)]}'
{
  "log": [
    {
      "commit": "7ce1f73af42ee08f2ce95dae844665f03eb5032d",
      "tree": "b3bfb982ed1f879f6382e34ed0b3bc1181288a3f",
      "parents": [
        "8a8a3fbcef4444a26a1fbe44e61f33142917903a"
      ],
      "author": {
        "name": "Anne van Kesteren",
        "email": "annevk@annevk.nl",
        "time": "Tue Oct 27 10:07:18 2026"
      },
      "committer": {
        "name": "Anne van Kesteren",
        "email": "annevk@annevk.nl",
        "time": "Tue Oct 27 10:07:18 2026"
      },
      "message": "A frame that a replace navigation moves to another process has no navigation API entries\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d328274\nrdar://190563871\n\nReviewed by Sihui Liu.\n\nWith site isolation, a subframe navigation that doesn\u0027t add a session history\nentry, such as one from location.replace(), updates the frame\u0027s current history\nitem. When the navigation moves the frame to another process, that process has\nno history item for the frame, and as the frame\u0027s parent is in another process,\nit doesn\u0027t create one either. So the new document\u0027s navigation.entries() was\nempty and navigation.activation was null. Since 324264@main this also happens\nfor navigation.navigate() with history: \"replace\".\n\nFor a main frame, the UI process gives the new process the current history item\nbefore such a load, with a SetCurrentHistoryItemForReattach message. For a\nsubframe it now passes the item in the LoadParameters of the load, so the load\nupdates the frame\u0027s item as it does when the frame stays in its process, but\nonly when the frame moves to another process. Neither sends the replaced\ndocument\u0027s children anymore, and for a document of another origin both only send\nthe item\u0027s identity and the flags that describe the entry, as\nHistoryController::updateCurrentItem() resets the rest. So the replaced entry\nalso no longer keeps the old document\u0027s scroll position, form state, and policy\ncontainer. A main frame load that only locks history, such as a navigation by\nscript without a user gesture, gets the message too, but it adds an entry. So it\nstill gets the whole item, as the new process saves state to the item and sends\nit back. Using LoadParameters for the main frame will happen in a subsequent\nchange.\n\nTests: imported/w3c/web-platform-tests/html/browsers/history/the-location-interface/location-replace-cross-site.html\n       imported/w3c/web-platform-tests/html/document-isolation-policy/location-replace-keeps-entry.tentative.https.html\n       imported/w3c/web-platform-tests/navigation-api/navigation-methods/navigate-replace-cross-site.html\n\nCanonical link: https://commits.webkit.org/324823@main\n"
    },
    {
      "commit": "8a8a3fbcef4444a26a1fbe44e61f33142917903a",
      "tree": "ab426ae0a77505e274b961722ffc900f2d4d4d6c",
      "parents": [
        "295016a3c61cc01d6a6b1006a9fab72a4f3de4d2"
      ],
      "author": {
        "name": "Timothy Hatcher",
        "email": "timothy@apple.com",
        "time": "Tue Oct 27 10:06:24 2026"
      },
      "committer": {
        "name": "Timothy Hatcher",
        "email": "timothy@apple.com",
        "time": "Tue Oct 27 10:06:24 2026"
      },
      "message": "IPC message generator does not treat a Variant containing a move-only type as move-only.\nhttps://webkit.org/b/329022\nrdar://problem/191062826\n\nReviewed by Adrian Taylor and Kimmo Kinnunen.\n\nThe generator treated a message argument as move-only only when its exact type string was listed in\ntypes_that_must_be_moved(). A Variant that contains a move-only alternative, such as\nVariant\u003cString, WebCore::ShareableBitmapHandle\u003e, was not listed, so the generated message class took\nit by const reference and encoded it as an lvalue instead of taking it by rvalue reference and moving\nit into the encoder. Treat a Variant as move-only when any of its alternatives is. None of the\nexisting message parameters changes classification.\n\nAdd a message with such a Variant to the TestWithImageData generator test.\n\n* Source/WebKit/Scripts/webkit/messages.py:\n(split_template_arguments):\n(type_must_be_moved):\n(function_parameter_type):\n(function_parameter_requires_suppress_forward_decl):\n(arguments_constructor_name):\n(message_to_struct_declaration):\n* Source/WebKit/Scripts/webkit/tests/MessageArgumentDescriptions.cpp:\n* Source/WebKit/Scripts/webkit/tests/MessageNames.cpp:\n* Source/WebKit/Scripts/webkit/tests/MessageNames.h:\n* Source/WebKit/Scripts/webkit/tests/TestWithImageData.messages.in:\n* Source/WebKit/Scripts/webkit/tests/TestWithImageDataMessageReceiver.cpp:\n* Source/WebKit/Scripts/webkit/tests/TestWithImageDataMessages.h:\n\nCanonical link: https://commits.webkit.org/324822@main\n"
    },
    {
      "commit": "295016a3c61cc01d6a6b1006a9fab72a4f3de4d2",
      "tree": "ed01dc04e3d42604bc7d106f21f29af6eefa1e41",
      "parents": [
        "46e483fb5445d147daa3ad8621345277da42592c"
      ],
      "author": {
        "name": "Anne van Kesteren",
        "email": "annevk@annevk.nl",
        "time": "Tue Oct 27 10:02:12 2026"
      },
      "committer": {
        "name": "Anne van Kesteren",
        "email": "annevk@annevk.nl",
        "time": "Tue Oct 27 10:02:12 2026"
      },
      "message": "A \u003cselect\u003e whose form state is restored keeps showing the old option\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d328736\nrdar://190877013\n\nReviewed by Tim Nguyen.\n\nA \u003cselect\u003e restores its form state, for instance when going back to a page, at\nits end tag, or at the end tag of its form if it has one.\nHTMLSelectElement::restoreFormControlState() changed which options are selected,\nbut didn\u0027t update \u003cselectedcontent\u003e descendants or the button text of a native\ndrop-down. \u003cselectedcontent\u003e kept showing the option selected during parsing,\nand so did the button text if it was rendered before the state was restored.\n\nLike reset(), restoreFormControlState() now invalidates the button text and\nupdates \u003cselectedcontent\u003e.\n\nselectedcontent-restore.optional.html timed out before checking\n\u003cselectedcontent\u003e. WebKit only adds a session history entry for a form\nsubmission that script triggers in a frame during a user gesture, which\ntest_driver.bless() doesn\u0027t provide. The test now submits from a click handler\nand is no longer skipped, except on iOS, where test_driver.click() isn\u0027t\nsupported. Its second subtest still fails: WebKit restores the form before the\nscript in the frame adds the named control that is part of the form\u0027s key.\n\nTests: fast/forms/select/select-state-restore-button-text.html\n       imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/selectedcontent-restore.optional.html\n\nCanonical link: https://commits.webkit.org/324821@main\n"
    },
    {
      "commit": "46e483fb5445d147daa3ad8621345277da42592c",
      "tree": "5134d9628d0fe3cb3df7208aa2c4aa16c6c61269",
      "parents": [
        "3656bc05d4be93811d800949d5f8ffcc133c9640"
      ],
      "author": {
        "name": "Claudio Saavedra",
        "email": "csaavedra@igalia.com",
        "time": "Tue Oct 27 09:59:55 2026"
      },
      "committer": {
        "name": "Claudio Saavedra",
        "email": "csaavedra@igalia.com",
        "time": "Tue Oct 27 09:59:55 2026"
      },
      "message": "REGRESSION(313570@main): [GTK][Tools] API tests abort when GTK cannot acquire the accessibility bus address\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d329044\n\nReviewed by Carlos Garcia Campos.\n\nSince 313570@main the container SDK auto-enter wrapper bind-mounts the\nAT-SPI bus socket instead of its directory. The container runtime then\ncreates $XDG_RUNTIME_DIR/at-spi inside the container\u0027s tmpfs as a\ndirectory owned by root, which the user cannot write to.\n\nThe WebKitGLib API tests run without DBUS_SESSION_BUS_ADDRESS, so they\nautolaunch a session bus on the test X server and start a second\naccessibility bus inside the container. Its bus daemon cannot create a\nsocket in that directory and exits, and at-spi-bus-launcher answers with\nan empty address before exiting. GTK then fails to get the address\n(NoReply), the warning is fatal and the test aborts. This made about a\nthird of the GTK API test runs on EWS fail.\n\nBind-mount the at-spi directory again when the socket found on the\nsession bus or in AT_SPI_BUS_ADDRESS lives there.\n\n* Tools/Scripts/webkitpy/port/linux_container_sdk_utils.py:\n(_get_at_spi_bus_socket_or_dir_and_var):\n(_get_at_spi_bus_socket_or_dir_and_var._socket_or_xdg_dir):\n* Tools/Scripts/webkitpy/port/linux_container_sdk_utils_unittest.py:\n(GetAtSpiBusDirTest.test_env_var_socket_in_xdg_dir_returns_dir):\n(GetAtSpiBusDirTest.test_gdbus_socket_in_xdg_dir_returns_dir):\n\nCanonical link: https://commits.webkit.org/324820@main\n"
    },
    {
      "commit": "3656bc05d4be93811d800949d5f8ffcc133c9640",
      "tree": "95725e60c4f4261862d695691aa6f4fd810572b5",
      "parents": [
        "7849206d28299867b218505c6937b82dade896da"
      ],
      "author": {
        "name": "Alejandro G. Castro",
        "email": "alex@igalia.com",
        "time": "Tue Oct 27 09:37:41 2026"
      },
      "committer": {
        "name": "Alejandro G. Castro",
        "email": "alex@igalia.com",
        "time": "Tue Oct 27 09:37:41 2026"
      },
      "message": "WorkerThreadableLoader can start a resource load after its owning Document enters the back/forward cache\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d323432\n\nReviewed by Chris Dumez.\n\nThe WPE layout-test bots sometimes hit the assertion in\nWebCore::DocumentLoader::addSubresourceLoader(). It is reported in wrong tests\nbecause it fails while destroying the previous test run, so the noise of\nthe crash is problematic.\n\nThe assertion indicates that a new SubresourceLoader was being added to a\nDocumentLoader whose document was already in Document::InBackForwardCache.\n\nThe crash stack shows the load originated from\nWorkerThreadableLoader::MainThreadBridge. Worker resource loads are initiated\non a worker thread and posted asynchronously to the owning document main thread.\n\nCachedResource::load() already blocks new loads while a page is in, or\nentering, the back/forward cache, but it checks the main frame\u0027s current\ndocument, not the document doing the load. When the worker belongs to a\nsubframe of a cached page, the main frame\u0027s document is already the newly\ncommitted one, which is not in the back/forward cache, so the load is allowed.\nAlso check the requesting document, keeping the main frame check.\n\nMultiple tests are causing these failures randomly in the bots.\n\nWe added a test to validate this situation: a page with an iframe that owns a\nworker navigates away into the back/forward cache, and the parent pagehide\nhandler tells that worker to fetch(), the load arrives on the main thread after\nthe subframe\u0027s document is already cached, then the test passes only if that\nfetch is rejected. The GTK and WPE bots build with assertions enabled, so\nwithout this patch the test crashes there; without assertions the fetch\nresolves and the test fails.\n\n* LayoutTests/http/tests/navigation/page-cache-worker-in-subframe-fetch-after-pagehide-expected.txt: Added.\n* LayoutTests/http/tests/navigation/page-cache-worker-in-subframe-fetch-after-pagehide.html: Added.\n* LayoutTests/http/tests/navigation/resources/page-cache-worker-in-subframe-fetch-after-pagehide-frame.html: Added.\n* LayoutTests/http/tests/navigation/resources/page-cache-worker-in-subframe-fetch-after-pagehide-worker.js: Added.\n* Source/WebCore/loader/cache/CachedResource.cpp:\n(WebCore::CachedResource::load):\n\nCanonical link: https://commits.webkit.org/324819@main\n"
    },
    {
      "commit": "7849206d28299867b218505c6937b82dade896da",
      "tree": "61af33617adca1f9127849ab18fc0f0200677f18",
      "parents": [
        "c81a1d1009ae4bf7c14dcda55a0d5ad2444f2675"
      ],
      "author": {
        "name": "Jintian Wang",
        "email": "jintian_wang@apple.com",
        "time": "Tue Oct 27 09:32:29 2026"
      },
      "committer": {
        "name": "Etienne Segonzac",
        "email": "sgz@apple.com",
        "time": "Tue Oct 27 09:32:29 2026"
      },
      "message": "Gaze glow on Google Maps category chips is a rectangle larger than the pill\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d328611\nrdar://190270685\n\nReviewed by Etienne Segonzac.\n\nThe category chips on Google Maps are transparent \u003cbutton\u003es that are taller\nthan the white pill inside them. The buttons set border-radius: 0. Any explicit\nborder radius stopped a button from being a guard container, so the glow used\nthe button\u0027s square box instead of the pill.\n\nNow such a button is a guard container when its only child element paints a box\n(a background, a full border, a shadow or an outline), like the pill. The glow\nthen takes the child\u0027s shape. A button whose only child paints nothing, such as\ntext with an icon or an icon alone, keeps its own region as before. Buttons\nwithout an explicit border radius are not affected.\n\nTest: interaction-region/guard-container-zero-border-radius.html\n* LayoutTests/interaction-region/guard-container-zero-border-radius-expected.txt: Added.\n* LayoutTests/interaction-region/guard-container-zero-border-radius.html: Added.\nChecks:\n- A border-radius: 0 button around a pill: a Guard on the button, and the\npill\u0027s region gives the shape.\n- The same button with no border radius: the same regions.\n- The same button with border-radius: 8px: one region over the button, with\nits own corners.\n- A border-radius: 0 button holding text and an icon: one region over the\nwhole button.\n- A border-radius: 0 button holding only an icon: one region over the whole\nbutton.\n\n* Source/WebCore/page/InteractionRegion.cpp:\n(WebCore::hasTransparentBoxDecorations):\nSplit out of hasTransparentContainerStyle, without the border-radius check.\nWhether a box paints nothing around itself: no background, outline, shadow,\nclip path or full border.\n\n(WebCore::hasTransparentContainerStyle):\nThe old check. Its callers behave the same.\n\n(WebCore::isGuardContainer):\nAlso treats a transparent button or link with a border radius of 0 as a guard\ncontainer, but only when its only child element paints a box.\n\nCanonical link: https://commits.webkit.org/324818@main\n"
