef2658a863cb24f44230589f4ec9803a7b2b"
      ],
      "author": {
        "name": "Charlie Wolfe",
        "email": "charliew@apple.com",
        "time": "Sat Sep 05 07:39:02 2026"
      },
      "committer": {
        "name": "Charlie Wolfe",
        "email": "charliew@apple.com",
        "time": "Sat Sep 05 07:39:02 2026"
      },
      "message": "[JSC] Move CodeOrigin instead of copying it when creating DFG nodes\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323490\nrdar://186725447\n\nReviewed by Yusuke Suzuki.\n\nCopying a CodeOrigin heap allocates an OutOfLineCodeOrigin when the bytecode index is too large to\npack into the spare top address bits. Its move constructor just steals the composite word, so every\ncopy we avoid along the node creation path is one malloc/free avoided for large or deeply inlined\ncode.\n\nwithSemantic() and withForExitAndExitOK() now construct the result directly rather than copying\n*this and overwriting a field, propagating wasHoisted explicitly.\n\nNo behavior change.\n\n* Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp:\n(JSC::DFG::ByteCodeParser::currentNodeOrigin):\n* Source/JavaScriptCore/dfg/DFGGraph.h:\n* Source/JavaScriptCore/dfg/DFGInsertionSet.h:\n(JSC::DFG::InsertionSet::insertNode):\n* Source/JavaScriptCore/dfg/DFGNode.h:\n(JSC::DFG::Node::Node):\n* Source/JavaScriptCore/dfg/DFGNodeOrigin.h:\n(JSC::DFG::NodeOrigin::NodeOrigin):\n(JSC::DFG::NodeOrigin::withSemantic const):\n(JSC::DFG::NodeOrigin::withForExitAndExitOK const):\n\nCanonical link: https://commits.webkit.org/320556@main\n"
    },
    {
      "commit": "2c42ef2658a863cb24f44230589f4ec9803a7b2b",
      "tree": "e9d82fc74a81cacfe5758c6d620f9dc79e961c0b",
      "parents": [
        "c8c37314ee17807d8d77e157e983f54872b103ab"
      ],
      "author": {
        "name": "Richard Robinson",
        "email": "richard_robinson2@apple.com",
        "time": "Sat Sep 05 07:21:22 2026"
      },
      "committer": {
        "name": "Richard Robinson",
        "email": "richard_robinson2@apple.com",
        "time": "Sat Sep 05 07:21:22 2026"
      },
      "message": "[AppKit Gestures] Update the `clickingOnSelectedWordOpensContextMenu` test with updated expectations\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323494\nrdar://186729378\n\nReviewed by Abrar Rahman Protyasha.\n\n* Tools/TestWebKitAPI/Tests/WebKit/WebPage/AppKit Gesture Tests/BasicAppKitGesturesTests.swift:\n(AppKitGesturesTests.clickingOnSelectedWordOpensContextMenu(_:)):\n\nCanonical link: https://commits.webkit.org/320555@main\n"
    },
    {
      "commit": "c8c37314ee17807d8d77e157e983f54872b103ab",
      "tree": "7a35d5ea716af9c2bcd5b55836094e359913ec56",
      "parents": [
        "a7cd2f5b0eb407ec31e9815dc5c9c3491e5f4451"
      ],
      "author": {
        "name": "itsu-dev",
        "email": "itsu020402@gmail.com",
        "time": "Sat Sep 05 07:09:26 2026"
      },
      "committer": {
        "name": "Yusuke Suzuki",
        "email": "ysuzuki@apple.com",
        "time": "Sat Sep 05 07:09:26 2026"
      },
      "message": "[JSC] Array.prototype.toSpliced incorrectly throws TypeError instead of RangeError when length is Infinity\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d320830\n\nReviewed by Yusuke Suzuki.\n\nArray.prototype.toSpliced should throw TypeError when the new array\nlength exceeds 2**53-1 (Step 12 of [1]), but it currently throws\nTypeError for the length of 2**53-1. For this case, it should throw\nRangeError instead (Step 13 of [1], Step 1 of [2]).\n\nTo fix this, this commit replaces `\u003e\u003d` with `\u003e` in the implementation\nof `Array.prototype.toSpliced` to check the new array length.\n\n[1]: https://tc39.es/ecma262/2026/multipage/indexed-collections.html#sec-array.prototype.tospliced\n[2]: https://tc39.es/ecma262/2026/multipage/ordinary-and-exotic-objects-behaviours.html#sec-arraycreate\n\nNo additional tests. Instead, this commit also modify a exisiting\nstress test to adjust the specification.\n\n* JSTests/stress/change-array-by-copy.js:\n(shouldThrow):\n* Source/JavaScriptCore/runtime/ArrayPrototype.cpp:\n(JSC::JSC_DEFINE_HOST_FUNCTION):\n\nCanonical link: https://commits.webkit.org/320554@main\n"
    },
    {
      "commit": "a7cd2f5b0eb407ec31e9815dc5c9c3491e5f4451",
      "tree": "1dbfd9801443898f3cddaf12a17135ba295624bf",
      "parents": [
        "6787a18c749f439c82a4b33e3679eec926351227"
      ],
      "author": {
        "name": "Ben Nham",
        "email": "nham@apple.com",
        "time": "Sat Sep 05 05:34:12 2026"
      },
      "committer": {
        "name": "Ben Nham",
        "email": "nham@apple.com",
        "time": "Sat Sep 05 05:34:12 2026"
      },
      "message": "[Site Isolation] Only broadcast frame geometry from frames with a cross-process descendant\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d322890\nrdar://problem/186140629\n\nReviewed by Kiet Ho and Matt Woodrow.\n\nOn every rendering update, each local frame broadcasts its frame geometry to every other process\nrendering the page.\n\nThis is mostly unnecessary, because remote frames only care about geometry from ancestors, not the\nentire tree:\n\n - IntersectionObserver: computeClippedRectInRootContentsSpace uses clip geometry from ancestors\n   only, e.g. layoutViewportRect and visibleRectOfChild.\n - LocalFrameView::windowClipRect: root frames in the remote process calculate their clip rect from\n   their parent\u0027s visibleRectInParent.\n - exposedContentRect: frames in the remote process calculate their exposedContentRect from their\n   parent\u0027s exposedContentRectInParent.\n\nTo fix this, skip calculating geometry for any child that is entirely local to this process.\nAdditionally, if a local frame has no remote descendants, then we should send nothing, since no\nremote frame exists that could use that geometry.\n\nOne complication here is with remote frames nested under multiple local frames:\n\n  Local main frame \u003d\u003e local child frame \u003d\u003e remote grandchild frame\n\nWhen we process the local main frame in the syncLocalFrameInfoToRemote loop, we still have to send\ngeometry associated with that local main frame even though its direct child is local. This is\nbecause an IntersectionObserver in the remote grandchild frame walks all the way up to the root of\nthe frame tree and uses clipping rectangles from all ancestor nodes.\n\nWe add a layout test to test this specific frame hierarchy with IntersectionObserver. Note that it\nis similar to but differs from the existing nested-cross-origin-iframe.sub.html IntersectionObserver\ntest in WPT, since the frame hierarchy in that test contains only remote child frames.\n\nThere is an obvious follow-up optimization here to stop broadcasting frame geometry and only send\nit to remote processes that actually need that particular state. That requires more significant\nrefactoring so we\u0027ll optimize that in a subsequent patch.\n\nTests: http/tests/site-isolation/intersection-observer/target-in-cross-site-frame-nested-in-same-site-frame.html\n       http/tests/site-isolation/only-broadcast-frame-geometry-from-frames-with-cross-process-descendants.html\n\n* LayoutTests/http/tests/site-isolation/intersection-observer/resources/report-intersections-frame.html: Added.\n* LayoutTests/http/tests/site-isolation/intersection-observer/resources/same-site-middle-frame.html: Added.\n* LayoutTests/http/tests/site-isolation/intersection-observer/target-in-cross-site-frame-nested-in-same-site-frame-expected.txt: Added.\n* LayoutTests/http/tests/site-isolation/intersection-observer/target-in-cross-site-frame-nested-in-same-site-frame.html: Added.\n* LayoutTests/http/tests/site-isolation/only-broadcast-frame-geometry-from-frames-with-cross-process-descendants-expected.txt: Added.\n* LayoutTests/http/tests/site-isolation/only-broadcast-frame-geometry-from-frames-with-cross-process-descendants.html: Added.\n* Source/WebCore/page/Page.cpp:\n(WebCore::Page::syncLocalFrameInfoToRemote):\n* Source/WebCore/page/FrameTree.cpp:\n(WebCore::FrameTree::containsLocalFrame const):\n* Source/WebCore/page/FrameTree.h:\n* Source/WebCore/page/RemoteFrameView.cpp:\n(WebCore::RemoteFrameView::childFrameOwnerToRootContentTransform const):\n(WebCore::RemoteFrameView::absoluteToChildFrameOwnerLocalTransform const):\n\nCanonical link: https://commits.webkit.org/320553@main\n"
    },
    {
      "commit": "6787a18c749f439c82a4b33e3679eec926351227",
      "tree": "36d5f3c163b6fd3779beca22e09d3a87ebb72507",
      "parents": [
        "d0088e0c11f00a846906bc805ea1385cd0cb1713"
      ],
      "author": {
        "name": "Simon Fraser",
        "email": "simon.fraser@apple.com",
        "time": "Sat Sep 05 03:13:17 2026"
      },
      "committer": {
        "name": "Simon Fraser",
        "email": "simon.fraser@apple.com",
        "time": "Sat Sep 05 03:13:17 2026"
      },
      "message": "[corner-shape] `shape-outside` ignores corner-shape for \u003cshape-box\u003e values\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d322358\nrdar://185643661\n\nReviewed by Simon Fraser.\n\nTake `corner-shape` into account for `shape-outside`. `computeGeometryForBoxShape()` now computes\na polygon for the inner or outer shape via new functions in PathUtilities, which produce a polygon by fetching\nthe path and sampling it to create a vector of points. This polygon feeds into the existing shape-outside\ncode.\n\nBased on work by Lilly Le (@cupidsity), with a fix for the positioning of the contour for\n`shape-outside: padding-box`.\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-borders/corner-shape/corner-shape-outside-left-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-borders/corner-shape/corner-shape-outside-left.html:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-borders/corner-shape/corner-shape-outside-right-expected.txt:\n* Source/WebCore/platform/graphics/BezierUtilities.cpp:\n(WebCore::appendFlattenedBezier): A helper that appends points to the vector for a bezier segment.\n* Source/WebCore/platform/graphics/BezierUtilities.h:\n* Source/WebCore/rendering/BorderShape.cpp:\n(WebCore::BorderShape::constrainedRadiiScale):\n(WebCore::flattenClosedPathToPolygon):\n(WebCore::BorderShape::outerShapeAsPolygon const):\n(WebCore::BorderShape::innerShapeAsPolygon const):\n(WebCore::BorderShape::offsetReferenceRect const):\n(WebCore::constrainedRadiiScale): Deleted.\n* Source/WebCore/rendering/BorderShape.h:\n* Source/WebCore/rendering/shapes/BoxLayoutShape.cpp:\n(WebCore::BoxShapeGeometry::roundedRect const):\n(WebCore::BoxShapeGeometry::contour const):\n(WebCore::computeGeometryForBoxShape):\n(WebCore::computeRoundedRectForBoxShape):\n(WebCore::BoxLayoutShape::getExcludedInterval const):\n* Source/WebCore/rendering/shapes/BoxLayoutShape.h:\n* Source/WebCore/rendering/shapes/LayoutShape.cpp:\n(WebCore::LayoutShape::createBoxShape):\n* Source/WebCore/rendering/shapes/LayoutShape.h:\n* Source/WebCore/rendering/shapes/PolygonLayoutShape.cpp:\n(WebCore::inwardEdgeNormal):\n(WebCore::uniteEdgeExcludedInterval):\n(WebCore::PolygonLayoutShape::getExcludedInterval const):\n(WebCore::outwardEdgeNormal): Deleted.\n* Source/WebCore/rendering/shapes/PolygonLayoutShape.h:\n* Source/WebCore/rendering/shapes/ShapeOutsideInfo.cpp:\n(WebCore::makeShapeForShapeOutside):\n* Source/WebCore/platform/graphics/PathUtilities.cpp:\n(WebCore::PathUtilities::flattenPath):\n(WebCore::PathUtilities::flattenPathToContour):\n* Source/WebCore/platform/graphics/PathUtilities.h:\n\nCanonical link: https://commits.webkit.org/320552@main\n"
    },
    {
      "commit": "d0088e0c11f00a846906bc805ea1385cd0cb1713",
      "tree": "4a7ec968dfd2943343c845d74d4562e5d8da9769",
      "parents": [
        "321cf5cc81d703c02cd32e628b755a3dc4499063"
      ],
      "author": {
        "name": "Richard Robinson",
        "email": "richard_robinson2@apple.com",
        "time": "Sat Sep 05 01:31:32 2026"
      },
      "committer": {
        "name": "Richard Robinson",
        "email": "richard_robinson2@apple.com",
        "time": "Sat Sep 05 01:31:32 2026"
      },
      "message": "[Swift in WebKit] Annotate a few more WTF smart pointer types as Escapable\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323468\nrdar://186698683\n\nReviewed by Abrar Rahman Protyasha.\n\nAnnotate RetainPtr and UniqueRef.\n\n* Source/WTF/wtf/RetainPtr.h:\n* Source/WTF/wtf/UniqueRef.h:\n\nCanonical link: https://commits.webkit.org/320551@main\n"
    },
    {
      "commit": "321cf5cc81d703c02cd32e628b755a3dc4499063",
      "tree": "ec1f2a77b6de7428a1f3dcdc98e933240047efeb",
      "parents": [
        "c714b8656601d77dd8855d9aa3a3a54e49b442e4"
      ],
      "author": {
        "name": "Alan Baradlay",
        "email": "zalan@apple.com",
        "time": "Sat Sep 05 01:08:39 2026"
      },
      "committer": {
        "name": "Alan Baradlay",
        "email": "zalan@apple.com",
        "time": "Sat Sep 05 01:08:39 2026"
      },
      "message": "[list-marker] AX: The list marker is missing from the stitched text of a list item with block content\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323457\nrdar://problem/186687365\n\nReviewed by Antti Koivisto.\n\nAn excluded marker is on no line\u0027s leaf boxes, so the stitch group for the line it was positioned against left it\nout. Put it at the start of that group.\n\nTest: accessibility/listmarker-text-with-block-content.html\n\n* LayoutTests/accessibility/listmarker-text-with-block-content-expected.txt: Added.\n* LayoutTests/accessibility/listmarker-text-with-block-content.html: Added.\n* Source/WebCore/accessibility/AccessibilityNodeObject.cpp:\n(WebCore::AccessibilityNodeObject::stitchGroups const):\n\nCanonical link: https://commits.webkit.org/320550@main\n"
    },
    {
      "commit": "c714b8656601d77dd8855d9aa3a3a54e49b442e4",
      "tree": "19f80a1fa56e0d9da073c0a8e77a42fa55737e2b",
      "parents": [
        "1b46b208061c4dbf3f8514b88d68d53bf124eb90"
      ],
      "author": {
        "name": "Alan Baradlay",
        "email": "zalan@apple.com",
        "time": "Sat Sep 05 00:19:07 2026"
      },
      "committer": {
        "name": "Alan Baradlay",
        "email": "zalan@apple.com",
        "time": "Sat Sep 05 00:19:07 2026"
      },
      "message": "[list-marker] A float in the list item\u0027s content pushes the list marker out with the line\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323453\nrdar://problem/186680551\n\nReviewed by Antti Koivisto.\n\nThe marker hangs off the line\u0027s inline start edge, which a float of that formatting context has already pushed\ninwards. Give that room back. A float intruding from earlier content keeps the marker with the line (webkit.org/b/166528).\n\nTest: imported/w3c/web-platform-tests/css/css-lists/outside-marker-with-float-in-content.html\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-lists/outside-marker-with-float-in-content-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-lists/outside-marker-with-float-in-content-ref.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-lists/outside-marker-with-float-in-content.html: Added.\n* Source/WebCore/layout/floats/PlacedFloats.cpp:\n(WebCore::Layout::PlacedFloats::Item::isInFormattingContextOf const):\n* Source/WebCore/layout/integration/inline/LayoutIntegrationLineLayout.cpp:\n(WebCore::LayoutIntegration::LineLayout::setExcludedMarkerPositions):\n* Source/WebCore/rendering/RenderListItem.cpp:\n(WebCore::excludedMarkerLogicalLeftOffsetFor):\n(WebCore::RenderListItem::placeExcludedMarker):\n* Source/WebCore/rendering/RenderListOutsideMarker.h:\n\nCanonical link: https://commits.webkit.org/320549@main\n"
    },
    {
      "commit": "1b46b208061c4dbf3f8514b88d68d53bf124eb90",
      "tree": "fccd35ee52c157f678b8215c34e3ad212cd7c8e2",
      "parents": [
        "59ed8ce0fa71356bb165bca077053055aec4fe77"
      ],
      "author": {
        "name": "Yusuke Suzuki",
        "email": "ysuzuki@apple.com",
        "time": "Sat Sep 05 00:01:51 2026"
      },
      "committer": {
        "name": "Yusuke Suzuki",
        "email": "ysuzuki@apple.com",
        "time": "Sat Sep 05 00:01:51 2026"
      },
      "message": "[JSC] Optimize Wasm globals initialization related code\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323465\nrdar://186697890\n\nReviewed by Yijia Huang.\n\nThis patch optimizes Wasm globals initialization related code,\n\n1. constant expression validator should collect maxStackHeight. So we\n   can use this when evaluating constant expression.\n2. Wasm array / struct are initialized with zeros. So we should set a\n   new value only when it is not zero (jsNull() for example).\n\n* Source/JavaScriptCore/wasm/WasmConstExprGenerator.cpp:\n(JSC::Wasm::ConstExprInterpreter::run):\n(JSC::Wasm::ConstExprInterpreter::createNewArray):\n(JSC::Wasm::ConstExprInterpreter::createNewStruct):\n(JSC::Wasm::ConstExprGenerator::maxStackHeight const):\n(JSC::Wasm::ConstExprGenerator::didParseOpcode):\n(JSC::Wasm::parseExtendedConstExpr):\n(JSC::Wasm::evaluateExtendedConstExpr):\n* Source/JavaScriptCore/wasm/WasmConstExprGenerator.h:\n* Source/JavaScriptCore/wasm/WasmModuleInformation.h:\n* Source/JavaScriptCore/wasm/WasmOperationsInlines.h:\n(JSC::Wasm::structNew):\n* Source/JavaScriptCore/wasm/WasmSectionParser.cpp:\n(JSC::Wasm::SectionParser::parseInitExpr):\n* Source/JavaScriptCore/wasm/WasmTable.cpp:\n(JSC::Wasm::FuncRefTable::FuncRefTable):\n* Source/JavaScriptCore/wasm/WasmTypeDefinition.h:\n* Source/JavaScriptCore/wasm/js/JSWebAssemblyStruct.cpp:\n(JSC::JSWebAssemblyStruct::get const):\n(JSC::JSWebAssemblyStruct::set):\n\nCanonical link: https://commits.webkit.org/320548@main\n"
    },
    {
      "commit": "59ed8ce0fa71356bb165bca077053055aec4fe77",
      "tree": "ae9961bbfb173ccefb3bd423822f899bc7b7aff0",
      "parents": [
        "717cf345ad13f11615ae56d16ca1049614916dc3"
      ],
      "author": {
        "name": "Wenson Hsieh",
        "email": "wenson_hsieh@apple.com",
        "time": "Fri Sep 04 23:59:45 2026"
      },
      "committer": {
        "name": "Wenson Hsieh",
        "email": "wenson_hsieh@apple.com",
        "time": "Fri Sep 04 23:59:45 2026"
      },
      "message": "[Text Extraction] Remove unnecessary `USE(APPLE_INTERNAL_SDK) || (!PLATFORM(WATCHOS) \u0026\u0026 !PLATFORM(APPLETV))` compile-time guards\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323458\n\nReviewed by Richard Robinson and Aditya Keerthi.\n\nRemove these now-unnecessary checks, now that the WKTextExtraction module compiles on non-internal\nwatchOS and tvOS SDKs.\n\n* Source/WebKit/UIProcess/API/Cocoa/WKWebView+TextExtraction.mm:\n(-[WKWebView _ensureTextExtractionFilterRulesWithCompletionHandler:]):\n(-[WKWebView _performInteraction:inFrame:actionType:staleNodeResolution:completionHandler:]):\n(-[WKWebView _retryInteractionWithConnectedRemapCandidate:actionType:requestedNodeIdentifier:remapCandidates:failureDescription:completionHandler:]):\n(-[WKWebView _requestTextExtractionInternal:completion:]):\n(-[WKWebView _requestTextExtraction:completionHandler:]):\n(-[WKWebView _describeInteraction:completionHandler:]):\n(-[WKWebView _describeInteraction:inFrame:staleNodeResolution:completionHandler:]):\n(-[WKWebView _retryDescribingInteractionWithConnectedRemapCandidate:requestedNodeIdentifier:remapCandidates:completionHandler:]):\n* Source/WebKit/UIProcess/API/Cocoa/WKWebView.mm:\n(-[WKWebView _extractDebugTextWithConfiguration:completionHandler:]):\n(-[WKWebView _performInteraction:completionHandler:]):\n(-[WKWebView _filterExtractedString:options:completionHandler:]):\n* Source/WebKit/UIProcess/API/Cocoa/WKWebViewInternal.h:\n* Source/WebKit/UIProcess/Cocoa/TextExtraction/WKTextExtractionUtilities.h:\n* Source/WebKit/UIProcess/Cocoa/TextExtraction/WKTextExtractionUtilities.mm:\n\nCanonical link: https://commits.webkit.org/320547@main\n"
    },
    {
      "commit": "717cf345ad13f11615ae56d16ca1049614916dc3",
      "tree": "59d0879d677f30d1bf7f9593c57001afc56465a9",
      "parents": [
        "34aca645c7fa15db0ea062c9259d824834be9792"
      ],
      "author": {
        "name": "Aleksei Marchenko",
        "email": "aleksei@apple.com",
        "time": "Fri Sep 04 23:48:35 2026"
      },
      "committer": {
        "name": "Aleksei Marchenko",
        "email": "aleksei@apple.com",
        "time": "Fri Sep 04 23:48:35 2026"
      },
      "message": "Add position-anchor syntax for model attachment points\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d322777\nrdar://182292647\n\nReviewed by Mike Wyrzykowski, Etienne Segonzac, and Sam Weinig.\n\nExtend position-anchor so an anchor name may carry a \u0027#\u0027-delimited attachment point naming a node in\nthe anchor\u0027s model asset. Parsing and serialization only. Proposed in the Spatial CSS explainer, not\nyet in a specification.\n\nThe name and the suffix tokenize separately, which grammar notation cannot express, so the suffix is\nparsed by hand while the property\u0027s grammar stays generated. Only the suffix is gated on the spatial\nportal feature, so other platforms accept the same values as before.\n\nAdjacency is deliberate: whitespace before the \u0027#\u0027 is rejected, comments are not, and the hash must be\nan identifier.\n\nTests: spatial-css/spatial-portal-anchor-css.html\n       spatial-css/spatial-portal-anchor-invalid.html\n       spatial-css/spatial-portal-anchor-off.html\n\n* LayoutTests/spatial-css/spatial-portal-anchor-css-expected.txt: Added.\n* LayoutTests/spatial-css/spatial-portal-anchor-css.html: Added.\n* LayoutTests/spatial-css/spatial-portal-anchor-invalid-expected.txt: Added.\n* LayoutTests/spatial-css/spatial-portal-anchor-invalid.html: Added.\n* LayoutTests/spatial-css/spatial-portal-anchor-off-expected.txt: Added.\n* LayoutTests/spatial-css/spatial-portal-anchor-off.html: Added.\n* Source/WebCore/Sources.txt:\n* Source/WebCore/WebCore.xcodeproj/project.pbxproj:\n* Source/WebCore/css/CSSPinnedAnchorNameValue.cpp: Added.\n(WebCore::CSSPinnedAnchorNameValue::create):\n(WebCore::CSSPinnedAnchorNameValue::CSSPinnedAnchorNameValue):\n(WebCore::CSSPinnedAnchorNameValue::customCSSText const):\n(WebCore::CSSPinnedAnchorNameValue::equals const):\n(WebCore::CSSPinnedAnchorNameValue::addDerivedHash const):\n* Source/WebCore/css/CSSPinnedAnchorNameValue.h: Added.\n* Source/WebCore/css/CSSProperties.json:\n* Source/WebCore/css/CSSValue.cpp:\n(WebCore::CSSValue::visitDerived):\n* Source/WebCore/css/CSSValue.h:\n(WebCore::CSSValue::isPinnedAnchorNameValue const):\n* Source/WebCore/css/parser/CSSPropertyParserConsumer+Anchor.cpp:\n(WebCore::CSSPropertyParserHelpers::consumePinnedAnchorName):\n* Source/WebCore/css/parser/CSSPropertyParserConsumer+Anchor.h:\n* Source/WebCore/style/values/anchor-position/StylePinnedAnchorName.cpp: Added.\n(WebCore::Style::CSSValueCreation\u003cPinnedAnchorName\u003e::operator):\n(WebCore::Style::Serialize\u003cPinnedAnchorName\u003e::operator):\n(WebCore::Style::operator\u003c\u003c):\n* Source/WebCore/style/values/anchor-position/StylePinnedAnchorName.h: Added.\n* Source/WebCore/style/values/anchor-position/StylePositionAnchor.cpp:\n(WebCore::Style::CSSValueConversion\u003cPositionAnchor\u003e::operator):\n* Source/WebCore/style/values/anchor-position/StylePositionAnchor.h:\n(WebCore::Style::PositionAnchor::PositionAnchor):\n(WebCore::Style::PositionAnchor::isName const):\n(WebCore::Style::PositionAnchor::tryName const):\n\nCanonical link: https://commits.webkit.org/320546@main\n"
    },
    {
      "commit": "34aca645c7fa15db0ea062c9259d824834be9792",
      "tree": "2cfd6d4fdd303663fe950ab0452db0f5b5f8d8cc",
      "parents": [
        "60dd821e68ff0a6563ad4304805b9c08492b13d0"
      ],
      "author": {
        "name": "Elliott Williams",
        "email": "emw@apple.com",
        "time": "Fri Sep 04 23:38:27 2026"
      },
      "committer": {
        "name": "Elliott Williams",
        "email": "emw@apple.com",
        "time": "Fri Sep 04 23:38:27 2026"
      },
      "message": "[Build speed] Collect swift/ninja traces in measure-build-time\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323380\nrdar://186613991\n\nReviewed by Geoffrey Garen.\n\nAdd --trace and --trace-dir options to mbt that configure a CMake build\nwith SWIFT_NINJA_TRACE\u003dON and produce a directory of JSON traces. This\nwill be consumed by CI to collect and upload traces for builds.\n\nTo support tracing without breaking Swift-C++ dependency tracking added\nin 320311@main, refactor swiftc-wrapper.py to support a nested wrapper.\nNow, trace mode causes CMake to invoke swiftc-wrapper which in turn\ninvokes swiftc_job_recorder which is what actually calls the frontend.\n\n* Source/cmake/OptionsCommon.cmake:\n* Tools/Scripts/measure-build-time:\n(Task):\n(Task.__init__):\n(Task.run):\n(run_test):\n(write_build_trace):\n(Arguments):\n(get_args):\n(main):\n* Tools/Scripts/swift/ninja_build_trace.py:\n(main):\n* Tools/Scripts/swift/ninja_build_trace_unittest.py:\n(MainTest._two_invocation_log):\n(MainTest):\n(MainTest._run_main):\n(MainTest.test_the_busiest_invocation_wins_when_nothing_bounds_the_time):\n(MainTest.test_since_epoch_ms_picks_the_later_invocation):\n(MainTest.test_since_epoch_ms_after_every_invocation_writes_nothing):\n(MainTest.test_a_gz_suffix_writes_a_gzipped_trace):\n(RecorderTest.test_recorder_forwards_every_flag_it_does_not_own):\n(RecorderTest.test_recorder_drops_only_the_wrapper_flags_it_knows): Deleted.\n* Tools/Scripts/webkitpy/scripts/measure_build_time_unittest.py:\n(MeasureBuildTimeTest._run_script):\n(MeasureBuildTimeTest):\n* CMakeLists.txt:\n* Tools/Scripts/swift/swiftc-wrapper.py:\n(main):\n* Tools/Scripts/swift/swiftc_job_recorder.py:\n(parse_args):\n\nCanonical link: https://commits.webkit.org/320545@main\n"
    },
    {
      "commit": "60dd821e68ff0a6563ad4304805b9c08492b13d0",
      "tree": "7a0213d63bd71ec4c65e1cc848ab7b1e9f38897c",
      "parents": [
        "6009380248ac33dc2cc9876ae881ed828993bff9"
      ],
      "author": {
        "name": "Tyler Wilcock",
        "email": "tyler_w@apple.com",
        "time": "Fri Sep 04 23:32:17 2026"
      },
      "committer": {
        "name": "Tyler Wilcock",
        "email": "tyler_w@apple.com",
        "time": "Fri Sep 04 23:32:17 2026"
      },
      "message": "AX: Add layout tests for boundary navigation over harder inputs (emoji, RTL)\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323338\nrdar://186580426\n\nReviewed by Dominic Mazzoni.\n\nparagraph-boundary-round-trip.html:\nRound trip for paragraphs. AXTextMarker::findParagraph derives paragraph boundaries\nfrom rendered newlines, so a br element starts a new paragraph and a soft wrap does\nnot -- the test asserts both halves of that, which is what makes it novel coverage.\n\nword-navigation-grapheme-boundaries.html:\nNo test exercised grapheme cluster boundaries. Asserts no word end falls inside a\njoined emoji\u0027s code unit span, which would leave an AT cursor mid-glyph.\n\ndynamic-rtl-line-boundaries.html:\nOne test combines RTL with a DOM mutation. Asserts line start and end stay logical\nafter direction flips at runtime.\n\n* LayoutTests/accessibility/isolated-tree/mac/dynamic-rtl-line-boundaries-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/dynamic-rtl-line-boundaries.html: Added.\n* LayoutTests/accessibility/isolated-tree/mac/paragraph-boundary-round-trip-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/paragraph-boundary-round-trip.html: Added.\n* LayoutTests/accessibility/isolated-tree/mac/word-navigation-grapheme-boundaries-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/word-navigation-grapheme-boundaries.html: Added.\n* LayoutTests/accessibility/mac/dynamic-rtl-line-boundaries-expected.txt: Added.\n* LayoutTests/accessibility/mac/dynamic-rtl-line-boundaries.html: Added.\n* LayoutTests/accessibility/mac/paragraph-boundary-round-trip-expected.txt: Added.\n* LayoutTests/accessibility/mac/paragraph-boundary-round-trip.html: Added.\n* LayoutTests/accessibility/mac/word-navigation-grapheme-boundaries-expected.txt: Added.\n* LayoutTests/accessibility/mac/word-navigation-grapheme-boundaries.html: Added.\n\nCanonical link: https://commits.webkit.org/320544@main\n"
    },
    {
      "commit": "6009380248ac33dc2cc9876ae881ed828993bff9",
      "tree": "e498342dd75579a4e08f6d07189d34f72233e571",
      "parents": [
        "d5531cc083bc63a525b1d442f3c102173ae9b17b"
      ],
      "author": {
        "name": "Tyler Wilcock",
        "email": "tyler_w@apple.com",
        "time": "Fri Sep 04 23:30:33 2026"
      },
      "committer": {
        "name": "Tyler Wilcock",
        "email": "tyler_w@apple.com",
        "time": "Fri Sep 04 23:30:33 2026"
      },
      "message": "AX: In isolated tree mode, drawFocusIfNeeded() bounds for a canvas fallback element can be delayed indefinitely\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323345\nrdar://186587133\n\nReviewed by Chris Fleizach and Dominic Mazzoni.\n\ndrawFocusIfNeeded() routes the focus ring\u0027s bounds to the accessibility tree\nthrough AXObjectCache::deferCanvasFocusPathBoundsUpdate, which queues them for\nperformDeferredCacheUpdate. That function returns early when\nneedsLayoutOrStyleRecalc() is true, and the only thing that brings it back is a\nlayout.\n\nThe problem is that needsLayoutOrStyleRecalc() is also true for a pending style recalc,\nand a style recalc can resolve without a layout following it, stranding the deferred changes\nindefinitely (until something else triggers an update).\n\nFix this by restarting m_performCacheUpdateTimer when we deferred due to a pending style recalc.\n\nThree new canvas tests pass in isolated tree mode.\n\n* LayoutTests/accessibility/isolated-tree/canvas-drawFocusIfNeeded-bounds-with-object-fit.html: Added.\n* LayoutTests/accessibility/isolated-tree/canvas-drawFocusIfNeeded-bounds-with-transform.html: Added.\n* LayoutTests/accessibility/isolated-tree/canvas-drawFocusIfNeeded-bounds.html: Added.\n* Source/WebCore/accessibility/AXObjectCache.cpp:\n(WebCore::AXObjectCache::performDeferredCacheUpdate):\n* Source/WebCore/accessibility/AXUtilities.cpp:\n(WebCore::needsLayoutOrStyleRecalc):\n* Source/WebCore/accessibility/AXUtilities.h:\n\nCanonical link: https://commits.webkit.org/320543@main\n"
    },
    {
      "commit": "d5531cc083bc63a525b1d442f3c102173ae9b17b",
      "tree": "4594f02ed5f378492dbbca8bc7ac044fa1736c8b",
      "parents": [
        "ceed1b6b79e820afac817dd8bd4f0dd751476818"
      ],
      "author": {
        "name": "Kai Tamkun",
        "email": "k_tamkun@apple.com",
        "time": "Fri Sep 04 23:15:44 2026"
      },
      "committer": {
        "name": "Kai Tamkun",
        "email": "k_tamkun@apple.com",
        "time": "Fri Sep 04 23:15:44 2026"
      },
      "message": "[JSC] Validate RegExps in DFG strength reduction phase\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d316723\nrdar://178446883\n\nReviewed by Yusuke Suzuki.\n\nThis patch prevents conversion to NewRegExpUntyped if the regexp in question is invalid.\n\nTest: JSTests/stress/new-regexp-untyped-soft-invalid-stale-captures.js\n\n* JSTests/stress/new-regexp-untyped-soft-invalid-stale-captures.js: Added.\n(atDepth):\n(const.make.eval):\n(catch):\n(try.catch):\n(try.i.catch):\n(exposed.i.catch):\n* Source/JavaScriptCore/dfg/DFGStrengthReductionPhase.cpp:\n(JSC::DFG::StrengthReductionPhase::handleNode):\n* Source/JavaScriptCore/runtime/RegExp.cpp:\n(JSC::RegExp::finishCreation):\n(JSC::RegExp::updateMetadataFromPattern):\n(JSC::RegExp::byteCodeCompileIfNecessary):\n(JSC::RegExp::compile):\n(JSC::RegExp::compileMatchOnly):\n* Source/JavaScriptCore/runtime/RegExp.h:\n* Source/JavaScriptCore/runtime/RegExpCache.cpp:\n(JSC::RegExpCache::lookupOrCreate):\n\nOriginally-landed-as: 305413.975@safari-7624.5-branch (d74d692503fc). rdar://185368575\nCanonical link: https://commits.webkit.org/320542@main\n"
    },
    {
      "commit": "ceed1b6b79e820afac817dd8bd4f0dd751476818",
      "tree": "60ed02562e80456c0180f2f4d49e5243309685cd",
      "parents": [
        "79282f6ac8df43e0e630547207f82308c9310a1f"
      ],
      "author": {
        "name": "Tyler Wilcock",
        "email": "tyler_w@apple.com",
        "time": "Fri Sep 04 21:29:36 2026"
      },
      "committer": {
        "name": "Tyler Wilcock",
        "email": "tyler_w@apple.com",
        "time": "Fri Sep 04 21:29:36 2026"
      },
      "message": "AX: list-marker-content-renderers-text.html fails in ITM because it queries focus synchronously after changing it (prior to a notification, thus not acting like an AT)\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323365\nrdar://186604502\n\nReviewed by Dominic Mazzoni.\n\nnameOf() focused a button and then read accessibilityController.focusedElement in\nthe same turn. With the isolated tree that returns the previously focused button,\nbecause setFocusedNodeID() writes into the tree\u0027s working changes and the new\nfocus isn\u0027t visible to the accessibility thread until the next commit is applied\n(which happens before the focused-element-changed notification is sent out to the AT).\n\nEvery name after the first came out one button behind:\n\n    FAIL nameOf(\u0027counter-button\u0027) should be Reply Item B. Was Reply Item A.\n\nChange the test to wait for the notification before reading the AX\nfocused element, mirroring actual AT behavior and allowing the test to\npass in ITM.\n\n* LayoutTests/accessibility/isolated-tree/list-marker-content-renderers-text-expected.txt: Copied from LayoutTests/accessibility/list-marker-content-renderers-text-expected.txt.\n* LayoutTests/accessibility/isolated-tree/list-marker-content-renderers-text.html: Added.\n* LayoutTests/accessibility/list-marker-content-renderers-text-expected.txt:\n* LayoutTests/accessibility/list-marker-content-renderers-text.html:\n\nCanonical link: https://commits.webkit.org/320541@main\n"