    },
    {
      "commit": "c81a1d1009ae4bf7c14dcda55a0d5ad2444f2675",
      "tree": "874566b1adeca30ca972e05a03e58a2e005edeba",
      "parents": [
        "c23b7322cff4de871bbedea666c34ce9999ac1b7"
      ],
      "author": {
        "name": "Zak Ridouh",
        "email": "zakr@apple.com",
        "time": "Tue Oct 27 09:30:18 2026"
      },
      "committer": {
        "name": "Zak Ridouh",
        "email": "zakr@apple.com",
        "time": "Tue Oct 27 09:30:18 2026"
      },
      "message": "[CMake][iOS] Fix the build after 324776@main\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d329040\n\nReviewed by Kiet Ho.\n\n324776@main removed the TextIndicator.h include from DragImage.h, which Page.cpp\nwas relying on. Include it directly.\n\nNo new tests (build fix).\n\n* Source/WebCore/page/Page.cpp:\n\nCanonical link: https://commits.webkit.org/324817@main\n"
    },
    {
      "commit": "c23b7322cff4de871bbedea666c34ce9999ac1b7",
      "tree": "6f21b7f48370f27a8390ee20f42ad0bb958839ae",
      "parents": [
        "58ebe7bde382f8eb6d2b8b57b1463e48f18e2547"
      ],
      "author": {
        "name": "Przemyslaw Gorszkowski",
        "email": "pgorszkowski@igalia.com",
        "time": "Tue Oct 27 09:23:31 2026"
      },
      "committer": {
        "name": "Przemyslaw Gorszkowski",
        "email": "pgorszkowski@igalia.com",
        "time": "Tue Oct 27 09:23:31 2026"
      },
      "message": "[GTK] Gamepad input is delayed by up to 50 ms\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d328916\n\nReviewed by Carlos Garcia Campos.\n\nManetteGamepadProvider coalesces gamepad input with a 50 ms one-shot\ntimer. The timer starts on the first input after an idle period and is\nnot restarted by later inputs. When it fires, the current gamepad state\nis copied and sent to the web process. As a result:\n\n- every isolated button press reaches the page about 50 ms late;\n- the page receives new gamepad state at most about 20 times per second,\n  so analog sticks and triggers update in visible steps;\n- a press and release within the same 50 ms window are never seen by\n  the page.\n\nUse 1 ms similar as it is in case of Mac and WPE implementation.\nWith this change the update interval measured on\nhttps://controllertest.io/latency-test/ drops from about 50 ms to about\n10-12 ms, the same as WPE.\n\nNo new tests. This code is only reached with a real gamepad; layout tests\nuse MockGamepadProvider, which bypasses ManetteGamepadProvider. Tested\nmanually with a physical gamepad.\n\n* Source/WebCore/platform/gamepad/manette/ManetteGamepadProvider.cpp:\n\nCanonical link: https://commits.webkit.org/324816@main\n"
    },
    {
      "commit": "58ebe7bde382f8eb6d2b8b57b1463e48f18e2547",
      "tree": "28c522bdddf07bd0c9e67287ce394a5c69696f36",
      "parents": [
        "39cee9c0383067d5aade7e30fa4d8fa57c7bdd9f"
      ],
      "author": {
        "name": "Adrian Perez de Castro",
        "email": "aperez@igalia.com",
        "time": "Tue Oct 27 09:16:59 2026"
      },
      "committer": {
        "name": "Adrian Perez de Castro",
        "email": "aperez@igalia.com",
        "time": "Tue Oct 27 09:16:59 2026"
      },
      "message": "[CMake][GTK][WPE] Remove NO_IMPLICIT_SOURCES from GI_INTROSPECT()\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d328915\n\nReviewed by Fujii Hironori.\n\nPass a SOURCES parameter to the GI_INTROSPECT() use in JSC\u0027s\nPlatformGTK.cmake file, which is the only instance that did not\npass NO_IMPLICIT_SOURCES.\n\nWith all uses of GI_INTROSPECT() explicitly listing the SOURCES\nto scan, the NO_IMPLICIT_SOURCES option can be dropped.\n\n* Source/JavaScriptCore/PlatformGTK.cmake:\n* Source/WebKit/PlatformGTK.cmake:\n* Source/WebKit/PlatformWPE.cmake:\n* Source/WebKit/WPEPlatform/CMakeLists.txt:\n* Source/cmake/FindGI.cmake:\n\nCanonical link: https://commits.webkit.org/324815@main\n"
    },
    {
      "commit": "39cee9c0383067d5aade7e30fa4d8fa57c7bdd9f",
      "tree": "c19e47beb2e1c7bc7258404b8ba6dced495d8d82",
      "parents": [
        "272972fe8ced4a33bab6d2612105cbdac21e84ae"
      ],
      "author": {
        "name": "Philippe Normand",
        "email": "philn@igalia.com",
        "time": "Tue Oct 27 09:10:01 2026"
      },
      "committer": {
        "name": "Philippe Normand",
        "email": "philn@igalia.com",
        "time": "Tue Oct 27 09:10:01 2026"
      },
      "message": "[GStreamer] Reduce video format conversions and deinterlacing when using the DL/DMABuf video sink\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d328917\n\nReviewed by Xabier Rodriguez-Calvar.\n\nThe playsink bin doesn\u0027t need to contain videoconvert and deinterlace elements when\nhardware-accelerated rendering is enabled because glcolorconvert can take care of it already. This\nsignificantly improves CPU usage when playing a special video that changes resolutions for every\nframe.\n\n* Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:\n(WebCore::MediaPlayerPrivateGStreamer::setPlaybackFlags):\n(WebCore::MediaPlayerPrivateGStreamer::createGSTPlayBin):\n\nCanonical link: https://commits.webkit.org/324814@main\n"
    },
    {
      "commit": "272972fe8ced4a33bab6d2612105cbdac21e84ae",
      "tree": "92d232fd9b18ed6b205fad1a23c9f204cba9b52d",
      "parents": [
        "8f621b614228697bcd857e2fbf0a71d41f03f6c1"
      ],
      "author": {
        "name": "Kimmo Kinnunen",
        "email": "kkinnunen@apple.com",
        "time": "Tue Oct 27 08:46:18 2026"
      },
      "committer": {
        "name": "Kimmo Kinnunen",
        "email": "kkinnunen@apple.com",
        "time": "Tue Oct 27 08:46:18 2026"
      },
      "message": "Partition object identifiers into WebContent process and GPU process domains\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d328652\nrdar://190831206\n\nReviewed by Youenn Fablet.\n\nGPU process creates VideoFrame instances when camera captures them.\nThese are offered to WebContent process, and the offer uses identifiers\nto reference these. WebContent process would like to also create\nVideoFrame instances and pass identifiers to GPU process. Currently this\nis done with synchronous messages, so that GPU process allocates the\nidentifier.\n\nMark all identifiers allocated by GPUP with top bit \u003d\u003d 1. This\nguarantees that GPUP can allocate identifiers in its own timeline, and\nWCP in its own.\n\nThe IPC test converted the GPU process identifiers with Number(), which\nloses precision for identifiers with the top bit set. Pass the BigInt\nidentifiers as is. The IPC test library checked identifiers against the\nint64_t range even though they are serialized as uint64_t. Check them\nagainst the uint64_t range.\n\n* LayoutTests/ipc/cocoa/legacy-cdm-session-avcontentkeysession-destruction-race.html:\n* LayoutTests/ipc/coreipc.js:\n(CoreIPC.serializeIdentifier):\n* Source/WTF/wtf/ObjectIdentifier.cpp:\n(WTF::initializeObjectIdentifierDomain):\n(WTF::ObjectIdentifierMainThreadAccessTraits::generateIdentifierInternal):\n(WTF::ObjectIdentifierThreadSafeAccessTraits::generateIdentifierInternal):\n* Source/WTF/wtf/ObjectIdentifier.h:\n* Source/WebKit/GPUProcess/EntryPoint/Cocoa/XPCService/GPUServiceEntryPoint.mm:\n(GPU_SERVICE_INITIALIZER):\n* Source/WebKit/Shared/AuxiliaryProcessMain.h:\n(WebKit::AuxiliaryProcessMainBase::run):\n* Source/WebKit/Shared/ObjectIdentifierDomains.h: Added.\n* Source/WebKit/WebKit.xcodeproj/project.pbxproj:\n\nCanonical link: https://commits.webkit.org/324813@main\n"
    },
    {
      "commit": "8f621b614228697bcd857e2fbf0a71d41f03f6c1",
      "tree": "5ec76d89e894e5b0e504019280190c6ae345f099",
      "parents": [
        "55b988c44226aeccddd878a1e9c38c1a4f846bc0"
      ],
      "author": {
        "name": "Philippe Normand",
        "email": "philn@igalia.com",
        "time": "Tue Oct 27 08:45:10 2026"
      },
      "committer": {
        "name": "Philippe Normand",
        "email": "philn@igalia.com",
        "time": "Tue Oct 27 08:45:10 2026"
      },
      "message": "[GStreamer][WebRTC] Disable auto-plugging of webkitthunderparser on incoming video sources\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d328906\n\nReviewed by Xabier Rodriguez-Calvar.\n\nPrevent auto-plugging of the webkitthunderparser elements, those are needed only for EME playback,\nnot WebRTC.\n\n* Source/WebCore/platform/mediastream/libwebrtc/gstreamer/GStreamerVideoDecoderFactory.cpp:\n\nCanonical link: https://commits.webkit.org/324812@main\n"
    },
    {
      "commit": "55b988c44226aeccddd878a1e9c38c1a4f846bc0",
      "tree": "3c3a93c0ea253c6ea5cdd1b283f75e142cb67cad",
      "parents": [
        "101fc0dd54cf064281779e752460acdbd0fe8877"
      ],
      "author": {
        "name": "Philippe Normand",
        "email": "philn@igalia.com",
        "time": "Tue Oct 27 08:42:08 2026"
      },
      "committer": {
        "name": "Philippe Normand",
        "email": "philn@igalia.com",
        "time": "Tue Oct 27 08:42:08 2026"
      },
      "message": "[GStreamer] http/wpt/webcodecs/audio-decoder-flac-multichannels.html fails\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d328849\n\nReviewed by Xabier Rodriguez-Calvar.\n\nSpecify the number of audio channels for the flac decoder.\n\n* LayoutTests/platform/glib/TestExpectations:\n* Source/WebCore/platform/audio/gstreamer/AudioDecoderGStreamer.cpp:\n(WebCore::GStreamerInternalAudioDecoder::GStreamerInternalAudioDecoder):\n\nCanonical link: https://commits.webkit.org/324811@main\n"
    },
    {
      "commit": "101fc0dd54cf064281779e752460acdbd0fe8877",
      "tree": "b7557129e00c6b986537bc253611be21cb15e46f",
      "parents": [
        "5d49f872a4f2e5e718f83c9a481fd9c6007aa732"
      ],
      "author": {
        "name": "Ronan Turner",
        "email": "ronan_turner@apple.com",
        "time": "Tue Oct 27 08:34:23 2026"
      },
      "committer": {
        "name": "Ronan Turner",
        "email": "ronan_turner@apple.com",
        "time": "Tue Oct 27 08:34:23 2026"
      },
      "message": "Fix Enhanced Security layout tests\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d328625\nrdar://190807870\n\nReviewed by Abrar Rahman Protyasha.\n\nOn iOS, WebKitTestRunner did not embed the ExtensionKit extension for\nEnhanced Security (WebContentEnhancedSecurityExtension). Thus, tests\nunder http/tests/enhanced-security/ which attempt to launch this version\nof the web process time out.\n\nThis change now embeds this appex in WebKitTestRunner, mirroring how\nthis is done for WebContentCaptivePortalExtension.\n\nThis adds a trivial layout test that exercises this path. Confirmed to\nfail on layout tests prior to this change.\n\n* LayoutTests/http/tests/enhanced-security/page-loads-in-enhanced-security-expected.txt: Added.\n* LayoutTests/http/tests/enhanced-security/page-loads-in-enhanced-security.html: Added.\n* Tools/WebKitTestRunner/PlatformCocoa.cmake:\n* Tools/WebKitTestRunner/WebKitTestRunner.xcodeproj/project.pbxproj:\n\nCanonical link: https://commits.webkit.org/324810@main\n"
    },
    {
      "commit": "5d49f872a4f2e5e718f83c9a481fd9c6007aa732",
      "tree": "60dcc9fcba2505cab8f2731586ef1dfd68f7c364",
      "parents": [
        "047a16c96ccdd12aa45a71452806ffeecb6c07de"
      ],
      "author": {
        "name": "Youenn Fablet",
        "email": "youenn@apple.com",
        "time": "Tue Oct 27 07:55:13 2026"
      },
      "committer": {
        "name": "Youenn Fablet",
        "email": "youennf@gmail.com",
        "time": "Tue Oct 27 07:55:13 2026"
      },
      "message": "Add support for VideoFrame flip\nrdar://190725436\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d328479\n\nReviewed by Eric Carlson.\n\nWe add WebIDL needed support for flip.\nThis allows to create mirrored VideoFrames from JS so we remove the internals API and we move LayoutTests/http/wpt/webcodecs/videoframe-rotation-then-flip.html tests to existing webcodecs WPT tests.\n\n* LayoutTests/http/wpt/webcodecs/videoframe-rotation-then-flip-expected.txt: Removed.\n* LayoutTests/http/wpt/webcodecs/videoframe-rotation-then-flip.html: Removed.\n* LayoutTests/imported/w3c/web-platform-tests/webcodecs/idlharness.https.any-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/webcodecs/idlharness.https.any.worker-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/webcodecs/videoFrame-orientation-drawImage.any-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/webcodecs/videoFrame-orientation-drawImage.any.js:\n(270.promise_test.async t):\n* LayoutTests/imported/w3c/web-platform-tests/webcodecs/videoFrame-orientation-drawImage.any.worker-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/webcodecs/videoFrame-orientation-imageBitmap.any-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/webcodecs/videoFrame-orientation-imageBitmap.any.worker-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/webcodecs/videoFrame-orientation-utils.js:\n(orientationDescription):\n* LayoutTests/imported/w3c/web-platform-tests/webcodecs/videoFrame-orientation-webgl-i420.window-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/webcodecs/videoFrame-orientation-webgl-i420.window.js:\n(makeI420Frame):\n(of.kOrientationCombinations.promise_test.async t):\n* LayoutTests/imported/w3c/web-platform-tests/webcodecs/videoFrame-orientation-webgl.window-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/webcodecs/videoFrame-orientation.any-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/webcodecs/videoFrame-orientation.any.js:\n(promise_test.async t):\n* LayoutTests/imported/w3c/web-platform-tests/webcodecs/videoFrame-orientation.any.worker-expected.txt:\n* Source/WebCore/Modules/webcodecs/WebCodecsVideoFrame.cpp:\n(WebCore::WebCodecsVideoFrame::create):\n(WebCore::WebCodecsVideoFrame::initializeFrameFromOtherFrame):\n(WebCore::WebCodecsVideoFrame::initializeFrameWithResourceAndSize):\n(WebCore::WebCodecsVideoFrame::flip const):\n* Source/WebCore/Modules/webcodecs/WebCodecsVideoFrame.h:\n* Source/WebCore/Modules/webcodecs/WebCodecsVideoFrame.idl:\n* Source/WebCore/testing/Internals.cpp:\n(WebCore::Internals::is10bitsVideoFrame const):\n(WebCore::Internals::mirroredVideoFrame const): Deleted.\n* Source/WebCore/testing/Internals.h:\n* Source/WebCore/testing/Internals.idl:\n\nCanonical link: https://commits.webkit.org/324809@main\n"
    },
    {
      "commit": "047a16c96ccdd12aa45a71452806ffeecb6c07de",
      "tree": "4c9a3336821f9321dbd89de2be080135acd03dc0",
      "parents": [
        "daf4fc468c288b01d960718ae081cd2a622e051f"
      ],
      "author": {
        "name": "Claudio Saavedra",
        "email": "csaavedra@igalia.com",
        "time": "Tue Oct 27 06:34:25 2026"
      },
      "committer": {
        "name": "Claudio Saavedra",
        "email": "csaavedra@igalia.com",
        "time": "Tue Oct 27 06:34:25 2026"
      },
      "message": "[IndexedDB] Worker IndexedDB objects can be destroyed on the main thread\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d316265\n\nReviewed by Sihui Liu.\n\nIDBConnectionProxy delivers server replies for a worker\u0027s requests,\ntransactions and operations by taking the object out of its map on the\nmain thread, releasing the map lock and then posting the callback to the\nworker, while keeping a local reference. That reference can end up being\nthe last one: the worker may run the task and drop its references first;\nduring worker termination the post may land after the run loop\u0027s final\ndrain, leaving the task to be destroyed with the run loop on the main\nthread; or the context may already be gone, so nothing is posted. The\nobject is then destroyed on the main thread and the destructors\u0027 thread\naffinity assertions fire.\n\nHand the caller\u0027s reference over to the origin thread together with the\ntask, and keep the map lock held until the task is posted. The worker\ntakes the same lock in abortActivitiesForCurrentThread() before its final\ndrain and before its context is destroyed, so an entry still found in the\nmap always has a context whose run loop will run or destroy the task on\nthe worker thread. Callbacks for the current thread are still called\ndirectly, after releasing the lock. Remove the overload that left the\ncaller\u0027s reference behind, and callFunctionOnOriginThread(), which no\nlonger has callers.\n\nget-databases.any.worker.html,\nabort-in-initial-upgradeneeded.any.serviceworker.html and\ntransaction-inflight-worker-terminate.window.html hit these assertions on\nthe GTK and WPE bots, which run with assertions enabled.\n\n* LayoutTests/platform/glib/TestExpectations:\n* Source/WebCore/Modules/indexeddb/IDBActiveDOMObject.h:\n* Source/WebCore/Modules/indexeddb/IDBActiveDOMObjectInlines.h:\n(WebCore::IDBActiveDOMObject::performCallbackOnOriginThread):\n(WebCore::IDBActiveDOMObject::callFunctionOnOriginThread): Deleted.\n* Source/WebCore/Modules/indexeddb/client/IDBConnectionProxy.cpp:\n(WebCore::IDBClient::performCallbackOnOriginThread):\n(WebCore::IDBClient::IDBConnectionProxy::completeOpenDBRequest):\n(WebCore::IDBClient::IDBConnectionProxy::completeOperation):\n(WebCore::IDBClient::IDBConnectionProxy::notifyOpenDBRequestBlocked):\n(WebCore::IDBClient::IDBConnectionProxy::didStartTransaction):\n(WebCore::IDBClient::IDBConnectionProxy::didCommitTransaction):\n(WebCore::IDBClient::IDBConnectionProxy::didAbortTransaction):\n(WebCore::IDBClient::IDBConnectionProxy::connectionToServerLost):\n(WebCore::IDBClient::IDBConnectionProxy::didGetAllDatabaseNamesAndVersions):\n* Source/WebCore/Modules/indexeddb/client/TransactionOperation.cpp:\n(WebCore::IDBClient::TransactionOperation::transitionToComplete):\n\nCanonical link: https://commits.webkit.org/324808@main\n"
    },
    {
      "commit": "daf4fc468c288b01d960718ae081cd2a622e051f",
      "tree": "a69388865979b5d7af349405722a6a93d2682bbf",
      "parents": [
        "af8c5f6947788ec80357daf7b6511e3d3d01be29"
      ],
      "author": {
        "name": "Brady Eidson",
        "email": "beidson@apple.com",
        "time": "Tue Oct 27 06:32:25 2026"
      },
      "committer": {
        "name": "Brady Eidson",
        "email": "beidson@apple.com",
        "time": "Tue Oct 27 06:32:25 2026"
      },
      "message": "Update struct layout in http/tests/ipc/createnewpage-file-body-sandbox-extension.html\nrdar://190559035\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d329009\n\nUnreviewed gardening.\n\nA few patches updated the layout of NavigationActionData without updating the struct layout in the test.\n\n* LayoutTests/http/tests/ipc/createnewpage-file-body-sandbox-extension.html:\n* LayoutTests/platform/ios/TestExpectations:\n* LayoutTests/platform/mac-wk2/TestExpectations:\n\nCanonical link: https://commits.webkit.org/324807@main\n"
    },
    {
      "commit": "af8c5f6947788ec80357daf7b6511e3d3d01be29",
      "tree": "d30328f944f5a622a43f1b321cf326d196e160b2",
      "parents": [
        "780058db21f8544eb6351be3d33dc0329398a1bb"
      ],
      "author": {
        "name": "Alexey Proskuryakov",
        "email": "ap@apple.com",
        "time": "Tue Oct 27 06:01:52 2026"
      },
      "committer": {
        "name": "Alexey Proskuryakov",
        "email": "ap@webkit.org",
        "time": "Tue Oct 27 06:01:52 2026"
      },
      "message": "[MiniBrowser] Close the window when its page asks to close\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d328731\n\nReviewed by BJ Burg.\n\nMiniBrowser ignored webViewDidClose:, so window.close() did nothing, and neither did\nWebDriver\u0027s Close Window, whose browsing context stayed around.\n\n* Tools/MiniBrowser/mac/WK2BrowserWindowController.m:\n(-[WK2BrowserWindowController dealloc]): Don\u0027t clear the find delegate. WebKit only holds it\nweakly, and setting it on a web view that webViewDidClose: has closed would crash.\n(-[WK2BrowserWindowController webViewDidClose:]): Added. Close the window, and the web view right\naway, so that WebDriver no longer lists it as a window when it replies to Close Window.\n* Tools/Scripts/webkitpy/style/checker.py: MiniBrowser doesn\u0027t use WTF, so don\u0027t ask it to use\nWTF\u0027s replacement for dispatch_get_main_queue().\n\nCanonical link: https://commits.webkit.org/324806@main\n"
    },
    {
      "commit": "780058db21f8544eb6351be3d33dc0329398a1bb",
      "tree": "7a97358bd3aaca04063fdcdf0e52dd996e326957",
      "parents": [
        "4bc9ad4d7fb4b066b56b95399a267a3bca230b15"
      ],
      "author": {
        "name": "Andy Estes",
        "email": "aestes@apple.com",
        "time": "Tue Oct 27 05:34:14 2026"
      },
      "committer": {
        "name": "Andy Estes",
        "email": "aestes@apple.com",
        "time": "Tue Oct 27 05:34:14 2026"
      },
      "message": "Take 2: [HomeView] Add quirks\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d329014\nrdar://190928214\n\nReviewed by Wenson Hsieh.\n\nAdded quirks for HomeView.\n\nTest: Tools/TestWebKitAPI/Tests/WebCore/Quirks.cpp\n\n* LayoutTests/platform/ios/fast/quirks/active-quirks-by-domain-expected.txt:\n* LayoutTests/platform/ipad/fast/quirks/active-quirks-by-domain-expected.txt:\n* Source/WebCore/PAL/pal/spi/ios/MobileGestaltSPI.h:\n* Source/WebCore/PAL/pal/system/ios/Device.cpp:\n(PAL::setDeviceClassIsHomeViewForTesting):\n(PAL::deviceClassIsHomeView):\n* Source/WebCore/PAL/pal/system/ios/Device.h:\n* Source/WebCore/page/QuirkBehaviors.yaml:\n* Source/WebCore/page/QuirkBuildConditions.yaml:\n* Source/WebCore/page/QuirkMatchPattern.cpp:\n(WebCore::evaluateURLEnvironment):\n* Source/WebCore/page/QuirkMatchPattern.h:\n* Source/WebCore/page/QuirkTable.json:\n* Source/WebCore/page/Quirks.cpp:\n(WebCore::Quirks::needsDesktopUserAgent):\n(WebCore::Quirks::defaultVisibilityAdjustmentSelectors):\n(WebCore::Quirks::determineRelevantQuirks):\n(WebCore::needsDesktopUserAgentInternal): Deleted.\n(WebCore::shouldPreventOrientationMediaQueryFromEvaluatingToLandscapeInternal): Deleted.\n* Source/WebKit/Shared/WebCoreArgumentCoders.serialization.in:\n* Tools/TestWebKitAPI/Tests/WebCore/Quirks.cpp:\n\nCanonical link: https://commits.webkit.org/324805@main\n"
    },
    {
      "commit": "4bc9ad4d7fb4b066b56b95399a267a3bca230b15",
      "tree": "404013cfac52574a5b64cf8513672493960ac0dc",
      "parents": [
        "1b4f243d05d7c835e25e9a3015befd4ce0a63bf0"
      ],
      "author": {
        "name": "Dan Hecht",
        "email": "dan.hecht@apple.com",
        "time": "Tue Oct 27 05:32:22 2026"
      },
      "committer": {
        "name": "Dan Hecht",
        "email": "dan.hecht@apple.com",
        "time": "Tue Oct 27 05:32:22 2026"
      },
      "message": "[JSC] Assert that Heap::resumeTheMutator finds the mutator stopped\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d329005\nrdar://191056975\n\nReviewed by Vassili Bykov.\n\nHeap::resumeTheMutator returned early when the mutator was not stopped, and\nits asserts allowed a mutator that has heap access and is not stopped. Neither\nhappens: only the collector thread calls resumeTheMutator, when it is\nconducting, and it conducts a stopped phase only after it has stopped the\nmutator. A mutator that held heap access would have been handed the conn\ninstead, a stopped mutator cannot take heap access, and only resumeTheMutator\nclears the stopped bit.\n\nReplace the early return and the old asserts with three asserts, one for each\npart of that state: the mutator is stopped, has no heap access, and does not\nhold the conn.\n\nCanonical link: https://commits.webkit.org/324804@main\n"
    },
    {
      "commit": "1b4f243d05d7c835e25e9a3015befd4ce0a63bf0",
      "tree": "184149105e878a8c2ed3c10ec0e6ef28c2b01b38",
      "parents": [
        "95efaa1c7b6bf4b5c95423445b0908d91f4bfba2"
      ],
      "author": {
        "name": "Qianlang Chen",
        "email": "qianlangchen@apple.com",
        "time": "Tue Oct 27 05:18:28 2026"
      },
      "committer": {
        "name": "Qianlang Chen",
        "email": "qianlangchen@apple.com",
        "time": "Tue Oct 27 05:18:28 2026"
      },
      "message": "[Site Isolation] Web Inspector: RELEASE_ASSERT in FrameNetworkAgentProxy::disable() for a frame destroyed with a remote ancestor\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d327608\nrdar://184588200\n\nReviewed by Basuke Suzuki.\n\nWebInspectorBackend keeps a FrameNetworkAgentProxy and a PageAgentProxy\nfor each frame, keyed by frame identifier. A proxy registers itself on\nthe frame\u0027s InstrumentingAgents and unregisters in disable(), which its\ndestructor also calls. Proxies were removed only in\ndetachedFromParent2() and WebFrame::removeFromTree().\n\nA frame can be destroyed without going through either one. For example,\na process can host a local frame whose parent is a remote frame. When\nanother process removes that parent, removeFromTree() runs on the remote\nframe. It removes the remote frame from the tree but does not detach the\nlocal frames below it, so they are destroyed with it and\ndetachedFromParent2() never runs for them. Their proxies stay in\nWebInspectorBackend after the frame and its InstrumentingAgents are\ngone. The next time the backend clears its proxies, for example when the\nUI process disables network instrumentation, disable() calls get() on a\nWeakRef that points to nothing and hits its RELEASE_ASSERT.\n\nFix this by removing the proxies from ~LocalFrame, while the frame\u0027s\nInstrumentingAgents are still alive. Add\nInspectorBackendClient::inspectedFrameDestroyed(), called by\nFrameInspectorController::inspectedFrameDestroyed() before its check\nfor frontends, because a frame can have proxies without a frontend.\nWebInspectorBackendClient implements it by calling\nWebInspectorBackend::removeInstrumentationForDestroyedFrame(), which\nremoves the proxies, and by removing the frame\u0027s overlays.\n~LocalFrame passes itself to FrameInspectorController, so the\ndestructor does not need to take a reference to a frame that is being\ndestroyed.\n\n(Both removals look for the dying frame object itself, not its frame\nidentifier, which names a logical frame that different LocalFrame\nobjects can back over time. This also guards against a possible newer\nLocalFrame with the same identifier. The proxies are removed only if\nthey are registered on the dying frame\u0027s own InstrumentingAgents.)\n\nThe overlay maps are already keyed by LocalFrame, so\nwillDestroyFrameOverlays() now takes the LocalFrame and finds its\noverlays directly on every path, without taking a reference to the\nframe. removeInstrumentationForFrame() takes the LocalFrame as well, so\nWebFrame::removeFromTree() now removes instrumentation only when its\nframe is local. A remote frame has none, and its provisional frame, if\nany, is detached by destroyProvisionalFrame(), which reaches\ndetachedFromParent2().\n\nA proxy now never outlives its InstrumentingAgents, so disable() can\nkeep assuming that they are alive.\n\nTest: http/tests/site-isolation/inspector/network/remove-cross-origin-iframe-with-third-site-grandchild.html\n\n* LayoutTests/http/tests/site-isolation/inspector/network/remove-cross-origin-iframe-with-third-site-grandchild-expected.txt: Added.\n* LayoutTests/http/tests/site-isolation/inspector/network/remove-cross-origin-iframe-with-third-site-grandchild.html: Added.\n* LayoutTests/http/tests/site-isolation/inspector/network/resources/frame-with-third-site-grandchild.html: Added.\n* LayoutTests/http/tests/site-isolation/inspector/network/resources/third-site-frame.html: Added.\n* Source/WebCore/inspector/FrameInspectorController.cpp:\n(WebCore::FrameInspectorController::inspectedFrameDestroyed):\n* Source/WebCore/inspector/InspectorBackendClient.h:\n(WebCore::InspectorBackendClient::willDestroyFrame):\n(WebCore::InspectorBackendClient::inspectedFrameDestroyed):\n(WebCore::InspectorBackendClient::willDestroyFrameOverlays):\n* Source/WebKit/WebProcess/Inspector/WebInspectorBackend.cpp:\n(WebKit::WebInspectorBackend::removeInstrumentationForDestroyedFrame):\n(WebKit::WebInspectorBackend::removeInstrumentationForFrame):\n* Source/WebKit/WebProcess/Inspector/WebInspectorBackend.h:\n* Source/WebKit/WebProcess/Inspector/WebInspectorBackendClient.cpp:\n(WebKit::WebInspectorBackendClient::willDestroyFrame):\n(WebKit::WebInspectorBackendClient::willDestroyFrameOverlays):\n(WebKit::WebInspectorBackendClient::removeOverlaysForFrames):\n(WebKit::WebInspectorBackendClient::inspectedFrameDestroyed):\n* Source/WebKit/WebProcess/Inspector/WebInspectorBackendClient.h:\n* Source/WebCore/inspector/FrameInspectorController.h:\n* Source/WebCore/page/LocalFrame.cpp:\n(WebCore::LocalFrame::~LocalFrame):\n* Source/WebKit/WebProcess/WebCoreSupport/WebLocalFrameLoaderClient.cpp:\n(WebKit::WebLocalFrameLoaderClient::detachedFromParent2):\n* Source/WebKit/WebProcess/WebPage/WebFrame.cpp:\n(WebKit::WebFrame::removeFromTree):\n\nCanonical link: https://commits.webkit.org/324803@main\n"