    },
    {
      "commit": "79282f6ac8df43e0e630547207f82308c9310a1f",
      "tree": "a15d181e0e22a3fb0bf6df9d07d26b05f8f75f2d",
      "parents": [
        "c0121e11c12f57c279705344e09bc1270491df97"
      ],
      "author": {
        "name": "WebKit CI Build Triage",
        "email": "noreply@webkit.org",
        "time": "Fri Sep 04 21:27:37 2026"
      },
      "committer": {
        "name": "Dawn Morningstar",
        "email": "morningstar@apple.com",
        "time": "Fri Sep 04 21:27:37 2026"
      },
      "message": "Fix a build issue after 320526@main\n\nUnreviewed build fix.\n* Source/WTF/wtf/SwiftBridging.h:\n\nCanonical link: https://commits.webkit.org/320540@main\n"
    },
    {
      "commit": "c0121e11c12f57c279705344e09bc1270491df97",
      "tree": "da61c70b41287d65eafc693bf146433c68c8bb11",
      "parents": [
        "66d43bea8153d9b8fd36876a06fcf2bd15e6f902"
      ],
      "author": {
        "name": "Mark Lam",
        "email": "mark.lam@apple.com",
        "time": "Fri Sep 04 21:23:23 2026"
      },
      "committer": {
        "name": "Mark Lam",
        "email": "mark.lam@apple.com",
        "time": "Fri Sep 04 21:23:23 2026"
      },
      "message": "Make SystemHeap-enabled failure actions equivalent to SystemHeap-disabled failure actions.\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323456\nrdar://185783006\n\nReviewed by Marcus Plutowski.\n\nThis means:\n1. non-\"try\" allocators should crash on failure to allocate memory.\n2. \"try\" allocators just return a nullptr on failure to allocate memory.  See exception in (3) below.\n3. For iso_try_reallocate allocators, existing SystemHeap-disabled allocators will also set errno\n   to ENOMEM in addition to returning nullptr.  Make the SystemHeap-enabled path do the same\n\nNo new tests because failures to allocate memory is not a condition we can force, and the expected\nbehavior is to crash in some cases (which is not testable).\n\n* Source/bmalloc/libpas/src/libpas/bmalloc_heap_flex_internal.h:\n(bmalloc_try_reallocate_flex_inline):\n(bmalloc_reallocate_flex_inline):\n* Source/bmalloc/libpas/src/libpas/bmalloc_heap_inlines.h:\n(bmalloc_try_reallocate_auxiliary_inline):\n(bmalloc_reallocate_auxiliary_inline):\n(bmalloc_try_reallocate_inline):\n(bmalloc_reallocate_inline):\n* Source/bmalloc/libpas/src/libpas/bmalloc_heap_iso_internal.h:\n(bmalloc_try_iso_reallocate_array_by_size_inline):\n(bmalloc_iso_reallocate_array_by_size_inline):\n(bmalloc_try_iso_reallocate_array_by_count_inline):\n(bmalloc_iso_reallocate_array_by_count_inline):\n* Source/bmalloc/libpas/src/libpas/hotbit_heap_inlines.h:\n(hotbit_try_reallocate_inline):\n* Source/bmalloc/libpas/src/libpas/iso_heap_inlines.h:\n(iso_try_reallocate_common_primitive_inline):\n(iso_reallocate_common_primitive_inline):\n(iso_try_reallocate_array_by_count_inline):\n(iso_reallocate_array_by_count_inline):\n(iso_try_reallocate_primitive_inline):\n(iso_reallocate_primitive_inline):\n* Source/bmalloc/libpas/src/libpas/pas_local_allocator_inlines.h:\n(pas_local_allocator_try_allocate):\n* Source/bmalloc/libpas/src/libpas/pas_try_allocate_intrinsic.h:\n(pas_try_allocate_intrinsic_impl_casual_case):\n* Source/bmalloc/libpas/src/libpas/pas_try_reallocate.h:\n(pas_try_reallocate):\n(pas_try_reallocate_intrinsic):\n(pas_try_reallocate_single):\n(pas_try_reallocate_array_by_size):\n(pas_try_reallocate_array_by_count):\n(pas_try_reallocate_primitive):\n* Source/bmalloc/libpas/src/libpas/tagged_bmalloc_heap_inlines.h:\n(tagged_bmalloc_try_reallocate_inline):\n(tagged_bmalloc_reallocate_inline):\n* Source/bmalloc/libpas/src/libpas/thingy_heap.c:\n(thingy_try_reallocate_primitive):\n(thingy_try_reallocate_array):\n\nCanonical link: https://commits.webkit.org/320539@main\n"
    },
    {
      "commit": "66d43bea8153d9b8fd36876a06fcf2bd15e6f902",
      "tree": "68a1b91bfede72812a2964af0bd6ae1c84c1b24d",
      "parents": [
        "e8639fda964b5ba082cd441adabda472426e20b2"
      ],
      "author": {
        "name": "Ian Gower",
        "email": "i_gower@apple.com",
        "time": "Fri Sep 04 20:58:28 2026"
      },
      "committer": {
        "name": "Ian Gower",
        "email": "i_gower@apple.com",
        "time": "Fri Sep 04 20:58:28 2026"
      },
      "message": "Revised Mixed Content rules to match LNA spec\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d297739\nrdar://154439054\n\nReviewed by Brent Fulgham.\n\nFeature work for Local Network Access (https://wicg.github.io/local-network-access/).\nSection 3.2 (https://wicg.github.io/local-network-access/#integration-with-mixed-content)\namends both mixed-content algorithms so a request whose target IP address space is local is\nneither upgraded nor blocked. Without it an https page can never reach a local device over\nhttp, and the Local Network Access permission never gets the chance to decide.\n\nOnly fetch() sets a target address space on its request, so MixedContentChecker derives one\nfrom the URL for every other load, and CachedResourceLoader and DocumentThreadableLoader thread\nthe request\u0027s declared value through to it. Deriving from the URL covers IP literals and .local\nnames; a hostname that resolves to a private address still reads as public and stays blocked,\nsince no peer address exists this early in the load. The derivation is gated on the\nLocalNetworkAccess setting, so with the feature off nothing escapes an upgrade or block that did\nnot already.\n\nThis exempts loopback as well as local, where the spec exempts only local. Section 3.1.1\nleaves loopback out on the grounds that a loopback URL is already potentially trustworthy and\nso never reaches these checks; exempting it explicitly means the rule does not depend on that\nholding.\n\n* Source/WebCore/loader/DocumentLoader.cpp:\n(WebCore::DocumentLoader::willSendRequest):\n* Source/WebCore/loader/DocumentThreadableLoader.cpp:\n(WebCore::DocumentThreadableLoader::loadRequest):\n* Source/WebCore/loader/MixedContentChecker.cpp:\n(WebCore::effectiveTargetAddressSpace):\n(WebCore::MixedContentChecker::shouldUpgradeInsecureContent):\n(WebCore::MixedContentChecker::canModifyRequest):\n(WebCore::MixedContentChecker::shouldBlockRequest):\n* Source/WebCore/loader/MixedContentChecker.h:\n* Source/WebCore/loader/cache/CachedResourceLoader.cpp:\n(WebCore::CachedResourceLoader::requestImage):\n(WebCore::CachedResourceLoader::checkInsecureContent const):\n(WebCore::CachedResourceLoader::canRequest):\n(WebCore::CachedResourceLoader::canRequestAfterRedirection const):\n(WebCore::CachedResourceLoader::updateRequestAfterRedirection):\n(WebCore::CachedResourceLoader::requestResource):\n* Source/WebCore/loader/cache/CachedResourceLoader.h:\n* Tools/TestWebKitAPI/Tests/WebCore/MixedContentChecker.cpp:\n\nCanonical link: https://commits.webkit.org/320538@main\n"
    },
    {
      "commit": "e8639fda964b5ba082cd441adabda472426e20b2",
      "tree": "ba872a871fff0a263a9694fbc7824a8410fb0b38",
      "parents": [
        "ca158eb19b753004c61c9405265669ccfdd8557a"
      ],
      "author": {
        "name": "Cole Carley",
        "email": "ccarley2@apple.com",
        "time": "Fri Sep 04 20:47:18 2026"
      },
      "committer": {
        "name": "Cole Carley",
        "email": "ccarley2@apple.com",
        "time": "Fri Sep 04 20:47:18 2026"
      },
      "message": "[Quirks] Remove additional compile flags in the Quirk accessor functions\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323285\nrdar://186539998\n\nReviewed by Brent Fulgham.\n\n320338@main removed compile flags from the Quirk table and created a single\nsource of truth for which Quirks are available on each platform. There are still\ncompile flags in the Quirk accessors in Quirks.cpp. This patch removes those\nredundant compile flags.\n\n* Source/WebCore/page/QuirkTable.cpp:\n(WebCore::SiteSpecificQuirks::isAvailable):\n* Source/WebCore/page/Quirks.cpp:\n\nCanonical link: https://commits.webkit.org/320537@main\n"
    },
    {
      "commit": "ca158eb19b753004c61c9405265669ccfdd8557a",
      "tree": "926ab35f6a8a1345974b2b5ef78431a0a9985499",
      "parents": [
        "64168e4d90c4f106867471495b7842b5995990a6"
      ],
      "author": {
        "name": "Jonas Devlieghere",
        "email": "jonas@devlieghere.com",
        "time": "Fri Sep 04 20:41:05 2026"
      },
      "committer": {
        "name": "Yijia Huang",
        "email": "yijia_huang@apple.com",
        "time": "Fri Sep 04 20:41:05 2026"
      },
      "message": "[JSC] Adopt the instance-scoped qWasmGlobal packet form\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323123\n\nReviewed by Yijia Huang.\n\nA Wasm global belongs to a module instance, not to a frame. The global\nindex space is per instance, and DW_OP_WASM_location\u0027s global operand\nindexes the index space of the instance whose code is being evaluated.\nqWasmGlobal took a frame index and used it as a proxy for that instance,\nwhich left the globals of an instance with no active frame out of reach:\na page loading several modules could only inspect whichever one it\nhappened to be stopped inside.\n\nLLDB has since landed a form that names the instance directly:\n\n    qWasmGlobal:\u003cglobal-index\u003e;instance:\u003cinstance-id\u003e\n\n    https://github.com/llvm/llvm-project/pull/213176\n    resolving https://github.com/llvm/llvm-project/issues/212833\n\nThis PR adds support for the new packet variant. The id is the module id\nalready carried in bits 61:32 of a Wasm virtual address. A stub opts in\nby advertising qWasmInstance+ in its qSupported reply, which covers any\nWasm query whose scope is an instance rather than a frame. A client that\ndoes not opt in keeps getting the frame form, and the two are told apart\nby the presence of the instance: key.\n\nBesides that, I had to make the following changes:\n\n- Because the id is a module id it cannot distinguish two instances of\n  one module, which have separate globals.\n  ModuleManager::soleInstanceOfModule() answers only when the module has\n  exactly one live instance, and QueryHandler::instanceForModule()\n  additionally accepts a module the debuggee is stopped in, where the\n  stop itself picks the instance. Anything else replies with an error\n  rather than guessing, since a wrong value is indistinguishable from a\n  right one on the wire.\n\n- Also stop qWasmLocal from defaulting an unparsable field to zero.\n  parseDecimal() returns 0 for a field that is not a number, so a client\n  sending a field this packet does not have read local 0 of frame 0 and\n  got a plausible wrong answer instead of an error. This matters more\n  now that a second packet shape exists.\n\n- Module::debugId() becomes JS_EXPORT_PRIVATE so the new test can link\n  against it.\n\n- On the test side, setBreakpointsAtAllFunctionEntries() now visits each\n  module once rather than once per instance. Breakpoints patch module\n  bytecode, which every instance of a module shares, and patching twice\n  records the breakpoint opcode itself as the original bytecode. That\n  was unreachable until a script held two instances of one module.\n\nTest: MultiVMMultipleInstancesPerModule exercises both the sole-instance\n\nand ambiguous paths; testSoleInstanceOfModule derives its expectation\nfrom the instances actually registered, so it holds for every script.\n\n* Source/JavaScriptCore/wasm/WasmModule.h:\n* Source/JavaScriptCore/wasm/debugger/README.md:\n* Source/JavaScriptCore/wasm/debugger/WasmModuleManager.cpp:\n(JSC::Wasm::ModuleManager::soleInstanceOfModule):\n* Source/JavaScriptCore/wasm/debugger/WasmModuleManager.h:\n* Source/JavaScriptCore/wasm/debugger/WasmQueryHandler.cpp:\n(JSC::Wasm::QueryHandler::handleSupported):\n(JSC::Wasm::QueryHandler::handleWasmLocal):\n(JSC::Wasm::QueryHandler::instanceForModule):\n(JSC::Wasm::QueryHandler::instanceForFrame):\n(JSC::Wasm::QueryHandler::handleWasmGlobal):\n* Source/JavaScriptCore/wasm/debugger/WasmQueryHandler.h:\n* Source/JavaScriptCore/wasm/debugger/tests/ExecutionHandlerTest.cpp:\n(ExecutionHandlerTest::setBreakpointsAtAllFunctionEntries):\n(ExecutionHandlerTest::testSoleInstanceOfModule):\n(ExecutionHandlerTest::setupScriptAndWaitForVMs):\n(ExecutionHandlerTest::runTests):\n* Source/JavaScriptCore/wasm/debugger/tests/TestScripts.cpp:\n* Source/JavaScriptCore/wasm/debugger/tests/TestScripts.h:\n* JSTests/wasm/debugger/lib/environment.py:\n(WebKitEnvironment.__init__):\n* JSTests/wasm/debugger/lib/session.py:\n(_source_map_command):\n(DebugSession.__init__):\n* JSTests/wasm/debugger/test-wasm-debugger.py:\n(main):\n\nCanonical link: https://commits.webkit.org/320536@main\n"
    },
    {
      "commit": "64168e4d90c4f106867471495b7842b5995990a6",
      "tree": "a9b06e73550bb4320f47a7ddbc04e6973822267b",
      "parents": [
        "054171fd6f8625e6cabc883518caa42c025a6d2e"
      ],
      "author": {
        "name": "Kiet Ho",
        "email": "kiet.ho@apple.com",
        "time": "Fri Sep 04 20:14:56 2026"
      },
      "committer": {
        "name": "Kiet Ho",
        "email": "kiet.ho@apple.com",
        "time": "Fri Sep 04 20:14:56 2026"
      },
      "message": "[CSS Module Scripts] Verify if a module type is allowed before fetching\nrdar://186415342\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323170\n\nReviewed by Yusuke Suzuki.\n\nAs defined in the HTML spec [1], when loading a module script, there\u0027s a check to\nensure the module script type is allowed (understood as \"supported by the environment\").\nThis wasn\u0027t needed before, as the available module script types (JS/WASM, JSON, text)\nare always supported by JSC. But CSS is a DOM concept, so CSS module scripts can only\nbe loaded in DOM environments (not worker/worklets or non-DOM.) Therefore to implement\nCSS module scripts, the type check must be present to avoid loading CSS modules in\nunsupported environments.\n\nThe check is implemented in both JSC and host. First, JSC checks if it\u0027s one of\nJS/WASM/JSON/text, which it supports. If it\u0027s not, JSC vends it out to the host through\nthe new moduleTypeIsAllowed method in the global object method table. A host should\nimplement this method if it can handle other module types not supported by JSC. For\nexample, a DOM host can indicate it supports CSS module scripts.\n\nThis will be tested by CSS module script tests once it\u0027s fully implemented.\n\n[1]: https://html.spec.whatwg.org/multipage/webappapis.html#module-type-allowed\n\n* Source/JavaScriptCore/API/JSAPIGlobalObject.cpp:\n(JSC::JSAPIGlobalObject::globalObjectMethodTable):\n* Source/JavaScriptCore/API/JSAPIGlobalObject.h:\n* Source/JavaScriptCore/API/JSAPIGlobalObject.mm:\n(JSC::JSAPIGlobalObject::globalObjectMethodTable):\n* Source/JavaScriptCore/jsc.cpp:\n* Source/JavaScriptCore/runtime/GlobalObjectMethodTable.h:\n* Source/JavaScriptCore/runtime/JSGlobalObject.cpp:\n(JSC::JSGlobalObject::baseGlobalObjectMethodTable):\n* Source/JavaScriptCore/runtime/JSModuleLoader.cpp:\n(JSC::moduleTypeIsAllowed):\n(JSC::JSModuleLoader::importModule):\n(JSC::JSModuleLoader::fetch):\n(JSC::JSModuleLoader::hostLoadImportedModule):\n* Source/WebCore/bindings/js/JSDOMWindowBase.cpp:\n(WebCore::JSDOMWindowBase::globalObjectMethodTable):\n* Source/WebCore/bindings/js/JSShadowRealmGlobalScopeBase.cpp:\n(WebCore::JSShadowRealmGlobalScopeBase::globalObjectMethodTable):\n* Source/WebCore/bindings/js/JSWorkerGlobalScopeBase.cpp:\n(WebCore::JSWorkerGlobalScopeBase::globalObjectMethodTable):\n* Source/WebCore/bindings/js/JSWorkletGlobalScopeBase.cpp:\n(WebCore::JSWorkletGlobalScopeBase::globalObjectMethodTable):\n\nCanonical link: https://commits.webkit.org/320535@main\n"
    },
    {
      "commit": "054171fd6f8625e6cabc883518caa42c025a6d2e",
      "tree": "b3416b80ce88a6081f610b9c41b754a72675bacd",
      "parents": [
        "67bf126de00740d0aa051144d4c4a23ef7482bec"
      ],
      "author": {
        "name": "Abrar Rahman Protyasha",
        "email": "a_protyasha@apple.com",
        "time": "Fri Sep 04 20:12:39 2026"
      },
      "committer": {
        "name": "Abrar Rahman Protyasha",
        "email": "a_protyasha@apple.com",
        "time": "Fri Sep 04 20:12:39 2026"
      },
      "message": "[macOS] \"Copy\" option is enabled in edit menu after selecting text in PDF with copying disallowed\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323418\nrdar://186648332\n\nReviewed by Aditya Keerthi.\n\nAppKit consults -validateUserInterfaceItem: when constructing its edit\nmenu. When inquired about @selector(copy:), isEditingCommandEnabled()\nsays yes if there is an active selection in the PDF. However, this is\nonly necessary and not sufficient for a copy operation, since the\nunderlying document itself must allow copying. In this patch, we teach\nour editing command validity check in the plugin to respect that\nattribute of the PDF document.\n\nFor test coverage, we retrofit the existing edit action validity check\nperformed by CopyMenuItemDisabledWithNoSelection.\n\nTest: WKWebViewEditActions.CopyMenuItemDisabledInCopyDisallowedPDF\n\n* Source/WebKit/WebProcess/Plugins/PDF/UnifiedPDF/UnifiedPDFPlugin.mm:\n(WebKit::UnifiedPDFPlugin::isEditingCommandEnabled):\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/WKWebViewEditActions.mm:\n(TestWebKitAPI::validateCopyMenuItem):\n(TestWebKitAPI::TEST(WKWebViewEditActions, CopyMenuItemDisabledWithNoSelection)):\n(TestWebKitAPI::TEST(WKWebViewEditActions, CopyMenuItemDisabledInCopyDisallowedPDF)):\n\nCanonical link: https://commits.webkit.org/320534@main\n"
    },
    {
      "commit": "67bf126de00740d0aa051144d4c4a23ef7482bec",
      "tree": "9ac26540790d585699aa17ef270fa0d9b0653f8e",
      "parents": [
        "65dd1d3fccd053730b9e2881484c1694a6a2d794"
      ],
      "author": {
        "name": "Alan Baradlay",
        "email": "zalan@apple.com",
        "time": "Fri Sep 04 19:38:30 2026"
      },
      "committer": {
        "name": "Alan Baradlay",
        "email": "zalan@apple.com",
        "time": "Fri Sep 04 19:38:30 2026"
      },
      "message": "[list-marker] text-indent moves the list marker with the text\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323448\nrdar://problem/186678552\n\nReviewed by Antti Koivisto.\n\ntext-indent is a margin on the line box, so the line\u0027s inline start edge already includes it and the marker hung off\nthat edge moved in with the text. Take the indent off first.\n\nTest: imported/w3c/web-platform-tests/css/css-lists/outside-marker-with-text-indent.html\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-lists/outside-marker-with-text-indent-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-lists/outside-marker-with-text-indent-ref.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-lists/outside-marker-with-text-indent.html: Added.\n* Source/WebCore/layout/formattingContexts/inline/InlineFormattingUtils.cpp:\n(WebCore::Layout::InlineFormattingUtils::computedTextIndentForFirstLine):\n* Source/WebCore/layout/formattingContexts/inline/InlineFormattingUtils.h:\n* Source/WebCore/layout/integration/inline/LayoutIntegrationLineLayout.cpp:\n(WebCore::LayoutIntegration::LineLayout::setExcludedMarkerPositions):\n\nCanonical link: https://commits.webkit.org/320533@main\n"
    },
    {
      "commit": "65dd1d3fccd053730b9e2881484c1694a6a2d794",
      "tree": "20a799614d04fcd0d16abb89b959d360de31a10e",
      "parents": [
        "e513b5fcd8573e7226108b3bb1caca5b21d92dd6"
      ],
      "author": {
        "name": "Alan Baradlay",
        "email": "zalan@apple.com",
        "time": "Fri Sep 04 19:37:30 2026"
      },
      "committer": {
        "name": "Alan Baradlay",
        "email": "zalan@apple.com",
        "time": "Fri Sep 04 19:37:30 2026"
      },
      "message": "[list-marker] align-content leaves the list marker behind\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323445\nrdar://problem/186676835\n\nReviewed by Antti Koivisto.\n\nAn outside marker is positioned against a line (RenderListItem::placeExcludedMarker) and takes no part in the inline\ncontent of that line. align-content moves the lines after they are built, and LineLayout::shiftLinesByInBlockDirection\nmoves the lines and the renderers of the boxes on them, so the marker stayed where the unshifted line was.\n\nMove the position the marker was given by the same amount.\n\nTest: imported/w3c/web-platform-tests/css/css-lists/outside-marker-with-align-content.html\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-lists/outside-marker-with-align-content-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-lists/outside-marker-with-align-content-ref.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-lists/outside-marker-with-align-content.html: Added.\n* Source/WebCore/layout/integration/inline/LayoutIntegrationLineLayout.cpp:\n(WebCore::LayoutIntegration::LineLayout::shiftLinesByInBlockDirection):\n* Source/WebCore/rendering/RenderListItem.cpp:\n(WebCore::RenderListItem::excludedMarkerAnchoredTo):\n* Source/WebCore/rendering/RenderListItem.h:\n\nCanonical link: https://commits.webkit.org/320532@main\n"
    },
    {
      "commit": "e513b5fcd8573e7226108b3bb1caca5b21d92dd6",
      "tree": "8a09e524a5779a95ae55c995efd6948bdbdf773f",
      "parents": [
        "1be505b36f434138574ce6db35417577c7c44146"
      ],
      "author": {
        "name": "Justin Michaud",
        "email": "jmichaud@igalia.com",
        "time": "Fri Sep 04 19:34:08 2026"
      },
      "committer": {
        "name": "Justin Michaud",
        "email": "jmichaud@igalia.com",
        "time": "Fri Sep 04 19:34:08 2026"
      },
      "message": "[non-cocoa][fuzz] GIF image decoder should not have negative width/height\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d321752\n\nReviewed by Patrick Griffis and Claudio Saavedra.\n\nGIFImageDecoder::initFrameBuffer() clamped a frame rect that extends past the\ncanvas by subtracting the frame\u0027s offset from the canvas extent. A GIF\u0027s logical\nscreen size is only published for the first frame, so a later frame\u0027s offset can\nitself be past the canvas, which made that subtraction negative and left the\nbacking store with a frame rect of negative width or height. Intersect with the\ncanvas instead, which clamps to an empty rect.\n\n* LayoutTests/fast/images/gif-frame-outside-logical-screen-expected.txt: Added.\n* LayoutTests/fast/images/gif-frame-outside-logical-screen.html: Added.\n* LayoutTests/fast/images/resources/gif-frame-outside-logical-screen.gif: Added.\n* Source/WebCore/platform/image-decoders/gif/GIFImageDecoder.cpp:\n(WebCore::GIFImageDecoder::initFrameBuffer):\n\nCanonical link: https://commits.webkit.org/320531@main\n"
    },
    {
      "commit": "1be505b36f434138574ce6db35417577c7c44146",
      "tree": "c718af17fd7d0eb74028a3f030e2ea42fae502bc",
      "parents": [
        "d257d675f4fe6aa7e8d29fd691e8662cc40cf30c"
      ],
      "author": {
        "name": "Issac Roy",
        "email": "issacroy05@gmail.com",
        "time": "Fri Sep 04 19:32:04 2026"
      },
      "committer": {
        "name": "Issac Roy",
        "email": "iroy@apple.com",
        "time": "Fri Sep 04 19:32:04 2026"
      },
      "message": "[Flex Wrap Balance] Add parsing support for flex-line-count\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323392\nrdar://186619043\n\nReviewed by Tim Nguyen and Sam Weinig.\n\nAdds flex-line-count as \u003cinteger [1,∞]\u003e, initial value 1, per css-flexbox-2\n§6.1. Storage, parsing and computed-style serialization only; the value does not\naffect layout yet, which is bug 323240.\n\nThe property is gated on the existing CSSFlexWrapBalanceEnabled setting rather\nthan a new one, because it only has an effect on a balanced container — see\nbalance-min-line-count-007 and -008, which assert it changes nothing under\nflex-wrap: wrap and nowrap. That setting is already status: testable, so the WPT\nsyntax tests run with it enabled and stay byte-identical to upstream.\n\nStyle::FlexLineCount is Integer\u003cCSS::Positive\u003e, and CSS::Positive is Range { 1,\nRange::infinity }, which is exactly the grammar\u0027s range. It is a value member of\nFlexibleBoxData next to flexBasis, not a bitfield, so calc() results wider than\na few bits round-trip.\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-flexbox/balance/flex-line-count-computed-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-flexbox/balance/flex-line-count-valid-expected.txt:\n* Source/WebCore/Headers.cmake:\n* Source/WebCore/WebCore.xcodeproj/project.pbxproj:\n* Source/WebCore/css/CSSProperties.json:\n* Source/WebCore/style/computed/StyleComputedStyleBase.h:\n* Source/WebCore/style/computed/data/StyleFlexibleBoxData.cpp:\n* Source/WebCore/style/computed/data/StyleFlexibleBoxData.h:\n* Source/WebCore/style/values/flexbox/StyleFlexLineCount.h: Added.\n\nCanonical link: https://commits.webkit.org/320530@main\n"
    },
    {
      "commit": "d257d675f4fe6aa7e8d29fd691e8662cc40cf30c",
      "tree": "ff676ebeb8be277245e3d2afe85788b94b84154d",
      "parents": [
        "bd7861b451f226a255358c8310321eae3e6c88f8"
      ],
      "author": {
        "name": "Tim Nguyen",
        "email": "ntim@apple.com",
        "time": "Fri Sep 04 19:27:56 2026"
      },
      "committer": {
        "name": "Tim Nguyen",
        "email": "ntim@apple.com",
        "time": "Fri Sep 04 19:27:56 2026"
      },
      "message": "Re-import css/css-highlight-api WPT\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323446\nrdar://186678078\n\nReviewed by Rupin Mittal.\n\nUpstream commit: https://github.com/web-platform-tests/wpt/commit/0588f3896e0caef44bc33ad6efb9522b0fe97a5b\n\n* LayoutTests/TestExpectations:\n* LayoutTests/imported/w3c/resources/resource-files.json:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-highlight-api/HighlightRegistry-iteration-with-modifications-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-highlight-api/HighlightRegistry-iteration-with-modifications.html:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-highlight-api/HighlightRegistry-maplike-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-highlight-api/HighlightRegistry-maplike.html:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-highlight-api/custom-highlight-escaped-star-001-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-highlight-api/custom-highlight-escaped-star-001.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-highlight-api/custom-highlight-universal-deep-chain-001.tentative-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-highlight-api/custom-highlight-universal-deep-chain-001.tentative-ref.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-highlight-api/custom-highlight-universal-deep-chain-001.tentative.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-highlight-api/custom-highlight-universal-inheritance-001.tentative-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-highlight-api/custom-highlight-universal-inheritance-001.tentative-ref.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-highlight-api/custom-highlight-universal-inheritance-001.tentative.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-highlight-api/custom-highlight-universal-no-named-rule-001.tentative-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-highlight-api/custom-highlight-universal-no-named-rule-001.tentative.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-highlight-api/custom-highlight-universal-no-named-rule-002.tentative-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-highlight-api/custom-highlight-universal-no-named-rule-002.tentative-ref.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-highlight-api/custom-highlight-universal-no-named-rule-002.tentative.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-highlight-api/custom-highlight-universal-painting-001-ref.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-highlight-api/custom-highlight-universal-painting-001.tentative-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-highlight-api/custom-highlight-universal-painting-001.tentative.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-highlight-api/custom-highlight-universal-painting-002.tentative-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-highlight-api/custom-highlight-universal-painting-002.tentative.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-highlight-api/custom-highlight-universal-painting-003.tentative-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-highlight-api/custom-highlight-universal-painting-003.tentative-ref.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-highlight-api/custom-highlight-universal-painting-003.tentative.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-highlight-api/custom-highlight-universal-parsing-and-computed-style.tentative-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-highlight-api/custom-highlight-universal-parsing-and-computed-style.tentative.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-highlight-api/highlight-pseudo-parsing-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-highlight-api/highlight-pseudo-parsing.html:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-highlight-api/painting/custom-highlight-painting-below-grammar.html:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-highlight-api/painting/custom-highlight-painting-user-select-none-expected.html:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-highlight-api/painting/custom-highlight-painting-user-select-none.html:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-highlight-api/painting/w3c-import.log:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-highlight-api/w3c-import.log:\n\nCanonical link: https://commits.webkit.org/320529@main\n"
    },
    {
      "commit": "bd7861b451f226a255358c8310321eae3e6c88f8",
      "tree": "3d386bb5a3d6bef851923a4fb9fc7bec53ccda85",
      "parents": [
        "da79705ade01755efb0bf2144b1636e4e744a592"
      ],
      "author": {
        "name": "Ben Nham",
        "email": "nham@apple.com",
        "time": "Fri Sep 04 19:20:28 2026"
      },
      "committer": {
        "name": "Ben Nham",
        "email": "nham@apple.com",
        "time": "Fri Sep 04 19:20:28 2026"
      },
      "message": "[Site Isolation] Change coordinate space for cross-process frame geometry\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323375\nrdar://problem/186609673\n\nReviewed by Alex Christensen.\n\nIn 318269@main and 319536@main, we introduced new fields in RemoteFrameLayoutInfo in order to fix\nthe way exposedContentRect (which controls tile coverage) and windowClipRect (which controls various\nvisibility-based heuristics like hidden frame throttling) work in remote frames.\n\nThere are two problems with these fields:\n\n1. windowClipRectInParent is the viewport in the parent frame\u0027s content coordinate space, so it\n   changes on every frame when the parent frame scrolls. We don\u0027t want these values to change on\n   every frame. Instead, they should only change when necessary (like when the remote frame\n   intersects the edges of the viewport). This allows us to make future perf optimizations to avoid\n   sending a FrameGeometry IPC if it matches a previously sent value.\n\n2. On the receiver side, we bailed out of mapping the rects into the remote frame\u0027s view space for\n   any non-affine transform, causing us to fall back to non-optimal fallback behavior for remote\n   frames with 3D transforms (e.g. tiling the entire frame and never throttling it).\n\nTo address this, this patch makes it so that on the sender side, Page::syncLocalFrameInfoToRemote\nnow sends rects in the child frame\u0027s view coordinate space instead of the parent frame\u0027s content\ncoordinate space. This is accomplished via a new mapAbsoluteToChildFrameViewRect function in\nLocalFrameView, which uses projectQuad rather than mapRect so that the non-affine case works.\n\nOn the receiver side, we no longer need to map the rect into our own view coordinate space, so we\ncan just intersect the rects with the frame\u0027s size and use them directly as inputs into the\nexposedContentRect and windowClipRect computations.\n\nMost of these paths had very little testing, so I added tests for both exposedContentRect and\nwindowClipRect which check that these values are correct for both same-site and cross-site iframes.\nThis needed new internals accessors for both rects, plus delegatesScrollingToNativeView, since\nwhether a clip rect in window coordinates has had the scroll position taken out of it differs\nbetween macOS and iOS.\n\nTests: http/tests/site-isolation/ios/exposed-content-rect-3d-transformed.html\n       http/tests/site-isolation/ios/exposed-content-rect-nested.html\n       http/tests/site-isolation/ios/exposed-content-rect.html\n       http/tests/site-isolation/request-animation-frame-throttling-scrolled-out-3d-transformed-cross-origin-iframe.html\n       http/tests/site-isolation/request-animation-frame-throttling-scrolled-out-cross-origin-iframe.html\n       http/tests/site-isolation/window-clip-rect-3d-transformed.html\n       http/tests/site-isolation/window-clip-rect-nested.html\n       http/tests/site-isolation/window-clip-rect.html\n\n* LayoutTests/http/tests/site-isolation/ios/exposed-content-rect-3d-transformed-expected.txt: Added.\n* LayoutTests/http/tests/site-isolation/ios/exposed-content-rect-3d-transformed.html: Added.\n* LayoutTests/http/tests/site-isolation/ios/exposed-content-rect-expected.txt: Added.\n* LayoutTests/http/tests/site-isolation/ios/exposed-content-rect-nested-expected.txt: Added.\n* LayoutTests/http/tests/site-isolation/ios/exposed-content-rect-nested.html: Added.\n* LayoutTests/http/tests/site-isolation/ios/exposed-content-rect.html: Added.\n* LayoutTests/http/tests/site-isolation/request-animation-frame-throttling-scrolled-out-3d-transformed-cross-origin-iframe-expected.txt: Added.\n* LayoutTests/http/tests/site-isolation/request-animation-frame-throttling-scrolled-out-3d-transformed-cross-origin-iframe.html: Added.\n* LayoutTests/http/tests/site-isolation/request-animation-frame-throttling-scrolled-out-cross-origin-iframe-expected.txt: Added.\n* LayoutTests/http/tests/site-isolation/request-animation-frame-throttling-scrolled-out-cross-origin-iframe.html: Added.\n* LayoutTests/http/tests/site-isolation/resources/frame-geometry-child-cross-site.html: Added.\n* LayoutTests/http/tests/site-isolation/resources/frame-geometry-frame-with-same-site-child.html: Added.\n* LayoutTests/http/tests/site-isolation/resources/frame-geometry-frame.html: Added.\n* LayoutTests/http/tests/site-isolation/resources/frame-geometry-grandchild-same-site.html: Added.\n* LayoutTests/http/tests/site-isolation/resources/frame-geometry-reporter.js: Added.\n* LayoutTests/http/tests/site-isolation/resources/frame-geometry-test.js: Added.\n* LayoutTests/http/tests/site-isolation/resources/request-animation-frame-throttling-frame.html:\n* LayoutTests/http/tests/site-isolation/window-clip-rect-3d-transformed-expected.txt: Added.\n* LayoutTests/http/tests/site-isolation/window-clip-rect-3d-transformed.html: Added.\n* LayoutTests/http/tests/site-isolation/window-clip-rect-expected.txt: Added.\n* LayoutTests/http/tests/site-isolation/window-clip-rect-nested-expected.txt: Added.\n* LayoutTests/http/tests/site-isolation/window-clip-rect-nested.html: Added.\n* LayoutTests/http/tests/site-isolation/window-clip-rect.html: Added.\n* LayoutTests/platform/ios/TestExpectations:\n* Source/WebCore/page/FrameTree.h:\n* Source/WebCore/page/LocalFrameView.cpp:\n(WebCore::LocalFrameView::mapAbsoluteToChildFrameViewRect const):\n(WebCore::LocalFrameView::mapAbsoluteToChildFrameViewRect):\n* Source/WebCore/page/LocalFrameView.h:\n* Source/WebCore/page/Page.cpp:\n(WebCore::Page::syncLocalFrameInfoToRemote):\n* Source/WebCore/page/RemoteFrameLayoutInfo.cpp:\n(WebCore::RemoteFrameLayoutInfo::RemoteFrameLayoutInfo):\n(WebCore::operator\u003c\u003c):\n(WebCore::RemoteFrameLayoutInfo::mapParentContentsToChildWindow const): Deleted.\n* Source/WebCore/page/RemoteFrameLayoutInfo.h:\n(WebCore::RemoteFrameLayoutInfo::onScreenRectInChildView const):\n(WebCore::RemoteFrameLayoutInfo::exposedContentRectInChildView const):\n(WebCore::RemoteFrameLayoutInfo::windowClipRectInParent const): Deleted.\n(WebCore::RemoteFrameLayoutInfo::exposedContentRectInParent const): Deleted.\n* Source/WebCore/testing/Internals.cpp:\n(WebCore::Internals::windowClipRect):\n(WebCore::Internals::exposedContentRect):\n(WebCore::Internals::delegatesScrollingToNativeView):\n* Source/WebCore/testing/Internals.h:\n* Source/WebCore/testing/Internals.idl:\n* Source/WebKit/Shared/WebCoreArgumentCoders.serialization.in:\n* Source/WebKit/WebProcess/WebPage/WebPage.cpp:\n(WebKit::WebPage::updateChildFrameVisibleRectsFromParent):\n\nCanonical link: https://commits.webkit.org/320528@main\n"
    },
    {
      "commit": "da79705ade01755efb0bf2144b1636e4e744a592",
      "tree": "c7c75f403d0fe200d0a78a044417bdc72622c60b",
      "parents": [
        "7e1a50ea089419edd8fd798542ea34445c30bbce"
      ],
      "author": {
        "name": "Ahmad Saleem",
        "email": "ahmad.saleem792+github@gmail.com",
        "time": "Fri Sep 04 19:18:10 2026"
      },
      "committer": {
        "name": "Ahmad Saleem",
        "email": "ahmad.saleem792@gmail.com",
        "time": "Fri Sep 04 19:18:10 2026"
      },
      "message": "ScrollingStateTree::insertNode does redundant work reordering children on pages with many sibling scrolling nodes\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d322891\nrdar://186143008\n\nReviewed by Chris Dumez and Simon Fraser.\n\nScrollingStateNode keeps its children in a Vector. When insertNode() moves an\nexisting node to a new index it called removeChild() (a linear scan plus a tail\nmemmove) followed by insertChild()/appendChild() (another tail memmove). Since\nregisterScrollingNodeID() runs this once per layer during every compositing\nupdate, a parent with N children that need reordering does more shifting than\nnecessary.\n\nAdd Vector::moveTo(), which relocates the element at one index to another by\nlifting it out, shifting only the elements between the current and target\npositions into the gap with Vector\u0027s own TypeOperations::moveOverlapping(), and\ndropping it back at its new home. Every element outside that range stays put.\nScrollingStateTree::insertNode() now finds the node once and calls moveTo()\ninstead of remove + insert.\n\nThis is a constant-factor improvement, not an asymptotic one: the find() is\nstill O(n) and moveTo() shifts O(distance) elements, so a full reordering of N\nsiblings remains O(n^2) in the worst case. What it removes is the redundant\nwork each reorder did before -- one bounded shift instead of a full-length\nremove memmove plus a full-length insert memmove -- and, in the common case\nwhere a node moves only a short distance, the shift touches just the elements\nin between rather than the whole tail.\n\nThe reorder path is unchanged behaviorally, so it stays covered by existing\ntests. A childIndex of notFound (or otherwise past the end) still means\n\"append\": it is clamped to the last slot, preserving the tolerance\ninsertChild() has long needed for the out-of-range indices that crash data\nshows do occur, rather than tripping moveTo()\u0027s bounds assertion. moveTo()\nitself gets direct coverage in TestWebKitAPI, including same-position and\nmove-only element cases.\n\n* Source/WTF/wtf/Vector.h:\n(WTF::Vector::moveTo):\n* Source/WebCore/page/scrolling/ScrollingStateTree.cpp:\n(WebCore::ScrollingStateTree::insertNode):\n* Tools/TestWebKitAPI/Tests/WTF/Vector.cpp:\n(TestWebKitAPI::TEST):\n\nCanonical link: https://commits.webkit.org/320527@main\n"
    },
    {
      "commit": "7e1a50ea089419edd8fd798542ea34445c30bbce",
      "tree": "ed338b1d930ebfa3226a1c5a98997a9230e6966e",
      "parents": [
        "2d6042742a7eb23c1b092e2d2235857c116f712c"
      ],
      "author": {
        "name": "Richard Robinson",
        "email": "richard_robinson2@apple.com",
        "time": "Fri Sep 04 19:12:41 2026"
      },
      "committer": {
        "name": "Richard Robinson",
        "email": "richard_robinson2@apple.com",
        "time": "Fri Sep 04 19:12:41 2026"
      },
      "message": "[Swift in WebKit] Annotate a few more WTF container types as Escapable \u0026 Copyable\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323454\nrdar://186682706\n\nReviewed by Abrar Rahman Protyasha.\n\nAdd Copyable to Vector, and add Escapable \u0026 Copyable to HashMap and Variant.\n\n* Source/WTF/wtf/HashMap.h:\n* Source/WTF/wtf/Variant.h:\n* Source/WTF/wtf/Vector.h:\n* Source/WTF/wtf/module.modulemap:\n\nCanonical link: https://commits.webkit.org/320526@main\n"
    },
    {
      "commit": "2d6042742a7eb23c1b092e2d2235857c116f712c",
      "tree": "310b0d558e55de8c9e372bb2ba51d8671f2f3036",
      "parents": [
        "946a6c01843cc7da0b446fffbae6c9b1c152a303"
      ],
      "author": {
        "name": "Richard Robinson",
        "email": "richard_robinson2@apple.com",
        "time": "Fri Sep 04 19:03:26 2026"
      },
      "committer": {
        "name": "Richard Robinson",
        "email": "richard_robinson2@apple.com",
        "time": "Fri Sep 04 19:03:26 2026"
      },
      "message": "[NewCodable] Add the ability to decode more primitive types\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d322932\nrdar://186193259\n\nReviewed by Wenson Hsieh.\n\nDecode numbers and strings and optionals too!\n\nTest: Tools/TestWebKitAPI/Tests/WebKit/WebPage/JavaScriptEvaluationTests.swift\n\n* Source/WebKit/Shared/JavaScriptEvaluationCodableValue.swift:\n* Source/WebKit/Shared/JavaScriptEvaluationGraphDecoder.swift:\n(JavaScriptEvaluationGraphDecoder.decode(_:)):\n(JavaScriptEvaluationGraphDecoder.codableValue() throws(CodingError.Decoding:)):\n(JavaScriptEvaluationGraphDecoder.decodeNil() throws(CodingError.Decoding:)):\n(JavaScriptEvaluationGraphDecoder.decodeOptional(_:)):\n* Source/WebKit/Shared/JavaScriptEvaluationResultCxxInteropSupport.h:\n(WebKit::CxxInteropSupport::alternativeForVariant):\n* Tools/TestWebKitAPI/Tests/WebKit/WebPage/JavaScriptEvaluationTests.swift:\n(JavaScriptEvaluationTests.decodingBool):\n(JavaScriptEvaluationTests.decodingDouble):\n(JavaScriptEvaluationTests.decodingFloat):\n(JavaScriptEvaluationTests.decodingInt):\n(JavaScriptEvaluationTests.decodingSignedIntegers):\n(JavaScriptEvaluationTests.decodingUnsignedIntegers):\n(JavaScriptEvaluationTests.decodingString):\n(JavaScriptEvaluationTests.decodingNonASCIIString):\n(JavaScriptEvaluationTests.decodingOptional):\n(JavaScriptEvaluationTests.evaluateBool): Deleted.\n\nCanonical link: https://commits.webkit.org/320525@main\n"
    },
    {
      "commit": "946a6c01843cc7da0b446fffbae6c9b1c152a303",
      "tree": "14a68a96aaf5435a48126da2b4800cff1baf9d28",
      "parents": [
        "1207e682053fff75cd104d5ae8a02f138c50f72a"
      ],
      "author": {
        "name": "Ahmad Saleem",
        "email": "ahmad.saleem792+github@gmail.com",
        "time": "Fri Sep 04 18:57:35 2026"
      },
      "committer": {
        "name": "Ahmad Saleem",
        "email": "ahmad.saleem792@gmail.com",
        "time": "Fri Sep 04 18:57:35 2026"
      },
      "message": "Cache.delete() and Cache.keys() swallow exceptions thrown while constructing a Request from a URL string\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323401\nrdar://186636105\n\nReviewed by Youenn Fablet.\n\nDOMCache::remove() and DOMCache::keys() called requestFromInfo() without the\nrequestValidationFailed out-parameter and resolved the promise with an empty\nresult (false / an empty array) on any exception. As a result a genuine\nTypeError thrown while constructing the Request from a string — e.g. a URL\nthat is invalid or contains credentials — was silently turned into an empty\nresolve instead of rejecting the promise.\n\nThe Cache specification requires the exception to propagate. For\nCache.delete() [1]:\n\n    \"Else if request is a string, then:\n     Set r to the associated request of the result of invoking the initial\n     value of Request as constructor with request as its argument. If this\n     throws an exception, return a promise rejected with that exception.\"\n\nand identically for Cache.keys() [2]:\n\n    \"Else if request is a string, then:\n     Set r to the associated request of the result of invoking the initial\n     value of Request as constructor with request as its argument. If this\n     throws an exception, return a promise rejected with that exception.\"\n\nOnly a Request object whose method is not `GET` (without ignoreMethod) resolves\nwith an empty result. doMatch() and matchAll() already distinguish these two\ncases via the requestValidationFailed bool; make remove() and keys() do the\nsame. Chrome and Firefox already reject in this case.\n\n[1] https://w3c.github.io/ServiceWorker/#cache-delete\n[2] https://w3c.github.io/ServiceWorker/#cache-keys\n\n* LayoutTests/imported/w3c/web-platform-tests/service-workers/cache-storage/cache-delete.https.any-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/service-workers/cache-storage/cache-delete.https.any.js:\n(cache_test):\n* LayoutTests/imported/w3c/web-platform-tests/service-workers/cache-storage/cache-delete.https.any.serviceworker-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/service-workers/cache-storage/cache-delete.https.any.sharedworker-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/service-workers/cache-storage/cache-delete.https.any.worker-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/service-workers/cache-storage/cache-keys.https.any-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/service-workers/cache-storage/cache-keys.https.any.js:\n(cache_test):\n* LayoutTests/imported/w3c/web-platform-tests/service-workers/cache-storage/cache-keys.https.any.serviceworker-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/service-workers/cache-storage/cache-keys.https.any.sharedworker-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/service-workers/cache-storage/cache-keys.https.any.worker-expected.txt:\n* Source/WebCore/Modules/cache/DOMCache.cpp:\n(WebCore::DOMCache::remove):\n(WebCore::DOMCache::keys):\n\nCanonical link: https://commits.webkit.org/320524@main\n"
    },
    {
      "commit": "1207e682053fff75cd104d5ae8a02f138c50f72a",
      "tree": "324cbaff26e10637fb8f55afad3cc7e3e5040699",
      "parents": [
        "f2a07be9fb7478e9b44a6ed50a7b9f07b8c793b1"
      ],
      "author": {
        "name": "Wenson Hsieh",
        "email": "wenson_hsieh@apple.com",
        "time": "Fri Sep 04 18:39:16 2026"
      },
      "committer": {
        "name": "Wenson Hsieh",
        "email": "wenson_hsieh@apple.com",
        "time": "Fri Sep 04 18:39:16 2026"
      },
      "message": "[Text Extraction] Stale node UID resolution heuristic should surface failure in the case where the resolved node is stale\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323397\nrdar://186483543\n\nReviewed by Abrar Rahman Protyasha.\n\nThe stale node resolution heuristic (for Safari MCP, Automatically Fix Passwords, etc.) currently\nallows agents to interact with stale node `uid`s, as long as the stale node `uid` can be mapped to a\nnode in the DOM that appeared in a later extraction with matching self-and-surrounding context. This\nis achieved by maintaining a sliding window of recent text extraction results on the web view, such\nthat we\u0027re able to both:\n\n1.  Detect when the agent tries to interact with a stale `uid` that no longer corresponds to\n    anything in the current page.\n\n2.  Check if anything in the later text extraction looks (nearly) identical to the old context\n    (ignoring differences in `uid` and some other transient attributes), and instead of failing,\n    handle the interaction as if the agent tried to interact with that newer node `uid`.\n\nThis is especially crucial to keep weaker models from consistently failing to issue valid tool calls\nwhen reasoning about long-horizon tasks, if it tries to interact with stale nodes. However, this\nmechanism currently doesn\u0027t check that this newer resolved node isn\u0027t (itself) stale; as a result,\nthe interaction result and description can end up confusing agents even further (\"node uid `X` was\nstale, so we resolved it to `Y`\", followed by \"Failed to interact with `Y` because `Y` was stale\").\n\nTo fix this, we add one final sanity check to ensure that the node we end up resolving the stale uid\nto isn\u0027t also stale. `resolve()` now returns the remapping candidates in order of preference, and we\nask the web process for the first one that\u0027s still connected before committing to it. If none of\nthem are, we report the original failure as a stale uid and tell the agent to re-extract the page\nrather than interacting with a node we already know is gone.\n\nTest:   TextExtractionTests.InteractionDebugDescriptionWithUnresolvableNodeIdentifier\n        TextExtractionTests.InteractionDebugDescriptionWithoutTargetElement\n        TextExtractionTests.InteractionReportsStaleNodeWhenRemapCandidateIsAlsoStale\n\n* Source/WebCore/page/text-extraction/TextExtraction.cpp:\n(WebCore::TextExtraction::interactionDescription):\n* Source/WebCore/page/text-extraction/TextExtractionTypes.h:\n* Source/WebKit/Shared/WebCoreArgumentCoders.serialization.in:\n* Source/WebKit/UIProcess/API/Cocoa/WKWebView+TextExtraction.mm:\n(noteForRemappedStaleNode):\n(findFirstConnectedRemapCandidate):\n(-[WKWebView _performInteraction:inFrame:actionType:staleNodeResolution:completionHandler:]):\n(-[WKWebView _retryInteractionWithConnectedRemapCandidate:actionType:requestedNodeIdentifier:remapCandidates:failureDescription:completionHandler:]):\n(-[WKWebView _describeInteraction:completionHandler:]):\n(-[WKWebView _describeInteraction:inFrame:staleNodeResolution:completionHandler:]):\n(-[WKWebView _retryDescribingInteractionWithConnectedRemapCandidate:requestedNodeIdentifier:remapCandidates:completionHandler:]):\n(-[WKWebView _performInteraction:inFrame:actionType:nodeIdentifier:staleNodeNote:shouldResolveStaleNodeIdentifier:completionHandler:]): Deleted.\n(-[WKWebView _describeInteraction:inFrame:nodeIdentifier:staleNodeNote:shouldResolveStaleNodeIdentifier:completionHandler:]): Deleted.\n* Source/WebKit/UIProcess/API/Cocoa/WKWebView.mm:\n(-[WKWebView _performInteraction:completionHandler:]):\n* Source/WebKit/UIProcess/API/Cocoa/WKWebViewInternal.h:\n* Source/WebKit/UIProcess/TextExtractionCache.cpp:\n(WebKit::TextExtractionCache::resolve const):\n* Source/WebKit/UIProcess/TextExtractionCache.h:\n(WebKit::StaleNodeResolutionState::didRemap const):\n* Source/WebKit/UIProcess/WebFrameProxy.cpp:\n(WebKit::WebFrameProxy::findFirstConnectedNode):\n* Source/WebKit/UIProcess/WebFrameProxy.h:\n* Source/WebKit/WebProcess/WebPage/WebFrame.cpp:\n(WebKit::WebFrame::describeTextExtractionInteraction):\n(WebKit::WebFrame::findFirstConnectedNode):\n* Source/WebKit/WebProcess/WebPage/WebFrame.h:\n* Source/WebKit/WebProcess/WebPage/WebFrame.messages.in:\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/TextExtractionTests.mm:\n(TestWebKitAPI::TEST(TextExtractionTests, InteractionDebugDescriptionWithStaleNodeIdentifier)):\n(TestWebKitAPI::TEST(TextExtractionTests, InteractionDebugDescriptionWithoutTargetElement)):\n(TestWebKitAPI::TEST(TextExtractionTests, InteractionReportsStaleNodeWhenRemapCandidateIsAlsoStale)):\n\nCanonical link: https://commits.webkit.org/320523@main\n"
    },
    {
      "commit": "f2a07be9fb7478e9b44a6ed50a7b9f07b8c793b1",
      "tree": "4b2661e102c3e332ee0737592b729ccc7c60c6c4",
      "parents": [
        "e6507c8f6aa83fb37b02d3c4ceaf7e4f4eb661d3"
      ],
      "author": {
        "name": "Brady Eidson",
        "email": "beidson@apple.com",
        "time": "Fri Sep 04 17:55:27 2026"
      },
      "committer": {
        "name": "Brady Eidson",
        "email": "beidson@apple.com",
        "time": "Fri Sep 04 17:55:27 2026"
      },
      "message": "WKWebView does not enforce CORS response header validation for apps\u0027 custom schemes after registerURLSchemeAsCORSEnabled()\nrdar://174287004\n\nReviewed by Chris Dumez.\n\nWe mean for app provided custom URL schemes to participate in CORS, but our implementation had a few holes.\n- The network process was never informed of the custom scheme registrations\n- Some types of requests that would never hit the network process skipped needed checks in the web process.\n\nA lot of care was taken to make sure app-provided content still works with custom schemes as it always had.\n\nThis patch makes those changes and tests them.\n\nTests: Tools/TestWebKitAPI/Tests/WebKitCocoa/CreateWebArchive.mm\n       Tools/TestWebKitAPI/Tests/WebKitCocoa/WKURLSchemeHandler-1.mm\n       Tools/TestWebKitAPI/Tests/WebKitCocoa/WebsitePolicies.mm\n\n* Source/WebCore/loader/DocumentThreadableLoader.cpp:\n(WebCore::DocumentThreadableLoader::loadRequest):\n* Source/WebCore/loader/cache/CachedResourceLoader.cpp:\n(WebCore::CachedResourceLoader::canRequest):\n(WebCore::CachedResourceLoader::canRequestAfterRedirection const):\n(WebCore::CachedResourceLoader::isNoCorsCrossOriginRequestToURLSchemeHandler const):\n* Source/WebCore/loader/cache/CachedResourceLoader.h:\n* Source/WebCore/platform/LegacySchemeRegistry.cpp:\n(WebCore::LegacySchemeRegistry::isBuiltInWebKitHandledScheme):\n(WebCore::LegacySchemeRegistry::registerURLSchemeAsCORSEnabled):\n* Source/WebCore/platform/LegacySchemeRegistry.h:\n* Source/WebKit/NetworkProcess/NetworkProcess.h:\n* Source/WebKit/WebProcess/WebPage/WebPage.cpp:\n(WebKit::WebPage::registerURLSchemeHandler):\n* Source/WebKit/WebProcess/WebProcess.cpp:\n(WebKit::WebProcess::registerURLSchemeAsCORSEnabled):\n* Source/WebKit/WebProcess/WebProcess.h:\n* Tools/TestWebKitAPI/Tests/WebKitCocoa/CreateWebArchive.mm:\n(TestWebKitAPI::(WebArchive, CreateCustomScheme)):\n* Tools/TestWebKitAPI/Tests/WebKitCocoa/WKURLSchemeHandler-1.mm:\n(TEST(URLSchemeHandler, BasicWithHTTPS)):\n((URLSchemeHandler, DisableCORSCanvas)):\n((URLSchemeHandler, SameSchemeSubresourcesAllowed)):\n((URLSchemeHandler, CrossOriginNoCorsSubresourcesBlocked)):\n((URLSchemeHandler, CrossOriginIframeCORSEnforcementForCustomScheme)):\n* Tools/TestWebKitAPI/Tests/WebKitCocoa/WebsitePolicies.mm:\n\nOriginally-landed-as: 305413.959@safari-7624-branch (1011610c6800). rdar://184744641\nCanonical link: https://commits.webkit.org/320522@main\n"
    },
    {
      "commit": "e6507c8f6aa83fb37b02d3c4ceaf7e4f4eb661d3",
      "tree": "bebfbc8170d3800455c7bb8527b7ad6f3e18a188",
      "parents": [
        "4a2069dce8984504a6eb97526a135c90166f2467"
      ],
      "author": {
        "name": "Anand Srinivasan",
        "email": "anand_srinivasan@apple.com",
        "time": "Fri Sep 04 17:47:06 2026"
      },
      "committer": {
        "name": "Anand Srinivasan",
        "email": "anand_srinivasan@apple.com",
        "time": "Fri Sep 04 17:47:06 2026"
      },
      "message": "Pre-invalidate captured-variable WatchpointSets in generator and async function bodies\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d313499\nrdar://173777534\n\nReviewed by Yusuke Suzuki.\n\nWhen deleteAllCode runs while an async generator is suspended, the generator\nbody\u0027s CodeBlock is cleared and later re-created from re-parsed source. The\nnew CodeBlock\u0027s constant pool gets a fresh SymbolTable clone with fresh\nWatchpointSets, but the suspended activation still references the original.\nA subsequent ResolvedClosureVar put_to_scope on the new CodeBlock fires\ntouch() against the fresh clone\u0027s WatchpointSet, which the DFG is not\nwatching, so DFG code that constant-folded the captured variable never\ndeoptimizes and returns stale values.\n\nTreat ResolvedClosureVar writes inside suspendable bodies the same way\nClosureVar writes are already treated: invalidate the WatchpointSet at\nlink time. Sibling closures using ClosureVar already pay this cost;\nextending it to the declaring function eliminates the only remaining\nruntime path that relies on SymbolTable identity across re-link.\n\nTests: JSTests/stress/watchpoint-async-generator-code-deletion.js\n       JSTests/stress/watchpoint-closure-not-affected.js\n\n* JSTests/stress/watchpoint-async-generator-code-deletion.js: Added.\n(async sleepAsync):\n(async main.opt):\n(async main):\n* JSTests/stress/watchpoint-closure-not-affected.js: Added.\n(async sleepAsync):\n(async test.):\n(async test.obj):\n* Source/JavaScriptCore/bytecode/CodeBlock.cpp:\n(JSC::CodeBlock::finishCreation):\n\nOriginally-landed-as: 305413.1026@safari-7624.5-branch (1af72a6f5454). rdar://185366656\nCanonical link: https://commits.webkit.org/320521@main\n"
    },
    {
      "commit": "4a2069dce8984504a6eb97526a135c90166f2467",
      "tree": "0319ba0058ef5d9acf738b076a55addb960a2d05",
      "parents": [
        "9f7bc0710176d1924e73f6d1c2ed00262b6f81be"
      ],
      "author": {
        "name": "Kristian Monsen",
        "email": "k_monsen@apple.com",
        "time": "Fri Sep 04 17:32:16 2026"
      },
      "committer": {
        "name": "Kristian Monsen",
        "email": "k_monsen@apple.com",
        "time": "Fri Sep 04 17:32:16 2026"
      },
      "message": "Reject WebRTC socket creation with overlong hostname to fix crash\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323282\nrdar://186254356\n\nReviewed by Youenn Fablet.\n\nNetworkRTCProvider::createUDPSocket on Cocoa would crash when passed a socket address with a\nhostname longer than 1023 characters. nw_endpoint_create_host_with_numeric_port cannot represent\nsuch a hostname and returns null, so nw_endpoint_get_hostname returns null, and constructing a\nwebrtc::SocketAddress from it traps in the std::string_view constructor\u0027s libc++ hardening check.\n\nThe fix rejects addresses whose hostname cannot be a valid DNS name, alongside the existing empty\naddress check, and notifies the caller with signalSocketIsClosed instead of crashing.\n\nTest: ipc/webrtc-create-socket-long-hostname-crash.html\n\n* LayoutTests/ipc/webrtc-create-socket-long-hostname-crash-expected.txt: Added.\n* LayoutTests/ipc/webrtc-create-socket-long-hostname-crash.html: Added.\n* Source/WebKit/NetworkProcess/webrtc/NetworkRTCProvider.cpp:\n(WebKit::isInvalidRTCAddress):\n(WebKit::NetworkRTCProvider::sendToSocket):\n(WebKit::NetworkRTCProvider::createUDPSocket):\n(WebKit::NetworkRTCProvider::createClientTCPSocket):\n(WebKit::isEmptyRTCAddress): Deleted.\n* Source/WebKit/NetworkProcess/webrtc/NetworkRTCUDPSocketCocoa.mm:\n(WebKit::NetworkRTCUDPSocketCocoaConnections::NetworkRTCUDPSocketCocoaConnections):\n\nCanonical link: https://commits.webkit.org/320520@main\n"
    },
    {
      "commit": "9f7bc0710176d1924e73f6d1c2ed00262b6f81be",
      "tree": "137239ae9d7cea7aa9cd664d596bf5c5de47d48d",
      "parents": [
        "f56eb24b31957067cad7f5fec90ee8f8f486f090"
      ],
      "author": {
        "name": "Alejandro G. Castro",
        "email": "alex@igalia.com",
        "time": "Fri Sep 04 16:50:21 2026"
      },
      "committer": {
        "name": "Alejandro G. Castro",
        "email": "alex@igalia.com",
        "time": "Fri Sep 04 16:50:21 2026"
      },
      "message": "[GTK][WPE] Build and run the IPC API tests on Linux\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323435\n\nReviewed by Carlos Garcia Campos.\n\nTools/TestWebKitAPI/Tests/IPC has 244 tests covering Connection,\nStreamClientConnection, StreamServerConnection, StreamConnectionWorkQueue,\nStreamConnectionBuffer and IPC::Event/Signal, and none of them are built on any\nLinux port. A change to the IPC layer can only be validated through layout\ntests, we are trying to check the semaphore implementation for the\nGPUProcess, we need more validation activating these tests.\n\nThree tests assert Cocoa specific semantics and are guarded, each where the\nbehavior actually differs rather than at the file level:\n\n- IPCEventTests.SignalDoesNotBlockWhenNotWaitedFor expects the Event to hold one\n  signal and drop the rest. A Mach notification port coalesces; the non-Cocoa\n  implementation is a counting semaphore pair, so it keeps them. Only that one\n  assertion is Cocoa only, and the remaining signals are drained so the rest of\n  the test still means something.\n- EventTestABBA.InterruptOnDestruct expects destroying the Signal to interrupt a\n  wait. That is a property of the Mach send and receive right pair, and\n  IPCEvent.h already carries a FIXME saying the non-Cocoa implementation does\n  not have it. IPCEventTests.cpp already guards the equivalent tests; this one\n  was missed because it could not be run. Without the guard it waits forever\n  rather than failing.\n- ConnectionTestABBA.UnopenedAAndInvalidateDoesNotDeliverBDidClose expects a\n  peer not to be told when an unopened connection is invalidated. Invalidating\n  it closes the socket, so a peer on Unix domain sockets sees the end of file\n  and reports didClose, where a Mach based peer is never told.\n\nThe result is 244 tests passing on WPE. Nothing changes for the Apple ports:\nevery guarded test stays inside its #if PLATFORM(COCOA), and no non-test code is\ntouched.\n\n* Tools/TestWebKitAPI/CMakeLists.txt:\n* Tools/TestWebKitAPI/PlatformWPE.cmake:\n* Tools/TestWebKitAPI/Tests/IPC/ConnectionTests.cpp:\n* Tools/TestWebKitAPI/Tests/IPC/EventTests.cpp:\n* Tools/TestWebKitAPI/Tests/IPC/IPCEventTests.cpp:\n\nCanonical link: https://commits.webkit.org/320519@main\n"
    },
    {
      "commit": "f56eb24b31957067cad7f5fec90ee8f8f486f090",
      "tree": "76fbb47de44d2efc7b012568a70c3815a88cc747",
      "parents": [
        "67c4317c42825ceaa90d2ed409a5ccc00e7b0137"
      ],
      "author": {
        "name": "Brent Fulgham",
        "email": "bfulgham@apple.com",
        "time": "Fri Sep 04 16:32:51 2026"
      },
      "committer": {
        "name": "Brent Fulgham",
        "email": "bfulgham@webkit.org",
        "time": "Fri Sep 04 16:32:51 2026"
      },
      "message": "WebDriver reports \"stale element reference\" for a node reference from a different browsing context\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323386\nrdar://186615759\n\nReviewed by Tim Nguyen.\n\nEach frame\u0027s injected WebAutomationSessionProxy.js keeps its own map of node handles.\n_nodeForIdentifier() throws NodeNotFound whenever a handle is absent from that map, which\nconflates two different situations:\n(1) the node was in this frame and has since been detached (a stale handle)\n(2) the node was never in this frame, because it belongs to a different frame or window\n\nCommandResult.cpp maps NodeNotFound to StaleElementReference, so both report stale element\nreference. Per the spec, the second case is no such element (or no such shadow root for a\nshadow root reference).\n\n_clearStaleNodes() already knows the difference: it evicts only those handles whose node\nis no longer rooted in this document. Recording what it evicts lets _nodeForIdentifier()\nthrow a distinct StaleNode error for the detached case and keep NodeNotFound for the\nforeign one.\n\nTests: webdriver/tests/classic/execute_script/arguments.py\n       webdriver/tests/classic/execute_async_script/arguments.py\n\n* Source/WebDriver/CommandResult.cpp:\n(WebDriver::CommandResult::CommandResult):\n* Source/WebKit/UIProcess/Automation/Automation.json:\n* Source/WebKit/WebProcess/Automation/WebAutomationSessionProxy.cpp:\n(WebKit::evaluateJavaScriptCallback):\n* Source/WebKit/WebProcess/Automation/WebAutomationSessionProxy.js:\n(let.AutomationSessionProxy):\n(let.AutomationSessionProxy.prototype._nodeForIdentifier):\n(let.AutomationSessionProxy.prototype._clearStaleNodes):\n\nCanonical link: https://commits.webkit.org/320518@main\n"
    },
    {
      "commit": "67c4317c42825ceaa90d2ed409a5ccc00e7b0137",
      "tree": "6ec8757e1ec79a00eee99ba6596d32de5534a4f8",
      "parents": [
        "0ddad2a1c101e319e5a7fcc89f59855438a3e646"
      ],
      "author": {
        "name": "Antti Koivisto",
        "email": "antti@apple.com",
        "time": "Fri Sep 04 16:25:27 2026"
      },
      "committer": {
        "name": "Antti Koivisto",
        "email": "koivisto@iki.fi",
        "time": "Fri Sep 04 16:25:27 2026"
      },
      "message": "Remove MediaQueryParserContext\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323413\nrdar://186644511\n\nReviewed by Sam Weinig.\n\nIt is almost just CSSParserContext.\n\n* Source/WebCore/Headers.cmake:\n* Source/WebCore/Sources.txt:\n* Source/WebCore/WebCore.xcodeproj/project.pbxproj:\n* Source/WebCore/WebCoreJSBindingsPrefix.h:\n* Source/WebCore/css/MediaList.h:\n* Source/WebCore/css/MediaQueryMatcher.cpp:\n* Source/WebCore/css/MediaQueryParserContext.cpp: Removed.\n* Source/WebCore/css/MediaQueryParserContext.h: Removed.\n* Source/WebCore/css/StyleRuleImport.cpp:\n* Source/WebCore/css/parser/CSSParser.cpp:\n* Source/WebCore/css/parser/SizesAttributeParser.cpp:\n* Source/WebCore/css/query/ContainerQueryParser.cpp:\n(WebCore::CQ::consumeStyleRangeFeature):\n(WebCore::CQ::consumeStyleFeature):\n(WebCore::CQ::ContainerQueryParser::consumeContainerQuery):\n(WebCore::CQ::ContainerQueryParser::consumeContainerCondition):\n(WebCore::CQ::ContainerQueryParser::schemaForFeatureName):\n(WebCore::CQ::ContainerQueryParser::consumeAndValidateFeature):\n* Source/WebCore/css/query/ContainerQueryParser.h:\n* Source/WebCore/css/query/GenericMediaQueryParser.cpp:\n(WebCore::MQ::FeatureParser::consumeFeature):\n(WebCore::MQ::FeatureParser::consumeCustomPropertyValue):\n(WebCore::MQ::consumeValue):\n(WebCore::MQ::FeatureParser::consumeBooleanOrPlainFeature):\n(WebCore::MQ::FeatureParser::consumeRangeFeature):\n\nPass EnumSet of parsing options to FeatureParser functions to replace treeCountingFunctionsAllowed\nbit in MediaQueryParserContext.\n\n* Source/WebCore/css/query/GenericMediaQueryParser.h:\n(WebCore::MQ::GenericMediaQueryParser::consumeCondition):\n(WebCore::MQ::GenericMediaQueryParser\u003cConcreteParser\u003e::consumeCondition):\n(WebCore::MQ::GenericMediaQueryParser\u003cConcreteParser\u003e::consumeQueryInParens):\n(WebCore::MQ::GenericMediaQueryParser\u003cConcreteParser\u003e::consumeAndValidateFeature):\n(WebCore::MQ::GenericMediaQueryParser\u003cConcreteParser\u003e::validateFeature):\n(WebCore::MQ::GenericMediaQueryParser\u003cConcreteParser\u003e::schemaForFeatureName):\n* Source/WebCore/css/query/MediaQueryParser.h:\n* Source/WebCore/dom/InlineStyleSheetOwner.cpp:\n* Source/WebCore/dom/ProcessingInstruction.cpp:\n* Source/WebCore/html/HTMLLinkElement.cpp:\n(WebCore::HTMLLinkElement::initializeStyleSheet):\n(WebCore::HTMLLinkElement::setCSSStyleSheet):\n* Source/WebCore/html/HTMLLinkElement.h:\n* Source/WebCore/html/HTMLMetaElement.cpp:\n* Source/WebCore/html/HTMLSourceElement.cpp:\n* Source/WebCore/html/HTMLStyleElement.cpp:\n* Source/WebCore/style/IfConditionEvaluator.cpp:\n(WebCore::Style::IfConditionEvaluator::evaluate):\n\nCanonical link: https://commits.webkit.org/320517@main\n"