    },
    {
      "commit": "95efaa1c7b6bf4b5c95423445b0908d91f4bfba2",
      "tree": "cf7894cb4b7e6bdf3a969f91a0023e4637ba1421",
      "parents": [
        "5de7b9645e43e4b76ace7e294d10c6e0620e2fff"
      ],
      "author": {
        "name": "Claudio Saavedra",
        "email": "csaavedra@igalia.com",
        "time": "Tue Oct 27 05:05:36 2026"
      },
      "committer": {
        "name": "Claudio Saavedra",
        "email": "csaavedra@igalia.com",
        "time": "Tue Oct 27 05:05:36 2026"
      },
      "message": "[Fullscreen] A late BeganEnterFullScreen reply closes a newer fullscreen request\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d316158\n\nReviewed by Chris Dumez.\n\nThe reply to BeganEnterFullScreen calls didEnterFullScreen(), which acts on\nthe current m_element. The UI process waits for the next presentation update\nbefore replying, so the reply can arrive after a later request has replaced\nthe element. The stale WebCore callback then fails because its document is no\nlonger in fullscreen, and close() clears the newer request\u0027s state. The next\nexit skips BeganExitFullScreen, so WebKitTestRunner never receives the exit\ncompletion handler and testRunner.finishFullscreenExit() calls an empty\nCompletionHandler.\n\nComplete the reply as failed when its element is no longer the current one,\nleaving the newer request untouched. This ungardens two fullscreen tests that\ncrashed flakily on the GTK and WPE bots.\n\n* LayoutTests/platform/glib/TestExpectations:\n* LayoutTests/platform/gtk/TestExpectations:\n* Source/WebKit/WebProcess/FullScreen/WebFullScreenManager.cpp:\n(WebKit::WebFullScreenManager::willEnterFullScreen):\n\nCanonical link: https://commits.webkit.org/324802@main\n"
    },
    {
      "commit": "5de7b9645e43e4b76ace7e294d10c6e0620e2fff",
      "tree": "a1a392dc632981aee9f6251218995dfe37f9f899",
      "parents": [
        "04a6c7182a8ccabaa4dd6c26505c017a80e073b6"
      ],
      "author": {
        "name": "Timothy Hatcher",
        "email": "timothy@apple.com",
        "time": "Tue Oct 27 05:03:40 2026"
      },
      "committer": {
        "name": "Timothy Hatcher",
        "email": "timothy@apple.com",
        "time": "Tue Oct 27 05:03:40 2026"
      },
      "message": "WKWebExtensionAPILocalization.mm is compiled with ARC unlike the other Objective-C API tests.\nhttps://webkit.org/b/329017\nrdar://problem/191061592\n\nReviewed by Brian Weinstein.\n\nThe test was built with -fobjc-arc through a per-file override in the TestWebKitAPILibrary exception\nset, while the other Objective-C API tests in that target build without ARC. The test already uses\nRetainPtr and adoptNS for ownership. Remove the override and the matching ARC #error guard so the\ntest builds the same way as its peers.\n\nXcode also re-sorted the QuirkTable.json entries when it saved the project; that reordering is\nincluded.\n\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/WKWebExtensionAPILocalization.mm: Remove the ARC requirement.\n* Tools/TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj: Drop the per-file -fobjc-arc override\nand keep QuirkTable.json in Xcode\u0027s order.\n\nCanonical link: https://commits.webkit.org/324801@main\n"
    },
    {
      "commit": "04a6c7182a8ccabaa4dd6c26505c017a80e073b6",
      "tree": "206814cfe25f2f57b0d9a8cdff7a043e5d46c7ac",
      "parents": [
        "e81441a5ec9c9ab1f7d02d2e49f9d1f86018ff85"
      ],
      "author": {
        "name": "Timothy Hatcher",
        "email": "timothy@apple.com",
        "time": "Tue Oct 27 04:34:07 2026"
      },
      "committer": {
        "name": "Timothy Hatcher",
        "email": "timothy@apple.com",
        "time": "Tue Oct 27 04:34:07 2026"
      },
      "message": "action.setIcon({windowId}) only has an effect after switching tabs.\nhttps://webkit.org/b/315432\nrdar://problem/177792323\n\nReviewed by Brian Weinstein.\n\nWhen a window-specific action property changed, WebExtensionAction::propertiesDidChange() only\nnotified the delegate about tabs that have their own tab action. The window action itself was never\ndispatched, so tabs that inherit from the window, including the active tab, were not updated until\nthe host re-queried the action after a tab switch.\n\nNotify the delegate about the window action itself, the same way the default action branch does.\nTab-specific overrides are still delivered as before.\n\n* Source/WebKit/UIProcess/Extensions/Cocoa/WebExtensionActionCocoa.mm:\n(WebKit::WebExtensionAction::propertiesDidChange): Call the delegate about the window action before\nthe tabs that inherit from it.\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/WKWebExtensionAPIAction.swift:\n(WKWebExtensionAPIActionTests.setIconWithWindowIdNotifiesWindowAction): Added. Verifies that\nsetIcon with a windowId reports the updated window action.\n\nCanonical link: https://commits.webkit.org/324800@main\n"
    },
    {
      "commit": "e81441a5ec9c9ab1f7d02d2e49f9d1f86018ff85",
      "tree": "7e77bfe0ad8c1d15085aaacf0917739061ccca3c",
      "parents": [
        "0927910cf9851eee9f65cf998b9f76ab1ce313d1"
      ],
      "author": {
        "name": "Yusuke Suzuki",
        "email": "ysuzuki@apple.com",
        "time": "Tue Oct 27 04:16:07 2026"
      },
      "committer": {
        "name": "Yusuke Suzuki",
        "email": "ysuzuki@apple.com",
        "time": "Tue Oct 27 04:16:07 2026"
      },
      "message": "[JSC] Add boolean/undefined/null handling to string join functions\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d328769\nrdar://190893702\n\nReviewed by Sosuke Suzuki.\n\nThis patch extends string join functions with fast\nboolean/undefined/null handlings. We also rename\nJSOnlyStringsAndInt32sJoiner to JSExactLengthJoiner.\n\nTest: JSTests/stress/array-join-booleans-and-nullish.js\n\n* JSTests/stress/array-join-booleans-and-nullish.js: Added.\n(shouldBe):\n(join):\n* JSTests/stress/array-join-dfg-tostring-mutation.js:\n* Source/JavaScriptCore/dfg/DFGOperations.cpp:\n(JSC::DFG::arrayJoinWithStringSeparator):\n* Source/JavaScriptCore/runtime/ArrayPrototype.cpp:\n(JSC::JSC_DEFINE_HOST_FUNCTION):\n* Source/JavaScriptCore/runtime/ArrayPrototypeInlines.h:\n(JSC::fastArrayJoin):\n* Source/JavaScriptCore/runtime/JSStringJoiner.cpp:\n(JSC::joinStrings):\n(JSC::JSExactLengthJoiner::joinImpl):\n(JSC::JSOnlyStringsAndInt32sJoiner::joinImpl): Deleted.\n* Source/JavaScriptCore/runtime/JSStringJoiner.h:\n(JSC::JSExactLengthJoiner::JSExactLengthJoiner):\n(JSC::JSExactLengthJoiner::tryJoin):\n(JSC::JSOnlyStringsAndInt32sJoiner::JSOnlyStringsAndInt32sJoiner): Deleted.\n(JSC::JSOnlyStringsAndInt32sJoiner::tryJoin): Deleted.\n\nCanonical link: https://commits.webkit.org/324799@main\n"
    },
    {
      "commit": "0927910cf9851eee9f65cf998b9f76ab1ce313d1",
      "tree": "afbe08f8b91eb401f952fdb044dd47019ca083b8",
      "parents": [
        "01fe2c7b0718950a73eae9bcf4e4761b254ebabc"
      ],
      "author": {
        "name": "Yusuke Suzuki",
        "email": "ysuzuki@apple.com",
        "time": "Tue Oct 27 04:12:50 2026"
      },
      "committer": {
        "name": "Yusuke Suzuki",
        "email": "ysuzuki@apple.com",
        "time": "Tue Oct 27 04:12:50 2026"
      },
      "message": "[JSC] Tail-call restore frame copy starts one restoreFrameSize too low\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d329002\nrdar://191056110\n\nReviewed by Dan Hecht.\n\nWe already moved sp with restoreFrameSize, so we do not need to start\nfrom sp to move. We change the starting cursor to sp + restoreFrameSize.\n\n* Source/JavaScriptCore/wasm/WasmIRGeneratorHelpers.h:\n(JSC::Wasm::emitRestoreInstanceFrameIfNeeded):\n\nCanonical link: https://commits.webkit.org/324798@main\n"
    },
    {
      "commit": "01fe2c7b0718950a73eae9bcf4e4761b254ebabc",
      "tree": "0a3b8736424365ad8955bcd28f5cd1eafeeeed4e",
      "parents": [
        "ad490a9bef9c475d8287e30c21b89292aeefdc44"
      ],
      "author": {
        "name": "Phinehas Fuachie",
        "email": "pfuachie2@apple.com",
        "time": "Tue Oct 27 03:46:34 2026"
      },
      "committer": {
        "name": "Phinehas Fuachie",
        "email": "phinehas133@gmail.com",
        "time": "Tue Oct 27 03:46:34 2026"
      },
      "message": "Spatial video render tests never seed the camera field of view, so the projection matrix is degenerate\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d328976\nrdar://191042319\n\nReviewed by Jer Noble.\n\ncreateRenderer deliberately skips _maybeEnable, which is the only thing that seeds the camera from the\nelement, so the field of view stays 0 and perspective() divides by tan(0). Nothing rasterises and the\nreadback samples the cleared background, which decodes to a direction 90 degrees from every aim.\n\n* LayoutTests/TestExpectations:\n* LayoutTests/media/modern-media-controls/resources/spatial-video-render-utils.js:\n(SpatialRenderTest.createRenderer):\n\nCanonical link: https://commits.webkit.org/324797@main\n"
    },
    {
      "commit": "ad490a9bef9c475d8287e30c21b89292aeefdc44",
      "tree": "e5b933c892bb6c7c4e904ac3b521f04865a06653",
      "parents": [
        "3932342d4ef3f337b8f162a3f0699d2d1ea10417"
      ],
      "author": {
        "name": "Adrian Perez de Castro",
        "email": "aperez@igalia.com",
        "time": "Tue Oct 27 03:44:17 2026"
      },
      "committer": {
        "name": "Adrian Perez de Castro",
        "email": "aperez@igalia.com",
        "time": "Tue Oct 27 03:44:17 2026"
      },
      "message": "[CMake][JSCOnly] Cannot build with ENABLE_JSC_GLIB_API\u003dON\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d328981\n\nReviewed by Patrick Griffis.\n\n* Source/WTF/wtf/PlatformJSCOnly.cmake: Add missing header to\n  the WTF_PUBLIC_HEADERS list.\n\nCanonical link: https://commits.webkit.org/324796@main\n"
    },
    {
      "commit": "3932342d4ef3f337b8f162a3f0699d2d1ea10417",
      "tree": "5f34eb0bbcadf6c291ac0465c3ff4771f0645954",
      "parents": [
        "500be61de4f109c0445c45e1abdd9408f9208cfd"
      ],
      "author": {
        "name": "Charlie Wolfe",
        "email": "charliew@apple.com",
        "time": "Tue Oct 27 03:40:30 2026"
      },
      "committer": {
        "name": "Charlie Wolfe",
        "email": "charliew@apple.com",
        "time": "Tue Oct 27 03:40:30 2026"
      },
      "message": "Cache.put() does not replace the request when overwriting an existing entry\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d328957\nrdar://190659952\n\nReviewed by Sihui Liu.\n\nWhen Cache.put() matched an existing entry, CacheStorageCache::putRecordsInStore() stored the new\nresponse but kept the old entry\u0027s request, header guard, options and referrer. The in-memory record\ninformation also kept the old URL and Vary data. As a result, Cache.keys() returned the stale\nrequest.\n\nPer the spec, the new request/response pair replaces the existing entry. We now reuse only the\nexisting record\u0027s identifier, storage key and insertion time, and take everything else from the new\nrecord, including the in-memory record information.\n\n* LayoutTests/imported/w3c/web-platform-tests/service-workers/cache-storage/cache-put.https.any-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/service-workers/cache-storage/cache-put.https.any.serviceworker-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/service-workers/cache-storage/cache-put.https.any.sharedworker-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/service-workers/cache-storage/cache-put.https.any.worker-expected.txt:\n* Source/WebKit/NetworkProcess/storage/CacheStorageCache.cpp:\n(WebKit::CacheStorageCache::putRecordsInStore):\n\nCanonical link: https://commits.webkit.org/324795@main\n"
    },
    {
      "commit": "500be61de4f109c0445c45e1abdd9408f9208cfd",
      "tree": "db6c296498458a32d75a8016f96e0a601ea229fc",
      "parents": [
        "a3d0ca424213ef7659b9ce74df52ee6546b90f87"
      ],
      "author": {
        "name": "Charlie Wolfe",
        "email": "charliew@apple.com",
        "time": "Tue Oct 27 03:38:32 2026"
      },
      "committer": {
        "name": "Charlie Wolfe",
        "email": "charliew@apple.com",
        "time": "Tue Oct 27 03:38:32 2026"
      },
      "message": "Concurrent CacheStorage put() calls fail with a WriteDisk error on an origin with no existing cache data\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d328959\nrdar://190660037\n\nReviewed by Sihui Liu.\n\nEach CacheStorageDiskStore writes records on its own IO queue. So put() calls on different caches of\nthe same origin can run makeAllDirectories() on the same path from different threads at the same\ntime. On Cocoa, makeAllDirectories() checks each path component with access() and then calls\nmkdir(). If another thread creates that component in between, mkdir() fails with EEXIST and the\nfunction returns false before creating the rest of the path. The record write then fails, and the\npage sees \"Failed writing data to the file system\".\n\nTreat EEXIST from mkdir() as success.\n\nTest: http/wpt/cache-storage/cache-open-put-in-parallel-clean-origin.https.html\n\n* LayoutTests/http/wpt/cache-storage/cache-open-put-in-parallel-clean-origin.https-expected.txt: Added.\n* LayoutTests/http/wpt/cache-storage/cache-open-put-in-parallel-clean-origin.https.html: Added.\n* Source/WTF/wtf/posix/FileSystemPOSIX.cpp:\n(WTF::FileSystemImpl::makeAllDirectories):\n\nCanonical link: https://commits.webkit.org/324794@main\n"
    },
    {
      "commit": "a3d0ca424213ef7659b9ce74df52ee6546b90f87",
      "tree": "10a6b359a5c344d5b2776fa20179e8fc865f27b5",
      "parents": [
        "b55b9c2ae0f0680208494d7ea6b8e4c4f71854ad"
      ],
      "author": {
        "name": "Timothy Hatcher",
        "email": "timothy@apple.com",
        "time": "Tue Oct 27 03:29:53 2026"
      },
      "committer": {
        "name": "Timothy Hatcher",
        "email": "timothy@apple.com",
        "time": "Tue Oct 27 03:29:53 2026"
      },