    },
    {
      "commit": "0ddad2a1c101e319e5a7fcc89f59855438a3e646",
      "tree": "b0090ee5123804ffcd686bd2817aaaeafc05702a",
      "parents": [
        "99084379b9c6a525240ac74f474534fd919173dc"
      ],
      "author": {
        "name": "Sergey Rubanov",
        "email": "chi187@gmail.com",
        "time": "Fri Sep 04 16:10:16 2026"
      },
      "committer": {
        "name": "Sergey Rubanov",
        "email": "chi187@gmail.com",
        "time": "Fri Sep 04 16:10:16 2026"
      },
      "message": "[JSC][Wasm] Use ARM64 post-index in the restore-frame copy\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323374\n\nReviewed by Yusuke Suzuki.\n\nThe wasm-to-wasm restore-frame copy loop does loadPair64, storePair64\nat base minus restoreFrameSize, then addPtr 16. ARM64 already has\nloadPair64(PostIndexAddress). Fold the increment into the load and\nstore at the adjusted negative offset. Other architectures keep the\nadd.\n\n* Source/JavaScriptCore/wasm/WasmIRGeneratorHelpers.h:\n\nCanonical link: https://commits.webkit.org/320516@main\n"
    },
    {
      "commit": "99084379b9c6a525240ac74f474534fd919173dc",
      "tree": "4bdc0b942bb79dc0c13e818d93f1120bc3c0b84d",
      "parents": [
        "5204a1a34fa4baaf679a4f39ae0895f393fae67a"
      ],
      "author": {
        "name": "Adrian Taylor",
        "email": "adrian_taylor@apple.com",
        "time": "Fri Sep 04 15:32:48 2026"
      },
      "committer": {
        "name": "Adrian Taylor",
        "email": "adrian_taylor@apple.com",
        "time": "Fri Sep 04 15:32:48 2026"
      },
      "message": "[cmake] Add more clang-target\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323437\nrdar://186662042\n\nReviewed by Zak Ridouh.\n\nhttps://commits.webkit.org/320498@main added a -clang-target flag for Swift\nunder a cmake build. We need to add that in two other places so that a\nconsistent set of options are passed to the clang importers. As well as\ncorrectness, this is necessary to work towards fewer PCM compile steps.\n\nCanonical link: https://commits.webkit.org/320515@main\n"
    },
    {
      "commit": "5204a1a34fa4baaf679a4f39ae0895f393fae67a",
      "tree": "f75281077518aeab84707fc06645300b77b27ec7",
      "parents": [
        "2a20415140e222bcb09da19d5f36494c26c4d715"
      ],
      "author": {
        "name": "Alan Baradlay",
        "email": "zalan@apple.com",
        "time": "Fri Sep 04 15:18:54 2026"
      },
      "committer": {
        "name": "Alan Baradlay",
        "email": "zalan@apple.com",
        "time": "Fri Sep 04 15:18:54 2026"
      },
      "message": "REGRESSION (Safari 27): line-height quirk not applied inside inline-block\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323287\n\u003crdar://problem/186614663\u003e\n\nReviewed by Antti Koivisto.\n\nIn quirks mode the line-height quirk applies to line break boxes too, since a \u003cbr\u003e has no text content.\n310839@main made a \u003cbr\u003e with a non-normal line-height stretch the line box unconditionally, so a line-height\ninherited from an ancestor started stretching lines that have other content on them. Now the \u003cbr\u003e only\nstretches the line box when there\u0027s nothing else on the line to do it.\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-inline/br-line-height-inherited-quirks-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-inline/br-line-height-inherited-quirks-ref.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-inline/br-line-height-inherited-quirks.html: Added.\n* Source/WebCore/layout/formattingContexts/inline/InlineFormattingUtils.cpp:\n(WebCore::Layout::InlineFormattingUtils::inlineLevelBoxAffectsLineBox const):\n* Source/WebCore/layout/formattingContexts/inline/InlineFormattingUtils.h:\n* Source/WebCore/layout/formattingContexts/inline/InlineLineBoxVerticalAligner.cpp:\n(WebCore::Layout::LineBoxVerticalAligner::computeLineBoxLogicalHeight const):\n(WebCore::Layout::LineBoxVerticalAligner::computeRootInlineBoxVerticalPosition const):\n(WebCore::Layout::LineBoxVerticalAligner::layoutBoundsForInlineBoxSubtree const):\n(WebCore::Layout::LineBoxVerticalAligner::alignInlineLevelBoxes const):\n* Source/WebCore/layout/formattingContexts/inline/InlineLineBoxVerticalAligner.h:\n* Source/WebCore/layout/formattingContexts/inline/InlineQuirks.cpp:\n(WebCore::Layout::InlineQuirks::lineBreakBoxIsOnlyContentOnLine):\n(WebCore::Layout::InlineQuirks::lineBreakBoxAffectsParentInlineBox):\n* Source/WebCore/layout/formattingContexts/inline/InlineQuirks.h:\n\nCanonical link: https://commits.webkit.org/320514@main\n"
    },
    {
      "commit": "2a20415140e222bcb09da19d5f36494c26c4d715",
      "tree": "80af661c7b5bd4a03067d5155e22ea0f35f45e78",
      "parents": [
        "1bf94f1c0c462bef841fca9877c167bf4bc769b3"
      ],
      "author": {
        "name": "Zak Ridouh",
        "email": "zakr@apple.com",
        "time": "Fri Sep 04 15:14:57 2026"
      },
      "committer": {
        "name": "Zak Ridouh",
        "email": "zakr@apple.com",
        "time": "Fri Sep 04 15:14:57 2026"
      },
      "message": "Null-check history items in history dumping testing code\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d322203\nrdar://185442169\n\nReviewed by David Kilzer.\n\nWebPage::dumpHistoryForTesting() and Internals::getReferencedFilePaths()\ndereferenced a nullable history item without checking it.\n\nIn dumpHistoryForTesting(), itemAtIndex() takes an offset relative to the\ncurrent item, so the range of valid offsets is [-backCount(), forwardCount()]\ninclusive. backCount() and forwardCount() are served from a cached value in\nWebBackForwardListProxy, while itemAtIndex() is a separate synchronous message\nto the UI process, so the bounds and the items are sampled at different times\nand itemAtIndex() can return null at an offset the bounds include. Skip those\nentries. A page with no current item at all has nothing to dump, so return\nearly: WebKitTestRunner dumps every page it knows about, and a page created by\nwindow.open() has no current item until its initial load commits.\n\nIn getReferencedFilePaths(), only the frame was checked.\nHistoryController::currentItem() is null until a load commits, and\nsaveDocumentAndScrollState() does not create an item.\n\nBoth are only reachable from test infrastructure, so this replaces a WebContent\nprocess crash with a skipped entry.\n\n* Source/WebCore/testing/Internals.cpp:\n(WebCore::Internals::getReferencedFilePaths const):\n* Source/WebKit/WebProcess/WebPage/WebPage.cpp:\n(WebKit::WebPage::dumpHistoryForTesting):\n\nCanonical link: https://commits.webkit.org/320513@main\n"
    },
    {
      "commit": "1bf94f1c0c462bef841fca9877c167bf4bc769b3",
      "tree": "d95ed06840f48bd65c14100526d3f6ffc2a7df09",
      "parents": [
        "56d21bcfd6717fd472ee2ba7d73776e6a9eb6e0d"
      ],
      "author": {
        "name": "Ahmad Saleem",
        "email": "ahmad.saleem792+github@gmail.com",
        "time": "Fri Sep 04 15:13:13 2026"
      },
      "committer": {
        "name": "Ahmad Saleem",
        "email": "ahmad.saleem792@gmail.com",
        "time": "Fri Sep 04 15:13:13 2026"
      },
      "message": "[Canvas] parseColor() constructs CSSParserContext(HTMLStandardMode) twice\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323404\nrdar://186639923\n\nReviewed by Tim Nguyen.\n\nThe ScriptExecutionContext overload of parseColor() constructed an\nidentical CSSParserContext(HTMLStandardMode) twice: once for the\nparseColorRawSimple() fast path, and again for parseColorRawGeneral()\non the fall-through slow path. CSSParserContext is a heavy struct, so\nthis was a redundant build whenever the simple parse failed.\n\nHoist it into a single local reused by both calls, matching the sibling\nCanvasBase overload which already binds the context once.\n\n* Source/WebCore/html/canvas/CanvasStyle.cpp:\n(WebCore::parseColor):\n\nCanonical link: https://commits.webkit.org/320512@main\n"
    },
    {
      "commit": "56d21bcfd6717fd472ee2ba7d73776e6a9eb6e0d",
      "tree": "0287457cf8b169e2a0e7c10813c9f5ee32218449",
      "parents": [
        "3c0232a5d33e17eeec3db8c24e5f7bf171cf8742"
      ],
      "author": {
        "name": "Adrian Taylor",
        "email": "adrian_taylor@apple.com",
        "time": "Fri Sep 04 15:11:23 2026"
      },
      "committer": {
        "name": "Adrian Taylor",
        "email": "adrian_taylor@apple.com",
        "time": "Fri Sep 04 15:11:23 2026"
      },
      "message": "[cmake] Set ENABLE_WEBGPU_SWIFT correctly\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323430\nrdar://186653895\n\nReviewed by Mike Wyrzykowski.\n\nIn the cmake build, previously ENABLE_WEBGPU_SWIFT was only being defined for\nthe Swift clang importer, not for regular C++ clang compiles. This currently\ncaused no problems, but if we ever added a type whose layout depended on that\nifdef, then Swift and C++ would see different offsets/layouts in that type.\nPromote ENABLE_WEBGPU_SWIFT to being a normal option.\n\nNote that in theory this could harm build performance by causing us to build\nmultiple copies of PCM files (per the comment just above the change in\nWebKitMacros.cmake). In practice, we already build several PCMs for many modules\nso the rationale in that comment no longer really holds. A follow-up commit\nwill attempt to reduce that down again to improve build speed.\n\nCanonical link: https://commits.webkit.org/320511@main\n"
    },
    {
      "commit": "3c0232a5d33e17eeec3db8c24e5f7bf171cf8742",
      "tree": "5e9ced58846aed2cb50a35133104952bafd83d2b",
      "parents": [
        "10ace68e7cd8d81ef2da87b682e4df3ca7e67637"
      ],
      "author": {
        "name": "Ahmad Saleem",
        "email": "ahmad.saleem792+github@gmail.com",
        "time": "Fri Sep 04 15:06:41 2026"
      },
      "committer": {
        "name": "Ahmad Saleem",
        "email": "ahmad.saleem792@gmail.com",
        "time": "Fri Sep 04 15:06:41 2026"
      },
      "message": "CanvasNoiseInjection misclassifies the bottom-left pixel due to an off-by-one in the bottom-row check\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323405\nrdar://186640624\n\nReviewed by Gerald Squelart.\n\nboundingNeighbors() classifies the bottom row with\n\n    pixelIndex \u003e (size.height() - 1) * size.width()\n\nbut the last row spans indices [(H-1)*W, H*W-1], so the test should be\n\"\u003e\u003d\". With \"\u003e\", the bottom-left pixel (pixelIndex \u003d\u003d (H-1)*W) is not\nrecognized as being in the bottom row, and consequently not recognized\nas the bottom-left corner. The top-row check on the line above already\nuses the correct \"\u003c\" form; this makes the bottom-row check symmetric.\n\nThis has no observable effect on output: the misclassified pixel falls\ninto the left-column branch, whose below-neighbor is out of bounds, so\nareColorsRelated() returns false and the bounding colors stay at their\ndefaults -- identical to what the corner early-return produces. It also\ndoes not trip the isIndexInBounds() assertion, because the out-of-bounds\nbelow-index equals bufferSize exactly and the \"+ 3\" probe is\nshort-circuited. This is a correctness/clarity fix; no test is added\nbecause the pixel output is byte-for-byte unchanged and any test would\npass without the fix.\n\n* Source/WebCore/html/CanvasNoiseInjection.cpp:\n(WebCore::boundingNeighbors):\n\nCanonical link: https://commits.webkit.org/320510@main\n"
    },
    {
      "commit": "10ace68e7cd8d81ef2da87b682e4df3ca7e67637",
      "tree": "ec4241bae9e5ca6c82069ed7491f1e6b265216f7",
      "parents": [
        "5e2f8ed9bc169adb88ca7adabf0528f00cf22868"
      ],
      "author": {
        "name": "Alan Baradlay",
        "email": "zalan@apple.com",
        "time": "Fri Sep 04 14:38:52 2026"
      },
      "committer": {
        "name": "Alan Baradlay",
        "email": "zalan@apple.com",
        "time": "Fri Sep 04 14:38:52 2026"
      },
      "message": "[list-marker] Rename RenderListMarker to RenderListOutsideMarker\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323226\nrdar://problem/186472147\n\nReviewed by Antti Koivisto.\n\nAn inside marker is built as an anonymous inline box now, so this renderer is only ever created for\nlist-style-position: outside: the marker the list item excludes from its content and positions itself. Name it for\nwhat it is.\n\nrenderName() keeps returning \"RenderListMarker\" so that no expected results move; the name in the render tree dumps\nis what the marker is called in CSS terms, not the class name.\n\nNo change in behavior.\n\n* Source/WebCore/SaferCPPExpectations/UncheckedCallArgsCheckerExpectations:\n* Source/WebCore/SaferCPPExpectations/UncheckedLocalVarsCheckerExpectations:\n* Source/WebCore/Sources.txt:\n* Source/WebCore/WebCore.xcodeproj/project.pbxproj:\n* Source/WebCore/accessibility/AXObjectCache.cpp:\n(WebCore::AXObjectCache::onTextRunsChanged):\n* Source/WebCore/accessibility/AXTextMarker.cpp:\n(WebCore::AXTextMarkerRange::toString const):\n* Source/WebCore/accessibility/AccessibilityNodeObject.cpp:\n(WebCore::AccessibilityNodeObject::canHaveChildren const):\n(WebCore::AccessibilityNodeObject::stitchGroups const):\n(WebCore::AccessibilityNodeObject::stringValue const):\n* Source/WebCore/accessibility/AccessibilityObject.cpp:\n* Source/WebCore/accessibility/AccessibilityRenderObject.cpp:\n(WebCore::AccessibilityRenderObject::parentObject const):\n(WebCore::AccessibilityRenderObject::textUnderElement const):\n(WebCore::AccessibilityRenderObject::stringValue const):\n(WebCore::AccessibilityRenderObject::boundingBoxRect const):\n(WebCore::AccessibilityRenderObject::computeIsIgnored const):\n(WebCore::AccessibilityRenderObject::listMarkerText const):\n(WebCore::AccessibilityRenderObject::determineAccessibilityRole):\n(WebCore::AccessibilityRenderObject::addChildren):\n* Source/WebCore/accessibility/atspi/AccessibilityObjectTextAtspi.cpp:\n(WebCore::AccessibilityObjectAtspi::textAttributes const):\n* Source/WebCore/layout/integration/LayoutIntegrationBoxGeometryUpdater.cpp:\n(WebCore::LayoutIntegration::BoxGeometryUpdater::setListMarkerOffsetForMarkerOutside):\n(WebCore::LayoutIntegration::baselineForBox):\n(WebCore::LayoutIntegration::setIntegrationBaseline):\n(WebCore::LayoutIntegration::BoxGeometryUpdater::updateBoxGeometryAfterIntegrationLayout):\n(WebCore::LayoutIntegration::BoxGeometryUpdater::updateBoxGeometry):\n* Source/WebCore/layout/integration/LayoutIntegrationBoxGeometryUpdater.h:\n* Source/WebCore/layout/integration/LayoutIntegrationBoxTreeUpdater.cpp:\n(WebCore::LayoutIntegration::elementAttributes):\n(WebCore::LayoutIntegration::calculateListMarkerAttribute):\n(WebCore::LayoutIntegration::BoxTreeUpdater::createLayoutBox):\n(WebCore::LayoutIntegration::BoxTreeUpdater::updateStyle):\n* Source/WebCore/layout/integration/LayoutIntegrationCoverage.cpp:\n(WebCore::LayoutIntegration::canUseForIntrinsicWidthComputation):\n* Source/WebCore/layout/integration/inline/InlineIteratorLineBox.cpp:\n(WebCore::InlineIterator::closestBoxForHorizontalPosition):\n* Source/WebCore/layout/integration/inline/LayoutIntegrationLineLayout.cpp:\n* Source/WebCore/layout/integration/inline/LayoutIntegrationLineLayout.h:\n* Source/WebCore/page/LocalFrameViewLayoutContext.cpp:\n(WebCore::ListItemExcludedMarkerScope::ListItemExcludedMarkerScope):\n* Source/WebCore/page/LocalFrameViewLayoutContext.h:\n* Source/WebCore/rendering/LegacyInlineIterator.h:\n(WebCore::LegacyInlineIterator::direction const):\n* Source/WebCore/rendering/OutlinePainter.cpp:\n(WebCore::OutlinePainter::collectFocusRingRectsForInline):\n* Source/WebCore/rendering/RenderBlock.cpp:\n* Source/WebCore/rendering/RenderBlockFlow.cpp:\n(WebCore::RenderBlockFlow::computeInlineIntrinsicLogicalWidths const):\n* Source/WebCore/rendering/RenderBox.cpp:\n(WebCore::RenderBox::lineHeight const):\n* Source/WebCore/rendering/RenderElementInlines.h:\n(WebCore::RenderElement::isAnonymousBlock const):\n* Source/WebCore/rendering/RenderInline.cpp:\n* Source/WebCore/rendering/RenderListItem.cpp:\n(WebCore::RenderListItem::excludedMarker const):\n(WebCore::RenderListItem::markerBox const):\n(WebCore::RenderListItem::placeExcludedMarker):\n(WebCore::RenderListItem::excludedMarkersForContainer):\n* Source/WebCore/rendering/RenderListItem.h:\n* Source/WebCore/rendering/RenderObject.cpp:\n(WebCore::RenderObject::isExcludedMarker const):\n* Source/WebCore/rendering/RenderObject.h:\n(WebCore::RenderObject::isRenderListOutsideMarker const):\n(WebCore::RenderObject::isRenderListMarker const): Deleted.\n* Source/WebCore/rendering/RenderText.cpp:\n(WebCore::RenderText::setRenderedText):\n* Source/WebCore/rendering/RenderTreeAsText.cpp:\n(WebCore::RenderTreeAsText::writeRenderObject):\n(WebCore::write):\n(WebCore::markerTextForListItem):\n* Source/WebCore/rendering/TextAutoSizing.cpp:\n(WebCore::TextAutoSizingValue::adjustTextNodeSizes):\n* Source/WebCore/rendering/line/BreakingContext.h:\n(WebCore::BreakingContext::commitAndUpdateLineBreakIfNeeded):\n* Source/WebCore/rendering/updating/RenderTreeBuilder.h:\n* Source/WebCore/rendering/updating/RenderTreeBuilderBlock.cpp:\n(WebCore::isExcludedMarker):\n* Source/WebCore/rendering/updating/RenderTreeBuilderList.cpp:\n(WebCore::firstNonMarkerChild):\n(WebCore::parentCandidateForMarker):\n(WebCore::RenderTreeBuilder::List::updateItemMarker):\n(WebCore::RenderTreeBuilder::List::buildMarkerContentRenderers):\n* Source/WebCore/rendering/updating/RenderTreeBuilderList.h:\n* Source/WebCore/rendering/updating/RenderTreeBuilderMultiColumn.cpp:\n(WebCore::RenderTreeBuilder::MultiColumn::createFragmentedFlow):\n* Source/WebCore/style/Styleable.cpp:\n* Source/WebCore/rendering/RenderListOutsideMarker.cpp: Renamed from Source/WebCore/rendering/RenderListMarker.cpp.\n(WebCore::RenderListOutsideMarker::RenderListOutsideMarker):\n(WebCore::RenderListOutsideMarker::willBeDestroyed):\n(WebCore::adjustedStyleDifference):\n(WebCore::RenderListOutsideMarker::styleWillChange):\n(WebCore::RenderListOutsideMarker::styleDidChange):\n(WebCore::RenderListOutsideMarker::isImage const):\n(WebCore::RenderListOutsideMarker::hasContentProperty const):\n(WebCore::RenderListOutsideMarker::textNeedsBidiResolution const):\n(WebCore::RenderListOutsideMarker::needsContentContainer const):\n(WebCore::RenderListOutsideMarker::contentContainer const):\n(WebCore::RenderListOutsideMarker::localSelectionRect):\n(WebCore::RenderListOutsideMarker::paint):\n(WebCore::RenderListOutsideMarker::parentBox):\n(WebCore::RenderListOutsideMarker::layout):\n(WebCore::RenderListOutsideMarker::layoutContentContainer):\n(WebCore::RenderListOutsideMarker::imageChanged):\n(WebCore::RenderListOutsideMarker::updateInlineMarginsAndContent):\n(WebCore::RenderListOutsideMarker::updateContent):\n(WebCore::RenderListOutsideMarker::updateContentContainerText):\n(WebCore::RenderListOutsideMarker::computeIntrinsicLogicalWidthContributions):\n(WebCore::RenderListOutsideMarker::updateInlineMargins):\n(WebCore::RenderListOutsideMarker::isDisclosureMarker const):\n(WebCore::RenderListOutsideMarker::listItem const):\n(WebCore::RenderListOutsideMarker::setExcludedPosition):\n(WebCore::RenderListOutsideMarker::invalidateExcludedMarkerContainer):\n(WebCore::RenderListOutsideMarker::nodeForHitTest const):\n(WebCore::RenderListOutsideMarker::relativeMarkerRect):\n(WebCore::RenderListOutsideMarker::selectionRectForRepaint):\n(WebCore::RenderListOutsideMarker::counterStyle const):\n(WebCore::RenderListOutsideMarker::synthesizesGlyph const):\n(WebCore::RenderListOutsideMarker::layoutBoundForTextContent const):\n* Source/WebCore/rendering/RenderListOutsideMarker.h: Renamed from Source/WebCore/rendering/RenderListMarker.h.\n\nCanonical link: https://commits.webkit.org/320509@main\n"
    },
    {
      "commit": "5e2f8ed9bc169adb88ca7adabf0528f00cf22868",
      "tree": "3b5297a06fbc3523984bd07d8f29c81eefa523ab",
      "parents": [
        "5eee8c0ae0310c78ad07f24b6532d9e10398bf75"
      ],
      "author": {
        "name": "Tyler Wilcock",
        "email": "tyler_w@apple.com",
        "time": "Fri Sep 04 14:31:19 2026"
      },
      "committer": {
        "name": "Tyler Wilcock",
        "email": "tyler_w@apple.com",
        "time": "Fri Sep 04 14:31:19 2026"
      },
      "message": "AX: Add layout tests for the text marker index space over non-Latin scripts\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323359\nrdar://186602375\n\nReviewed by Chris Fleizach.\n\nAXIndexForTextMarker and AXTextMarkerForIndex describe a character offset space, and\ncheckRoundTripAllTextMarkerIndicesWithinContainer measures two invariants over it:\n\n  1. Every index round-trips through a marker\n  2. The string from the container start to an index is as long as that index.\n\nExisting bidi and multibyte tests assert the extracted string but use no index API, so\nadd tests verifying index-based roundtrips work in these cases.\n\ntext-marker-index-hebrew.html:\ntext-marker-bidi-element-hebrew.html already asserts that mixed Hebrew and English\ncomes back in logical order, across six unicode-bidi values. It reads only\nstringForTextMarkerRange and boundsForRange, never the index APIs.\n\ntext-marker-index-combining-marks.html:\nNo accessibility test contains a combining mark at all. Two code units per grapheme\ncluster is where an index counting clusters would drift from one counting code units.\n\ntext-marker-index-indic.html:\nNo accessibility test contains Devanagari or Tamil. A vowel sign renders left of the\nconsonant it follows and a virama fuses two consonants, so glyph order and code unit\norder disagree, making it an interesting and novel test.\n\n* LayoutTests/accessibility/isolated-tree/mac/text-marker-index-combining-marks-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/text-marker-index-combining-marks.html: Added.\n* LayoutTests/accessibility/isolated-tree/mac/text-marker-index-hebrew-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/text-marker-index-hebrew.html: Added.\n* LayoutTests/accessibility/isolated-tree/mac/text-marker-index-indic-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/text-marker-index-indic.html: Added.\n* LayoutTests/accessibility/mac/text-marker-index-combining-marks-expected.txt: Added.\n* LayoutTests/accessibility/mac/text-marker-index-combining-marks.html: Added.\n* LayoutTests/accessibility/mac/text-marker-index-hebrew-expected.txt: Added.\n* LayoutTests/accessibility/mac/text-marker-index-hebrew.html: Added.\n* LayoutTests/accessibility/mac/text-marker-index-indic-expected.txt: Added.\n* LayoutTests/accessibility/mac/text-marker-index-indic.html: Added.\n\nCanonical link: https://commits.webkit.org/320508@main\n"
    },
    {
      "commit": "5eee8c0ae0310c78ad07f24b6532d9e10398bf75",
      "tree": "2f4c545699e76af8cf5b2b5126111edf48962d60",
      "parents": [
        "9977e3c2b4c81fbf2aecf8b7762cb9bea1322b9c"
      ],
      "author": {
        "name": "Tyler Wilcock",
        "email": "tyler_w@apple.com",
        "time": "Fri Sep 04 14:30:36 2026"
      },
      "committer": {
        "name": "Tyler Wilcock",
        "email": "tyler_w@apple.com",
        "time": "Fri Sep 04 14:30:36 2026"
      },
      "message": "AX: Add layout tests for bidirectional text and runtime text direction changes\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323362\nrdar://186603868\n\nReviewed by Chris Fleizach.\n\ntext-marker-index-mixed-direction.html:\ntext-marker-bidi-inline-cite.html already covers a dir\u003dauto paragraph holding nested\ndir\u003drtl and dir\u003dltr runs, and asserts the extracted string and range length. It uses no\nindex API, so the round trip across the direction boundaries, and the offset of the\nembedded left-to-right run, are what this adds.\n\ntext-marker-index-rtl-attribute.html:\nSame gap for dir\u003drtl. Left-to-right words in a right-to-left paragraph are a distinct\ncase from right-to-left characters. The words reverse while the letters inside them do\nnot, and an index space built from drawn order would still contain the right characters.\n\ndynamic-rtl-children-order.html:\nNo accessibility test sets direction at runtime at all. Asserts the drawn order actually\nreverses before re-checking the reported order, so it cannot pass against a tree that\nnever updated.\n\ndynamic-rtl-string-content.html:\nLikewise. The text is replaced in the same turn as the flip, so a stale isolated-tree\nread cannot satisfy the assertion.\n\n* LayoutTests/accessibility/isolated-tree/mac/dynamic-rtl-children-order-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/dynamic-rtl-children-order.html: Added.\n* LayoutTests/accessibility/isolated-tree/mac/dynamic-rtl-string-content-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/dynamic-rtl-string-content.html: Added.\n* LayoutTests/accessibility/isolated-tree/mac/text-marker-index-mixed-direction-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/text-marker-index-mixed-direction.html: Added.\n* LayoutTests/accessibility/isolated-tree/mac/text-marker-index-rtl-attribute-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/text-marker-index-rtl-attribute.html: Added.\n* LayoutTests/accessibility/mac/dynamic-rtl-children-order-expected.txt: Added.\n* LayoutTests/accessibility/mac/dynamic-rtl-children-order.html: Added.\n* LayoutTests/accessibility/mac/dynamic-rtl-string-content-expected.txt: Added.\n* LayoutTests/accessibility/mac/dynamic-rtl-string-content.html: Added.\n* LayoutTests/accessibility/mac/text-marker-index-mixed-direction-expected.txt: Added.\n* LayoutTests/accessibility/mac/text-marker-index-mixed-direction.html: Added.\n* LayoutTests/accessibility/mac/text-marker-index-rtl-attribute-expected.txt: Added.\n* LayoutTests/accessibility/mac/text-marker-index-rtl-attribute.html: Added.\n\nCanonical link: https://commits.webkit.org/320507@main\n"
    },
    {
      "commit": "9977e3c2b4c81fbf2aecf8b7762cb9bea1322b9c",
      "tree": "b3d032c7139feff8919cf505c93e3efca7d55bda",
      "parents": [
        "2ce849b5d2f2e55dbb9dffa1fd8f139bbf88a76b"
      ],
      "author": {
        "name": "Tyler Wilcock",
        "email": "tyler_w@apple.com",
        "time": "Fri Sep 04 14:20:23 2026"
      },
      "committer": {
        "name": "Tyler Wilcock",
        "email": "tyler_w@apple.com",
        "time": "Fri Sep 04 14:20:23 2026"
      },
      "message": "AX: Add layout tests for the text marker index space over emoji and invisible characters\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323360\nrdar://186603195\n\nReviewed by Chris Fleizach.\n\nbounds-for-range-multibyte-glyphs.html already captures the code unit span of a joined\nemoji and a variation-selector emoji, by asserting the rect boundsForRange returns for\neach. It never reads the string and never uses the index APIs, so what is new below is\nthe index round trip and the presence of the invisible characters themselves.\n\ntext-marker-index-regional-indicators.html:\nNo accessibility test contains a regional indicator. A flag is four code units and two\ncode points in one glyph, stressing surrogate pairs and cluster boundaries together.\n\ntext-marker-index-zwj-sequence.html:\nAsserts the zero width joiner survives into the accessibility text at its own index.\nThe bounds test shows an eleven code unit span is treated as one glyph but cannot show\nthe joiner is still in the string. Without it, an assistive technology reconstructing\nthe sequence from character offsets gets two unrelated emoji.\n\ntext-marker-index-variation-selector.html:\nSame for a variation selector, which is invisible and only changes how the preceding\ncharacter is drawn. Asserting its code point is the only way to tell it was preserved\nrather than folded into the character it modifies.\n\n* LayoutTests/accessibility/isolated-tree/mac/text-marker-index-regional-indicators-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/text-marker-index-regional-indicators.html: Added.\n* LayoutTests/accessibility/isolated-tree/mac/text-marker-index-variation-selector-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/text-marker-index-variation-selector.html: Added.\n* LayoutTests/accessibility/isolated-tree/mac/text-marker-index-zwj-sequence-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/text-marker-index-zwj-sequence.html: Added.\n* LayoutTests/accessibility/mac/text-marker-index-regional-indicators-expected.txt: Added.\n* LayoutTests/accessibility/mac/text-marker-index-regional-indicators.html: Added.\n* LayoutTests/accessibility/mac/text-marker-index-variation-selector-expected.txt: Added.\n* LayoutTests/accessibility/mac/text-marker-index-variation-selector.html: Added.\n* LayoutTests/accessibility/mac/text-marker-index-zwj-sequence-expected.txt: Added.\n* LayoutTests/accessibility/mac/text-marker-index-zwj-sequence.html: Added.\n\nCanonical link: https://commits.webkit.org/320506@main\n"
    },
    {
      "commit": "2ce849b5d2f2e55dbb9dffa1fd8f139bbf88a76b",
      "tree": "3ab31fd6b5b26e04120d06a3317e863ffc72bd0f",
      "parents": [
        "87c72505aec52b2072b1ead1caac9aaed6a02a49"
      ],
      "author": {
        "name": "Alejandro G. Castro",
        "email": "alex@igalia.com",
        "time": "Fri Sep 04 12:42:17 2026"
      },
      "committer": {
        "name": "Alejandro G. Castro",
        "email": "alex@igalia.com",
        "time": "Fri Sep 04 12:42:17 2026"
      },
      "message": "[GTK][WPE] REGRESSION(320146@main): build is broken with USE_TEXTURE_MAPPER\u003dOFF and USE_GBM\u003dOFF\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323340\n\nReviewed by Adrian Perez de Castro.\n\n320146@main moved two includes behind USE(TEXTURE_MAPPER), and with them\nthe only declarations that two files were relying on when GBM is also\ndisabled. It broke the Android compilation.\n\n* Source/WebCore/platform/graphics/egl/BitmapTexture.h:\n* Source/WebCore/platform/graphics/texmap/coordinated/CoordinatedPlatformLayerBufferExternalOES.cpp:\n\nCanonical link: https://commits.webkit.org/320505@main\n"
    },
    {
      "commit": "87c72505aec52b2072b1ead1caac9aaed6a02a49",
      "tree": "c25138b7973de7a83c9865679e4a27b12e6625be",
      "parents": [
        "272c82948c1a6819398410db92ea34d7ff6a1d74"
      ],
      "author": {
        "name": "Alan Baradlay",
        "email": "zalan@apple.com",
        "time": "Fri Sep 04 12:26:48 2026"
      },
      "committer": {
        "name": "Alan Baradlay",
        "email": "zalan@apple.com",
        "time": "Fri Sep 04 12:26:48 2026"
      },