      "message": "Content-Security-Policy-Report-Only mistakenly blocks Safari extension scripts.\nhttps://webkit.org/b/305807\nrdar://problem/168472819\n\nReviewed by Brian Weinstein.\n\nWhen any policy on a page includes \u0027strict-dynamic\u0027, even a Content-Security-Policy-Report-Only\none, allowScriptFromSource() returns early and leaves script loads to allowScriptForStrictDynamic().\nThat function, unlike allowScriptFromSource(), had no bypass for schemes registered to bypass CSP,\nso a script element pointing at a web extension URL was checked against every policy, including an\nenforced one without \u0027strict-dynamic\u0027, and was blocked.\n\nSkip the check in allowScriptForStrictDynamic() for a script URL whose scheme bypasses CSP, matching\nallowScriptFromSource() and the other allow*FromSource() functions.\n\n* Source/WebCore/page/csp/ContentSecurityPolicy.cpp:\n(WebCore::ContentSecurityPolicy::allowScriptForStrictDynamic const): Return early when the script\nURL\u0027s scheme bypasses CSP.\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/WKWebExtensionAPIScripting.mm:\n(TEST(WKWebExtensionAPIScripting, InjectExtensionScriptElementWithStrictDynamicReportOnlyCSP)): Added.\nInjects a script element for a web accessible extension resource into a page with an enforced\nscript-src \u0027self\u0027 policy and a report-only \u0027strict-dynamic\u0027 policy.\n\nCanonical link: https://commits.webkit.org/324793@main\n"
    },
    {
      "commit": "b55b9c2ae0f0680208494d7ea6b8e4c4f71854ad",
      "tree": "998dfc79ef8cac4d0a4b9c4820c3ace53fdf818e",
      "parents": [
        "0bf94cf0c1c16ede4c04e2cb3f50d776eae8b70e"
      ],
      "author": {
        "name": "Timothy Hatcher",
        "email": "timothy@apple.com",
        "time": "Tue Oct 27 03:02:03 2026"
      },
      "committer": {
        "name": "Timothy Hatcher",
        "email": "timothy@apple.com",
        "time": "Tue Oct 27 03:02:03 2026"
      },
      "message": "Need test cases for browser.runtime.lastError.\nhttps://webkit.org/b/248156\nrdar://problem/102695342\n\nReviewed by Brian Weinstein.\n\nThe runtime.lastError test only checked the idle value and carried a FIXME for real coverage. Add\ntests for the three states: set inside a callback after a failure, null inside a callback after\na success, and cleared once the failing callback has returned.\n\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/WKWebExtensionAPIRuntime.mm:\n(TestWebKitAPI::TEST(WKWebExtensionAPIRuntime, LastError)): Remove the FIXME.\n(TestWebKitAPI::TEST(WKWebExtensionAPIRuntime, LastErrorSetInCallbackOnFailure)): Added.\n(TestWebKitAPI::TEST(WKWebExtensionAPIRuntime, LastErrorNullInCallbackOnSuccess)): Added.\n(TestWebKitAPI::TEST(WKWebExtensionAPIRuntime, LastErrorClearedAfterCallback)): Added.\n\nCanonical link: https://commits.webkit.org/324792@main\n"
    },
    {
      "commit": "0bf94cf0c1c16ede4c04e2cb3f50d776eae8b70e",
      "tree": "be9a2dc03b44c22ec6b4609814b444e3b65301cd",
      "parents": [
        "be583048f3d5228ff6f0ea6b199833bd7e2f3e85"
      ],
      "author": {
        "name": "Dan Hecht",
        "email": "dan.hecht@apple.com",
        "time": "Tue Oct 27 02:26:54 2026"
      },
      "committer": {
        "name": "Dan Hecht",
        "email": "dan.hecht@apple.com",
        "time": "Tue Oct 27 02:26:54 2026"
      },
      "message": "[JSC] Replace an unreachable branch in Heap::stopTheMutator with an assert\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d328987\nrdar://191050629\n\nReviewed by Yusuke Suzuki.\n\nHeap::stopTheMutator returned false when the mutator already held the conn,\nafter asserting that the mutator had no heap access. That branch is never\ntaken: only the collector thread calls stopTheMutator, and only while it is\nconducting, so no mutator holds the conn. Its asserts could not hold either: a\nmutator is given the conn only while it has heap access, and releasing heap\naccess also gives up the conn.\n\nReplace the branch, and the two other asserts that the mutator does not hold\nthe conn, with one assert at the top of the loop.\n\n* Source/JavaScriptCore/heap/Heap.cpp:\n(JSC::Heap::clearConcurrentRetainedDataIfPossible):\n\nCanonical link: https://commits.webkit.org/324791@main\n"
    },
    {
      "commit": "be583048f3d5228ff6f0ea6b199833bd7e2f3e85",
      "tree": "56d473b788701cb1750b9b92fc58410b66f73873",
      "parents": [
        "969d0697bb2c7117f9bed305a42f3dffdfd3698b"
      ],
      "author": {
        "name": "Sosuke Suzuki",
        "email": "sosuke@anthropic.com",
        "time": "Tue Oct 27 02:23:25 2026"
      },
      "committer": {
        "name": "Sosuke Suzuki",
        "email": "sosuke@anthropic.com",
        "time": "Tue Oct 27 02:23:25 2026"
      },
      "message": "[JSC] `Identifier::add` should not ref and deref the returned `AtomStringImpl`\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d328788\n\nReviewed by Yusuke Suzuki.\n\n`Identifier::add` and `add8` dereference the temporary RefPtr returned by\n`AtomStringImpl::add` and build a Ref from the reference, which costs one extra\natomic ref and deref per call. Use `releaseNonNull()` instead.\n\n* Source/JavaScriptCore/runtime/Identifier.cpp:\n(JSC::Identifier::add8):\n* Source/JavaScriptCore/runtime/IdentifierInlines.h:\n(JSC::Identifier::add):\n\nCanonical link: https://commits.webkit.org/324790@main\n"
    },
    {
      "commit": "969d0697bb2c7117f9bed305a42f3dffdfd3698b",
      "tree": "aec223b686a5fc7a5ea44c3b596782970939bb70",
      "parents": [
        "fad04e2527d858db0920b3c14c62ae2b9b434a53"
      ],
      "author": {
        "name": "Timothy Hatcher",
        "email": "timothy@apple.com",
        "time": "Tue Oct 27 02:22:27 2026"
      },
      "committer": {
        "name": "Timothy Hatcher",
        "email": "timothy@apple.com",
        "time": "Tue Oct 27 02:22:27 2026"
      },
      "message": "Add a test for updating a tab from a webNavigation.onCommitted listener.\nhttps://webkit.org/b/328994\nrdar://problem/66033669\n\nReviewed by Brian Weinstein.\n\nThe original report, filed against the earlier Safari-internal implementation, said that\ntabs.update() with a url did nothing when called from a webNavigation.onCommitted listener. The\ncurrent implementation navigates the tab and fires the follow-up onCommitted event, but no test\ncovered the scenario.\n\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/WKWebExtensionAPIWebNavigation.mm:\n(TestWebKitAPI::TEST(WKWebExtensionAPIWebNavigation, UpdateTabDuringCommittedEvent)): Added.\n\nCanonical link: https://commits.webkit.org/324789@main\n"
    },
    {
      "commit": "fad04e2527d858db0920b3c14c62ae2b9b434a53",
      "tree": "d31ab9deb7c4f76899ac4a7b2a79054c6cbc1140",
      "parents": [
        "013c6a8a8a8ce860f234df6fe592c780892fbfcb"
      ],
      "author": {
        "name": "Sosuke Suzuki",
        "email": "sosuke@anthropic.com",
        "time": "Tue Oct 27 02:21:00 2026"
      },
      "committer": {
        "name": "Sosuke Suzuki",
        "email": "sosuke@anthropic.com",
        "time": "Tue Oct 27 02:21:00 2026"
      },
      "message": "[JSC] `Proxy.revocable` should not set up the revoke function on each call\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d328635\n\nReviewed by Yusuke Suzuki.\n\nOn each call, Proxy.revocable atomized \"proxy\" and \"revoke\", added them to an\nempty object one by one, and allocated a ProxyRevoke (an InternalFunction) with\nits `length` and `name` properties.\n\nThis patch makes the revoke function a JSFunctionWithFields whose NativeExecutable\nis cached in VM, as Promise resolving functions do, and caches the Structure of the\nresult object in JSGlobalObject. ProxyRevoke is removed.\n\nThe revoke function now behaves like other JSFunctions when its own keys are\nenumerated: `length` and `name` come first even after they are deleted and\nredefined, and the keys are not cached per Structure.\n\n                          Baseline                  Patched\n\nproxy-revocable       96.7449+-3.8240     ^     33.5181+-1.7186        ^ definitely 2.8863x faster\n\nTests: JSTests/microbenchmarks/proxy-revocable.js\n       JSTests/stress/proxy-revocable-result-and-revoke-function.js\n\n* JSTests/microbenchmarks/proxy-revocable.js: Added.\n* JSTests/stress/proxy-revocable-result-and-revoke-function.js: Added.\n(shouldBe):\n(testResult):\n(testRevokeFunction):\n(testRevoke):\n* JSTests/wasm/ipint-tests/ipint-stress.wasm:\n* Source/JavaScriptCore/CMakeLists.txt:\n* Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj:\n* Source/JavaScriptCore/Sources.txt:\n* Source/JavaScriptCore/heap/Heap.h:\n* Source/JavaScriptCore/heap/HeapSubspaceTypes.h:\n* Source/JavaScriptCore/runtime/CommonIdentifiers.h:\n* Source/JavaScriptCore/runtime/JSFunctionWithFields.h:\n* Source/JavaScriptCore/runtime/JSGlobalObject.cpp:\n(JSC::JSGlobalObject::init):\n(JSC::JSGlobalObject::visitChildrenImpl):\n* Source/JavaScriptCore/runtime/JSGlobalObject.h:\n(JSC::JSGlobalObject::proxyRevocableResultStructure const):\n(JSC::JSGlobalObject::proxyRevokeStructure const): Deleted.\n* Source/JavaScriptCore/runtime/ProxyConstructor.cpp:\n(JSC::createProxyRevocableResultStructure):\n(JSC::JSC_DEFINE_HOST_FUNCTION):\n* Source/JavaScriptCore/runtime/ProxyConstructor.h:\n* Source/JavaScriptCore/runtime/ProxyRevoke.cpp: Removed.\n* Source/JavaScriptCore/runtime/ProxyRevoke.h: Removed.\n* Source/JavaScriptCore/runtime/ProxyRevokeInlines.h: Removed.\n* Source/JavaScriptCore/runtime/VM.cpp:\n(JSC::VM::proxyRevokeExecutableSlow):\n(JSC::VM::visitAggregateImpl):\n* Source/JavaScriptCore/runtime/VM.h:\n* Source/JavaScriptCore/runtime/VMInlines.h:\n\nCanonical link: https://commits.webkit.org/324788@main\n"
    },
    {
      "commit": "013c6a8a8a8ce860f234df6fe592c780892fbfcb",
      "tree": "cd6c72319d8ba98c5d000adcc4f8fd8390ce80f7",
      "parents": [
        "ca48e0119c5616f668080cbbf50765812199063f"
      ],
      "author": {
        "name": "Ahmad Saleem",
        "email": "ahmad.saleem792+github@gmail.com",
        "time": "Tue Oct 27 02:19:40 2026"
      },
      "committer": {
        "name": "Ahmad Saleem",
        "email": "ahmad.saleem792@gmail.com",
        "time": "Tue Oct 27 02:19:40 2026"
      },
      "message": "[Quirk] cnn.com: \"More\" menu stays open on top of the Search menu in Safari\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d329003\nrdar://190735753\n\nReviewed by Brent Fulgham.\n\nOn macOS, form controls without an explicit tabindex are not mouse\nfocusable, so clicking the \"More\" button does not focus it. Clicking\nSearch afterwards therefore never moves focus away from the More menu,\nand the site does not dismiss it, leaving it open on top of the Search\nmenu. Apply NeedsFormControlToBeMouseFocusableQuirk to cnn.com, as is\nalready done for affirm.com, thetimes.com, weather.com and others.\n\n* LayoutTests/platform/mac-sequoia/fast/quirks/active-quirks-by-domain-expected.txt:\n* LayoutTests/platform/mac-tahoe/fast/quirks/active-quirks-by-domain-expected.txt:\n* Source/WebCore/page/QuirkBehaviors.yaml:\n* Source/WebCore/page/QuirkTable.json:\n\nCanonical link: https://commits.webkit.org/324787@main\n"
    },
    {
      "commit": "ca48e0119c5616f668080cbbf50765812199063f",
      "tree": "7b984fdccf09c398e484699cdef724b6b070b1f3",
      "parents": [
        "b6386317f9ba03c4b3b77d07e9ff8407af922546"
      ],
      "author": {
        "name": "Sosuke Suzuki",
        "email": "sosuke@anthropic.com",
        "time": "Tue Oct 27 02:13:32 2026"
      },
      "committer": {
        "name": "Sosuke Suzuki",
        "email": "sosuke@anthropic.com",
        "time": "Tue Oct 27 02:13:32 2026"
      },
      "message": "[JSC] Remove remaining BIGINT32 code\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d328786\n\nReviewed by Yusuke Suzuki.\n\n324510@main removed BIGINT32, but two `#if USE(BIGINT32)` blocks were left\nin JSBigInt.cpp. This patch removes them.\n\n* Source/JavaScriptCore/runtime/JSBigInt.cpp:\n(JSC::JSBigInt::tryToBigUInt64):\n(JSC::JSBigInt::tryToBigInt64):\n\nCanonical link: https://commits.webkit.org/324786@main\n"
    },
    {
      "commit": "b6386317f9ba03c4b3b77d07e9ff8407af922546",
      "tree": "d7b9c0b3bf180bb7182501a0f05815d4bfa942f0",
      "parents": [
        "4fc79af3d584b3ffb0976aaf64051c31d25c5fbe"
      ],
      "author": {
        "name": "Alan Baradlay",
        "email": "zalan@apple.com",
        "time": "Tue Oct 27 02:01:56 2026"
      },
      "committer": {
        "name": "Alan Baradlay",
        "email": "zalan@apple.com",
        "time": "Tue Oct 27 02:01:56 2026"
      },
      "message": "ChatGPT\u0027s floating toolbar sits too high when selecting text\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d328946\nrdar://190449381\n\nReviewed by Antti Koivisto.\n\n    \u003cdiv contenteditable\u003eSelect some text\u003c/div\u003e\n    \u003cdiv id\u003d\"toolbar\" style\u003d\"position: fixed\"\u003e\u003c/div\u003e\n    \u003cscript\u003e\n    document.addEventListener(\"selectionchange\", () \u003d\u003e {\n        let selectionRect \u003d getSelection().getRangeAt(0).getBoundingClientRect();\n        toolbar.style.top \u003d (selectionRect.top - toolbar.offsetHeight - 8) + \"px\";\n    });\n    \u003c/script\u003e\n\nOn iPhone with the keyboard up, the toolbar should sit 8px above the selected\ntext. Instead it sits higher by visualViewport.offsetTop.\n\ngetBoundingClientRect() measures from the visual viewport\u0027s origin, while\nposition: fixed is laid out against the layout viewport. With the keyboard up,\nthe visual viewport scrolls down inside the layout viewport, so the client rect\ncomes back too small by that offset.\n\nApply ShouldUseLayoutViewportForClientRectsQuirk to chatgpt.com, as is already\ndone for discord.com (307378@main).\n\n* LayoutTests/fast/quirks/active-quirks-by-domain.html:\n* Source/WebCore/page/QuirkTable.json:\n* LayoutTests/platform/ios/fast/quirks/active-quirks-by-domain-expected.txt:\n* LayoutTests/fast/quirks/active-quirks-by-domain-expected.txt:\n* LayoutTests/platform/glib/fast/quirks/active-quirks-by-domain-expected.txt:\n* LayoutTests/platform/ipad/fast/quirks/active-quirks-by-domain-expected.txt:\n* LayoutTests/platform/mac-sequoia/fast/quirks/active-quirks-by-domain-expected.txt:\n* LayoutTests/platform/mac-tahoe/fast/quirks/active-quirks-by-domain-expected.txt:\n\nCanonical link: https://commits.webkit.org/324785@main\n"
    },
    {
      "commit": "4fc79af3d584b3ffb0976aaf64051c31d25c5fbe",
      "tree": "8facaa8aeec1faf558b0f23223c9b39b0573cc65",