      "message": "[list-marker] unicode-bidi and direction on ::marker have no effect on an inside marker\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323223\nrdar://problem/186468752\n\nReviewed by Antti Koivisto.\n\nAn inside marker is inline content of its list item: css-lists-3 says it is \"inline content at the beginning of the\nprincipal box\", so the ::marker\u0027s own text properties are supposed to act on it the way they act on any other inline\ncontent.\nWebKit instead uses a RenderListMarker, an atomic inline level box where unicode-bidi, direction, hyphens, text-emphasis, text-shadow\ndo not apply properly.\n\nLet\u0027s build the inside marker as an anonymous inline box (a RenderInline carrying the ::marker style)\nholding the marker\u0027s own renderers: a RenderText for counter style text, a RenderImage for a list-style-image, or the generated content\nrenderers for \u0027content\u0027 (RenderListMarker is left building only the outside markers it positions itself).\n\n* LayoutTests/TestExpectations:\n* LayoutTests/fast/css/001-expected.txt:\n* LayoutTests/fast/html/details-add-child-1-expected.txt:\n* LayoutTests/fast/html/details-add-child-2-expected.txt:\n* LayoutTests/fast/html/details-add-details-child-1-expected.txt:\n* LayoutTests/fast/html/details-add-details-child-2-expected.txt:\n* LayoutTests/fast/html/details-add-summary-10-expected.txt:\n* LayoutTests/fast/html/details-add-summary-6-expected.txt:\n* LayoutTests/fast/html/details-add-summary-7-expected.txt:\n* LayoutTests/fast/html/details-add-summary-8-expected.txt:\n* LayoutTests/fast/html/details-add-summary-9-expected.txt:\n* LayoutTests/fast/html/details-add-summary-child-1-expected.txt:\n* LayoutTests/fast/html/details-add-summary-child-2-expected.txt:\n* LayoutTests/fast/html/details-nested-1-expected.txt:\n* LayoutTests/fast/html/details-nested-2-expected.txt:\n* LayoutTests/fast/html/details-no-summary2-expected.txt:\n* LayoutTests/fast/html/details-open6-expected.txt:\n* LayoutTests/fast/html/details-remove-child-1-expected.txt:\n* LayoutTests/fast/html/details-remove-child-2-expected.txt:\n* LayoutTests/fast/html/details-remove-summary-4-expected.txt:\n* LayoutTests/fast/html/details-remove-summary-5-expected.txt:\n* LayoutTests/fast/html/details-remove-summary-6-expected.txt:\n* LayoutTests/fast/html/details-remove-summary-child-1-expected.txt:\n* LayoutTests/fast/html/details-remove-summary-child-2-expected.txt:\n* LayoutTests/fast/lists/004-expected.txt:\n* LayoutTests/fast/lists/inline-before-content-after-list-marker-expected.txt:\n* LayoutTests/fast/repaint/list-marker-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-pseudo/text-selection-expected.txt:\n* LayoutTests/platform/mac-wk2/fast/html/details-no-summary4-expected.txt:\n* LayoutTests/platform/mac-wk2/fast/html/details-open-javascript-expected.txt:\n* LayoutTests/platform/mac-wk2/fast/html/details-open2-expected.txt:\n* LayoutTests/platform/mac-wk2/fast/html/details-open4-expected.txt:\n* LayoutTests/platform/mac-wk2/fast/html/details-replace-summary-child-expected.txt:\n* LayoutTests/platform/mac-wk2/fast/html/details-replace-text-expected.txt:\n* LayoutTests/platform/mac/fast/css-generated-content/details-summary-before-after-expected.txt:\n* LayoutTests/platform/mac/fast/html/details-add-summary-1-and-click-expected.txt:\n* LayoutTests/platform/mac/fast/html/details-add-summary-1-expected.txt:\n* LayoutTests/platform/mac/fast/html/details-add-summary-10-and-click-expected.txt:\n* LayoutTests/platform/mac/fast/html/details-add-summary-2-and-click-expected.txt:\n* LayoutTests/platform/mac/fast/html/details-add-summary-2-expected.txt:\n* LayoutTests/platform/mac/fast/html/details-add-summary-3-and-click-expected.txt:\n* LayoutTests/platform/mac/fast/html/details-add-summary-3-expected.txt:\n* LayoutTests/platform/mac/fast/html/details-add-summary-4-and-click-expected.txt:\n* LayoutTests/platform/mac/fast/html/details-add-summary-4-expected.txt:\n* LayoutTests/platform/mac/fast/html/details-add-summary-5-and-click-expected.txt:\n* LayoutTests/platform/mac/fast/html/details-add-summary-5-expected.txt:\n* LayoutTests/platform/mac/fast/html/details-add-summary-6-and-click-expected.txt:\n* LayoutTests/platform/mac/fast/html/details-add-summary-7-and-click-expected.txt:\n* LayoutTests/platform/mac/fast/html/details-add-summary-8-and-click-expected.txt:\n* LayoutTests/platform/mac/fast/html/details-add-summary-9-and-click-expected.txt:\n* LayoutTests/platform/mac/fast/html/details-marker-style-expected.txt:\n* LayoutTests/platform/mac/fast/html/details-marker-style-mixed-expected.txt:\n* LayoutTests/platform/mac/fast/html/details-no-summary1-expected.txt:\n* LayoutTests/platform/mac/fast/html/details-no-summary3-expected.txt:\n* LayoutTests/platform/mac/fast/html/details-open1-expected.txt:\n* LayoutTests/platform/mac/fast/html/details-open3-expected.txt:\n* LayoutTests/platform/mac/fast/html/details-open5-expected.txt:\n* LayoutTests/platform/mac/fast/html/details-position-expected.txt:\n* LayoutTests/platform/mac/fast/html/details-remove-summary-1-and-click-expected.txt:\n* LayoutTests/platform/mac/fast/html/details-remove-summary-1-expected.txt:\n* LayoutTests/platform/mac/fast/html/details-remove-summary-2-and-click-expected.txt:\n* LayoutTests/platform/mac/fast/html/details-remove-summary-2-expected.txt:\n* LayoutTests/platform/mac/fast/html/details-remove-summary-3-and-click-expected.txt:\n* LayoutTests/platform/mac/fast/html/details-remove-summary-3-expected.txt:\n* LayoutTests/platform/mac/fast/html/details-remove-summary-4-and-click-expected.txt:\n* LayoutTests/platform/mac/fast/html/details-remove-summary-5-and-click-expected.txt:\n* LayoutTests/platform/mac/fast/html/details-remove-summary-6-and-click-expected.txt:\n* LayoutTests/platform/mac/fast/html/details-writing-mode-expected.txt:\n* LayoutTests/platform/mac/fast/html/details-writing-mode-mixed-expected.txt:\n* LayoutTests/platform/mac/fast/lists/008-expected.txt:\n* LayoutTests/platform/mac/fast/lists/008-vertical-expected.txt:\n* LayoutTests/platform/mac/fast/lists/009-expected.txt:\n* LayoutTests/platform/mac/fast/lists/009-vertical-expected.txt:\n* LayoutTests/platform/mac/fast/lists/li-br-expected.txt:\n* LayoutTests/platform/mac/fast/lists/markers-in-selection-expected.txt:\n* Source/WebCore/accessibility/AccessibilityNodeObject.cpp:\n(WebCore::AccessibilityNodeObject::stitchGroups const):\n* Source/WebCore/accessibility/AccessibilityRenderObject.cpp:\n(WebCore::AccessibilityRenderObject::textUnderElement const):\n* Source/WebCore/layout/formattingContexts/inline/InlineFormattingUtils.cpp:\n(WebCore::Layout::InlineFormattingUtils::isAtSoftWrapOpportunity const):\n* Source/WebCore/layout/formattingContexts/inline/InlineLine.cpp:\n(WebCore::Layout::Line::appendText):\n(WebCore::Layout::Line::hasContentOrDecoration const):\n(WebCore::Layout::Line::Run::isListMarkerOrItsContent const):\n(WebCore::Layout::Line::appendTextFast):\n(WebCore::Layout::toLineRunType):\n* Source/WebCore/layout/formattingContexts/inline/InlineLine.h:\n(WebCore::Layout::Line::hasContent const):\n(WebCore::Layout::Line::Run::isListMarker const):\n(WebCore::Layout::Line::Run::isListMarkerInside const): Deleted.\n(WebCore::Layout::Line::Run::isListMarkerOutside const): Deleted.\n* Source/WebCore/layout/formattingContexts/inline/InlineLineBoxBuilder.cpp:\n(WebCore::Layout::LineBoxBuilder::constructInlineLevelBoxes):\n(WebCore::Layout::LineBoxBuilder::adjustOutsideListMarkersPosition):\n* Source/WebCore/layout/formattingContexts/inline/InlineLineBuilder.cpp:\n(WebCore::Layout::LineBuilder::handleInlineContent):\n(WebCore::Layout::LineBuilder::processLineBreakingResult):\n(WebCore::Layout::LineBuilder::placeInlineAndFloatContent):\n(WebCore::Layout::LineBuilder::handleBlockContent):\n* Source/WebCore/layout/formattingContexts/inline/InlineQuirks.cpp:\n(WebCore::Layout::InlineQuirks::shouldCollapseLineBoxHeight const):\n* Source/WebCore/layout/formattingContexts/inline/IntrinsicWidthHandler.cpp:\n(WebCore::Layout::IntrinsicWidthHandler::computedIntrinsicWidthForConstraint):\n* Source/WebCore/layout/integration/LayoutIntegrationBoxGeometryUpdater.cpp:\n(WebCore::LayoutIntegration::BoxGeometryUpdater::setListMarkerOffsetForMarkerOutside):\n(WebCore::LayoutIntegration::BoxGeometryUpdater::updateBoxGeometry):\n(WebCore::LayoutIntegration::BoxGeometryUpdater::updateBoxGeometryAfterIntegrationLayout):\n* Source/WebCore/layout/integration/LayoutIntegrationBoxTreeUpdater.cpp:\n(WebCore::LayoutIntegration::calculateListMarkerAttribute):\n(WebCore::LayoutIntegration::markerTextSynthesizesGlyph):\n* Source/WebCore/layout/layouttree/LayoutElementBox.h:\n(WebCore::Layout::ElementBox::isListMarkerImage const):\n(WebCore::Layout::ElementBox::isListMarkerOutside const): Deleted.\n* Source/WebCore/rendering/RenderElement.cpp:\n(WebCore::RenderElement::referenceBoxRect const):\n* Source/WebCore/style/computed/StyleComputedStyleBase+GettersInlines.h:\n(WebCore::Style::ComputedStyleBase::isListMarkerStyle const):\n* Source/WebCore/style/computed/StyleComputedStyleBase.h:\n* Source/WebCore/rendering/RenderBlock.cpp:\n(WebCore::RenderBlock::firstLetterAndContainer):\n* Source/WebCore/rendering/RenderListItem.cpp:\n(WebCore::RenderListItem::computeMarkerStyle const):\n(WebCore::RenderListItem::updateValue):\n(WebCore::RenderListItem::updateMarkerContent):\n(WebCore::RenderListItem::styleDidChange):\n(WebCore::RenderListItem::excludedMarker const):\n(WebCore::RenderListItem::markerBox const):\n(WebCore::RenderListItem::usedCounterDirectivesChanged):\n(WebCore::RenderListItem::firstFormattedLineRootFor):\n* Source/WebCore/rendering/RenderListItem.h:\n* Source/WebCore/rendering/RenderListMarker.cpp:\n(WebCore::RenderListMarker::updateInlineMargins):\n(WebCore::RenderListMarker::isInside const): Deleted.\n(WebCore::listMarkerIsDisclosure):\n* Source/WebCore/rendering/RenderListMarker.h:\n* Source/WebCore/rendering/RenderObject.cpp:\n(WebCore::RenderObject::nodeForHitTest const):\n(WebCore::RenderObject::isExcludedMarker const):\n* Source/WebCore/rendering/line/BreakingContext.h:\n(WebCore::BreakingContext::commitAndUpdateLineBreakIfNeeded):\n* Source/WebCore/rendering/updating/RenderTreeBuilderBlock.cpp:\n(WebCore::isExcludedMarker):\n* Source/WebCore/rendering/updating/RenderTreeBuilderList.cpp:\n(WebCore::adjustStyleForInlineMarker):\n(WebCore::parentCandidateForMarker):\n(WebCore::RenderTreeBuilder::List::updateItemMarker):\n(WebCore::parentForInlineMarker):\n(WebCore::RenderTreeBuilder::List::buildInlineMarker):\n* Source/WebCore/rendering/updating/RenderTreeBuilderList.h:\n* LayoutTests/css1/classification/list_style_position-expected.txt:\n* LayoutTests/css2.1/t1205-c565-list-pos-00-b-expected.txt:\n* LayoutTests/css2.1/t1205-c566-list-stl-00-e-ag-expected.txt:\n* LayoutTests/platform/glib/css1/classification/list_style-expected.txt:\n* LayoutTests/platform/glib/css1/classification/list_style_position-expected.txt:\n* LayoutTests/platform/glib/css2.1/t1205-c561-list-displ-00-b-expected.txt:\n* LayoutTests/platform/glib/css2.1/t1205-c565-list-pos-00-b-expected.txt:\n* LayoutTests/platform/glib/css2.1/t1205-c566-list-stl-00-e-ag-expected.txt:\n* LayoutTests/platform/glib/fast/css-generated-content/details-summary-before-after-expected.txt:\n* LayoutTests/platform/glib/fast/css/001-expected.txt:\n* LayoutTests/platform/glib/fast/html/details-add-child-1-expected.txt:\n* LayoutTests/platform/glib/fast/html/details-add-child-2-expected.txt:\n* LayoutTests/platform/glib/fast/html/details-add-details-child-1-expected.txt:\n* LayoutTests/platform/glib/fast/html/details-add-details-child-2-expected.txt:\n* LayoutTests/platform/glib/fast/html/details-add-summary-1-and-click-expected.txt:\n* LayoutTests/platform/glib/fast/html/details-add-summary-10-expected.txt:\n* LayoutTests/platform/glib/fast/html/details-add-summary-2-and-click-expected.txt:\n* LayoutTests/platform/glib/fast/html/details-add-summary-3-and-click-expected.txt:\n* LayoutTests/platform/glib/fast/html/details-add-summary-4-and-click-expected.txt:\n* LayoutTests/platform/glib/fast/html/details-add-summary-5-and-click-expected.txt:\n* LayoutTests/platform/glib/fast/html/details-add-summary-6-expected.txt:\n* LayoutTests/platform/glib/fast/html/details-add-summary-7-expected.txt:\n* LayoutTests/platform/glib/fast/html/details-add-summary-8-expected.txt:\n* LayoutTests/platform/glib/fast/html/details-add-summary-9-expected.txt:\n* LayoutTests/platform/glib/fast/html/details-add-summary-child-1-expected.txt:\n* LayoutTests/platform/glib/fast/html/details-add-summary-child-2-expected.txt:\n* LayoutTests/platform/glib/fast/html/details-marker-style-expected.txt:\n* LayoutTests/platform/glib/fast/html/details-marker-style-mixed-expected.txt:\n* LayoutTests/platform/glib/fast/html/details-nested-1-expected.txt:\n* LayoutTests/platform/glib/fast/html/details-nested-2-expected.txt:\n* LayoutTests/platform/glib/fast/html/details-no-summary2-expected.txt:\n* LayoutTests/platform/glib/fast/html/details-open6-expected.txt:\n* LayoutTests/platform/glib/fast/html/details-remove-child-1-expected.txt:\n* LayoutTests/platform/glib/fast/html/details-remove-child-2-expected.txt:\n* LayoutTests/platform/glib/fast/html/details-remove-summary-1-and-click-expected.txt:\n* LayoutTests/platform/glib/fast/html/details-remove-summary-2-and-click-expected.txt:\n* LayoutTests/platform/glib/fast/html/details-remove-summary-3-and-click-expected.txt:\n* LayoutTests/platform/glib/fast/html/details-remove-summary-4-expected.txt:\n* LayoutTests/platform/glib/fast/html/details-remove-summary-5-expected.txt:\n* LayoutTests/platform/glib/fast/html/details-remove-summary-6-expected.txt:\n* LayoutTests/platform/glib/fast/html/details-remove-summary-child-1-expected.txt:\n* LayoutTests/platform/glib/fast/html/details-remove-summary-child-2-expected.txt:\n* LayoutTests/platform/glib/fast/html/details-writing-mode-expected.txt:\n* LayoutTests/platform/glib/fast/html/details-writing-mode-mixed-expected.txt:\n* LayoutTests/platform/glib/fast/lists/004-expected.txt:\n* LayoutTests/platform/glib/fast/lists/008-expected.txt:\n* LayoutTests/platform/glib/fast/lists/008-vertical-expected.txt:\n* LayoutTests/platform/glib/fast/lists/009-expected.txt:\n* LayoutTests/platform/glib/fast/lists/009-vertical-expected.txt:\n* LayoutTests/platform/glib/fast/lists/li-br-expected.txt:\n* LayoutTests/platform/glib/fast/lists/markers-in-selection-expected.txt:\n* LayoutTests/platform/glib/fast/repaint/list-marker-expected.txt:\n* LayoutTests/platform/gtk/fast/html/details-add-summary-1-expected.txt:\n* LayoutTests/platform/gtk/fast/html/details-add-summary-10-and-click-expected.txt:\n* LayoutTests/platform/gtk/fast/html/details-add-summary-2-expected.txt:\n* LayoutTests/platform/gtk/fast/html/details-add-summary-3-expected.txt:\n* LayoutTests/platform/gtk/fast/html/details-add-summary-4-expected.txt:\n* LayoutTests/platform/gtk/fast/html/details-add-summary-5-expected.txt:\n* LayoutTests/platform/gtk/fast/html/details-add-summary-6-and-click-expected.txt:\n* LayoutTests/platform/gtk/fast/html/details-add-summary-7-and-click-expected.txt:\n* LayoutTests/platform/gtk/fast/html/details-add-summary-8-and-click-expected.txt:\n* LayoutTests/platform/gtk/fast/html/details-add-summary-9-and-click-expected.txt:\n* LayoutTests/platform/gtk/fast/html/details-no-summary1-expected.txt:\n* LayoutTests/platform/gtk/fast/html/details-no-summary3-expected.txt:\n* LayoutTests/platform/gtk/fast/html/details-no-summary4-expected.txt:\n* LayoutTests/platform/gtk/fast/html/details-open-javascript-expected.txt:\n* LayoutTests/platform/gtk/fast/html/details-open1-expected.txt:\n* LayoutTests/platform/gtk/fast/html/details-open2-expected.txt:\n* LayoutTests/platform/gtk/fast/html/details-open3-expected.txt:\n* LayoutTests/platform/gtk/fast/html/details-open4-expected.txt:\n* LayoutTests/platform/gtk/fast/html/details-open5-expected.txt:\n* LayoutTests/platform/gtk/fast/html/details-position-expected.txt:\n* LayoutTests/platform/gtk/fast/html/details-remove-summary-1-expected.txt:\n* LayoutTests/platform/gtk/fast/html/details-remove-summary-2-expected.txt:\n* LayoutTests/platform/gtk/fast/html/details-remove-summary-3-expected.txt:\n* LayoutTests/platform/gtk/fast/html/details-remove-summary-4-and-click-expected.txt:\n* LayoutTests/platform/gtk/fast/html/details-remove-summary-5-and-click-expected.txt:\n* LayoutTests/platform/gtk/fast/html/details-remove-summary-6-and-click-expected.txt:\n* LayoutTests/platform/gtk/fast/html/details-replace-summary-child-expected.txt:\n* LayoutTests/platform/gtk/fast/html/details-replace-text-expected.txt:\n* LayoutTests/platform/gtk/tables/mozilla/bugs/bug30692-expected.txt:\n* LayoutTests/platform/ios/css1/classification/list_style-expected.txt:\n* LayoutTests/platform/ios/css2.1/t1205-c561-list-displ-00-b-expected.txt:\n* LayoutTests/platform/ios/fast/html/details-add-child-1-expected.txt:\n* LayoutTests/platform/ios/fast/html/details-add-child-2-expected.txt:\n* LayoutTests/platform/ios/fast/html/details-add-details-child-1-expected.txt:\n* LayoutTests/platform/ios/fast/html/details-add-details-child-2-expected.txt:\n* LayoutTests/platform/ios/fast/html/details-add-summary-1-and-click-expected.txt:\n* LayoutTests/platform/ios/fast/html/details-add-summary-1-expected.txt:\n* LayoutTests/platform/ios/fast/html/details-add-summary-10-and-click-expected.txt:\n* LayoutTests/platform/ios/fast/html/details-add-summary-10-expected.txt:\n* LayoutTests/platform/ios/fast/html/details-add-summary-2-and-click-expected.txt:\n* LayoutTests/platform/ios/fast/html/details-add-summary-2-expected.txt:\n* LayoutTests/platform/ios/fast/html/details-add-summary-3-and-click-expected.txt:\n* LayoutTests/platform/ios/fast/html/details-add-summary-3-expected.txt:\n* LayoutTests/platform/ios/fast/html/details-add-summary-4-and-click-expected.txt:\n* LayoutTests/platform/ios/fast/html/details-add-summary-4-expected.txt:\n* LayoutTests/platform/ios/fast/html/details-add-summary-5-and-click-expected.txt:\n* LayoutTests/platform/ios/fast/html/details-add-summary-5-expected.txt:\n* LayoutTests/platform/ios/fast/html/details-add-summary-6-and-click-expected.txt:\n* LayoutTests/platform/ios/fast/html/details-add-summary-6-expected.txt:\n* LayoutTests/platform/ios/fast/html/details-add-summary-7-and-click-expected.txt:\n* LayoutTests/platform/ios/fast/html/details-add-summary-7-expected.txt:\n* LayoutTests/platform/ios/fast/html/details-add-summary-8-and-click-expected.txt:\n* LayoutTests/platform/ios/fast/html/details-add-summary-8-expected.txt:\n* LayoutTests/platform/ios/fast/html/details-add-summary-9-and-click-expected.txt:\n* LayoutTests/platform/ios/fast/html/details-add-summary-9-expected.txt:\n* LayoutTests/platform/ios/fast/html/details-add-summary-child-1-expected.txt:\n* LayoutTests/platform/ios/fast/html/details-add-summary-child-2-expected.txt:\n* LayoutTests/platform/ios/fast/html/details-marker-style-expected.txt:\n* LayoutTests/platform/ios/fast/html/details-marker-style-mixed-expected.txt:\n* LayoutTests/platform/ios/fast/html/details-nested-1-expected.txt:\n* LayoutTests/platform/ios/fast/html/details-nested-2-expected.txt:\n* LayoutTests/platform/ios/fast/html/details-no-summary1-expected.txt:\n* LayoutTests/platform/ios/fast/html/details-no-summary2-expected.txt:\n* LayoutTests/platform/ios/fast/html/details-no-summary3-expected.txt:\n* LayoutTests/platform/ios/fast/html/details-open1-expected.txt:\n* LayoutTests/platform/ios/fast/html/details-open3-expected.txt:\n* LayoutTests/platform/ios/fast/html/details-open5-expected.txt:\n* LayoutTests/platform/ios/fast/html/details-open6-expected.txt:\n* LayoutTests/platform/ios/fast/html/details-position-expected.txt:\n* LayoutTests/platform/ios/fast/html/details-remove-child-1-expected.txt:\n* LayoutTests/platform/ios/fast/html/details-remove-child-2-expected.txt:\n* LayoutTests/platform/ios/fast/html/details-remove-summary-1-and-click-expected.txt:\n* LayoutTests/platform/ios/fast/html/details-remove-summary-1-expected.txt:\n* LayoutTests/platform/ios/fast/html/details-remove-summary-2-and-click-expected.txt:\n* LayoutTests/platform/ios/fast/html/details-remove-summary-2-expected.txt:\n* LayoutTests/platform/ios/fast/html/details-remove-summary-3-and-click-expected.txt:\n* LayoutTests/platform/ios/fast/html/details-remove-summary-3-expected.txt:\n* LayoutTests/platform/ios/fast/html/details-remove-summary-4-and-click-expected.txt:\n* LayoutTests/platform/ios/fast/html/details-remove-summary-4-expected.txt:\n* LayoutTests/platform/ios/fast/html/details-remove-summary-5-and-click-expected.txt:\n* LayoutTests/platform/ios/fast/html/details-remove-summary-5-expected.txt:\n* LayoutTests/platform/ios/fast/html/details-remove-summary-6-and-click-expected.txt:\n* LayoutTests/platform/ios/fast/html/details-remove-summary-6-expected.txt:\n* LayoutTests/platform/ios/fast/html/details-remove-summary-child-1-expected.txt:\n* LayoutTests/platform/ios/fast/html/details-remove-summary-child-2-expected.txt:\n* LayoutTests/platform/ios/fast/html/details-writing-mode-expected.txt:\n* LayoutTests/platform/ios/fast/html/details-writing-mode-mixed-expected.txt:\n* LayoutTests/platform/ios/fast/lists/008-expected.txt:\n* LayoutTests/platform/ios/fast/lists/008-vertical-expected.txt:\n* LayoutTests/platform/ios/fast/lists/009-expected.txt:\n* LayoutTests/platform/ios/fast/lists/009-vertical-expected.txt:\n* LayoutTests/platform/ios/fast/lists/li-br-expected.txt:\n* LayoutTests/platform/ios/fast/lists/markers-in-selection-expected.txt:\n* LayoutTests/platform/ios/tables/mozilla/bugs/bug30692-expected.txt:\n* LayoutTests/platform/mac-sequoia-wk2/fast/html/details-no-summary4-expected.txt:\n* LayoutTests/platform/mac-sequoia-wk2/fast/html/details-open-javascript-expected.txt:\n* LayoutTests/platform/mac-sequoia-wk2/fast/html/details-open2-expected.txt:\n* LayoutTests/platform/mac-sequoia-wk2/fast/html/details-open4-expected.txt:\n* LayoutTests/platform/mac-sequoia-wk2/fast/html/details-replace-summary-child-expected.txt:\n* LayoutTests/platform/mac-sequoia-wk2/fast/html/details-replace-text-expected.txt:\n* LayoutTests/platform/mac-sequoia-wk2/tables/mozilla/bugs/bug30692-expected.txt:\n* LayoutTests/platform/mac-wk2/tables/mozilla/bugs/bug30692-expected.txt:\n* LayoutTests/platform/mac/css1/classification/list_style-expected.txt:\n* LayoutTests/platform/mac/css2.1/t1205-c561-list-displ-00-b-expected.txt:\n\nCanonical link: https://commits.webkit.org/320504@main\n"
    },
    {
      "commit": "272c82948c1a6819398410db92ea34d7ff6a1d74",
      "tree": "a0a8c6236c88838eafa6b3a4ae583077f52b7d82",
      "parents": [
        "bd286f7751a8ad8c5ba5aac4528782c571f8b10c"
      ],
      "author": {
        "name": "Sergey Rubanov",
        "email": "chi187@gmail.com",
        "time": "Fri Sep 04 12:19:29 2026"
      },
      "committer": {
        "name": "Sergey Rubanov",
        "email": "chi187@gmail.com",
        "time": "Fri Sep 04 12:19:29 2026"
      },
      "message": "[JSC][Wasm] Add memory.fill and memory.copy stress tests\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d322778\n\nReviewed by Yusuke Suzuki.\n\nCover memory 0 fill/copy bounds, overlapping copies, grow, and\nMemory64.\n\n* JSTests/wasm/stress/memory-fill-copy.js: Added.\n\nCanonical link: https://commits.webkit.org/320503@main\n"
    },
    {
      "commit": "bd286f7751a8ad8c5ba5aac4528782c571f8b10c",
      "tree": "4f8549d0a9420b7560d1106be43632fe2c18ff35",
      "parents": [
        "ab9b56ad6cc1a19caccdfb252dc3408030f237c6"
      ],
      "author": {
        "name": "Claudio Saavedra",
        "email": "csaavedra@igalia.com",
        "time": "Fri Sep 04 11:28:30 2026"
      },
      "committer": {
        "name": "Claudio Saavedra",
        "email": "csaavedra@igalia.com",
        "time": "Fri Sep 04 11:28:30 2026"
      },
      "message": "[WPE] Add a tutorial about writing a WPE platform implementation\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d322277\n\nReviewed by Carlos Garcia Campos.\n\nThis walks through writing a WPE platform implementation concept by\nconcept — the WPEDisplay/WPEView/WPEToplevel subclasses, rendering,\ninput, and module registration — using the public API and the built-in\nimplementations as examples.\n\n* Source/WebKit/WPEPlatform/docs/tutorial-platform.md:\n\nCanonical link: https://commits.webkit.org/320502@main\n"
    },
    {
      "commit": "ab9b56ad6cc1a19caccdfb252dc3408030f237c6",
      "tree": "9d04be62e8b324624967641e8c72524d3d78f459",
      "parents": [
        "772a91ace41a493b5eaa051c702a4ddfcee122c0"
      ],
      "author": {
        "name": "Issac Roy",
        "email": "issacroy05@gmail.com",
        "time": "Fri Sep 04 11:16:28 2026"
      },
      "committer": {
        "name": "Aakash Jain",
        "email": "aakash_jain@apple.com",
        "time": "Fri Sep 04 11:16:28 2026"
      },
      "message": "[EWS] Each results-database test step carries its own copy of the shared reporting behaviour\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323387\nrdar://186616569\n\nReviewed by Aakash Jain.\n\nThe layout, API and JSC test steps all report to the results database\nthrough `ResultsDBReportMixin`, but each carried its own log name, its\nown copy of the query constants, its own copy of the configuration a\nquery is built from, its own copy of the lookup deciding which commit to\nask about, and its own copy of the classifier deciding which new\nfailures the database already knew were flaky. A change to any of it had\nto be made three times, and a step that drifted from the others drew no\ncomplaint. Hoist the lookup as `resolve_identifier_for_results_db`, the\nclassifier as `pre_existing_flakes_using_results_db`, the two sentences\nnaming ignored evidence as `results_db_ignore_message` and\n`results_db_ignore_counts_message`, and `NUM_FAILURES_TO_DISPLAY`, and\ndrop the duplicate constants. `RunWebKitTests` keeps its own\n`MAX_FAILURES_TO_CHECK_RESULTS_DB`, since it asks about 60 failures\nrather than the shared 50.\n\nThe classifier names the properties it writes from `prefix`, so layout\ngains `prefix \u003d \u0027first_run_\u0027` on `RunWebKitTests` and `\u0027second_run_\u0027` on\n`ReRunWebKitTests` in place of the names it spelled out. Every\n`results-db_` property keeps the name it had, which matters because\nbuilds are ingested by keying on those strings, so a rename loses data\nrather than failing. The `pre_existing` property stays written at each\ncall site, since the API steps build that one name from `suffix` and\nfolding it in would rename four of them.\n\nLayout excused a `BetweenBuilds` verdict that carried no\n`intra_build_evidence`, and the shared classifier does not, so layout is\ntightened to agree with API and JSC. A test failing only in that shape\nis now blamed on the change rather than ignored.\n\nSome text a reader sees changes with the sharing. The JSC log line gains\nthe trailing newline it was missing and reads \"failing tests\" like the\nothers rather than \"failing JSC tests\". The API step\u0027s ignored-evidence\nline reads \"Ignored pre-existing failures\" rather than \"Ignored\npre-existing failure\", and can now name ignored flakes as well.\n\nThe two ignored-evidence sentences change shape as well. A `; ` joined the\ntwo halves under one leading \"Ignored\", so the flaky half read as a\ncontinuation of the failure half; each half now carries its own \"Ignored\"\nand they are joined by a newline, which means `build_summary` and\n`descriptionDone` can hold two lines where they held one. \"flaky tests\"\nbecomes \"pre-existing flakes\", the name the attribute and the property\nalready use, and the trailing \"based on results-db\" goes from all three\nsentences — a reader who cares which database answered is already reading\nthe results-db log.\n\n`preexisting_failures_in_results_db` and `flaky_failures_in_results_db`\nbecome `pre_existing_failures_in_results_db` and\n`pre_existing_flakes_in_results_db`. A flake found this way is\npre-existing in the sense the failures are, and `pre_existing` with the\nunderscore is the spelling `is_test_pre_existing_failure` and the\nproperty names already use.\n\n`FindUnexpectedStaticAnalyzerResults` already declared\n`results_db_log_name` and `suite` but not the mixin that defines them,\nwhich is why it could not reach the shared query configuration until it\nlisted the mixin among its bases.\n\nA row the results database returns did not know which test it described,\nso the lines saying which evidence was ignored — whether a row was\nrecorded by the change\u0027s own pull request, carried no `flaky_type`, or\nfell below the clean-tree bar — named no test at all. A build with\nseveral failing tests therefore produced a log whose lines could not be\nattributed to any of them. Carry the test name on `EWSRow` and print it\non each of those lines.\n\n* Tools/CISupport/ews-build/results_db.py:\n(EWSRow):\n(EWSRow.from_json):\n(ResultsDatabase):\n(ResultsDatabase._is_intra_build_flake):\n(ResultsDatabase._is_inter_build_flake):\n* Tools/CISupport/ews-build/steps.py:\n(ResultsDBReportMixin):\n(ResultsDBReportMixin.resolve_identifier_for_results_db):\n(RunJavaScriptCoreTests):\n(RunJavaScriptCoreTests.filter_failures_using_results_db):\n(RunWebKitTests):\n(RunWebKitTests.filter_failures_using_results_db):\n(RunAPITests):\n(RunAPITests.filter_api_test_failures_using_results_db):\n(AnalyzeAPITestsResults):\n(ResultsDBReportMixin.results_db_ignore_message):\n(ResultsDBReportMixin.results_db_ignore_counts_message):\n(ResultsDBReportMixin.pre_existing_flakes_using_results_db):\n(RunJavaScriptCoreTests.__init__):\n(RunJavaScriptCoreTests.runCommand):\n(RunJavaScriptCoreTests.evaluateCommand):\n(RunJavaScriptCoreTests._check_for_pre_existing_failures):\n(RunJavaScriptCoreTests.getResultSummary):\n(AnalyzeJSCTestsResults):\n(RunWebKitTests.__init__):\n(RunWebKitTests.runCommand):\n(RunWebKitTests.evaluateCommand):\n(RunWebKitTests.getResultSummary):\n(ReRunWebKitTests):\n(ReRunWebKitTests.evaluateCommand):\n(ReRunWebKitTests.runCommand):\n(AnalyzeLayoutTestsResults):\n(RunAPITests.__init__):\n(RunAPITests.run):\n(RunAPITests.analyze_failures_using_results_db):\n(ReRunAPITests.doOnFailure):\n(AnalyzeAPITestsResults.run):\n(FindUnexpectedStaticAnalyzerResults):\n(FindUnexpectedStaticAnalyzerResults.filter_results_using_results_db):\n(ResultsDBReportMixin.flaky_new_failures_using_results_db): Deleted.\n(RunJavaScriptCoreTests._check_for_preexisting_failures): Deleted.\n* Tools/CISupport/ews-build/steps_unittest.py:\n(TestFilterLayoutTestFailuresUsingResultsDB._check_order):\n(TestFilterLayoutTestFailuresUsingResultsDB.test_a_verdict_in_the_included_set_removes_the_failure):\n(TestFilterLayoutTestFailuresUsingResultsDB.test_a_verdict_outside_the_included_set_is_recorded_without_ignoring_the_failure):\n(TestFilterLayoutTestFailuresUsingResultsDB):\n(TestFilterLayoutTestFailuresUsingResultsDB.test_a_between_builds_verdict_with_no_intra_build_evidence_is_not_excused):\n(TestFilterLayoutTestFailuresUsingResultsDB.test_a_test_with_no_verdict_is_not_treated_as_sound):\n(TestFilterLayoutTestFailuresUsingResultsDB.test_ignoring_every_failure_sets_the_property_set_build_summary_reads):\n(TestJSCTestStepsReportAsTheyRun.configureRunStep.fake_filter):\n(TestLayoutTestStepsReportAsTheyRun):\n(TestLayoutTestStepsReportAsTheyRun.configureStep.fake_filter):\n(TestLayoutTestStepsReportAsTheyRun.test_the_first_run_exports_the_verdicts_it_relied_on):\n(TestLayoutTestStepsReportAsTheyRun.test_the_rerun_exports_the_verdicts_it_relied_on_under_its_own_prefix):\n(TestLayoutTestStepsReportAsTheyRun.test_the_first_run_exports_the_verdicts_it_relied_on.fake_filter): Deleted.\n\nCanonical link: https://commits.webkit.org/320501@main\n"
    },
    {
      "commit": "772a91ace41a493b5eaa051c702a4ddfcee122c0",
      "tree": "db55df23c26469040b00918697046ec1e7dde8f7",
      "parents": [
        "c9d3d549bac56327218522180949faaeb1966ef1"
      ],
      "author": {
        "name": "Issac Roy",
        "email": "issacroy05@gmail.com",
        "time": "Fri Sep 04 10:54:41 2026"
      },
      "committer": {
        "name": "Aakash Jain",
        "email": "aakash_jain@apple.com",
        "time": "Fri Sep 04 10:54:41 2026"
      },
      "message": "[EWS] results-db log contains a JSON dump of everything reported to results.webkit.org\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323304\nrdar://186553847\n\nReviewed by Aakash Jain.\n\nEvery successful report dumps the whole upload payload into the\nresults-db log as pretty-printed JSON, then the whole response body\nafter it, burying the one line saying which tests were reported under\nhundreds. Remove both, as the FIXME above them asked once reporting had\nbeen validated against the deployed database. A failed report still logs\nthe response body.\n\n* Tools/CISupport/ews-build/results_db.py:\n(ResultsDatabase.report_ews):\n* Tools/CISupport/ews-build/steps_unittest.py:\n(TestResultsDatabaseFailureHandling.test_report_ews_logs_the_request_without_the_api_key):\n\nCanonical link: https://commits.webkit.org/320500@main\n"
    },
    {
      "commit": "c9d3d549bac56327218522180949faaeb1966ef1",
      "tree": "5a9609a62e28e8c0bc9be35d2bc81f226427923e",
      "parents": [
        "1bcccddc7c00bb163950a5707e9b18c4a2861609"
      ],
      "author": {
        "name": "Fady Farag",
        "email": "com.webkit.iidmsa@gmail.com",
        "time": "Fri Sep 04 10:52:18 2026"
      },
      "committer": {
        "name": "Fady Farag",
        "email": "com.webkit.iidmsa@gmail.com",
        "time": "Fri Sep 04 10:52:18 2026"
      },
      "message": "Remove incorrect `NODELETE` annotation from `Document::invalidateAccessKeyCacheSlowCase()`\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323388\nrdar://186618132\n\nReviewed by Chris Dumez.\n\nDrop `NODELETE` from function that destroys objects since it is a lie.\n\n* Source/WebCore/dom/Document.h:\n* Source/WebCore/dom/Element.cpp:\n(WebCore::Element::attributeChanged):\n\nCanonical link: https://commits.webkit.org/320499@main\n"
    },
    {
      "commit": "1bcccddc7c00bb163950a5707e9b18c4a2861609",
      "tree": "cd4aa564568abbbf52052567705a47a7f5b65b9c",
      "parents": [
        "bce916c0709c34e188946fa60d1f210cbb132b1f"
      ],
      "author": {
        "name": "Adrian Taylor",
        "email": "adrian_taylor@apple.com",
        "time": "Fri Sep 04 09:14:31 2026"
      },
      "committer": {
        "name": "Adrian Taylor",