      "parents": [
        "6f5f583b55ecab83b237a8fd1a5aade75acef938"
      ],
      "author": {
        "name": "Timothy Hatcher",
        "email": "timothy@apple.com",
        "time": "Tue Oct 27 01:17:29 2026"
      },
      "committer": {
        "name": "Timothy Hatcher",
        "email": "timothy@apple.com",
        "time": "Tue Oct 27 01:17:29 2026"
      },
      "message": "Add a test that action.setIcon({}) resets the icon.\nhttps://webkit.org/b/328996\nrdar://problem/191052267\n\nReviewed by Brian Weinstein.\n\nhttps://github.com/w3c/webextensions/issues/1101 asks that action.setIcon({}) reset the icon to the\nmanifest default, as Safari and Firefox already do (Chrome rejects). WebExtensionAPIAction::setIcon\nleaves the icon dictionary empty when no path, imageData or variants is given, which clears the icon.\nNothing covered that, so add a test.\n\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/WKWebExtensionAPIAction.swift:\n(WKWebExtensionAPIActionTests.setIconWithEmptyDetails): Added. Sets an icon, then calls setIcon({})\nand checks the manifest icon is used again.\n(WKWebExtensionAPIActionTests.expectDefaultIconAfterSettingIcon): Added additionalResources so a\ntest can supply extra icon files.\n\nCanonical link: https://commits.webkit.org/324784@main\n"
    },
    {
      "commit": "6f5f583b55ecab83b237a8fd1a5aade75acef938",
      "tree": "2bfc07bfbf189da53f09c33a30ccb6134ffffe86",
      "parents": [
        "7b78a52a5c706f6c08e57f0928097f2b977e05a8"
      ],
      "author": {
        "name": "Yusuke Suzuki",
        "email": "ysuzuki@apple.com",
        "time": "Tue Oct 27 01:14:12 2026"
      },
      "committer": {
        "name": "Yusuke Suzuki",
        "email": "ysuzuki@apple.com",
        "time": "Tue Oct 27 01:14:12 2026"
      },
      "message": "[JSC] JSON.parse should take keys found in JSONCache\u0027s name table, and their values, through a dedicated loop\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d328615\nrdar://190797577\n\nReviewed by Keith Miller.\n\nJSON Tokenizing can be much faster if we are leveraging the skew of next\ntoken. When parsing an object and having a key (\"key\"), then next only\nvalid token is colon (:). Based on this skew, we scan tokens more\nquickly before going to the generic lexing code.\n\nGiven that JSON.parse is extremely frequently executed, we are tuning\nsuper carefuly to make everything super efficient.\n\n1. A key found in the name table was returned as an std::optional\u003cExistingProperty\u003e,\n   folded into the Variant\u003cExistingProperty, Identifier\u003e that the generic key lookup\n   produces, and paired with a consumedColon flag carried across the iteration. The\n   compiler ends up spilling them into the stack.\n2. The lexer\u0027s position is a member, and the source is read one byte at a time, so\n   the compiler has to assume any byte store could change it. It was stored after\n   every advance, including after every digit of a number, and loaded again at the\n   top of the loop. The token after each value was likewise stored and loaded back\n   to decide whether the object continues.\n\nThis patch gives keys found in the name table their own loop, which reads the source through a local cursor\nthat stays in a register. For each key it matches the name, then reads a string value found in JSONCache\u0027s\nsource-text table, or an integer of at most nine digits without a sign, directly through the cursor,\nstores the property with its transition, and dispatches on the separator byte.\n\nAny other value is read by the lexer from the same position, and any other key takes the existing path for\nthat one property before returning to the loop.\n\n                                                         ToT                     Patched\n\n    json-parse-object-reviver-same-value           78.3654+-0.2510     ?     78.9265+-0.3672        ?\n    todomvc-javascript-es5-json-parse              15.5418+-0.0712     ^     12.6900+-0.0496        ^ definitely 1.2247x faster\n    vanilla-es2015-babel-webpack-todomvc-json-parse\n                                                   25.2949+-0.1827     ^     21.5578+-0.1615        ^ definitely 1.1734x faster\n    todomvc-javascript-es6-webpack-json-parse\n                                                   27.4154+-0.1697     ^     22.1923+-0.0995        ^ definitely 1.2354x faster\n    json-parse-array-reviver-same-value            56.1238+-0.1920     ^     54.8521+-0.3038        ^ definitely 1.0232x faster\n    flight-todomvc-json-parse                      16.0599+-0.0981     ^     14.0560+-0.0439        ^ definitely 1.1426x faster\n    json-parse-object-reviver                      80.3643+-0.2950     ?     80.9511+-0.5340        ?\n    json-parse-leaf-object                          9.8980+-0.0613     ^      7.6658+-0.0689        ^ definitely 1.2912x faster\n    vanilla-es2015-todomvc-json-parse              25.2668+-0.2169     ^     21.5433+-0.0925        ^ definitely 1.1728x faster\n    json-parse-utf16-leaf-object                   82.6690+-0.2743     ^     62.4780+-0.4512        ^ definitely 1.3232x faster\n    json-parse-repeated-short-strings               9.3115+-0.0552     ^      7.4934+-0.0350        ^ definitely 1.2426x faster\n    vanilla-todomvc-json-parse                     18.8332+-0.0518     ^     15.9560+-0.0715        ^ definitely 1.1803x faster\n    json-parse-utf16-nested-records                32.1751+-0.1018     ^     28.4392+-0.1211        ^ definitely 1.1314x faster\n    json-parse-array-reviver                       61.4988+-0.4369           60.5441+-0.5521          might be 1.0158x faster\n    json-parse-double                              46.6939+-0.1455     ^     45.6980+-0.3330        ^ definitely 1.0218x faster\n    json-parse-short-string-ids                   108.9573+-1.1631     ^    103.1068+-1.3449        ^ definitely 1.0567x faster\n    json-parse-int32-array                        208.2562+-1.2047     ^    195.6330+-0.9339        ^ definitely 1.0645x faster\n\n    \u003cgeometric\u003e                                    37.0365+-0.0552     ^     32.7853+-0.0497        ^ definitely 1.1297x faster\n\nTest: JSTests/stress/json-parse-cached-integer-values.js\n\n* JSTests/stress/json-parse-cached-integer-values.js: Added.\n(shouldBe):\n(parse):\n(shouldThrow):\n(iteration.p.of.prefixes.const.number.of.numbers.const.number.of.invalid.shouldThrow.shouldThrow.shouldThrow.shouldThrow.shouldThrow.join):\n* Source/JavaScriptCore/runtime/LiteralParser.cpp:\n(JSC::scanJSONIntegerDigits):\n(JSC::reviverMode\u003e::Lexer::lexNumber):\n(JSC::requires):\n(JSC::reviverMode\u003e::Lexer::skipWhitespaceBeforeKey): Deleted.\n* Source/JavaScriptCore/runtime/LiteralParser.h:\n(JSC::LiteralParser::Lexer::end const):\n(JSC::LiteralParser::Lexer::setPtr):\n* Source/JavaScriptCore/runtime/ParseInt.h:\n(JSC::parseInt):\n\nCanonical link: https://commits.webkit.org/324783@main\n"
    },
    {
      "commit": "7b78a52a5c706f6c08e57f0928097f2b977e05a8",
      "tree": "1cb79265a182aa9a760f300ab7f56ef02f575ad4",
      "parents": [
        "7954241ec14cfebc10e8487a2f77142ccbad4446"
      ],
      "author": {
        "name": "Per Arne Vollan",
        "email": "pvollan@apple.com",
        "time": "Tue Oct 27 00:56:49 2026"
      },
      "committer": {
        "name": "Per Arne Vollan",
        "email": "pvollan@apple.com",
        "time": "Tue Oct 27 00:56:49 2026"
      },
      "message": "Fix flaky privateClickMeasurement/database-disabled-in-ephemeral-session.html\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d317441\n\nReviewed by Ben Nham (OOPS\\!).\n\nThe test was flaky because the application bundle identifier in the\noutput could vary depending on WebContent process reuse. The fix\nexplicitly sets the app bundle ID via the Network process testing\nAPI, making the test deterministic.\n\nCanonical link: https://commits.webkit.org/324782@main\n"
    },
    {
      "commit": "7954241ec14cfebc10e8487a2f77142ccbad4446",
      "tree": "b46fb4f9e0532697cafb77b3d5c15412fbedfd02",
      "parents": [
        "b8e70e11572fa9f1e824e193c6b90481e166f189"
      ],
      "author": {
        "name": "Cameron McCormack",
        "email": "heycam@apple.com",
        "time": "Tue Oct 27 00:23:47 2026"
      },
      "committer": {
        "name": "Cameron McCormack",
        "email": "heycam@apple.com",
        "time": "Tue Oct 27 00:23:47 2026"
      },
      "message": "Allow gradients affected by -apple-color-filter to be cached\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d328884\nrdar://190976194\n\nReviewed by Dan Glastonbury.\n\nPages with many gradients affected by -apple-color-filter can be slow to\nrender due to missing the cache.\n\nTests: css3/color-filters/color-filter-gradient-caching.html\n       css3/color-filters/color-filter-gradient-filter-change.html\n       css3/color-filters/color-filter-gradient-shared-by-different-filters.html\n\n* Source/WebCore/style/values/images/kinds/StyleGradientImage.cpp:\n(WebCore::Style::GradientImage::CachedGradient::size const):\n(WebCore::Style::GradientImage::CachedGradient::patternBufferIdentifierForTesting const):\n(WebCore::Style::GradientImage::CachedGradient::CachedGradient):\n(WebCore::Style::GradientImage::CachedGradient::evictionTimerFired):\n(WebCore::Style::GradientImage::cachedGradient):\n(WebCore::Style::GradientImage::evictCachedGradient):\n(WebCore::Style::GradientImage::cachedGradientsForTesting const):\n(WebCore::Style::GradientImage::gradientForSize const):\n(WebCore::Style::GradientImage::cachedGradientForSize): Deleted.\n* Source/WebCore/style/values/images/kinds/StyleGradientImage.h:\n* LayoutTests/css3/color-filters/color-filter-gradient-caching-expected.txt: Added.\n* LayoutTests/css3/color-filters/color-filter-gradient-caching.html: Added.\n* LayoutTests/css3/color-filters/color-filter-gradient-filter-change-expected.html: Added.\n* LayoutTests/css3/color-filters/color-filter-gradient-filter-change.html: Added.\n* LayoutTests/css3/color-filters/color-filter-gradient-shared-by-different-filters-expected.html: Added.\n* LayoutTests/css3/color-filters/color-filter-gradient-shared-by-different-filters.html: Added.\n* Source/WebCore/testing/Internals.cpp:\n(WebCore::backgroundGradientImage):\n(WebCore::Internals::backgroundGradientCache):\n* Source/WebCore/testing/Internals.h:\n* Source/WebCore/testing/Internals.idl:\n\nCanonical link: https://commits.webkit.org/324781@main\n"
    },
    {
      "commit": "b8e70e11572fa9f1e824e193c6b90481e166f189",
      "tree": "05d6b4a2add403d4c739eae12bb150d449119d9d",
      "parents": [
        "73c011f8c0a087d4d6bb4fd4ea80ff070b7bb4d5"
      ],
      "author": {
        "name": "Dawn Morningstar",
        "email": "morningstar@apple.com",
        "time": "Tue Oct 27 00:16:23 2026"
      },
      "committer": {
        "name": "Dawn Morningstar",
        "email": "morningstar@apple.com",
        "time": "Tue Oct 27 00:16:23 2026"
      },
      "message": "[webkitpy] Don\u0027t look for variants in web-platform-tests files that declare none\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d326878\nrdar://189555102\n\nReviewed by Jonathan Bedard.\n\nFinding tests parses every web-platform-tests file for variants. Skip files that don\u0027t mention \"variant\", since both\nways of declaring one contain it. Finding the mac tests drops from about 6.4 s to 4.8 s of CPU, and finds the same tests\non mac and iOS as before.\n\n* Tools/Scripts/webkitpy/layout_tests/controllers/layout_test_finder.py:\n(LayoutTestFinder._find_variants):\n\nCanonical link: https://commits.webkit.org/324780@main\n"
    },
    {
      "commit": "73c011f8c0a087d4d6bb4fd4ea80ff070b7bb4d5",
      "tree": "5e4360bac65ac05d14f9bdaa32c19ed23b0a32a0",
      "parents": [
        "62c9b61581d26d08a22e7883dd3e363ec6e42639"
      ],
      "author": {
        "name": "Roberto Rodriguez",
        "email": "roberto_rodriguez2@apple.com",
        "time": "Tue Oct 27 00:14:31 2026"
      },
      "committer": {
        "name": "Roberto Rodriguez",
        "email": "roberto_rodriguez2@apple.com",
        "time": "Tue Oct 27 00:14:31 2026"
      },
      "message": "PDF HUD keeps its unscaled frame after a pinch zoom\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d328368\nrdar://190644542\n\nReviewed by Abrar Rahman Protyasha and Mike Wyrzykowski.\n\nWith UnifiedMacZoomEnabled on, updateVisibleContentRects in WebPage updates\nan embedded PDF plugin\u0027s transform after a pinch zoom only for an update\nmarked stable. The UI process sends a stable update at the end of a pinch,\nthen an unstable update with the same scale and rects from\nmainFrameScrollPositionDidChange. ViewUpdateDispatcher keeps only the newest\npending update per page, so the unstable one can replace the stable one\nbefore the web process handles it. The plugin then keeps its transform from\nbefore the pinch and the HUD keeps its original frame, which made\nEmbeddedPDFHUDAfterPinch.HUDScalesWithPinchZoom fail intermittently.\n\nFix by having sendVisibleContentRectUpdate in\nRemoteLayerTreeDrawingAreaProxyMac skip an unstable update that equals the\nlast update sent, ignoring only view stability, when that last update was\nstable. Layers are still adjusted if the UI process owns the scrolled\ncontents layer position.\n\n* Source/WebKit/Shared/VisibleContentRectUpdateInfo.h:\n(WebKit::equalIgnoringViewStability):\n(WebKit::operator\u003d\u003d):\n* Source/WebKit/UIProcess/Cocoa/WebPageProxyCocoa.mm:\n(WebKit::WebPageProxy::isRedundantUnstableVisibleContentRectUpdate const):\n* Source/WebKit/UIProcess/RemoteLayerTree/mac/RemoteLayerTreeDrawingAreaProxyMac.mm:\n(WebKit::RemoteLayerTreeDrawingAreaProxyMac::sendVisibleContentRectUpdate):\n* Source/WebKit/UIProcess/WebPageProxy.h:\n* TestExpectations/apitests:\n\nCanonical link: https://commits.webkit.org/324779@main\n"
    },
    {
      "commit": "62c9b61581d26d08a22e7883dd3e363ec6e42639",
      "tree": "e0aeb3f441b7cddb5ac41289d229534f8f7a4601",
      "parents": [
        "1eda084f24889468aa7fc8fab76cd420ef742a46"
      ],
      "author": {
        "name": "Dawn Morningstar",
        "email": "morningstar@apple.com",
        "time": "Tue Oct 27 00:09:25 2026"
      },
      "committer": {
        "name": "Dawn Morningstar",
        "email": "morningstar@apple.com",