        "email": "adrian_taylor@apple.com",
        "time": "Fri Sep 04 09:14:31 2026"
      },
      "message": "Fix test failures using cmake and most recent MacOS SDK\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323370\nrdar://186605623\n\nReviewed by Elliott Williams.\n\nThis section in PlatformEnable.h depends on a valid -target\nargument, which was supplied to clang but not to swiftc\u0027s built-in clang importer.\n\n  #if PLATFORM(MAC) \u0026\u0026 __MAC_OS_X_VERSION_MIN_REQUIRED \u003e\u003d 270000\n  #define ENABLE_SCROLL_POCKET_IN_FULLSCREEN 1\n  #endif\n\nThis resulted in a differing layout of WebPageProxy based on fields such\nas m_windowIsInNativeFullScreen which were predicated on this condition.\nThis resulted in a runtime crash related to BrowsingContextGroup which was\na result of the different object layout interpretations.\n\nThis happens only when the deployment target is less than the SDK version.\n\nSolve by informing Swift of th correct clang target to use.\n\n* Source/cmake/WebKitMacros.cmake:\n\nCanonical link: https://commits.webkit.org/320498@main\n"
    },
    {
      "commit": "bce916c0709c34e188946fa60d1f210cbb132b1f",
      "tree": "f40835c455c2c1bcc5b739c8d597b5b17ff0cb96",
      "parents": [
        "57303f8073605d181ef2070be13c8e359a0bdd51"
      ],
      "author": {
        "name": "Richard Robinson",
        "email": "richard_robinson2@apple.com",
        "time": "Fri Sep 04 08:47:18 2026"
      },
      "committer": {
        "name": "Richard Robinson",
        "email": "richard_robinson2@apple.com",
        "time": "Fri Sep 04 08:47:18 2026"
      },
      "message": "[NewCodable] Add an initial implementation of a Swift decoder for JS evaluation\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d322884\nrdar://186132455\n\nReviewed by Abrar Rahman Protyasha.\n\nAdd a JavaScriptEvaluationGraphDecoder to decode JavaScript evaluation results into Swift.\nCurrently, this only supports decoding `Bool`.\n\nTest: Tools/TestWebKitAPI/Tests/WebKit/WebPage/JavaScriptEvaluationTests.swift\n\n* Source/WebKit/Shared/JavaScriptEvaluationArrayDecoder.swift: Added.\n(JavaScriptEvaluationArrayDecoder.createDecoder(_:)):\n* Source/WebKit/Shared/JavaScriptEvaluationCodableValue.swift: Added.\n* Source/WebKit/Shared/JavaScriptEvaluationDecodingGraph.swift: Added.\n(JavaScriptEvaluationDecodingGraph.map):\n* Source/WebKit/Shared/JavaScriptEvaluationFieldDecoder.swift: Added.\n(JavaScriptEvaluationFieldDecoder.string):\n(JavaScriptEvaluationFieldDecoder.matches(_:)):\n* Source/WebKit/Shared/JavaScriptEvaluationGraphDecoder.swift: Added.\n(JavaScriptEvaluationGraphDecoder.decode(_:)):\n(JavaScriptEvaluationGraphDecoder.decodeNil() throws(CodingError.Decoding:)):\n(JavaScriptEvaluationGraphDecoder.decodeOptional(_:)):\n* Source/WebKit/Shared/JavaScriptEvaluationObjectDecoder.swift: Added.\n(JavaScriptEvaluationObjectDecoder.keyName(_:)):\n(JavaScriptEvaluationObjectDecoder.valueDecoder(_:name:)):\n(JavaScriptEvaluationObjectDecoder.keyDecoder(_:name:)):\n* Source/WebKit/Shared/JavaScriptEvaluationResultCxxInteropSupport.h: Added.\n(WebKit::JavaScriptEvaluationOwnedResult::JavaScriptEvaluationOwnedResult):\n(WebKit::JavaScriptEvaluationOwnedResult::begin const):\n(WebKit::JavaScriptEvaluationOwnedResult::end const):\n(WebKit::JavaScriptEvaluationResultCxxInteropSupport::takeValue):\n(WebKit::CxxInteropSupport::alternativeForVariant):\n(WebKit::CxxInteropSupport::alternativeIndexForJavaScriptEvaluationResultValue):\n(WebKit::CxxInteropSupport::jsObjectIDRawValue):\n* Source/WebKit/Shared/JavaScriptEvaluationResultDecoder.swift: Added.\n* Source/WebKit/UIProcess/API/Swift/WebPage+NewCodable.swift: Copied from Source/WebKit/UIProcess/WebPageProxy.swift.\n* Source/WebKit/WebKit.xcodeproj/project.pbxproj:\n* Tools/TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:\n* Tools/TestWebKitAPI/Tests/WebKit/WebPage/JavaScriptEvaluationTests.swift: Copied from Source/WebKit/UIProcess/WebPageProxy.swift.\n(JavaScriptEvaluationTests.evaluateBool):\n\nCanonical link: https://commits.webkit.org/320497@main\n"
    },
    {
      "commit": "57303f8073605d181ef2070be13c8e359a0bdd51",
      "tree": "298faeeea6c2ee9b67c42baf305d7e13805c632d",
      "parents": [
        "cbd15fc88bdeffb4618a464681e03ef1f25bc5b6"
      ],
      "author": {
        "name": "Ahmad Saleem",
        "email": "ahmad.saleem792+github@gmail.com",
        "time": "Fri Sep 04 08:42:31 2026"
      },
      "committer": {
        "name": "Ahmad Saleem",
        "email": "ahmad.saleem792@gmail.com",
        "time": "Fri Sep 04 08:42:31 2026"
      },
      "message": "Avoid redundant PasteboardCustomData copies when writing clipboard items\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323305\nrdar://186553823\n\nReviewed by Wenson Hsieh and Chris Dumez.\n\nClipboard::ItemWriter::write() copied every clipboard payload twice while\nbuilding the Vector\u003cPasteboardCustomData\u003e handed to the pasteboard: once by\niterating dataToWrite by value, and once more via customData.append(*data).\nPasteboardCustomData owns the actual clipboard buffers, so each copy is a\nfull deep copy of the payload.\n\ndataToWrite is already a std::exchange\u0027d local that is discarded when the\nloop ends, so nothing needs the originals afterward. Iterate over it as an\nrvalue (WTF::move) to make the destructive intent explicit and move each\nitem into customData instead, taking the per-item cost from two full copies\ndown to a single move.\n\n* Source/WebCore/Modules/async-clipboard/Clipboard.cpp:\n(WebCore::Clipboard::ItemWriter::didSetAllData):\n\nCanonical link: https://commits.webkit.org/320496@main\n"
    },
    {
      "commit": "cbd15fc88bdeffb4618a464681e03ef1f25bc5b6",
      "tree": "e9956c4df8907f2f597d7b43b4374784c44be3d2",
      "parents": [
        "4af7b773e279f8908b804e342c74ffe11139c1f1"
      ],
      "author": {
        "name": "Sosuke Suzuki",
        "email": "sosuke@bun.sh",
        "time": "Fri Sep 04 08:20:00 2026"
      },
      "committer": {
        "name": "Sosuke Suzuki",
        "email": "sosuke@bun.com",
        "time": "Fri Sep 04 08:20:00 2026"
      },
      "message": "[JSC] Add Karatsuba multiplication to `JSBigInt`\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323244\n\nReviewed by Yusuke Suzuki.\n\nJSBigInt multiplies with O(n^2) schoolbook / Comba loops only, so the time per\nproduct grows quadratically with the operand size: 1000 x 1000 digits takes\n336 us and 4000 x 4000 takes 5.3 ms. Add Karatsuba multiplication for products\nwhose smaller operand has at least 44 digits, which brings the growth to\nO(n^1.58). This is a port of V8\u0027s implementation [1], itself based on Go\u0027s\nmath/big [2].\n\nThe threshold is 44 rather than V8\u0027s 34 because JSC\u0027s Comba base case is faster\nthan V8\u0027s schoolbook: balanced shapes win from 40 digits, but for a long x the\nlength rounding pads an odd smaller operand by a digit, and at 41 or 43 digits\nthat padding costs the 2-3% Karatsuba would gain. At 44 no measured shape\nregresses. Sizes below the threshold keep the existing paths, and allocation,\nsign and normalization in multiplyImpl are unchanged.\n\nTime per product (us, 64-bit digits, Apple M4, best of 3 x 7 rounds):\n\ndigits          Before      After\n\n40 x 40          0.647      0.652\n43 x 43          0.738      0.738\n44 x 44          0.762      0.714\n64 x 64          1.658      1.406\n100 x 100        3.987      2.872\n256 x 256       23.901     13.113\n1000 x 1000    335.548    122.562\n4000 x 4000   5337.000   1110.688\n1000 x 43       16.089     16.447\n1000 x 45       16.870     16.677\n10000 x 45     163.054    164.321\n10000 x 100    352.316    276.342\n\n                                   Baseline                  Patched\n\nbigint-mul-large              249.7296+-0.6119     ^    140.1950+-0.4092        ^ definitely 1.7813x faster\nbigint-mul-large-unequal      371.3519+-0.7129     ^    299.9962+-0.7217        ^ definitely 1.2379x faster\n\n[1]: https://source.chromium.org/chromium/chromium/src/+/main:v8/src/bigint/mul-karatsuba.cc\n[2]: https://go.dev/src/math/big/nat.go\n\nTests: JSTests/microbenchmarks/bigint-mul-large-unequal.js\n       JSTests/microbenchmarks/bigint-mul-large.js\n       JSTests/stress/bigint-multiply-karatsuba.js\n\n* JSTests/microbenchmarks/bigint-mul-large-unequal.js: Added.\n(test):\n(next):\n* JSTests/microbenchmarks/bigint-mul-large.js: Added.\n(test):\n(next):\n* JSTests/stress/bigint-multiply-karatsuba.js: Added.\n(shouldBe):\n(refMul):\n(makeOperand):\n(makeSparseOperand):\n(check):\n* Source/JavaScriptCore/runtime/JSBigInt.cpp:\n(JSC::karatsubaRoundUpLength):\n(JSC::karatsubaLength):\n(JSC::clampedSubspan):\n(JSC::JSBigInt::inplaceAddAndPropagate):\n(JSC::JSBigInt::inplaceSubAndPropagate):\n(JSC::JSBigInt::karatsubaAbsoluteDifference):\n(JSC::JSBigInt::multiplyZeroPadded):\n(JSC::JSBigInt::karatsubaMain):\n(JSC::JSBigInt::karatsubaChunk):\n(JSC::JSBigInt::karatsubaStart):\n(JSC::JSBigInt::multiplyKaratsuba):\n(JSC::JSBigInt::multiplyDigitsInto):\n* Source/JavaScriptCore/runtime/JSBigInt.h:\n\nCanonical link: https://commits.webkit.org/320495@main\n"
    },
    {
      "commit": "4af7b773e279f8908b804e342c74ffe11139c1f1",
      "tree": "1679168adeebe501f8d6cfe2685857800406845a",
      "parents": [
        "a2b3ca6b9e95d8b94200d874fd95e3dd36f873ab"
      ],
      "author": {
        "name": "Fujii Hironori",
        "email": "fujii@igalia.com",
        "time": "Fri Sep 04 08:07:13 2026"
      },
      "committer": {
        "name": "Fujii Hironori",
        "email": "fujii@igalia.com",
        "time": "Fri Sep 04 08:07:13 2026"
      },
      "message": "SkiaCompositingLayer: Take the last animation value after animation ended\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d321993\n\nReviewed by Carlos Garcia Campos.\n\nTake the last animation value after animation ended as well as\nTextureMapperLayer does. This has no effect for web, but only for \"flush\nrepaint\" feature of WebInspector.\n\n* Source/WebCore/platform/graphics/skia/SkiaCompositingLayer.cpp:\n(WebCore::SkiaCompositingLayer::localTransform const):\n(WebCore::SkiaCompositingLayer::futureLocalTransform const):\n(WebCore::SkiaCompositingLayer::opacityForAnimationsState const):\n(WebCore::SkiaCompositingLayer::filter const):\n\nCanonical link: https://commits.webkit.org/320494@main\n"
    },
    {
      "commit": "a2b3ca6b9e95d8b94200d874fd95e3dd36f873ab",
      "tree": "e1c022c1fccee4909f4ba60a2edb010eeb4af3e8",
      "parents": [
        "956f6fb49678a6f6b0116325be5b5357df948970"
      ],
      "author": {
        "name": "Antti Koivisto",
        "email": "antti@apple.com",
        "time": "Fri Sep 04 07:58:37 2026"
      },
      "committer": {
        "name": "Antti Koivisto",
        "email": "koivisto@iki.fi",
        "time": "Fri Sep 04 07:58:37 2026"
      },
      "message": "[css-values-5] Support tree counting functions in container queries\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323319\nrdar://186564084\n\nReviewed by Alan Baradlay.\n\nThey should work per https://github.com/w3c/csswg-drafts/issues/10982.\n\nTwo things stopped them. They were rejected at parse time by a currentProperty test standing in for\n\"no element to resolve against\", which a container query condition does have. Replace it with an\nexplicit treeCountingFunctionsAllowed. Media queries keep rejecting them, which is what makes them\nevaluate to unknown.\n\nResolving one also needs a BuilderState and ContainerQueryEvaluator built its conversion data\nwithout one. Make it for the container and take the conversion data from that, like\nIfConditionEvaluator does. The style() declaration form was already doing this the long way around\nwith a Builder of its own, which is why that form worked and nothing else did.\n\nInvalidation on sibling changes is still missing.\n\nTest: imported/w3c/web-platform-tests/css/css-values/tree-counting/sibling-function-if-style-query.html\n* LayoutTests/imported/w3c/web-platform-tests/css/css-values/tree-counting/sibling-function-container-query-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-values/tree-counting/sibling-function-container-query-invalidation-expected.txt:\n\nStill failing, but later: the queries now match, they just don\u0027t invalidate.\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-values/tree-counting/sibling-function-container-query.html:\n\nCover the style() range form too, which nothing tested.\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-values/tree-counting/sibling-function-if-style-query-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-values/tree-counting/sibling-function-if-style-query.html: Added.\n* Source/WebCore/css/MediaQueryParserContext.h:\n* Source/WebCore/css/calc/CSSCalcTree+Parser.cpp:\n(WebCore::CSSCalc::parseCalcFunction):\n* Source/WebCore/css/parser/CSSPropertyParserState.h:\n* Source/WebCore/css/query/ContainerQueryFeatures.cpp:\n(WebCore::CQ::Features::evaluateStyleRangeValue):\n(WebCore::CQ::Features::StyleFeatureSchema::localPropertyRegistry):\n\nBoth evaluators that reach a style() feature have a builder state now, so stop testing for it.\n\n* Source/WebCore/css/query/ContainerQueryParser.cpp:\n(WebCore::CQ::ContainerQueryParser::consumeContainerCondition):\n* Source/WebCore/css/query/GenericMediaQueryParser.cpp:\n(WebCore::MQ::consumeValue):\n* Source/WebCore/style/ContainerQueryEvaluator.cpp:\n(WebCore::Style::ContainerQueryEvaluator::featureEvaluationContextForCondition const):\n* Source/WebCore/style/ContainerQueryEvaluator.h:\n\nCanonical link: https://commits.webkit.org/320493@main\n"
    },
    {
      "commit": "956f6fb49678a6f6b0116325be5b5357df948970",
      "tree": "9586249177a3aae8ab534668f856d501a01357d5",
      "parents": [
        "63337facdaadf7a2388cab5838048c3e9f5fca99"
      ],
      "author": {
        "name": "Sosuke Suzuki",
        "email": "sosuke@bun.sh",
        "time": "Fri Sep 04 07:57:34 2026"
      },
      "committer": {
        "name": "Sosuke Suzuki",
        "email": "sosuke@bun.com",
        "time": "Fri Sep 04 07:57:34 2026"
      },
      "message": "[YARR] Match lookbehinds in the interpreter from a copy of the disjunction in match order\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d322692\n\nReviewed by Daniel Liu.\n\nThis is the second step of the plan in 319067@main. The interpreter now\nmatches a lookbehind the way the JIT does: from a copy of its disjunction with\nthe terms in match order, so that only the input reading primitives know\nabout the direction.\n\nUntil now the interpreter handled the direction term by term: each matching\nfunction had a Forward implementation and a separate Backward one. Those\nBackward implementations each re-derived the surrogate pair rules, and the\nones that got them wrong are where the interpreter-only lookbehind bugs in /u\nmode came from. With one set of primitives whose Backward form is the mirror\nof the Forward one, the following are fixed without a case-by-case change, and\neach gets its own test:\n\n1. /(?\u003c\u003d[\\u{1F600}a])b/u on \"x😀b\" returned null.\n2. /(?\u003c\u003d\\u{1F600}{2})x/u on \"😀😀x\" returned null.\n3. /(?\u003c\u003d$.*)/su on \"😁\" matched at index 1, inside the surrogate pair.\n4. /(?\u003c\u003d\\uD83D)/u on \"😀\" matched at index 1.\n\nThe diff is large because most of it is deletion: every Backward\nimplementation and the Backward-specific bookkeeping in the bytecode compiler\nare gone. The forward bytecode and the JIT\u0027s machine code are unchanged.\n\nTests: JSTests/stress/regexp-interpreter-lookbehind-character-class-non-bmp.js\n       JSTests/stress/regexp-interpreter-lookbehind-fixed-count-non-bmp-character.js\n       JSTests/stress/regexp-interpreter-lookbehind-greedy-class-backtrack-non-bmp.js\n       JSTests/stress/regexp-interpreter-lookbehind-surrogate-half.js\n       JSTests/stress/regexp-interpreter-lookbehind.js\n\n* JSTests/stress/regexp-interpreter-lookbehind-character-class-non-bmp.js: Added.\n(shouldBe):\n(stringify):\n(shouldMatch):\n* JSTests/stress/regexp-interpreter-lookbehind-fixed-count-non-bmp-character.js: Added.\n(shouldBe):\n(stringify):\n(shouldMatch):\n* JSTests/stress/regexp-interpreter-lookbehind-greedy-class-backtrack-non-bmp.js: Added.\n(shouldBe):\n(stringify):\n(shouldMatch):\n* JSTests/stress/regexp-interpreter-lookbehind-surrogate-half.js: Added.\n(shouldBe):\n(stringify):\n(shouldMatch):\n* JSTests/stress/regexp-interpreter-lookbehind.js: Added.\n(shouldBe):\n(stringify):\n(shouldMatch):\n* Source/JavaScriptCore/yarr/YarrInterpreter.cpp:\n(JSC::Yarr::Interpreter::InputStream::characterIndex):\n(JSC::Yarr::Interpreter::InputStream::readChecked):\n(JSC::Yarr::Interpreter::InputStream::readCheckedDontAdvance):\n(JSC::Yarr::Interpreter::InputStream::readSurrogatePairChecked):\n(JSC::Yarr::Interpreter::InputStream::readCodePoint):\n(JSC::Yarr::Interpreter::InputStream::reread):\n(JSC::Yarr::Interpreter::InputStream::positionAt):\n(JSC::Yarr::Interpreter::InputStream::checkInput):\n(JSC::Yarr::Interpreter::InputStream::uncheckInput):\n(JSC::Yarr::Interpreter::InputStream::uncheckCodePoint):\n(JSC::Yarr::Interpreter::InputStream::isValidNegativeInputOffset):\n(JSC::Yarr::Interpreter::checkCharacter):\n(JSC::Yarr::Interpreter::checkSurrogatePair):\n(JSC::Yarr::Interpreter::checkCasedCharacter):\n(JSC::Yarr::Interpreter::checkCharacterClass):\n(JSC::Yarr::Interpreter::checkCharacterClassDontAdvanceInputForNonBMP):\n(JSC::Yarr::Interpreter::tryConsumeBackReference):\n(JSC::Yarr::Interpreter::matchAssertionBOL):\n(JSC::Yarr::Interpreter::matchAssertionEOL):\n(JSC::Yarr::Interpreter::matchAssertionBOI):\n(JSC::Yarr::Interpreter::matchAssertionEOI):\n(JSC::Yarr::Interpreter::matchAssertionWordBoundary):\n(JSC::Yarr::Interpreter::matchFixedCount):\n(JSC::Yarr::Interpreter::matchGreedy):\n(JSC::Yarr::Interpreter::backtrackNonGreedy):\n(JSC::Yarr::Interpreter::backtrackPatternCharacter):\n(JSC::Yarr::Interpreter::backtrackPatternCasedCharacter):\n(JSC::Yarr::Interpreter::matchCharacterClass):\n(JSC::Yarr::Interpreter::backtrackCharacterClass):\n(JSC::Yarr::Interpreter::matchBackReference):\n(JSC::Yarr::Interpreter::backtrackBackReference):\n(JSC::Yarr::Interpreter::matchPatternCharacterFixed):\n(JSC::Yarr::Interpreter::matchPatternCharacterGreedy):\n(JSC::Yarr::Interpreter::matchPatternCasedCharacterFixed):\n(JSC::Yarr::Interpreter::matchPatternCasedCharacterGreedy):\n(JSC::Yarr::Interpreter::recordParenthesesMatch):\n(JSC::Yarr::Interpreter::matchParenthesesOnceBegin):\n(JSC::Yarr::Interpreter::matchParenthesesOnceEnd):\n(JSC::Yarr::Interpreter::backtrackParenthesesOnceEnd):\n(JSC::Yarr::Interpreter::matchParentheticalAssertionBegin):\n(JSC::Yarr::Interpreter::backtrackParentheticalAssertionBegin):\n(JSC::Yarr::Interpreter::matchDisjunction):\n(JSC::Yarr::ByteCompiler::checkInput):\n(JSC::Yarr::ByteCompiler::assertionBOL):\n(JSC::Yarr::ByteCompiler::assertionEOL):\n(JSC::Yarr::ByteCompiler::assertionBOI):\n(JSC::Yarr::ByteCompiler::assertionEOI):\n(JSC::Yarr::ByteCompiler::atomPatternCharacter):\n(JSC::Yarr::ByteCompiler::atomCharacterClass):\n(JSC::Yarr::ByteCompiler::atomParentheticalAssertionBegin):\n(JSC::Yarr::ByteCompiler::atomParenthesesOnceEnd):\n(JSC::Yarr::ByteCompiler::atomParenthesesTerminalEnd):\n(JSC::Yarr::ByteCompiler::emitDisjunction):\n(JSC::Yarr::ByteTermDumper::dumpTerm):\n(JSC::Yarr::Interpreter::InputStream::rewind): Deleted.\n(JSC::Yarr::Interpreter::InputStream::read): Deleted.\n(JSC::Yarr::Interpreter::InputStream::readForCharacterDump): Deleted.\n(JSC::Yarr::Interpreter::InputStream::tryReadBackward): Deleted.\n(JSC::Yarr::Interpreter::InputStream::prev): Deleted.\n(JSC::Yarr::Interpreter::InputStream::atStart): Deleted.\n(JSC::Yarr::Interpreter::InputStream::tryUncheckInput): Deleted.\n(JSC::Yarr::ByteCompiler::uncheckInput): Deleted.\n(JSC::Yarr::ByteCompiler::haveCheckedInput): Deleted.\n* Source/JavaScriptCore/yarr/YarrInterpreter.h:\n(JSC::Yarr::ByteTerm::directed):\n(JSC::Yarr::ByteTerm::ByteTerm):\n(JSC::Yarr::ByteTerm::BOL):\n(JSC::Yarr::ByteTerm::BOI):\n(JSC::Yarr::ByteTerm::CheckInput):\n(JSC::Yarr::ByteTerm::EOL):\n(JSC::Yarr::ByteTerm::EOI):\n(JSC::Yarr::ByteTerm::WordBoundary):\n(JSC::Yarr::ByteTerm::BackReference):\n(JSC::Yarr::ByteTerm::ParentheticalAssertionBegin):\n(JSC::Yarr::ByteTerm::ParentheticalAssertionEnd):\n(JSC::Yarr::ByteTerm::isCharacterType):\n(JSC::Yarr::ByteTerm::isCasedCharacterType):\n(JSC::Yarr::ByteTerm::isCharacterClass):\n(JSC::Yarr::ByteTerm::isBackReference):\n(JSC::Yarr::ByteTerm::parentMatchDirection):\n(JSC::Yarr::ByteTerm::UncheckInput): Deleted.\n(JSC::Yarr::ByteTerm::HaveCheckedInput): Deleted.\n* Source/JavaScriptCore/yarr/YarrJIT.cpp:\n* Source/JavaScriptCore/yarr/YarrPattern.cpp:\n(JSC::Yarr::YarrPattern::copyDisjunctionInMatchOrder):\n* Source/JavaScriptCore/yarr/YarrPattern.h:\n\nCanonical link: https://commits.webkit.org/320492@main\n"
    },
    {
      "commit": "63337facdaadf7a2388cab5838048c3e9f5fca99",
      "tree": "400d5ce80dcee4602a10189bfb58ec968325ee73",
      "parents": [
        "f42e74f7147c7a1d2dfc69021d103dcd85ff9c03"
      ],
      "author": {
        "name": "Ahmad Saleem",
        "email": "ahmad.saleem792+github@gmail.com",
        "time": "Fri Sep 04 07:43:38 2026"
      },
      "committer": {
        "name": "Ahmad Saleem",
        "email": "ahmad.saleem792@gmail.com",
        "time": "Fri Sep 04 07:43:38 2026"
      },
      "message": "Remove duplicate Blink-imported tests that are byte-identical to existing WebKit tests\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323402\nrdar://186636449\n\nReviewed by Anne van Kesteren.\n\nNine tests under LayoutTests/imported/blink/ are byte-identical and both the\ntest and its expected baseline - to tests already present elsewhere in\nLayoutTests/. They add no coverage over the native copies, so remove the\nredundant imported/blink duplicates.\n\nEach removed test is byte-identical to the existing WebKit test noted below:\n\n- imported/blink/css3/calc/calc-with-percent-and-number-in-line-height-crash.html\n  (\u003d fast/css/calc-with-percent-and-number-in-line-height-crash.html)\n- imported/blink/fast/multicol/unbreakable-content-taller-than-height-crash.html\n  (\u003d fast/multicol/unbreakable-content-taller-than-height-crash.html)\n- imported/blink/svg/text/text-decoration-propagation-2.html\n  (\u003d svg/text/text-decoration-propagation-2.html)\n- imported/blink/fast/block/positioning/abspos-auto-left-auto-top-inside-auto-margins.html\n  (\u003d fast/block/positioning/abspos-auto-left-auto-top-inside-auto-margins.html)\n- imported/blink/fast/block/positioning/abspos-auto-left-and-width-change-parent-margin-left.html\n  (\u003d fast/block/positioning/abspos-auto-left-and-width-change-parent-margin-left.html)\n- imported/blink/fast/box-shadow/normal-box-shadow-with-background-image.html\n  (\u003d fast/box-shadow/normal-box-shadow-with-background-image.html)\n- imported/blink/fast/css/style-preferred-stylesheet-02.html\n  (\u003d fast/css/style-preferred-stylesheet-02.html)\n- imported/blink/fast/parser/badurl-base-preloader-crash.html\n  (\u003d fast/parser/badurl-base-preloader-crash.html)\n- imported/blink/fast/table/overflowScroll-display-block.html\n  (\u003d fast/table/overflowScroll-display-block.html)\n\n* LayoutTests/imported/blink/css3/calc/calc-with-percent-and-number-in-line-height-crash-expected.txt: Removed.\n* LayoutTests/imported/blink/css3/calc/calc-with-percent-and-number-in-line-height-crash.html: Removed.\n* LayoutTests/imported/blink/fast/block/positioning/abspos-auto-left-and-width-change-parent-margin-left-expected.html: Removed.\n* LayoutTests/imported/blink/fast/block/positioning/abspos-auto-left-and-width-change-parent-margin-left.html: Removed.\n* LayoutTests/imported/blink/fast/block/positioning/abspos-auto-left-auto-top-inside-auto-margins-expected.html: Removed.\n* LayoutTests/imported/blink/fast/block/positioning/abspos-auto-left-auto-top-inside-auto-margins.html: Removed.\n* LayoutTests/imported/blink/fast/box-shadow/normal-box-shadow-with-background-image-expected-mismatch.html: Removed.\n* LayoutTests/imported/blink/fast/box-shadow/normal-box-shadow-with-background-image.html: Removed.\n* LayoutTests/imported/blink/fast/css/style-preferred-stylesheet-02-expected.html: Removed.\n* LayoutTests/imported/blink/fast/css/style-preferred-stylesheet-02.html: Removed.\n* LayoutTests/imported/blink/fast/multicol/unbreakable-content-taller-than-height-crash-expected.txt: Removed.\n* LayoutTests/imported/blink/fast/multicol/unbreakable-content-taller-than-height-crash.html: Removed.\n* LayoutTests/imported/blink/fast/parser/badurl-base-preloader-crash-expected.txt: Removed.\n* LayoutTests/imported/blink/fast/parser/badurl-base-preloader-crash.html: Removed.\n* LayoutTests/imported/blink/fast/table/overflowScroll-display-block-expected.html: Removed.\n* LayoutTests/imported/blink/fast/table/overflowScroll-display-block.html: Removed.\n* LayoutTests/imported/blink/svg/text/text-decoration-propagation-2-expected.html: Removed.\n* LayoutTests/imported/blink/svg/text/text-decoration-propagation-2.html: Removed.\n\nCanonical link: https://commits.webkit.org/320491@main\n"
    },
    {
      "commit": "f42e74f7147c7a1d2dfc69021d103dcd85ff9c03",
      "tree": "e7765e88e789165628521701476e4f2ffaccd7bd",
      "parents": [
        "8d57bce3aacce4281565e492d1b4e6bf377ed314"
      ],
      "author": {
        "name": "Nikolas Zimmermann",
        "email": "nzimmermann@igalia.com",
        "time": "Fri Sep 04 07:37:00 2026"
      },
      "committer": {
        "name": "Carlos Garcia Campos",
        "email": "cgarcia@igalia.com",
        "time": "Fri Sep 04 07:37:00 2026"
      },
      "message": "[GTK][WPE] Skia compositor: backing store tiles ignore the layer transform when picking sampling options\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323260\n\nReviewed by Carlos Garcia Campos.\n\nLayer tiles are always drawn with SkFilterMode::kNearest. That is fine as long as\neach pixel of the tile ends up on exactly one screen pixel, at the same size and\nwithout any rotation. Once the layer is shifted by a fraction of a pixel, every\nscreen pixel still takes its color from a single source pixel, rather than from a\nmix of the two it now falls inbetween. Edges lose their smoothness and visibly\n\"snap\" from one pixel to the next. TextureMapper does not have this problem,\nbecause its GL path always uses GL_LINEAR.\n\nThe fix is to choose nearest or linear for each draw, depending on whether the\ntransform still maps tile pixels 1:1 onto screen pixels. Layers whose content\nis a single image, already performed this test before they are drawn, so move\nthat functionality into a shared place and use it for backing store tiles as well.\nAudit all other places that hardcoded linear vs. nearest and fast vs\nstrict srcRect constraint.\n\nimported/w3c/web-platform-tests/css/css-animations/transform-animation-under-large-scale.html\nloses its glib specific [ Pass ] override and falls back to the generic ImageOnlyFailure of\nwebkit.org/b/225407. The test scales a layer by 100 without re-rasterizing its contents at\nthat scale, since GraphicsLayerCoordinated keeps the root relative scale factor updates\nturned off. Nearest sampling replicated each of the two content rows into a sharp block,\nwhich happened to match the reference. Linear sampling blurs the magnified tile, the same\nresult all other ports produce.\n\nLinear sampling reaches past the source rect, which only matters for a tile whose\ntexture is padded past its logical size (super-tiled textures) - keep\nthat into account when deciding which sampling strategy to use.\n\n* LayoutTests/platform/glib/TestExpectations:\n* Source/WebCore/platform/graphics/skia/SkiaBackingStore.cpp:\n(WebCore::SkiaBackingStore::processPendingTileUpdates):\n(WebCore::SkiaBackingStore::samplingOptionsForMatrix const):\n(WebCore::SkiaBackingStore::paintToCanvas):\n(WebCore::SkiaBackingStore::Tile::isPadded const):\n* Source/WebCore/platform/graphics/skia/SkiaBackingStore.h:\n(WebCore::SkiaBackingStore::requiresStrictSourceConstraint const):\n* Source/WebCore/platform/graphics/skia/SkiaCompositingLayer.cpp:\n(WebCore::SkiaCompositingLayer::paintContents):\n(WebCore::SkiaCompositingLayer::paintWithIntermediateSurface):\n(WebCore::SkiaCompositingLayer::paintWithMaskAndBackdrop):\n* Source/WebCore/platform/graphics/skia/SkiaCompositingLayerImageSetBatch.cpp:\n(WebCore::SkiaCompositingLayerImageSetBatch::samplingOptionsForImage const):\n(WebCore::SkiaCompositingLayerImageSetBatch::samplingOptionsForBackingStore const):\n(WebCore::SkiaCompositingLayerImageSetBatch::addImageSet):\n(WebCore::SkiaCompositingLayerImageSetBatch::addImage):\n(WebCore::SkiaCompositingLayerImageSetBatch::imageRequiresLinearSampling const): Deleted.\n* Source/WebCore/platform/graphics/skia/SkiaCompositingLayerImageSetBatch.h:\n(WebCore::SkiaCompositingLayerImageSetBatch::planRestrictedDraw):\n(WebCore::SkiaCompositingLayerImageSetBatch::drawOutsideBatch):\n* Source/WebCore/platform/graphics/skia/SkiaUtilities.h:\n(WebCore::SkiaUtilities::samplingOptionsForMatrix):\n(WebCore::SkiaUtilities::samplingOptionsForImageDraw):\n\nCanonical link: https://commits.webkit.org/320490@main\n"
    },
    {
      "commit": "8d57bce3aacce4281565e492d1b4e6bf377ed314",
      "tree": "1674fcfa628aca992e4184065c13eaeca6a3545a",
      "parents": [
        "0d6cf47c3b1211a20135cc74ae54768dbeb1aa93"
      ],
      "author": {
        "name": "Ahmad Saleem",
        "email": "ahmad.saleem792+github@gmail.com",
        "time": "Fri Sep 04 07:20:47 2026"
      },
      "committer": {
        "name": "Ahmad Saleem",
        "email": "ahmad.saleem792@gmail.com",
        "time": "Fri Sep 04 07:20:47 2026"
      },
      "message": "Modernize isValidPathSegment() to use a range-based for loop over code units\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323398\nrdar://186630818\n\nReviewed by Chris Dumez.\n\nReplace the index-based loop in isValidPathSegment() with a range-based\nfor loop over StringView::codeUnits(). This avoids re-evaluating\nsegment.length() on every iteration and the per-index operator[] access,\nand reads more clearly. No change in behavior.\n\n* Source/WebCore/Modules/entriesapi/DOMFileSystem.cpp:\n(WebCore::isValidPathSegment):\n\nCanonical link: https://commits.webkit.org/320489@main\n"
    },
    {
      "commit": "0d6cf47c3b1211a20135cc74ae54768dbeb1aa93",
      "tree": "616f961cfed7363b05c0e32a54ad5e6ac6665709",
      "parents": [
        "34141654c7a5bedfa41619da1f9513b39a8dd694"
      ],
      "author": {
        "name": "Sosuke Suzuki",
        "email": "sosuke@bun.sh",
        "time": "Fri Sep 04 06:30:31 2026"
      },
      "committer": {
        "name": "Sosuke Suzuki",
        "email": "sosuke@bun.com",
        "time": "Fri Sep 04 06:30:31 2026"
      },
      "message": "[JSC] Vectorize `Array#indexOf` and `Array#includes` on long Int32 and Double arrays\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323192\n\nReviewed by Yusuke Suzuki.\n\nDFG and FTL compile ArrayIndexOf / ArrayIncludes on Int32 and Double arrays\ninto a scalar loop, while the C++ paths for Int32 arrays already scan the\nbutterfly with the vectorized WTF::find64. On a long array the JIT-compiled\ncode was slower per element than the interpreter, about 1.8x slower than V8.\n\nWhen at least 32 elements remain, the JIT now calls a NOEXCEPT operation that\nruns WTF::find64 / WTF::findDouble and keeps the inline loop for shorter scans;\nthe threshold is where the call overhead stops mattering on Apple Silicon.\nfindDouble is rewritten to share find64\u0027s unrolled kernel, since its aligned\nvariant was slower than the scalar loop, and the remaining scalar double\nsearches in the runtime call it too.\n\n                                                   baseline                  patched\n\narray-prototype-indexOf-int32-from-contiguous\n                                               13.2918+-0.4091           13.0476+-0.3309          might be 1.0187x faster\narray-prototype-includes-int32-from-contiguous\n                                               12.9337+-0.0922           12.8622+-0.4050\narray-prototype-includes-int32-miss           285.7966+-0.9708     ^     85.4147+-1.1408        ^ definitely 3.3460x faster\narray-prototype-includes-double                12.5542+-0.5818     ^      6.5374+-0.1602        ^ definitely 1.9204x faster\narray-prototype-includes-int32                148.5482+-2.2786     ^     53.7430+-0.5775        ^ definitely 2.7640x faster\narray-prototype-indexOf-int32                 148.3728+-2.5853     ^     53.8890+-0.9227        ^ definitely 2.7533x faster\narray-prototype-includes-double-from-contiguous\n                                               32.8554+-1.6434     ?     32.8829+-1.2574        ?\narray-prototype-indexOf-double-long           153.0529+-4.8413     ^     62.5287+-1.7941        ^ definitely 2.4477x faster\n\nTests: JSTests/microbenchmarks/array-prototype-includes-int32-miss.js\n       JSTests/microbenchmarks/array-prototype-indexOf-double-long.js\n       JSTests/stress/array-indexof-includes-long-int32-double.js\n\n* JSTests/microbenchmarks/array-prototype-includes-int32-miss.js: Added.\n(test):\n* JSTests/microbenchmarks/array-prototype-indexOf-double-long.js: Added.\n(test):\n* JSTests/stress/array-indexof-includes-long-int32-double.js: Added.\n(shouldBe):\n(int32IndexOf):\n(int32IndexOfFrom):\n(int32Includes):\n(int32IncludesFrom):\n(doubleIndexOf):\n(doubleIndexOfFrom):\n(doubleIncludes):\n(doubleIncludesFrom):\n(makeInt32Array):\n(makeDoubleArray):\n(let.length.of.lengths.3):\n(let.length.of.lengths.0.5):\n* Source/JavaScriptCore/dfg/DFGOperations.cpp:\n(JSC::DFG::arrayIncludesDouble):\n(JSC::DFG::arrayIndexOfDouble):\n(JSC::DFG::JSC_DEFINE_NOEXCEPT_JIT_OPERATION):\n* Source/JavaScriptCore/dfg/DFGOperations.h:\n* Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:\n(JSC::DFG::SpeculativeJIT::compileArrayIndexOfOrArrayIncludes):\n* Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:\n(JSC::FTL::DFG::LowerDFGToB3::compileArrayIndexOfOrArrayIncludes):\n* Source/JavaScriptCore/runtime/ArrayPrototype.cpp:\n(JSC::fastIndexOf):\n* Source/JavaScriptCore/runtime/JSArray.cpp:\n(JSC::JSArray::fastIncludes):\n* Source/WTF/wtf/SIMDHelpers.h:\n(WTF::SIMD::splatDouble):\n(WTF::SIMD::splat):\n* Source/WTF/wtf/text/StringCommon.cpp:\n(WTF::findFloatAlignedImpl):\n(WTF::findDoubleAlignedImpl): Deleted.\n* Source/WTF/wtf/text/StringCommon.h:\n(WTF::find64BitLaneImpl):\n(WTF::find64):\n(WTF::findDouble):\n\nCanonical link: https://commits.webkit.org/320488@main\n"