        "time": "Tue Oct 27 00:09:25 2026"
      },
      "message": "[webkitpy] run-api-tests --test-parallel-safety should leave the checked tests\u0027 suites out of the background load\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d328526\nrdar://190750683\n\nReviewed by Jonathan Bedard.\n\nA normal run puts each suite in one shard and runs its tests one after another, but --test-parallel-safety kept the\nrest of a checked test\u0027s suite in the background load, so the check could report conflicts with tests of the same suite\nthat a normal run can\u0027t hit. Leave the suites of the checked tests out of the background load. Checked tests from one\nsuite still run side by side, since running them one after another would multiply the step\u0027s time.\n\n* Tools/Scripts/webkitpy/api_tests/runner.py:\n(Runner._suite_name):\n(Runner._shard_tests):\n(Runner._run_parallel_safety):\n* Tools/Scripts/webkitpy/api_tests/runner_unittest.py:\n(RunnerRunTest.test_parallel_safety_runs_each_checked_test_in_one_task_and_leaves_their_suites_out_of_the_background):\n\nCanonical link: https://commits.webkit.org/324778@main\n"
    },
    {
      "commit": "1eda084f24889468aa7fc8fab76cd420ef742a46",
      "tree": "e877a49cb09af3908f48fd704432f949ca5c9df4",
      "parents": [
        "b5f42600599acb770318c3ecf7dd3946e0f769be"
      ],
      "author": {
        "name": "Karl Rackler",
        "email": "rackler@apple.com",
        "time": "Tue Oct 27 00:02:52 2026"
      },
      "committer": {
        "name": "Karl Rackler",
        "email": "rackler@apple.com",
        "time": "Tue Oct 27 00:02:52 2026"
      },
      "message": "[Gardening]: New Test(322050@main): [macOS] 4 compositing/filters/filter-fractional-translation tests are a constant IMAGE failure\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d329010\nrdar://191055675\n\nUnreviewed test gardening.\n\nAdd test expectations.\n\n* LayoutTests/platform/mac-wk2/TestExpectations:\n\nCanonical link: https://commits.webkit.org/324777@main\n"
    },
    {
      "commit": "b5f42600599acb770318c3ecf7dd3946e0f769be",
      "tree": "649e8cdffcab91f7a01bb3a1c45ecebbbafd7118",
      "parents": [
        "d71f3d702b1d0273006ba957193ffbb278fc0bcc"
      ],
      "author": {
        "name": "Sam Weinig",
        "email": "sam@webkit.org",
        "time": "Mon Oct 26 23:43:56 2026"
      },
      "committer": {
        "name": "Sam Weinig",
        "email": "sam@webkit.org",
        "time": "Mon Oct 26 23:43:56 2026"
      },
      "message": "[Image Redux] Make DragImage a class wrapping a PlatformDragImage\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d328879\n\nReviewed by Abrar Rahman Protyasha and Darin Adler.\n\nPart 2 of fixing the layering violations in DragImage.\n\nIn this change we remove the uses of TextIndicator in platform code. To do this, we first move the DragItem class\nfrom platform/ to page/, as its not used by any other platform types. Then, we change the existing DragImage type\nfrom owning a DragImageRef, TextIndicator and Path, to just owning the DragImageRef (which is renamed to\nPlatformDragImage) and moving most of the free functions that acted on DragImageRef to be member functions. Since\nTextIndicator and Path are no longer part of DragImage, DragItem is updated to have them be direct members, and\nmoves DragImage to the bottom, to appease IPC, which sends the DragImage as a separate shared bitmap.\n\n* Source/WebCore/Headers.cmake:\n* Source/WebCore/WebCore.xcodeproj/project.pbxproj:\n* Source/WebCore/dom/DataTransfer.cpp:\n* Source/WebCore/dom/DataTransfer.h:\n* Source/WebCore/page/DragController.cpp:\n* Source/WebCore/page/DragController.h:\n* Source/WebCore/page/DragItem.h: Renamed from Source/WebCore/platform/DragItem.h.\n* Source/WebCore/page/cocoa/DragControllerCocoa.mm:\n* Source/WebCore/page/win/DragControllerWin.cpp:\n* Source/WebCore/platform/DragImage.cpp:\n* Source/WebCore/platform/DragImage.h:\n* Source/WebCore/platform/Pasteboard.h:\n* Source/WebCore/platform/StaticPasteboard.h:\n* Source/WebCore/platform/cocoa/DragImageCocoa.mm:\n* Source/WebCore/platform/glib/PasteboardGLib.cpp:\n* Source/WebCore/platform/ios/DragImageIOS.mm:\n* Source/WebCore/platform/ios/PasteboardIOS.mm:\n* Source/WebCore/platform/mac/PasteboardMac.mm:\n* Source/WebCore/platform/skia/DragImageSkia.cpp:\n* Source/WebCore/platform/win/PasteboardWin.cpp:\n* Source/WebCore/platform/win/cairo/DragImageWinCairo.cpp:\n* Source/WebKit/Shared/WebCoreArgumentCoders.serialization.in:\n* Source/WebKit/UIProcess/ios/DragDropInteractionState.mm:\n* Source/WebKit/WebProcess/WebCoreSupport/cocoa/WebDragClientCocoa.mm:\n* Source/WebKit/WebProcess/WebCoreSupport/gtk/WebDragClientGtk.cpp:\n* Source/WebKitLegacy/mac/DOM/DOM.mm:\n* Source/WebKitLegacy/mac/WebCoreSupport/WebDragClient.mm:\n* Source/WebKitLegacy/mac/WebView/WebHTMLView.mm:\n* Source/WebKitLegacy/mac/WebView/WebView.mm:\n\nCanonical link: https://commits.webkit.org/324776@main\n"
    },
    {
      "commit": "d71f3d702b1d0273006ba957193ffbb278fc0bcc",
      "tree": "3a49be0401d63d0f8cd29fb735a2145dbd503432",
      "parents": [
        "9025b90e17802e3a54e94e4e6a611b30d8afba13"
      ],
      "author": {
        "name": "Anthony Tarbinian",
        "email": "a_tarbinian@apple.com",
        "time": "Mon Oct 26 23:33:13 2026"
      },
      "committer": {
        "name": "Anthony Tarbinian",
        "email": "a_tarbinian@apple.com",
        "time": "Mon Oct 26 23:33:13 2026"
      },
      "message": "Reland [324554@main] Add PhoneNumberPossessionController\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d328973\nrdar://191041223\n\nReviewed by Abrar Rahman Protyasha.\n\nThis was reverted in 324570@main because Swift 6.4 crashed compiling it, which\nbroke the macOS 27.0 builds. This version works around both crashes:\n- The tasks capture their completion handlers explicitly, since capturing a\n  sending C++ reference implicitly crashes the optimizer (rdar://191032757).\n- Swift gets the request boxed in WTF::RefCountable, as\n  RefCountedPhoneNumberPossessionRequest, since moving a\n  PhoneNumberPossessionRequest into a closure crashes IRGen (rdar://191033367).\n\nAdd PhoneNumberPossessionController, the first UI process part of phone number\npossession:\n- PhoneNumberPossessionController is what C++ calls. It\u0027s nonisolated, and each\n  method hops to the main actor with Task.immediate and reports back through a\n  C++ completion handler.\n- Its Base holds the request state and the cancellable task, on the main actor.\n- A PhoneNumberPossessionManaging does the request, also on the main actor. For\n  now, the only one is UnavailablePhoneNumberPossessionManager, which reports\n  every request as unavailable.\n\nManagers take the boxed request and return WebCore\u0027s\nPhoneNumberPossessionResponse, or throw a PhoneNumberPossessionError. The\ncontroller turns that into a PhoneNumberPossessionResult, an std::expected, for\nC++. Calling Swift from C++ needs two workarounds:\n- CompletionHandler is move-only, and Swift functions that take a move-only C++\n  type aren\u0027t exposed to C++. So PhoneNumberPossessionTypes.h boxes the\n  completion handlers in WTF::RefCountable, as the Swift IPC receivers do.\n- C++ can\u0027t call actor-isolated Swift, so the controller doesn\u0027t require any\n  actor isolation and hops the work onto the main actor.\n\nAlso add an async Result.init(catching:), which the standard library lacks.\n\nMaking an std::expected from Swift needs Swift 6.4, which comes with the 27.0\nSDKs, so ENABLE(PHONE_NUMBER_POSSESSION) now requires a 27.0 SDK on macOS and\niOS. Task.immediate also needs an OS 26 deployment target.\n\nNo new tests: nothing uses the controller yet.\n\n* Source/WTF/wtf/PlatformEnableCocoa.h:\n* Source/WebKit/Modules/Internal/module.modulemap:\n* Source/WebKit/PlatformCocoa.cmake:\n* Source/WebKit/Shared/Concurrency+Extras.swift:\n(Result.init(catching:)):\n* Source/WebKit/Shared/WebKit-Swift.h:\n* Source/WebKit/UIProcess/PhoneNumberPossession/Cocoa/PhoneNumberPossessionController.swift: Added.\n* Source/WebKit/UIProcess/PhoneNumberPossession/Cocoa/PhoneNumberPossessionManaging.swift: Added.\n* Source/WebKit/UIProcess/PhoneNumberPossession/Cocoa/PhoneNumberPossessionTypes.h: Added.\n* Source/WebKit/WebKit.xcodeproj/project.pbxproj:\n\nCanonical link: https://commits.webkit.org/324775@main\n"
    },
    {
      "commit": "9025b90e17802e3a54e94e4e6a611b30d8afba13",
      "tree": "a55079879bd64f22c3fd5703d558e6aa5083a072",
      "parents": [
        "985c7e9b2ee1da6952b709b886412b23ad939b3e"
      ],
      "author": {
        "name": "Dawn Morningstar",
        "email": "morningstar@apple.com",
        "time": "Mon Oct 26 23:31:51 2026"
      },
      "committer": {
        "name": "Dawn Morningstar",
        "email": "morningstar@apple.com",
        "time": "Mon Oct 26 23:31:51 2026"
      },
      "message": "[webkitpy] Don\u0027t resolve web-platform-tests names against the working directory to find crash tests\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d326879\nrdar://189554894\n\nReviewed by Jonathan Bedard.\n\nis_wpt_crash_test passes the test name, already relative to LayoutTests, to relpath, which resolves it against the\nworking directory; run from a directory named crashtests, every web-platform-tests test is a crash test. Take the part\nof the name after the WPT directory instead. This also cuts finding the mac tests from about 6.4 s to 5.5 s of CPU.\n\n* Tools/Scripts/webkitpy/layout_tests/controllers/layout_test_finder.py:\n(LayoutTestFinder.is_wpt_crash_test):\n* Tools/Scripts/webkitpy/layout_tests/controllers/layout_test_finder_legacy_unittest.py:\n(LayoutTestFinderTests.test_is_wpt_crash_test_ignores_working_directory):\n\nCanonical link: https://commits.webkit.org/324774@main\n"
    },
    {
      "commit": "985c7e9b2ee1da6952b709b886412b23ad939b3e",
      "tree": "61895dc356411911608651abd4fe2b8271d59e4a",
      "parents": [
        "808954687f19fbf64d8b85a3eefd888510d67746"
      ],
      "author": {
        "name": "Phinehas Fuachie",
        "email": "pfuachie2@apple.com",
        "time": "Mon Oct 26 23:21:16 2026"
      },
      "committer": {
        "name": "Phinehas Fuachie",
        "email": "phinehas133@gmail.com",
        "time": "Mon Oct 26 23:21:16 2026"
      },
      "message": "Spatial video teardown test declares the projection attribute by its old x-webkit- name\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d328975\nrdar://191041822\n\nReviewed by Jer Noble.\n\nThe attribute was renamed to projection, so _resolveProjection no longer finds the declared value and the\nrenderer never becomes active, failing every assertion.\n\n* LayoutTests/TestExpectations:\n* LayoutTests/media/modern-media-controls/spatial-video-support/spatial-video-support-teardown-releases-context-objects.html:\n\nCanonical link: https://commits.webkit.org/324773@main\n"
    },
    {
      "commit": "808954687f19fbf64d8b85a3eefd888510d67746",
      "tree": "51dbb32d667f189c8d66a536fed0863e8941be31",
      "parents": [
        "23a67cc61ebbe21990841b275991e4c48c9a26f0"
      ],
      "author": {
        "name": "Ling Ho",
        "email": "lingho@apple.com",
        "time": "Mon Oct 26 23:10:05 2026"
      },
      "committer": {
        "name": "Ling Ho",
        "email": "lingho@apple.com",
        "time": "Mon Oct 26 23:10:05 2026"
      },
      "message": "[WKBI] Bugs filed with git-webkit are sometimes not imported to Radar\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d328978\nrdar://191043217\n\nReviewed by Ryan Haddad.\n\ngit-webkit files a Bugzilla bug and then immediately CCs the WebKit Bug Importer\nin a second request (Tracker.create() followed by Tracker.cc_radar()). When both\nland in the same clock second, Bugzilla never sends the importer a notification:\nBugMail::Send only mails changes whose bug_when is strictly greater than the\nbug\u0027s whole-second lastdiffed, and the new-bug notification just advanced\nlastdiffed to that second. The CC is still recorded on the bug, but the importer\nnever hears about it, so the bug is never imported. This is the same race fixed\nfor the pull-request comment in 317883@main.\n\nHave the Bugzilla tracker remember when it created a bug, and wait out the\ncurrent second in cc_radar() before updating a bug it created less than 1.1s\nago. Bugs that were not just created are unaffected.\n\nBump webkitbugspy to 0.15.12.\n\n* Tools/Scripts/libraries/webkitbugspy/setup.py:\n* Tools/Scripts/libraries/webkitbugspy/webkitbugspy/__init__.py:\n* Tools/Scripts/libraries/webkitbugspy/webkitbugspy/bugzilla.py:\n(Tracker):\n(Tracker._wait_for_bugmail_after_create):\n(Tracker.cc_radar):\n* Tools/Scripts/libraries/webkitbugspy/webkitbugspy/tests/bugzilla_unittest.py:\n\nCanonical link: https://commits.webkit.org/324772@main\n"
    },
    {
      "commit": "23a67cc61ebbe21990841b275991e4c48c9a26f0",
      "tree": "cf660c13bb4c37ec401807cf3394374f55cc02d4",
      "parents": [
        "1883a6a637e58f6c9f12f0b2a496e45c99c96ff5"
      ],
      "author": {
        "name": "Anthony Tarbinian",
        "email": "a_tarbinian@apple.com",
        "time": "Mon Oct 26 22:55:51 2026"
      },
      "committer": {
        "name": "Anthony Tarbinian",
        "email": "a_tarbinian@apple.com",
        "time": "Mon Oct 26 22:55:51 2026"
      },
      "message": "Add a mock configuration for testing phone number possession\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d328673\nrdar://190850408\n\nReviewed by Abrar Rahman Protyasha.\n\nAdd Internals::setMockPhoneNumberPossessionConfiguration(), which passes a\nMockPhoneNumberPossessionConfiguration to the coordinator\u0027s client, so that\nlayout tests can choose how the platform answers.\n\nNo new tests: nothing reads the configuration yet. The mock manager that does\ncomes in a later change.\n\n* Source/WebCore/CMakeLists.txt:\n* Source/WebCore/DerivedSources-input.xcfilelist:\n* Source/WebCore/DerivedSources-output.xcfilelist:\n* Source/WebCore/DerivedSources.make:\n* Source/WebCore/Headers.cmake:\n* Source/WebCore/Modules/phonenumberpossession/PhoneNumberPossessionCoordinator.cpp:\n(WebCore::PhoneNumberPossessionCoordinator::setMockConfigurationForTesting):\n* Source/WebCore/Modules/phonenumberpossession/PhoneNumberPossessionCoordinator.h:\n* Source/WebCore/Modules/phonenumberpossession/PhoneNumberPossessionCoordinatorClient.h:\n* Source/WebCore/WebCore.xcodeproj/project.pbxproj:\n* Source/WebCore/testing/Internals.cpp:\n(WebCore::Internals::setMockPhoneNumberPossessionConfiguration):\n* Source/WebCore/testing/Internals.h:\n* Source/WebCore/testing/Internals.idl:\n* Source/WebCore/testing/MockPhoneNumberPossessionConfiguration.h: Added.\n* Source/WebCore/testing/MockPhoneNumberPossessionConfiguration.idl: Added.\n\nCanonical link: https://commits.webkit.org/324771@main\n"