    },
    {
      "commit": "34141654c7a5bedfa41619da1f9513b39a8dd694",
      "tree": "ec73512b12c15cf1ab86248a2cff653f24bcc104",
      "parents": [
        "7f4b74c9b84081d0a733e471f506d2480c43b89f"
      ],
      "author": {
        "name": "Sosuke Suzuki",
        "email": "sosuke@bun.sh",
        "time": "Fri Sep 04 06:25:19 2026"
      },
      "committer": {
        "name": "Sosuke Suzuki",
        "email": "sosuke@bun.com",
        "time": "Fri Sep 04 06:25:19 2026"
      },
      "message": "[JSC] `RegExp#test` should fast-fail on an input shorter than the pattern\u0027s minimum size\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d322689\n\nReviewed by Yusuke Suzuki.\n\nRegExp#test on a non-constant RegExp (routes held in an array, as\npath-to-regexp routers do) always goes through the operation, RegExp::match\nand the Yarr JIT prologue, only for the first Yarr instruction to reject an\ninput shorter than the pattern\u0027s minimum size.\n\nYarr already computes that minimum (PatternDisjunction::m_minimumSize) but\nkeeps it only in the transient YarrPattern. Keep a copy in RegExp (it fits in\nexisting padding), filled in once the pattern has compiled so that a pattern\nwhose bytecode compilation fails still enters compilation and throws, and\ncompare against it in RegExp::matchInline and inline in DFG / FTL RegExpTest.\nGlobal and sticky patterns are excluded from the inline check since they\nstart at lastIndex and reset it on failure.\n\n                                                   Baseline                  Patched\n\nregexp-test-non-constant-minimum-length        53.1873+-1.0025     ^     10.5381+-1.0628        ^ definitely 5.0471x faster\nregexp-prototype-match-short-string            17.4101+-0.1716     ^     16.8127+-0.2799        ^ definitely 1.0355x faster\n\nTests: JSTests/microbenchmarks/regexp-test-non-constant-minimum-length.js\n       JSTests/stress/regexp-test-minimum-length-filter.js\n\n* JSTests/microbenchmarks/regexp-test-non-constant-minimum-length.js: Added.\n(dispatch):\n* JSTests/stress/regexp-test-minimum-length-filter.js: Added.\n(shouldBe):\n(testUntyped):\n(shortObject.toString):\n(longObject.toString):\n(nonConstantString):\n(rope):\n(testConstantUnicode):\n(testConstantGlobal):\n(testConstantZeroMinimum):\n(testHoisted):\n(shouldThrow):\n(testUncompilable):\n* Source/JavaScriptCore/b3/B3AbstractHeapRepository.h:\n* Source/JavaScriptCore/dfg/DFGGraph.cpp:\n(JSC::DFG::constantRegExpFor):\n(JSC::DFG::Graph::tryGetConstantRegExpFirstCharacterBitmap):\n(JSC::DFG::Graph::tryGetConstantRegExpTestMinimumSize):\n* Source/JavaScriptCore/dfg/DFGGraph.h:\n* Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:\n(JSC::DFG::SpeculativeJIT::compileRegExpTest):\n(JSC::DFG::SpeculativeJIT::emitRegExpTestWithFilter):\n(JSC::DFG::SpeculativeJIT::tryEmitRegExpTestFirstCharacterFilter): Deleted.\n* Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h:\n* Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp:\n(JSC::DFG::SpeculativeJIT::emitRegExpMinimumLengthFilterGuards):\n* Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:\n(JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):\n* Source/JavaScriptCore/runtime/RegExp.cpp:\n(JSC::RegExp::finishCreation):\n(JSC::RegExp::compile):\n(JSC::RegExp::compileMatchOnly):\n(JSC::RegExp::deleteCode):\n* Source/JavaScriptCore/runtime/RegExp.h:\n* Source/JavaScriptCore/runtime/RegExpInlines.h:\n(JSC::RegExp::matchInline):\n\nCanonical link: https://commits.webkit.org/320487@main\n"
    },
    {
      "commit": "7f4b74c9b84081d0a733e471f506d2480c43b89f",
      "tree": "bcbc74c8aa8f8231a35c1f972a132c5e51543b86",
      "parents": [
        "e6874d76293912ded70cac7adceb2877bb9122d1"
      ],
      "author": {
        "name": "Ahmad Saleem",
        "email": "ahmad.saleem792+github@gmail.com",
        "time": "Fri Sep 04 06:10:36 2026"
      },
      "committer": {
        "name": "Ahmad Saleem",
        "email": "ahmad.saleem792@gmail.com",
        "time": "Fri Sep 04 06:10:36 2026"
      },
      "message": "Resync `cookies` from WPT Upstream\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323366\nrdar://186604627\n\nReviewed by Rupin Mittal.\n\nUpstream commit: https://github.com/web-platform-tests/wpt/commit/a1e944e7a879854494e1a041a8ad1e4a8ae28ab1\n\n* LayoutTests/imported/w3c/web-platform-tests/cookies/WEB_FEATURES.yml:\n* LayoutTests/imported/w3c/web-platform-tests/cookies/attributes/WEB_FEATURES.yml:\n* LayoutTests/imported/w3c/web-platform-tests/cookies/attributes/httponly-overwrite.https.window-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/cookies/attributes/httponly-overwrite.https.window.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/cookies/attributes/httponly-overwrite.https.window.js: Added.\n(async setCookieViaHTTP.const.set encodeURIComponent):\n(async getCookieHeader):\n(async isHttpOnly):\n(cookieTest):\n(async cookieTest):\n* LayoutTests/imported/w3c/web-platform-tests/cookies/attributes/resources/path/w3c-import.log:\n* LayoutTests/imported/w3c/web-platform-tests/cookies/attributes/resources/pathfakeout/w3c-import.log:\n* LayoutTests/imported/w3c/web-platform-tests/cookies/attributes/resources/w3c-import.log:\n* LayoutTests/imported/w3c/web-platform-tests/cookies/attributes/w3c-import.log:\n* LayoutTests/imported/w3c/web-platform-tests/cookies/domain/WEB_FEATURES.yml:\n* LayoutTests/imported/w3c/web-platform-tests/cookies/domain/support/w3c-import.log:\n* LayoutTests/imported/w3c/web-platform-tests/cookies/domain/w3c-import.log:\n* LayoutTests/imported/w3c/web-platform-tests/cookies/encoding/w3c-import.log:\n* LayoutTests/imported/w3c/web-platform-tests/cookies/name/WEB_FEATURES.yml:\n* LayoutTests/imported/w3c/web-platform-tests/cookies/name/w3c-import.log:\n* LayoutTests/imported/w3c/web-platform-tests/cookies/ordering/resources/w3c-import.log:\n* LayoutTests/imported/w3c/web-platform-tests/cookies/ordering/w3c-import.log:\n* LayoutTests/imported/w3c/web-platform-tests/cookies/origin-bound-cookies/resources/w3c-import.log:\n* LayoutTests/imported/w3c/web-platform-tests/cookies/origin-bound-cookies/w3c-import.log:\n* LayoutTests/imported/w3c/web-platform-tests/cookies/partitioned-cookies/WEB_FEATURES.yml:\n* LayoutTests/imported/w3c/web-platform-tests/cookies/partitioned-cookies/partitioned-cookies-a-b-a-embed.tentative.https-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/cookies/partitioned-cookies/partitioned-cookies-a-b-a-embed.tentative.https.html:\n* LayoutTests/imported/w3c/web-platform-tests/cookies/partitioned-cookies/resources/ancestor-chain-cross-site-embed.html:\n* LayoutTests/imported/w3c/web-platform-tests/cookies/partitioned-cookies/resources/ancestor-chain-same-site-embed.html:\n* LayoutTests/imported/w3c/web-platform-tests/cookies/partitioned-cookies/resources/w3c-import.log:\n* LayoutTests/imported/w3c/web-platform-tests/cookies/partitioned-cookies/w3c-import.log:\n* LayoutTests/imported/w3c/web-platform-tests/cookies/path/WEB_FEATURES.yml:\n* LayoutTests/imported/w3c/web-platform-tests/cookies/path/match-percent-encoded.https.window-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/cookies/path/match-percent-encoded.https.window.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/cookies/path/match-percent-encoded.https.window.js: Added.\n(cookieValue):\n(probeAtPath):\n(set assert_true):\n(async setCookieViaHTTP):\n* LayoutTests/imported/w3c/web-platform-tests/cookies/path/match-segment-boundaries.https.window-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/cookies/path/match-segment-boundaries.https.window.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/cookies/path/match-segment-boundaries.https.window.js: Added.\n(async setCookieViaHTTP.const.set encodeURIComponent):\n(async cookieHeaderAtTarget):\n(cookieValue):\n(pathTest):\n(async setCookieViaHTTP.set assert_true):\n(async setCookieViaHTTP):\n(async pathTest):\n* LayoutTests/imported/w3c/web-platform-tests/cookies/path/non-ascii-path-attribute.https.window-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/cookies/path/non-ascii-path-attribute.https.window.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/cookies/path/non-ascii-path-attribute.https.window.js: Added.\n(async cookieValueAtTarget):\n(async cookieValueAtDefaultPath):\n(cookieTest):\n(async cookieTest):\n(set assert_true):\n(async setCookieViaHTTP):\n* LayoutTests/imported/w3c/web-platform-tests/cookies/path/resources/echo.py: Added.\n(main):\n* LayoutTests/imported/w3c/web-platform-tests/cookies/path/resources/probe/sw.js: Added.\n(event.url.pathname.endsWith):\n* LayoutTests/imported/w3c/web-platform-tests/cookies/path/resources/probe/w3c-import.log: Copied from LayoutTests/imported/w3c/web-platform-tests/cookies/encoding/w3c-import.log.\n* LayoutTests/imported/w3c/web-platform-tests/cookies/path/resources/w3c-import.log: Copied from LayoutTests/imported/w3c/web-platform-tests/cookies/encoding/w3c-import.log.\n* LayoutTests/imported/w3c/web-platform-tests/cookies/path/w3c-import.log:\n* LayoutTests/imported/w3c/web-platform-tests/cookies/prefix/WEB_FEATURES.yml:\n* LayoutTests/imported/w3c/web-platform-tests/cookies/prefix/__host.explicit-path.https.window-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/cookies/prefix/__host.explicit-path.https.window.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/cookies/prefix/__host.explicit-path.https.window.js: Added.\n(loadRootDocument):\n(rootDocumentTest):\n* LayoutTests/imported/w3c/web-platform-tests/cookies/prefix/w3c-import.log:\n* LayoutTests/imported/w3c/web-platform-tests/cookies/resources/w3c-import.log:\n* LayoutTests/imported/w3c/web-platform-tests/cookies/samesite-none-secure/w3c-import.log:\n* LayoutTests/imported/w3c/web-platform-tests/cookies/samesite/WEB_FEATURES.yml:\n* LayoutTests/imported/w3c/web-platform-tests/cookies/samesite/resources/w3c-import.log:\n* LayoutTests/imported/w3c/web-platform-tests/cookies/samesite/w3c-import.log:\n* LayoutTests/imported/w3c/web-platform-tests/cookies/schemeful-same-site/WEB_FEATURES.yml:\n* LayoutTests/imported/w3c/web-platform-tests/cookies/schemeful-same-site/resources/w3c-import.log:\n* LayoutTests/imported/w3c/web-platform-tests/cookies/schemeful-same-site/w3c-import.log:\n* LayoutTests/imported/w3c/web-platform-tests/cookies/secure/WEB_FEATURES.yml:\n* LayoutTests/imported/w3c/web-platform-tests/cookies/secure/w3c-import.log:\n* LayoutTests/imported/w3c/web-platform-tests/cookies/size/WEB_FEATURES.yml:\n* LayoutTests/imported/w3c/web-platform-tests/cookies/size/w3c-import.log:\n* LayoutTests/imported/w3c/web-platform-tests/cookies/third-party-cookies/WEB_FEATURES.yml:\n* LayoutTests/imported/w3c/web-platform-tests/cookies/third-party-cookies/resources/w3c-import.log:\n* LayoutTests/imported/w3c/web-platform-tests/cookies/third-party-cookies/w3c-import.log:\n* LayoutTests/imported/w3c/web-platform-tests/cookies/value/WEB_FEATURES.yml:\n* LayoutTests/imported/w3c/web-platform-tests/cookies/value/value-overwrite.https.window-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/cookies/value/value-overwrite.https.window.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/cookies/value/value-overwrite.https.window.js: Added.\n(async setCookiesViaHTTP.const.set encodeURIComponent):\n(async getCookiesViaHTTP):\n(cookieValue):\n(overwriteTest):\n(async setCookiesViaHTTP.set assert_true):\n(async setCookiesViaHTTP):\n(async const):\n(const.attributes.of.attributeSets.filter.a.a.includes):\n* LayoutTests/imported/w3c/web-platform-tests/cookies/value/w3c-import.log:\n* LayoutTests/imported/w3c/web-platform-tests/cookies/w3c-import.log:\n* LayoutTests/platform/glib/imported/w3c/web-platform-tests/cookies/path/match-percent-encoded.https.window-expected.txt: Added.\n\nCanonical link: https://commits.webkit.org/320486@main\n"
    },
    {
      "commit": "e6874d76293912ded70cac7adceb2877bb9122d1",
      "tree": "22a5763cf5427d71ea03aaf63aa0b5972db21f6d",
      "parents": [
        "edd9fe9dbe988d809ee9819e78bc0f4c1668f0d2"
      ],
      "author": {
        "name": "Claudio Saavedra",
        "email": "csaavedra@igalia.com",
        "time": "Fri Sep 04 05:39:57 2026"
      },
      "committer": {
        "name": "Claudio Saavedra",
        "email": "csaavedra@igalia.com",
        "time": "Fri Sep 04 05:39:57 2026"
      },
      "message": "[WPE] Gardening of WPE arm64 flakies\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323400\n\nUnreviewed gardening.\n\n* LayoutTests/platform/wpe/TestExpectations:\n\nCanonical link: https://commits.webkit.org/320485@main\n"
    },
    {
      "commit": "edd9fe9dbe988d809ee9819e78bc0f4c1668f0d2",
      "tree": "64916615fcfa6c9b4e10a33c13f6f505ec63f47c",
      "parents": [
        "b7794d481cec9bcf56e76492f68d4d44e0686cfd"
      ],
      "author": {
        "name": "Jessica Lee",
        "email": "jlee53@apple.com",
        "time": "Fri Sep 04 05:32:00 2026"
      },
      "committer": {
        "name": "Jessica Lee",
        "email": "jlee53@apple.com",
        "time": "Fri Sep 04 05:32:00 2026"
      },
      "message": "[Site Isolation] http/tests/misc/webtiming-cross-origin-and-back1.html is a timeout\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d322870\nrdar://186116994\n\nReviewed by Alex Christensen.\n\nCurrently, m_topLoadingFrame is tracked per-process in the InjectedBundle which means it is\nshared by all the WKBundlePages of InjectedBundle. Because it\u0027s per process, it can end\nup tracking the wrong load of the various pages. In webtiming-cross-origin-and-back1.html\u0027s case,\nit was an abandoned provisional load from a redirect. For tests with pop-ups, the pop-up can overwrite\nthe opener\u0027s m_topLoadingFrame. WebKit relies on m_topLoadingFrame to match the load\u0027s\nframe to properly notify the test runner. If the loading frame does not match m_topLoadingFrame,\nthe test runner is never notified and the test times out.\n\nThe fix is to have each page track its own m_topLoadingFrame so that provisional loads for\npages in the shared process don\u0027t overwrite the primary page\u0027s (ie InjectedBundle::page())\nm_topLoadingFrame. We additionally check that the page being loaded is the primary page. If not,\nwe don\u0027t notify the test runner and exit early.\n\nhttp/tests/misc/webtiming-cross-origin-and-back1.html is the relevant test.\n\n* Tools/WebKitTestRunner/InjectedBundle/InjectedBundle.cpp:\n(WTR::InjectedBundle::didReceiveMessageToPage):\n(WTR::InjectedBundle::done):\n* Tools/WebKitTestRunner/InjectedBundle/InjectedBundle.h:\n(WTR::InjectedBundle::topLoadingFrame): Deleted.\n(WTR::InjectedBundle::setTopLoadingFrame): Deleted.\n* Tools/WebKitTestRunner/InjectedBundle/InjectedBundlePage.cpp:\n(WTR::InjectedBundlePage::resetAfterTest):\n(WTR::InjectedBundlePage::didStartProvisionalLoadForFrame):\n(WTR::InjectedBundlePage::frameDidChangeLocation):\n(WTR::InjectedBundlePage::notifyDone):\n* Tools/WebKitTestRunner/InjectedBundle/InjectedBundlePage.h:\n(WTR::InjectedBundlePage::topLoadingFrame):\n(WTR::InjectedBundlePage::setTopLoadingFrame):\n\nCanonical link: https://commits.webkit.org/320484@main\n"
    },
    {
      "commit": "b7794d481cec9bcf56e76492f68d4d44e0686cfd",
      "tree": "b9484b0d57bbea1e1e19fd1cfd175b541e490d38",
      "parents": [
        "f8e5626fddd9625271f3eb084950be6ba42b74b1"
      ],
      "author": {
        "name": "Kiet Ho",
        "email": "kiet.ho@apple.com",
        "time": "Fri Sep 04 04:49:03 2026"
      },
      "committer": {
        "name": "Kiet Ho",
        "email": "kiet.ho@apple.com",
        "time": "Fri Sep 04 04:49:03 2026"
      },
      "message": "Refactor CachedCSSStyleSheet::sheetText to return std::expected\nrdar://186388202\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323125\n\nReviewed by Alex Christensen.\n\nCachedCSSStyleSheet::sheetText signals error by setting the passed in\nboolean pointers, if they\u0027re set. This is inelegant, and particularly\nthere\u0027s a bug where the booleans only get set when an error occur.\n\nTake this opportunity to refactor CachedCSSStyleSheet::sheetText to\nreturn std::expected. If an error occurs, then it returns an Error\nenum, otherwise it returns the CSS text.\n\nRefactoring, tested by existing test suite.\n\n* Source/WebCore/css/StyleSheetContents.cpp:\n(WebCore::StyleSheetContents::parseAuthorStyleSheet):\n* Source/WebCore/dom/ProcessingInstruction.cpp:\n(WebCore::ProcessingInstruction::setCSSStyleSheet):\n* Source/WebCore/inspector/InspectorResourceUtilities.cpp:\n(Inspector::ResourceUtilities::cachedResourceContent):\n* Source/WebCore/loader/cache/CachedCSSStyleSheet.cpp:\n(WebCore::CachedCSSStyleSheet::sheetText const):\n(WebCore::CachedCSSStyleSheet::canUseSheet const):\n* Source/WebCore/loader/cache/CachedCSSStyleSheet.h:\n\nCanonical link: https://commits.webkit.org/320483@main\n"
    },
    {
      "commit": "f8e5626fddd9625271f3eb084950be6ba42b74b1",
      "tree": "b39d6b021f5f1b066550a60490c389bc4b18256b",
      "parents": [
        "f2edbf67293a4f7ab9551a9012b169508e862a75"
      ],
      "author": {
        "name": "Ahmad Saleem",
        "email": "ahmad.saleem792+github@gmail.com",
        "time": "Fri Sep 04 04:47:56 2026"
      },
      "committer": {
        "name": "Ahmad Saleem",
        "email": "ahmad.saleem792@gmail.com",
        "time": "Fri Sep 04 04:47:56 2026"
      },
      "message": "Simplify icon \"purpose\" parsing in ApplicationManifestParser\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323299\nrdar://186547640\n\nReviewed by Chris Dumez.\n\nThe three code paths handling an icon\u0027s \"purpose\" member each duplicated\nthe `currentIcon.purposes \u003d purposes;` assignment, nested two levels deep.\nHoist that assignment to a single statement after the branches and flatten\nthe else-if chain. No behavior change: a missing or non-string \"purpose\"\nstill defaults to Any, valid keywords are still collected, and an icon whose\n\"purpose\" contains no valid keywords is still dropped.\n\n* Source/WebCore/Modules/applicationmanifest/ApplicationManifestParser.cpp:\n(WebCore::ApplicationManifestParser::parseIcons):\n\nCanonical link: https://commits.webkit.org/320482@main\n"
    },
    {
      "commit": "f2edbf67293a4f7ab9551a9012b169508e862a75",
      "tree": "5017f9722ad2c79070f0eaf4d0abed22fbabf762",
      "parents": [
        "dc774f0cde658499d412683a1f9e69e061b0ff97"
      ],
      "author": {
        "name": "Ahmad Saleem",
        "email": "ahmad.saleem792+github@gmail.com",
        "time": "Fri Sep 04 04:47:11 2026"
      },
      "committer": {
        "name": "Ahmad Saleem",
        "email": "ahmad.saleem792@gmail.com",
        "time": "Fri Sep 04 04:47:11 2026"
      },
      "message": "Deduplicate identical image/png and image/svg+xml read branches in Clipboard::getType\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323394\nrdar://186626780\n\nReviewed by Chris Dumez.\n\nClipboard::getType() handled the \"image/png\" and \"image/svg+xml\" content\ntypes with two byte-identical blocks: each constructed a\nClipboardImageReader, read the active pasteboard, took the resulting blob,\nrevalidated the session via updateSessionValidity(), and resolved or\nrejected the promise. Collapse them into a single branch guarded by both\ntype checks. No behavior change.\n\n* Source/WebCore/Modules/async-clipboard/Clipboard.cpp:\n(WebCore::Clipboard::getType):\n\nCanonical link: https://commits.webkit.org/320481@main\n"
    },
    {
      "commit": "dc774f0cde658499d412683a1f9e69e061b0ff97",
      "tree": "7fae654465eaaeaa3c120eae1c23e759b8433fa7",
      "parents": [
        "fcfb4293170de8c5de572164a5ab42b0a48a8780"
      ],
      "author": {
        "name": "Ahmad Saleem",
        "email": "ahmad.saleem792+github@gmail.com",
        "time": "Fri Sep 04 04:45:27 2026"
      },
      "committer": {
        "name": "Ahmad Saleem",
        "email": "ahmad.saleem792@gmail.com",
        "time": "Fri Sep 04 04:45:27 2026"
      },
      "message": "Use WTF::switchOn for the BufferOrString variant in ClipboardItemBindingsDataSource\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323363\nrdar://186603909\n\nReviewed by Chris Dumez.\n\nClipboardItemBindingsDataSource::ClipboardItemTypeLoader::m_data is a\nVariant\u003cString, Ref\u003cSharedBuffer\u003e\u003e, but it was hand-decoded with\nstd::holds_alternative + std::get pairs in three places. Besides being\nverbose, the form in invokeCompletionHandler() only rejected an\nunexpected alternative via a catch-all else, so an added variant\nalternative could silently fall through elsewhere.\n\nReplace the manual decoding with WTF::switchOn, which is exhaustive over\nthe variant\u0027s alternatives and lets the compiler enforce that every\nalternative is handled. No change in behavior: invokeCompletionHandler()\nstill rejects on a null String, and both dataAsString() and the image/png\nsanitization path resolve to the same values as before.\n\n* Source/WebCore/Modules/async-clipboard/ClipboardItemBindingsDataSource.cpp:\n(WebCore::ClipboardItemBindingsDataSource::invokeCompletionHandler):\n(WebCore::ClipboardItemBindingsDataSource::ClipboardItemTypeLoader::dataAsString const):\n(WebCore::ClipboardItemBindingsDataSource::ClipboardItemTypeLoader::sanitizeDataIfNeeded):\n\nCanonical link: https://commits.webkit.org/320480@main\n"
    },
    {
      "commit": "fcfb4293170de8c5de572164a5ab42b0a48a8780",
      "tree": "c29888bb1abafecd30426341b4c4ed1fc0301561",
      "parents": [
        "7c509707e29d40a0e194ac5fe89f796da4f05e7a"
      ],
      "author": {
        "name": "Ahmad Saleem",
        "email": "ahmad.saleem792+github@gmail.com",
        "time": "Fri Sep 04 04:43:56 2026"
      },
      "committer": {
        "name": "Ahmad Saleem",
        "email": "ahmad.saleem792@gmail.com",
        "time": "Fri Sep 04 04:43:56 2026"
      },
      "message": "DOMAudioSession::type() redundantly tests the document twice against the same fallback\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323395\nrdar://186627178\n\nReviewed by Chris Dumez.\n\nDOMAudioSession::type() tested the document twice, once implicitly and once\nexplicitly, both returning Type::Auto. Collapse them into the single guard\nthat state() already uses correctly. No change in behavior, so no new tests.\n\n* Source/WebCore/Modules/audiosession/DOMAudioSession.cpp:\n(WebCore::DOMAudioSession::type const):\n\nCanonical link: https://commits.webkit.org/320479@main\n"
    },
    {
      "commit": "7c509707e29d40a0e194ac5fe89f796da4f05e7a",
      "tree": "a1632cb250466e719d90aaff0f039a7e6254061a",
      "parents": [
        "635ad039f2d9ff604dbce90e1ef72e293ab4f182"
      ],
      "author": {
        "name": "Ahmad Saleem",
        "email": "ahmad.saleem792+github@gmail.com",
        "time": "Fri Sep 04 04:40:41 2026"
      },
      "committer": {
        "name": "Ahmad Saleem",
        "email": "ahmad.saleem792@gmail.com",
        "time": "Fri Sep 04 04:40:41 2026"
      },
      "message": "Add early-return to `SVGAElement::isKeyboardFocusable` and drop redundant `isFocusable()` checks\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d281540\nrdar://138005652\n\nReviewed by Chris Dumez.\n\nThis adds an early return when the element is not focusable in\n\u0027SVGAElement::isKeyboardFocusable\u0027, matching \u0027HTMLAnchorElement::isKeyboardFocusable\u0027,\nand then removes the now-redundant \u0027isFocusable()\u0027 from the following condition in\nboth functions, since it is already guaranteed by the early return above it.\n\nThis is not a change in behavior. \u0027Element::isKeyboardFocusable\u0027, which both of these\noverride and call through to, already returns false when \u0027isFocusable()\u0027 is false, and\nthe two intermediate early returns (\u0027!frame\u0027 and \u0027isLink() \u0026\u0026 !tabsToLinks()\u0027) return\nfalse as well, so every path already returned false for a non-focusable element. The\nearly return just avoids the frame lookup and the \u0027tabsToLinks()\u0027 query, neither of\nwhich has an observable side effect. No new tests, since no behavior change is\nobservable from content.\n\n* Source/WebCore/html/HTMLAnchorElement.cpp:\n(WebCore::HTMLAnchorElement::isKeyboardFocusable const):\n* Source/WebCore/svg/SVGAElement.cpp:\n(WebCore::SVGAElement::isKeyboardFocusable const):\n\nCanonical link: https://commits.webkit.org/320478@main\n"
    },
    {
      "commit": "635ad039f2d9ff604dbce90e1ef72e293ab4f182",
      "tree": "62578ef7dc801ccd20dba8598cd771ef34ebecdd",
      "parents": [
        "f492fdc1e11419bcc5693266ceed6f518d9fef0c"
      ],
      "author": {
        "name": "Ahmad Saleem",
        "email": "ahmad.saleem792+github@gmail.com",
        "time": "Fri Sep 04 04:39:29 2026"
      },
      "committer": {
        "name": "Ahmad Saleem",
        "email": "ahmad.saleem792@gmail.com",
        "time": "Fri Sep 04 04:39:29 2026"
      },
      "message": "Avoid per-item String and Ref\u003cDOMPromise\u003e copies in ClipboardItemBindingsDataSource::collectDataForWriting()\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323306\nrdar://186553836\n\nReviewed by Chris Dumez.\n\nWhile mapping m_itemPromises (a Vector\u003cKeyValuePair\u003cString, Ref\u003cDOMPromise\u003e\u003e\u003e)\nto item type loaders, collectDataForWriting() made a redundant copy of each\nentry\u0027s key and value. The String key was copied into a local even though it\nis only passed to ClipboardItemTypeLoader::create(), which takes a const\nString\u0026, before being captured by copy into the whenSettledWithResult()\ncallback; the inner capture is the only copy actually required. The\nRef\u003cDOMPromise\u003e value was copied into a local (an atomic refcount bump) even\nthough it is only used once to invoke promise-\u003ewhenSettledWithResult() and is\nnever captured.\n\nBind both by reference instead, dropping one String copy and one\nRef\u003cDOMPromise\u003e refcount round-trip per clipboard item written.\n\n* Source/WebCore/Modules/async-clipboard/ClipboardItemBindingsDataSource.cpp:\n(WebCore::ClipboardItemBindingsDataSource::collectDataForWriting):\n\nCanonical link: https://commits.webkit.org/320477@main\n"
    },
    {
      "commit": "f492fdc1e11419bcc5693266ceed6f518d9fef0c",
      "tree": "b2d55e2f420ef50784a244864d6c6ec70e34a884",
      "parents": [
        "a0042af348458a9d9de2ec3f1636424c20163818"
      ],
      "author": {
        "name": "Ahmad Saleem",
        "email": "ahmad.saleem792+github@gmail.com",
        "time": "Fri Sep 04 04:38:10 2026"
      },
      "committer": {
        "name": "Ahmad Saleem",
        "email": "ahmad.saleem792@gmail.com",
        "time": "Fri Sep 04 04:38:10 2026"
      },
      "message": "Remove dead reportingObservers local in ReportingScope::notifyReportObservers()\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323292\nrdar://186543781\n\nReviewed by Chris Dumez.\n\nThe reportingObservers local was computed and immediately discarded via\nUNUSED_VARIABLE, serving no purpose. Remove it.\n\n* Source/WebCore/Modules/reporting/ReportingScope.cpp:\n(WebCore::ReportingScope::notifyReportObservers):\n\nCanonical link: https://commits.webkit.org/320476@main\n"
    },
    {
      "commit": "a0042af348458a9d9de2ec3f1636424c20163818",
      "tree": "fe7d4b1baf8398c8242c0acc24500834a13486fd",
      "parents": [
        "0d58b764f34b86ecf520ac7954b7aa1ded15cc5e"
      ],
      "author": {
        "name": "Yusuke Suzuki",
        "email": "ysuzuki@apple.com",
        "time": "Fri Sep 04 04:27:22 2026"
      },
      "committer": {
        "name": "Yusuke Suzuki",
        "email": "ysuzuki@apple.com",
        "time": "Fri Sep 04 04:27:22 2026"
      },
      "message": "[JSC] Add \"dc zva\" zero-fill loop for sanitizeStackForVM\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323368\nrdar://186606262\n\nReviewed by Marcus Plutowski.\n\nThis patch adds \"dc zva\" zero-fill code for sanitizeStackForVM.\nClearing stack can be dramatically large, and \"dc zva\" loop can be\nfaster to zero-fill these region. Currently we only allow it when\ndczid_el0 is configured to be 4 in OS.\nAlso, for smaller size, stp is faster than stnp, so now \"dc zva\" handles\nlarge region and stp will fill the gap.\n\nWe may apply the same to zero-filling locals at the top of interpreter,\nand potentially using it in JIT as well as a subsequent change.\n\n* Source/JavaScriptCore/llint/LowLevelInterpreter.asm:\n\nCanonical link: https://commits.webkit.org/320475@main\n"
    },
    {
      "commit": "0d58b764f34b86ecf520ac7954b7aa1ded15cc5e",
      "tree": "1a058db4132a8567ba4cf5c7480d4450c42a4a2f",
      "parents": [
        "1f4a1bf5458ebec31d9a3fb2f67504f9c4d92513"
      ],
      "author": {
        "name": "Alex Christensen",
        "email": "achristensen@apple.com",
        "time": "Fri Sep 04 03:06:51 2026"
      },
      "committer": {
        "name": "Chris Dumez",
        "email": "cdumez@apple.com",
        "time": "Fri Sep 04 03:06:51 2026"
      },
      "message": "Fix crash in MemoryCache::add after 315967@main\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323053\nrdar://182493844\n\nReviewed by Chris Dumez.\n\n_WKUserStyleSheet can be used to load a font very early in the document creation process.\nIt was loading before the firstPartyForCookies was set, then later the firstPartyForCookies\nwas being updated, which caused inconsistent state in the memory cache which hit the\nrelease assertion.\n\nThis adds a missing call to updateFirstPartyForCookies to update earlier if necessary.\nThe test also hit the debug assertion in FrameLoader::applyUserAgentIfNeeded because\nthe user agent was null.  I move the user agent setting to earlier in the WebPage constructor\nto avoid calling initWithCoreMainFrame with a null user agent, which caused the debug assert.\n\nI added a layout test that hits the MemoryCache issue, but it doesn\u0027t hit the user agent\nissue, so I also added an API test that does.\n\nTests: Tools/TestWebKitAPI/Tests/WebKit/WKWebView/MemoryCachePartitioning.mm\n       Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SecurityFlags.mm\n       http/tests/cache/memory-cache-partition-drift.html\n\n* Source/WebCore/loader/FrameLoader.h:\n* Source/WebCore/page/LocalFrame.cpp:\n(WebCore::LocalFrame::setDocument):\n* Source/WebKit/WebProcess/WebPage/WebPage.cpp:\n(WebKit::WebPage::WebPage):\n(WebKit::m_allowsImmersiveEnvironments):\n* Tools/TestWebKitAPI/SourcesCocoa.txt:\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/MemoryCachePartitioning.mm: Added.\n(TestWebKitAPI::TEST(MemoryCache, FontFromUserStyleSheetKeepsCachePartition)):\n* LayoutTests/http/tests/cache/memory-cache-partition-drift-expected.txt: Added.\n* LayoutTests/http/tests/cache/memory-cache-partition-drift.html: Added.\n* LayoutTests/http/tests/cache/resources/memory-cache-partition-drift-frame.html: Added.\n* LayoutTests/http/tests/cache/resources/no-store-font.py: Added.\n* Tools/TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:\n* Tools/WebKitTestRunner/TestController.cpp:\n(WTR::TestController::resetPreferencesToConsistentValues):\n* Tools/WebKitTestRunner/TestOptions.cpp:\n(WTR::TestOptions::defaults):\n(WTR::TestOptions::keyTypeMapping):\n* Tools/WebKitTestRunner/TestOptions.h:\n(WTR::TestOptions::blockThirdPartyStorage const):\n\nCanonical link: https://commits.webkit.org/320474@main\n"
    },
    {
      "commit": "1f4a1bf5458ebec31d9a3fb2f67504f9c4d92513",
      "tree": "c8f2e6f199937afb71ea19d684e505c22d785488",
      "parents": [
        "c0646476dd4967d5dd33b22586b0d0842c0ec388"
      ],
      "author": {
        "name": "Ahmad Saleem",
        "email": "ahmad.saleem792+github@gmail.com",
        "time": "Fri Sep 04 02:40:27 2026"
      },
      "committer": {
        "name": "Ahmad Saleem",
        "email": "ahmad.saleem792@gmail.com",
        "time": "Fri Sep 04 02:40:27 2026"
      },
      "message": "Negative z-index layer inside stacking context fails to composite when overlapping external composited layer\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d272318\nrdar://130595406\n\nReviewed by Matt Woodrow.\n\nREGRESSION (249828@main, 254746@main).\n\nWhen a layer has negative z-order children and isn\u0027t yet composited, we push a speculative\ncompositing container onto the overlap map (254746@main, bug 244543), which keeps those children\nfrom polluting the overlap map and causing unnecessary compositing of later siblings. However,\noverlapsLayers() then returned false unconditionally while the speculative stack was live, which\nprevents negative z-index children from detecting genuine overlap with layers that were already\ncomposited earlier in paint order.\n\nThis means a negative z-index child inside a z-index: 1 stacking context that geometrically\noverlaps a composited layer (z-index: auto/0) outside the stacking context never gets\ncomposited for overlap, so it paints into the root backing store behind the composited\nlayer\u0027s GraphicsLayer - wrong stacking order.\n\nThe fix is to test against m_overlapStack.last() instead of returning false. While a speculative\ncontainer is live, m_overlapStack.last() holds exactly the overlap state as of the speculative\npush: add() only ever writes to m_overlapStack[size - 2], and no container can be pushed or popped\nwithout first confirming or discarding the speculative stack. Negative z-order children therefore\nsee the bounds of already-composited layers, but nothing contributed by the speculative traversal\nitself, so they still don\u0027t force each other to composite and the fix for bug 244543 is preserved.\nno-compositing-for-overlapping-negative-z-siblings.html covers that half of the behavior, which a\nreference test cannot: two overlapping negative z-order children inside a composited (non-root)\nancestor, overlapping nothing composited, must not create any layers.\n\nNote the composited box in the reference tests is offset horizontally from the stacking context:\nthe stacking contexts in these tests have no in-flow content, so their overlap rect is an empty\nrect inflated to 1x1 at their origin, and a composited box covering that point would promote the\nstacking context itself for overlap before its negative z-order children are visited, making the\ntests pass with or without this change.\n\n* Source/WebCore/rendering/LayerOverlapMap.cpp:\n(WebCore::LayerOverlapMap::overlapsLayers const):\n* LayoutTests/compositing/layer-creation/no-compositing-for-overlapping-negative-z-siblings-expected.txt: Added.\n* LayoutTests/compositing/layer-creation/no-compositing-for-overlapping-negative-z-siblings.html: Added.\n* LayoutTests/compositing/z-order/multiple-negative-z-in-stacking-context-above-composited-expected.html: Added.\n* LayoutTests/compositing/z-order/multiple-negative-z-in-stacking-context-above-composited.html: Added.\n* LayoutTests/compositing/z-order/negative-z-in-stacking-context-above-composited-expected.html: Added.\n* LayoutTests/compositing/z-order/negative-z-in-stacking-context-above-composited.html: Added.\n* LayoutTests/compositing/z-order/negative-z-overlap-and-non-overlap-with-composited-expected.html: Added.\n* LayoutTests/compositing/z-order/negative-z-overlap-and-non-overlap-with-composited.html: Added.\n\nCanonical link: https://commits.webkit.org/320473@main\n"
    },
    {
      "commit": "c0646476dd4967d5dd33b22586b0d0842c0ec388",
      "tree": "ccf7c81cc2704d9a45279007ec65179705c0dc17",
      "parents": [
        "7b5f5df9aba3f2e84f450068496c3ec50fd89d23"
      ],
      "author": {
        "name": "Harrison Weinerman",
        "email": "hmw@apple.com",
        "time": "Fri Sep 04 02:25:30 2026"
      },
      "committer": {
        "name": "Abrar Rahman Protyasha",
        "email": "a_protyasha@apple.com",
        "time": "Fri Sep 04 02:25:30 2026"
      },
      "message": "Add callback for completed Apple Pay transactions\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323353\nrdar://186229850\n\nReviewed by Abrar Rahman Protyasha.\n\nClients may need a notification when an Apple Pay transaction completes, which does not currently exist.\n\n* Source/WebKit/UIProcess/API/APIUIClient.h:\n(API::UIClient::didCompleteApplePayPayment):\n* Source/WebKit/UIProcess/API/Cocoa/WKUIDelegatePrivate.h:\n* Source/WebKit/UIProcess/Cocoa/UIDelegate.h:\n* Source/WebKit/UIProcess/Cocoa/UIDelegate.mm:\n(WebKit::UIDelegate::setDelegate):\n(WebKit::UIDelegate::UIClient::didCompleteApplePayPayment):\n* Source/WebKit/UIProcess/Cocoa/WebPageProxyCocoa.mm:\n(WebKit::WebPageProxy::didCompleteApplePayPayment):\n* Source/WebKit/UIProcess/WebPageProxy.h:\n* Source/WebKit/UIProcess/WebPageProxy.messages.in:\n* Source/WebKit/WebProcess/ApplePay/WebPaymentCoordinator.cpp:\n(WebKit::WebPaymentCoordinator::completePaymentSession):\n\nCanonical link: https://commits.webkit.org/320472@main\n"
    },
    {
      "commit": "7b5f5df9aba3f2e84f450068496c3ec50fd89d23",
      "tree": "8ec8485a9fb497d6c74fc150c7b2405415ccc3f7",
      "parents": [
        "0927bf2fe3887f4103703b82f2f7d3cbc30c7260"
      ],
      "author": {
        "name": "Anthony Tarbinian",
        "email": "atar137h@gmail.com",
        "time": "Fri Sep 04 00:53:11 2026"
      },
      "committer": {
        "name": "Anthony Tarbinian",
        "email": "a_tarbinian@apple.com",
        "time": "Fri Sep 04 00:53:11 2026"
      },
      "message": "[Site Isolation] Concurrent navigations to the same site should share the same process\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d321029\nrdar://184063194\n\nReviewed by Sihui Liu.\n\nWith site isolation enabled, there is a race where two concurrent navigations to\nthe same site can create two different web processes. It is expected that\nnavigations to the same site should be in the same process.\n\nBoth navigations reach WebProcessPool::processForNavigation and notice that\nBrowsingContextGroup::m_processMap doesn\u0027t have an existing process entry for\ntheir site. So, they both create a new web process for themselves, creating two\nprocesses for the same site.\n\nThe entry isn\u0027t added until ProvisionalPageProxy::initializeWebPage runs, and\nfor a main frame navigation that is on the far side of the\naddAllowedFirstPartyForCookies IPC in prepareProcessForNavigation. Any\nnavigation that reaches prepareProcessForNavigation during that gap\nsees an empty process map for the same site.\n\nIn this patch, I reserve a process before that hop, in\nprepareProcessForNavigation. This also keeps the reservation up to date\nsince prepareProcessForNavigation is called multiple times to retry\nprocess selection if the chosen process dies during the\n`addAllowedFirstPartyForCookies` IPC.\nTo perform the reservation I call BrowsingContextGroup::ensureProcessForSite there,\nthen register the site and inject page context for the group\u0027s other pages,\nexactly as initializeWebPage does.\n\nm_processMap only holds the FrameProcess weakly, so something has to keep it\nalive in the meantime. I capture a strong reference in the completion handler\nused for the retry attempts, so the reservation lasts exactly until that\nhandler has run. By then continueNavigationInNewProcess has created the\nProvisionalPageProxy that owns the FrameProcess, or the navigation was abandoned\nand nobody needs it. I don\u0027t store it in API::Navigation, because a navigation\noutlives the frames using its process. That was the leak 319916@main fixed by\ndeleting the equivalent reference for the shared process.\n\nThis patch only handles main frame navigations. Subframe navigations return\nfrom processForNavigation synchronously and create the ProvisionalFrameProxy\nthat registers the site in the same task, so two of them can never both find\nthe site unregistered.\n\nTests: http/tests/site-isolation/concurrent-same-site-navigations-use-same-process.html\n       TestWebKitAPI.SiteIsolation.ConcurrentPopupNavigationsToSameSiteShareProcessWhenOneFails\n\n* LayoutTests/http/tests/site-isolation/concurrent-same-site-navigations-use-same-process-expected.txt: Added.\n* LayoutTests/http/tests/site-isolation/concurrent-same-site-navigations-use-same-process.html: Added.\n* Source/WebKit/UIProcess/WebProcessPool.cpp:\n(WebKit::WebProcessPool::processForNavigation):\n(WebKit::WebProcessPool::prepareProcessForNavigation):\n* Source/WebKit/UIProcess/WebProcessPool.h:\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolation.mm:\n(TestWebKitAPI::TEST(SiteIsolation, ConcurrentPopupNavigationsToSameSiteShareProcessWhenOneFails)):\n\nCanonical link: https://commits.webkit.org/320471@main\n"
    },
    {
      "commit": "0927bf2fe3887f4103703b82f2f7d3cbc30c7260",
      "tree": "f303fe75a64e06c0bdf212b9c9235d7ee18c2b1a",
      "parents": [
        "b6fb7aad68ce9f58d7c1c3a9f345ea7cb9ea0015"
      ],
      "author": {
        "name": "Mike Wyrzykowski",
        "email": "mwyrzykowski@apple.com",
        "time": "Fri Sep 04 00:31:06 2026"
      },
      "committer": {
        "name": "Mike Wyrzykowski",
        "email": "mwyrzykowski@apple.com",
        "time": "Fri Sep 04 00:31:06 2026"
      },
      "message": "fix typo in IOSurfacePool.h\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323379\nrdar://186614058\n\nReviewed by Alex Christensen.\n\nThis has been mispelled for ~5 years so it got missed when\nDestinationColorSpace was renamed to ColorSpace.\n\n* Source/WebCore/platform/graphics/cg/IOSurfacePool.h:\n\nCanonical link: https://commits.webkit.org/320470@main\n"
    },
    {
      "commit": "b6fb7aad68ce9f58d7c1c3a9f345ea7cb9ea0015",
      "tree": "a2c3b2a35c7df8039744c7206a83c228d4dbb83c",
      "parents": [
        "0491e835aaeb89231f2ee5bd0ea3396e5c9535f7"
      ],
      "author": {
        "name": "Issac Roy",
        "email": "issacroy05@gmail.com",
        "time": "Fri Sep 04 00:29:44 2026"
      },
      "committer": {
        "name": "Issac Roy",
        "email": "iroy@apple.com",
        "time": "Fri Sep 04 00:29:44 2026"
      },
      "message": "[resultsdbpy] The EWS upload and query endpoints are missing from /documentation\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323344\n\u003crdar://problem/186585819\u003e\n\nReviewed by Sam Sneddon.\n\n`/documentation` describes every results-database endpoint except the three EWS\nones. `/upload/ews`, `/results-ews` and `/results-ews/tests` have no entry, so\nthe only way to learn that its `results` is a flat map rather than a trie, that\n`flaky_type` decides which table an upload lands in, or that a query with no\nmatches answers 404 rather than an empty list is to read `ews_controller.py`.\n\nDocument the three, including the behaviours a caller cannot guess from the\nshape of a response: `limit` is applied per test rather than shared across the\nbatch, so a 50-test request can return 50 times the limit; `MAX_TESTS_PER_QUERY`\ncaps a request at 100 names, but the names travel in the query string, so long\ntest paths overflow the request line well before that cap; a `timestamp` may\nbackfill an older result but not one more than five minutes ahead; and\n`/results-ews/tests` defaults to 100 names, which makes a default-length answer\na sample rather than the whole catalog.\n\n* Tools/Scripts/libraries/resultsdbpy/resultsdbpy/view/templates/documentation.html:\n\nCanonical link: https://commits.webkit.org/320469@main\n"
    },
    {
      "commit": "0491e835aaeb89231f2ee5bd0ea3396e5c9535f7",
      "tree": "20a8c8f095b1a82f738d280a2d650fb3d814202a",
      "parents": [
        "4b594da11bb25377198f0a4a47617f8cf7085d90"
      ],
      "author": {
        "name": "Tyler Wilcock",
        "email": "tyler_w@apple.com",
        "time": "Fri Sep 04 00:18:10 2026"
      },
      "committer": {
        "name": "Tyler Wilcock",
        "email": "tyler_w@apple.com",
        "time": "Fri Sep 04 00:18:10 2026"
      },
      "message": "AX: Add layout tests for form control state reaching accessibility\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323356\nrdar://186598685\n\nReviewed by Chris Fleizach.\n\nrequired-control-invalid-status.html:\nNo test called checkValidity(). Asserts AXInvalid and checkValidity() agree on the same\ncontrol, and that aria-invalid wins over the native state (a branch that was untested).\n\ncustom-validity-invalid-status.html:\nNo test called setCustomValidity() and verified AXInvalid changed to match.\n\nfieldset-disabled-propagation.html:\nNo test both used a disabled fieldset and asserted the enabled state it propagates.\nCovers HTML\u0027s first-legend exemption, the rule most likely to be lost in a refactor.\n\n* LayoutTests/accessibility/isolated-tree/mac/custom-validity-invalid-status-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/custom-validity-invalid-status.html: Added.\n* LayoutTests/accessibility/isolated-tree/mac/fieldset-disabled-propagation-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/fieldset-disabled-propagation.html: Added.\n* LayoutTests/accessibility/isolated-tree/mac/required-control-invalid-status-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/required-control-invalid-status.html: Added.\n* LayoutTests/accessibility/mac/custom-validity-invalid-status-expected.txt: Added.\n* LayoutTests/accessibility/mac/custom-validity-invalid-status.html: Added.\n* LayoutTests/accessibility/mac/fieldset-disabled-propagation-expected.txt: Added.\n* LayoutTests/accessibility/mac/fieldset-disabled-propagation.html: Added.\n* LayoutTests/accessibility/mac/required-control-invalid-status-expected.txt: Added.\n* LayoutTests/accessibility/mac/required-control-invalid-status.html: Added.\n\nCanonical link: https://commits.webkit.org/320468@main\n"
    },
    {
      "commit": "4b594da11bb25377198f0a4a47617f8cf7085d90",
      "tree": "2f3722987265726d848febd5ff0cb69cf4b44fe8",
      "parents": [
        "7d9b535a65731303029650179df74902e0828281"
      ],
      "author": {
        "name": "Tyler Wilcock",
        "email": "tyler_w@apple.com",
        "time": "Fri Sep 04 00:15:21 2026"
      },
      "committer": {
        "name": "Tyler Wilcock",
        "email": "tyler_w@apple.com",
        "time": "Fri Sep 04 00:15:21 2026"
      },
      "message": "AX: Add layout tests for accessibility attributes that had none (AXContents, AXTabs), and new coverage for editable design-mode web areas\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323343\nrdar://186583544\n\nReviewed by Chris Fleizach.\n\nscroll-view-contents.html:\nAXContents had zero tests prior to this one.\n\ntab-list-tabs.html:\nAXTabs had zero tests prior to this one.\n\ndesign-mode-editable-ancestor.html:\nAXEditableAncestor and AXHighestEditableAncestor had two tests each, so unlike the two\nabove the attribute is not new here -- the branch is. editableAncestor() matches an\nancestor that is either a text control or an editable web area, and document.designMode\nis the only way to reach the second without contenteditable. No existing test does this.\n\n* LayoutTests/accessibility/isolated-tree/mac/design-mode-editable-ancestor-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/design-mode-editable-ancestor.html: Added.\n* LayoutTests/accessibility/isolated-tree/mac/scroll-view-contents-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/scroll-view-contents.html: Added.\n* LayoutTests/accessibility/isolated-tree/mac/tab-list-tabs-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/tab-list-tabs.html: Added.\n* LayoutTests/accessibility/mac/design-mode-editable-ancestor-expected.txt: Added.\n* LayoutTests/accessibility/mac/design-mode-editable-ancestor.html: Added.\n* LayoutTests/accessibility/mac/scroll-view-contents-expected.txt: Added.\n* LayoutTests/accessibility/mac/scroll-view-contents.html: Added.\n* LayoutTests/accessibility/mac/tab-list-tabs-expected.txt: Added.\n* LayoutTests/accessibility/mac/tab-list-tabs.html: Added.\n\nCanonical link: https://commits.webkit.org/320467@main\n"
    },
    {
      "commit": "7d9b535a65731303029650179df74902e0828281",
      "tree": "9b59c720e1d5db66b30e0eb6695221b8eb71b10d",
      "parents": [
        "9e098ca11b8f8de1ffc6bcd45ea2aabae15d7912"
      ],
      "author": {
        "name": "Tyler Wilcock",
        "email": "tyler_w@apple.com",
        "time": "Fri Sep 04 00:01:46 2026"
      },
      "committer": {
        "name": "Tyler Wilcock",
        "email": "tyler_w@apple.com",
        "time": "Fri Sep 04 00:01:46 2026"
      },
      "message": "AX: Add layout tests for line / sentence / word text marker boundary round trips\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323335\nrdar://186579669\n\nReviewed by Chris Fleizach.\n\nEach of these asserts that stepping forward to a unit\u0027s end and back to its start\nreturns to where it started, from any position inside the unit. The existing tests\nwalk one direction and dump what they see, so a drift moving both directions equally\nreads as correct. Each covers a hard line break and a soft wrap, since a line break of\neither kind is what most often moves a boundary.\n\nline-boundary-round-trip.html:\nAXNextLineEndTextMarkerForTextMarker and AXPreviousLineStartTextMarkerForTextMarker\neach had tests, but nothing asserted they round-trip. Covers lines broken by a br element\nand lines broken only by wrapping.\n\nword-boundary-round-trip.html:\nSame round trip testing for word APIs.\n\nsentence-boundary-round-trip.html:\nSame round trip testing for sentence APIs.\n\n* LayoutTests/accessibility/isolated-tree/mac/line-boundary-round-trip-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/line-boundary-round-trip.html: Added.\n* LayoutTests/accessibility/isolated-tree/mac/sentence-boundary-round-trip-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/sentence-boundary-round-trip.html: Added.\n* LayoutTests/accessibility/isolated-tree/mac/word-boundary-round-trip-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/word-boundary-round-trip.html: Added.\n* LayoutTests/accessibility/mac/line-boundary-round-trip-expected.txt: Added.\n* LayoutTests/accessibility/mac/line-boundary-round-trip.html: Added.\n* LayoutTests/accessibility/mac/sentence-boundary-round-trip-expected.txt: Added.\n* LayoutTests/accessibility/mac/sentence-boundary-round-trip.html: Added.\n* LayoutTests/accessibility/mac/word-boundary-round-trip-expected.txt: Added.\n* LayoutTests/accessibility/mac/word-boundary-round-trip.html: Added.\n\nCanonical link: https://commits.webkit.org/320466@main\n"
    },
    {
      "commit": "9e098ca11b8f8de1ffc6bcd45ea2aabae15d7912",
      "tree": "70f2383a75cee2413cb79eb3d2ed32df39e24f9e",
      "parents": [
        "ae4e64022c2f5abe9db96726c5f066812875a375"
      ],
      "author": {
        "name": "Issac Roy",
        "email": "issacroy05@gmail.com",
        "time": "Thu Sep 03 23:43:39 2026"
      },
      "committer": {
        "name": "Issac Roy",
        "email": "iroy@apple.com",
        "time": "Thu Sep 03 23:43:39 2026"
      },
      "message": "[EWS] API EWS runs the whole retry ladder for an already-known flaky failure\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323311\n\u003crdar://problem/186558544\u003e\n\nReviewed by Aakash Jain.\n\nWhen `run-api-tests` fails twice with the change, `ReRunAPITests.doOnFailure`\nqueues the revert, a rebuild and a clean-tree run, and only afterwards does\n`AnalyzeAPITestsResults` ask the results database whether those failures were\nflaky all along. `API-Tests-macOS-EWS` build 164902 spent 85 minutes on that\nladder before excusing a test the database records at a 98% pass rate.\n\nAsk at the point the ladder would be queued instead. Both runs with the change\nhave reported their `BetweenStepsDirtyTree` evidence by then, so no evidence the\nquery depends on is lost. The first run still cannot ask: `run-api-tests` has no\n`--treat-failing-as-flaky`, so it records one outcome per test, and a first-run\nverdict would empty the failure list, pass the step, and prevent the rerun that\nwrites the only evidence API can produce.\n\nCandidates are the failures both dirty runs share, taken from the same\n`_filtered` properties `AnalyzeAPITestsResults` reads and falling back the same\nway, so the two steps cannot disagree about what is excusable. When every\ncandidate has a verdict in `INCLUDED_FLAKY_VERDICTS` the build finishes green\nthrough `force_build_success` and skips the revert, the rebuild, the clean-tree\nrun and the analyze step. One unexplained failure queues the ladder unchanged.\n\nThe early exit reports those candidates itself. `parse_and_set_failures` reports\nonly the symmetric difference of the two runs, and the intersection was reported\nby `AnalyzeAPITestsResults`, which never runs on this path, so without a report\nhere the results-database rows for exactly the tests being excused would be\nlost. The two reports remain disjoint, so nothing is written twice.\n\n`flaky_new_failures_using_results_db` and `INCLUDED_FLAKY_VERDICTS` move to\n`ResultsDBReportMixin`, which both callers now share.\n\n* Tools/CISupport/ews-build/steps.py:\n(ResultsDBReportMixin):\n(ResultsDBReportMixin.flaky_new_failures_using_results_db):\n(RunAPITests.__init__):\n(RunAPITests.run):\n(ReRunAPITests.failures_in_both_dirty_runs):\n(ReRunAPITests):\n(ReRunAPITests.doOnFailure):\n(AnalyzeAPITestsResults):\n(AnalyzeAPITestsResults.run):\n(AnalyzeAPITestsResults.flaky_new_failures_using_results_db): Deleted.\n* Tools/CISupport/ews-build/steps_unittest.py:\n\nCanonical link: https://commits.webkit.org/320465@main\n"
    },
    {
      "commit": "ae4e64022c2f5abe9db96726c5f066812875a375",
      "tree": "5bf7282d388400a6242d8a093bada7b77a73d4a4",
      "parents": [
        "d9f0af20a0d11b23f2b3a3c80c976be1751742a3"
      ],
      "author": {
        "name": "Wenson Hsieh",
        "email": "wenson_hsieh@apple.com",
        "time": "Thu Sep 03 23:25:57 2026"
      },
      "committer": {
        "name": "Wenson Hsieh",
        "email": "wenson_hsieh@apple.com",
        "time": "Thu Sep 03 23:25:57 2026"
      },
      "message": "[Text Extraction] iOS: Override several mouse-related media queries when loading desktop-class content with background text extraction\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323355\nrdar://186475042\n\nReviewed by Abrar Rahman Protyasha and Richard Robinson.\n\nOverride several mouse, hover and pointer-related media queries to behave more like Mac in the case\nwhere:\n\n- Background text extraction is enabled\n- The client requests desktop content mode\n\nInstead of `(pointer: coarse)` and `(hover: none)`, we\u0027ll instead get `(pointer: fine)` and\n`(hover: hover)`.\n\nTest: TextExtractionTests.DesktopClassHardwareEmulationInDesktopContentMode\n\n* Source/WTF/Scripts/Preferences/UnifiedWebPreferences.yaml:\n* Source/WebCore/css/query/MediaQueryFeatures.cpp:\n(WebCore::MQ::Features::anyHoverFeatureSchema):\n(WebCore::MQ::Features::anyPointerFeatureSchema):\n(WebCore::MQ::Features::hoverFeatureSchema):\n(WebCore::MQ::Features::pointerFeatureSchema):\n* Source/WebKit/Shared/WebsitePoliciesData.cpp:\n(WebKit::WebsitePoliciesData::applyToSettings):\n(WebKit::WebsitePoliciesData::applyToDocumentLoader):\n* Source/WebKit/Shared/WebsitePoliciesData.h:\n* Source/WebKit/Shared/WebsitePoliciesData.serialization.in:\n* Source/WebKit/UIProcess/API/APIWebsitePolicies.h:\n* Source/WebKit/UIProcess/ios/WebPageProxyIOS.mm:\n(WebKit::WebPageProxy::effectiveContentModeAfterAdjustingPolicies):\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/TextExtractionTests.mm:\n\nCanonical link: https://commits.webkit.org/320464@main\n"
    },
    {
      "commit": "d9f0af20a0d11b23f2b3a3c80c976be1751742a3",
      "tree": "c5672bc3e66f61c16b50955e68eeb26ce96c21a4",
      "parents": [
        "09cf0cb360d81842e3aea21528537db8dd891c7b"
      ],
      "author": {
        "name": "Ahmad Saleem",
        "email": "ahmad.saleem792+github@gmail.com",
        "time": "Thu Sep 03 22:40:13 2026"
      },
      "committer": {
        "name": "Ahmad Saleem",
        "email": "ahmad.saleem792@gmail.com",
        "time": "Thu Sep 03 22:40:13 2026"
      },
      "message": "Remove dead declared-but-undefined member functions from ResourceMonitorThrottler\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323288\nrdar://186540356\n\nReviewed by Abrar Rahman Protyasha.\n\nThese five members are declared in the header but never defined or\ncalled. Remove the stale declarations. No behavior change.\n\n* Source/WebCore/loader/ResourceMonitorThrottler.h:\n\nCanonical link: https://commits.webkit.org/320463@main\n"
    },
    {
      "commit": "09cf0cb360d81842e3aea21528537db8dd891c7b",
      "tree": "a7fac55d5581631dabec4425279895c03f2fff82",
      "parents": [
        "ffffaa2b2c717ed716eb66afe6b596ace506bfb8"
      ],
      "author": {
        "name": "Ahmad Saleem",
        "email": "ahmad.saleem792+github@gmail.com",
        "time": "Thu Sep 03 22:24:14 2026"
      },
      "committer": {
        "name": "Ahmad Saleem",
        "email": "ahmad.saleem792@gmail.com",
        "time": "Thu Sep 03 22:24:14 2026"
      },
      "message": "MediaSession::setActionHandler() looks up the document multiple times and shadows a local\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323294\nrdar://186544360\n\nReviewed by Jer Noble.\n\nsetActionHandler() called document() once inside the ENABLE(MEDIA_STREAM)\nguard and again in an if-init statement that shadowed the first local, with\neach document() call dereferencing m_navigator-\u003ewindow() twice. Hoist a\nsingle RefPtr document to the top of the function (outside the MEDIA_STREAM\nguard, so it is used in every build) and reuse it.\n\nNo change in behavior.\n\n* Source/WebCore/Modules/mediasession/MediaSession.cpp:\n(WebCore::MediaSession::setActionHandler):\n\nCanonical link: https://commits.webkit.org/320462@main\n"
    },
    {
      "commit": "ffffaa2b2c717ed716eb66afe6b596ace506bfb8",
      "tree": "53c8a701da22d00e37332acfe6452a31bafdebf3",
      "parents": [
        "c7920bb4d79695c39c594708667389641397bb60"
      ],
      "author": {
        "name": "Alan Baradlay",
        "email": "zalan@apple.com",
        "time": "Thu Sep 03 22:22:13 2026"
      },
      "committer": {
        "name": "Alan Baradlay",
        "email": "zalan@apple.com",
        "time": "Thu Sep 03 22:22:13 2026"
      },
      "message": "[list-marker] Opening a \u003cdetails\u003e makes its summary one pixel shorter\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323168\nrdar://problem/186413478\n\nReviewed by Antti Koivisto.\n\n280433@main renders disclosure triangles with system-ui rather than with the font the marker inherited.\nIt gave RenderListMarker a font cascade of its own, built at paint time, and used it for painting,\nbut not for the marker box\u0027s height or its layout bounds, which stayed with the inherited font.\n\nMake the font part of the ::marker style instead, so that the glyph is measured with the font it is drawn with.\n\nTests: imported/w3c/web-platform-tests/css/css-counter-styles/counter-style-at-rule/disclosure-line-height-ref.html\n       imported/w3c/web-platform-tests/css/css-counter-styles/counter-style-at-rule/disclosure-line-height.html\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-counter-styles/counter-style-at-rule/disclosure-line-height-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-counter-styles/counter-style-at-rule/disclosure-line-height-ref.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-counter-styles/counter-style-at-rule/disclosure-line-height.html: Added.\n* Source/WebCore/rendering/RenderListItem.cpp:\n(WebCore::RenderListItem::computeMarkerStyle const):\n* Source/WebCore/rendering/RenderListMarker.cpp:\n(WebCore::RenderListMarker::paint):\n(WebCore::RenderListMarker::computeIntrinsicLogicalWidthContributions):\n(WebCore::RenderListMarker::relativeMarkerRect):\n(WebCore::disclosureMarkerFontCascade): Deleted.\n(WebCore::RenderListMarker::paintDisclosureMarker): Deleted.\n* Source/WebCore/rendering/RenderListMarker.h:\n* LayoutTests/fast/html/details-add-child-1-expected.txt:\n* LayoutTests/fast/html/details-add-child-2-expected.txt:\n* LayoutTests/fast/html/details-add-details-child-1-expected.txt:\n* LayoutTests/fast/html/details-add-details-child-2-expected.txt:\n* LayoutTests/fast/html/details-add-summary-10-expected.txt:\n* LayoutTests/fast/html/details-add-summary-6-expected.txt:\n* LayoutTests/fast/html/details-add-summary-7-expected.txt:\n* LayoutTests/fast/html/details-add-summary-8-expected.txt:\n* LayoutTests/fast/html/details-add-summary-9-expected.txt:\n* LayoutTests/fast/html/details-add-summary-child-1-expected.txt:\n* LayoutTests/fast/html/details-add-summary-child-2-expected.txt:\n* LayoutTests/fast/html/details-nested-1-expected.txt:\n* LayoutTests/fast/html/details-nested-2-expected.txt:\n* LayoutTests/fast/html/details-no-summary2-expected.txt:\n* LayoutTests/fast/html/details-open6-expected.txt:\n* LayoutTests/fast/html/details-remove-child-1-expected.txt:\n* LayoutTests/fast/html/details-remove-child-2-expected.txt:\n* LayoutTests/fast/html/details-remove-summary-4-expected.txt:\n* LayoutTests/fast/html/details-remove-summary-5-expected.txt:\n* LayoutTests/fast/html/details-remove-summary-6-expected.txt:\n* LayoutTests/fast/html/details-remove-summary-child-1-expected.txt:\n* LayoutTests/fast/html/details-remove-summary-child-2-expected.txt:\n* LayoutTests/platform/mac-wk2/fast/html/details-no-summary4-expected.txt:\n* LayoutTests/platform/mac-wk2/fast/html/details-open-javascript-expected.txt:\n* LayoutTests/platform/mac-wk2/fast/html/details-open2-expected.txt:\n* LayoutTests/platform/mac-wk2/fast/html/details-open4-expected.txt:\n* LayoutTests/platform/mac-wk2/fast/html/details-replace-summary-child-expected.txt:\n* LayoutTests/platform/mac-wk2/fast/html/details-replace-text-expected.txt:\n* LayoutTests/platform/mac/fast/css-generated-content/details-summary-before-after-expected.txt:\n* LayoutTests/platform/mac/fast/html/details-add-summary-1-and-click-expected.txt:\n* LayoutTests/platform/mac/fast/html/details-add-summary-1-expected.txt:\n* LayoutTests/platform/mac/fast/html/details-add-summary-10-and-click-expected.txt:\n* LayoutTests/platform/mac/fast/html/details-add-summary-2-and-click-expected.txt:\n* LayoutTests/platform/mac/fast/html/details-add-summary-2-expected.txt:\n* LayoutTests/platform/mac/fast/html/details-add-summary-3-and-click-expected.txt:\n* LayoutTests/platform/mac/fast/html/details-add-summary-3-expected.txt:\n* LayoutTests/platform/mac/fast/html/details-add-summary-4-and-click-expected.txt:\n* LayoutTests/platform/mac/fast/html/details-add-summary-4-expected.txt:\n* LayoutTests/platform/mac/fast/html/details-add-summary-5-and-click-expected.txt:\n* LayoutTests/platform/mac/fast/html/details-add-summary-5-expected.txt:\n* LayoutTests/platform/mac/fast/html/details-add-summary-6-and-click-expected.txt:\n* LayoutTests/platform/mac/fast/html/details-add-summary-7-and-click-expected.txt:\n* LayoutTests/platform/mac/fast/html/details-add-summary-8-and-click-expected.txt:\n* LayoutTests/platform/mac/fast/html/details-add-summary-9-and-click-expected.txt:\n* LayoutTests/platform/mac/fast/html/details-marker-style-expected.txt:\n* LayoutTests/platform/mac/fast/html/details-marker-style-mixed-expected.txt:\n* LayoutTests/platform/mac/fast/html/details-no-summary1-expected.txt:\n* LayoutTests/platform/mac/fast/html/details-no-summary3-expected.txt:\n* LayoutTests/platform/mac/fast/html/details-open1-expected.txt:\n* LayoutTests/platform/mac/fast/html/details-open3-expected.txt:\n* LayoutTests/platform/mac/fast/html/details-open5-expected.txt:\n* LayoutTests/platform/mac/fast/html/details-position-expected.txt:\n* LayoutTests/platform/mac/fast/html/details-remove-summary-1-and-click-expected.txt:\n* LayoutTests/platform/mac/fast/html/details-remove-summary-1-expected.txt:\n* LayoutTests/platform/mac/fast/html/details-remove-summary-2-and-click-expected.txt:\n* LayoutTests/platform/mac/fast/html/details-remove-summary-2-expected.txt:\n* LayoutTests/platform/mac/fast/html/details-remove-summary-3-and-click-expected.txt:\n* LayoutTests/platform/mac/fast/html/details-remove-summary-3-expected.txt:\n* LayoutTests/platform/mac/fast/html/details-remove-summary-4-and-click-expected.txt:\n* LayoutTests/platform/mac/fast/html/details-remove-summary-5-and-click-expected.txt:\n* LayoutTests/platform/mac/fast/html/details-remove-summary-6-and-click-expected.txt:\n* LayoutTests/platform/mac/fast/html/details-writing-mode-expected.txt:\n* LayoutTests/platform/mac/fast/html/details-writing-mode-mixed-expected.txt:\n\nCanonical link: https://commits.webkit.org/320461@main\n"
    }
  ],
  "next": "c7920bb4d79695c39c594708667389641397bb60"
}