    },
    {
      "commit": "1883a6a637e58f6c9f12f0b2a496e45c99c96ff5",
      "tree": "864f0aff6fe47e5e6a68270ff9123055c08969a1",
      "parents": [
        "d70dc52c80d2f3f95af6be413b8a0017371d2e9d"
      ],
      "author": {
        "name": "Taher Ali",
        "email": "taher_ali@apple.com",
        "time": "Mon Oct 26 22:50:16 2026"
      },
      "committer": {
        "name": "Taher Ali",
        "email": "taher_ali@apple.com",
        "time": "Mon Oct 26 22:50:16 2026"
      },
      "message": "[HTML-in-Canvas] Fire the paint event when drawable elements change\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d325648\nrdar://188696833\n\nReviewed by Said Abou-Hallawa.\n\nA canvas with drawable children now fires the paint event without an explicit\nrequestPaint() when a drawable child is first laid out or its rendering changes.\nThe event reports those children in changedElements.\n\n* LayoutTests/fast/canvas/draw-element-image/2d-drawElementImage-composited-descendant.html:\n* LayoutTests/fast/canvas/draw-element-image/2d-drawElementImage-nested-drawable.html:\n* LayoutTests/fast/canvas/draw-element-image/2d-drawElementImage-redraw.html:\n* LayoutTests/fast/canvas/draw-element-image/2d-drawElementImage-rotated-text.html:\n* LayoutTests/fast/canvas/draw-element-image/2d-drawElementImage-transparent-rect.html:\n* LayoutTests/fast/canvas/draw-element-image/paint-event-nested-content-drawable-canvas-expected.txt: Added.\n* LayoutTests/fast/canvas/draw-element-image/paint-event-nested-content-drawable-canvas.html: Added.\n* Source/WebCore/html/HTMLCanvasElement.cpp:\n(WebCore::HTMLCanvasElement::dispatchPaintEvent):\n(WebCore::HTMLCanvasElement::drawableElementDidChange):\n* Source/WebCore/html/HTMLCanvasElement.h:\n* Source/WebCore/rendering/RenderHTMLCanvas.cpp:\n(WebCore::RenderHTMLCanvas::layout):\n(WebCore::RenderHTMLCanvas::requestPaintEventIfNeeded const):\n* Source/WebCore/rendering/RenderHTMLCanvas.h:\n* Source/WebCore/rendering/RenderObject.cpp:\n(WebCore::requestCanvasPaintEventIfNeeded):\n(WebCore::RenderObject::repaintUsingContainer const):\n(WebCore::RenderObject::issueRepaint const):\n\nCanonical link: https://commits.webkit.org/324770@main\n"
    },
    {
      "commit": "d70dc52c80d2f3f95af6be413b8a0017371d2e9d",
      "tree": "cdffa18d8f8e967973174b22e2ef9e031b33f0fd",
      "parents": [
        "3e90cc907c781aba2722e6d66383a9b91eba15ba"
      ],
      "author": {
        "name": "Jean-Yves Avenard",
        "email": "jya@apple.com",
        "time": "Mon Oct 26 22:43:49 2026"
      },
      "committer": {
        "name": "Jean-Yves Avenard",
        "email": "jean-yves.avenard@apple.com",
        "time": "Mon Oct 26 22:43:49 2026"
      },
      "message": "[WebCodecs] VP8 frames with show_frame unset close the VideoDecoder\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d282227\nrdar://138819149\n\nReviewed by Eric Carlson and Youenn Fablet.\n\nA VP8 frame with show_frame unset, such as the alternate reference frames\nthat libvpx emits with auto-alt-ref, is decoded into the reference buffers\nbut yields no picture. LibvpxVp8Decoder returned WEBRTC_VIDEO_CODEC_NO_OUTPUT\nfor it, which LibWebRTCVPXVideoDecoder rejected unless the decoder was created\nwith TreatNoOutputAsError::No. Only WebCoreDecompressionSession (286329@main)\nand MediaSamplesDecoder (324604@main) set it, so a WebCodecs VideoDecoder\nclosed with \"VPx decoding failed with error 1\" on the first such frame: 100%\nfailure at frame 1 of media/content/test-vp8-hiddenframes.webm decoded through\nWebCodecs.\n\nThe flag was added on the assumption that WebCodecs required a decode without\noutput to be an error, because the WPT subtest \"Decode empty frame\" in\nvideoDecoder-codec-specific only passed that way. That subtest expects a\nzero-byte chunk to fail with EncodingError. It passed by accident:\nLibvpxVp8Decoder passed the empty buffer to libvpx as a flush request, which\nalso returned WEBRTC_VIDEO_CODEC_NO_OUTPUT.\n\nLibWebRTCVPXVideoDecoder no longer treats WEBRTC_VIDEO_CODEC_NO_OUTPUT as an\nerror. With both media playback and WebCodecs needing the same behaviour,\nTreatNoOutputAsError is removed.\n\nWebCodecs VideoDecoder and AudioDecoder now reject an empty chunk themselves,\nwhatever the codec or decoder in use: the decode is reported as an\nEncodingError through the same queued task as any other decoding error. The\nspec does not define this case yet (https://github.com/w3c/webcodecs/issues/983).\nChromium makes the same check for every audio and video codec in\nDecoderTemplate::ProcessDecodeRequest(), before the chunk reaches the decoder,\nand the WPT subtest expects that behaviour, so this keeps WebKit compatible\nwith it.\n\nAn empty EncodedAudioChunk used to reach AudioSampleBufferConverter, which has\nskipped zero-sized packets since 311704@main, so flush() resolved. It is now\nrejected before reaching the decoder: resetting-audio-decoder-with-zero-size-crash\nexpects flush() to reject.\n\nThe existing VP8 hidden frame tests are run again with\nDecoderInContentProcessEnabled, which decodes through MediaSamplesDecoder and\nso through LibWebRTCVPXVideoDecoder, the same code WebCodecs uses.\n\nThe media test is dependent on webkit.org/b/327832\n\n* LayoutTests/fast/webcodecs/resetting-audio-decoder-with-zero-size-crash.html:\n* LayoutTests/http/wpt/webcodecs/resources/test-vp8-hiddenframes.webm: Added.\n* LayoutTests/http/wpt/webcodecs/videoDecoder-vp8-hidden-frames-expected.txt: Added.\n* LayoutTests/http/wpt/webcodecs/videoDecoder-vp8-hidden-frames.html: Added.\n* LayoutTests/media/media-source/media-source-vp8-hiddenframes-decoder-in-content-process-expected.html: Added.\n* LayoutTests/media/media-source/media-source-vp8-hiddenframes-decoder-in-content-process.html: Added.\n* LayoutTests/media/media-vp8-hiddenframes-decoder-in-content-process-expected.html: Added.\n* LayoutTests/media/media-vp8-hiddenframes-decoder-in-content-process.html: Added.\n* LayoutTests/platform/glib/TestExpectations: Mirror the expectations of the original tests.\n* LayoutTests/platform/mac-wk2/TestExpectations: Ditto.\n* Source/WebCore/Modules/webcodecs/WebCodecsAudioDecoder.cpp:\n(WebCore::WebCodecsAudioDecoder::decode): Reject an empty chunk.\n* Source/WebCore/Modules/webcodecs/WebCodecsVideoDecoder.cpp:\n(WebCore::WebCodecsVideoDecoder::decode): Ditto.\n* Source/WebCore/platform/MediaSamplesDecoder.cpp:\n(WebCore::videoDecoderConfiguration):\n* Source/WebCore/platform/VideoDecoder.h: Remove TreatNoOutputAsError.\n* Source/WebCore/platform/graphics/cocoa/WebCoreDecompressionSession.mm:\n(WebCore::WebCoreDecompressionSession::initializeVideoDecoder):\n* Source/WebCore/platform/libwebrtc/LibWebRTCVPXVideoDecoder.cpp:\n(WebCore::LibWebRTCVPXInternalVideoDecoder::decode): Don\u0027t treat\nWEBRTC_VIDEO_CODEC_NO_OUTPUT as an error.\n(WebCore::LibWebRTCVPXInternalVideoDecoder::LibWebRTCVPXInternalVideoDecoder):\n\nCanonical link: https://commits.webkit.org/324769@main\n"
    },
    {
      "commit": "3e90cc907c781aba2722e6d66383a9b91eba15ba",
      "tree": "df555237dcc2422c3f45675a16e78d544f3b9efe",
      "parents": [
        "474bb3fa626aab1666af369a9784071e4e4702f2"
      ],
      "author": {
        "name": "Ahmad Saleem",
        "email": "ahmad.saleem792+github@gmail.com",
        "time": "Mon Oct 26 22:41:31 2026"
      },
      "committer": {
        "name": "Ahmad Saleem",
        "email": "ahmad.saleem792@gmail.com",
        "time": "Mon Oct 26 22:41:31 2026"
      },
      "message": "LoggingHashMap::set() and add() recurse infinitely, and the header does not compile when instantiated\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d328442\nrdar://190697626\n\nReviewed by Yusuke Suzuki.\n\nLoggingHashMap::set() and add() log the operation and then call themselves\ninstead of m_map, so any use overflows the stack. fastAdd() goes through\nadd(), so it recursed too. Nothing instantiates LoggingHashMap today, which\nis why this went unnoticed.\n\nInstantiating it also failed to compile for two further reasons:\n- Both operator\u003d overloads were missing `return *this;`, which is an error\n  under -Werror\u003dreturn-type.\n- MappedPeekType named HashMap::MappedTraits, which is private. Use\n  MappedTraitsArg::PeekType instead.\n\nThe move constructor also copied other.m_map instead of moving it.\n\nAdd API tests that instantiate LoggingHashMap and exercise set(), add(),\nfastAdd() and both assignment operators.\n\n* Source/WTF/wtf/LoggingHashMap.h:\n* Tools/TestWebKitAPI/CMakeLists.txt:\n* Tools/TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:\n* Tools/TestWebKitAPI/Tests/WTF/LoggingHashMap.cpp: Added.\n(TestWebKitAPI::TEST(WTF_LoggingHashMap, SetForwardsToUnderlyingMap)):\n(TestWebKitAPI::TEST(WTF_LoggingHashMap, AddForwardsToUnderlyingMap)):\n(TestWebKitAPI::TEST(WTF_LoggingHashMap, FastAddForwardsToUnderlyingMap)):\n(TestWebKitAPI::TEST(WTF_LoggingHashMap, AssignmentReturnsThis)):\n\nCanonical link: https://commits.webkit.org/324768@main\n"
    },
    {
      "commit": "474bb3fa626aab1666af369a9784071e4e4702f2",
      "tree": "6e22a97312821c9aa9a743e703eb7cc2f3087acf",
      "parents": [
        "fa28e03a1d04797478de513cdb3447f1303e889b"
      ],
      "author": {
        "name": "Ahmad Saleem",
        "email": "ahmad.saleem792+github@gmail.com",
        "time": "Mon Oct 26 22:38:57 2026"
      },
      "committer": {
        "name": "Ahmad Saleem",
        "email": "ahmad.saleem792@gmail.com",
        "time": "Mon Oct 26 22:38:57 2026"
      },
      "message": "BitSet::setEachNthBit() and clearEachNthBit() loop forever when n is 0\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d328452\nrdar://190702141\n\nReviewed by Yusuke Suzuki.\n\nBoth functions advance `index` by `n` inside a do/while loop, so passing\nn \u003d\u003d 0 never advances the index and the loop never terminates. Passing\nn \u003d\u003d 0 is a caller error, so add ASSERT(n) to both functions so it fails\nimmediately in debug builds instead of hanging.\n\nTest: Tools/TestWebKitAPI/Tests/WTF/BitSet.cpp\n\n* Source/WTF/wtf/BitSet.h:\n(WTF::WordType\u003e::setEachNthBit):\n(WTF::WordType\u003e::clearEachNthBit):\n* Tools/TestWebKitAPI/Tests/WTF/BitSet.cpp:\n(TestWebKitAPI::TEST(WTF_BitSetDeathTest, MAYBE_ASSERT_ENABLED_DEATH_TEST(SetEachNthBitZero)):\n(TestWebKitAPI::TEST(WTF_BitSetDeathTest, MAYBE_ASSERT_ENABLED_DEATH_TEST(ClearEachNthBitZero)):\n\nCanonical link: https://commits.webkit.org/324767@main\n"
    },
    {
      "commit": "fa28e03a1d04797478de513cdb3447f1303e889b",
      "tree": "f1d24f78cf60045983f2c9ac4a7a975647233cef",
      "parents": [
        "844870fb1f610df6879dc89dffdb52fe0c1ff469"
      ],
      "author": {
        "name": "Fujii Hironori",
        "email": "fujii@igalia.com",
        "time": "Mon Oct 26 22:37:31 2026"
      },
      "committer": {
        "name": "Fujii Hironori",
        "email": "fujii@igalia.com",
        "time": "Mon Oct 26 22:37:31 2026"
      },
      "message": "[GLib] Add stubs for the Cocoa-only WebExtensions code referenced by the GLib build\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d328908\n\nReviewed by Timothy Hatcher and Patrick Griffis.\n\nWith ENABLE_WK_WEB_EXTENSIONS, the GTK and WPE ports compiled code that\nreferenced about 100 symbols defined only in Cocoa files. The link only\nsucceeded because --gc-sections discarded the callers. It failed when the\nsections were kept, for example in an ASan build linked with GNU ld.\n\nBuild JSWebExtensionWrapper.cpp, which is already plain C++, on all ports.\nDefine WebExtensionAPINamespace::runtime() and storage() outside the\nPLATFORM(COCOA) block, since WebExtensionAPIRuntime and\nWebExtensionAPIStorage are already built for the GLib ports. Move\ntoDocumentIdentifier(), which has no Cocoa dependency, to\nWebExtensionUtilities.cpp. Implement toJSRejectedPromise() with the\nJavaScriptCore C API for the GLib ports. Add GLib stubs for the remaining\nfunctions. The stubs do not report false success: the test API returns\nrejected promises, URL scheme tasks complete with an error, and\ntoSortedJSONString() returns the unsorted JSON string instead of a null\nstring, which made test.assertDeepEq() always pass.\n\n* Source/WebKit/Shared/Extensions/WebExtensionUtilities.cpp:\n(WebKit::toDocumentIdentifier): Moved from WebExtensionUtilities.mm.\n* Source/WebKit/Shared/Extensions/WebExtensionUtilities.mm:\n(WebKit::toDocumentIdentifier): Deleted.\nRemove the includes that only toDocumentIdentifier() used.\n* Source/WebKit/Shared/Extensions/glib/WebExtensionUtilitiesGLib.cpp: Added.\n(WebKit::toJSRejectedPromise):\n* Source/WebKit/Sources.txt:\n* Source/WebKit/SourcesCocoa.txt:\n* Source/WebKit/SourcesGTK.txt:\n* Source/WebKit/SourcesWPE.txt:\n* Source/WebKit/UIProcess/Extensions/glib/WebExtensionContextGLib.cpp:\n(WebKit::WebExtensionContext::load):\n(WebKit::WebExtensionContext::unload):\n(WebKit::WebExtensionContext::permissionsDidChange):\n(WebKit::WebExtensionContext::removePage):\n(WebKit::WebExtensionContext::didStartProvisionalLoadForFrame):\n(WebKit::WebExtensionContext::didCommitLoadForFrame):\n(WebKit::WebExtensionContext::didFinishLoadForFrame):\n(WebKit::WebExtensionContext::didFailLoadForFrame):\n(WebKit::WebExtensionContext::backgroundPageIdentifier const):\n(WebKit::WebExtensionContext::popupPageIdentifiers const):\n(WebKit::WebExtensionContext::tabPageIdentifiers const):\n(WebKit::WebExtensionContext::cookiesDidChange):\n(WebKit::WebExtensionContext::isBackgroundPage const):\n(WebKit::WebExtensionContext::declarativeNetRequestContentRuleListFilePath):\n(WebKit::WebExtensionContext::incrementActionCountForTab):\n* Source/WebKit/UIProcess/Extensions/glib/WebExtensionControllerConfigurationGLib.cpp: Added.\n(WebKit::WebExtensionControllerConfiguration::createStorageDirectoryPath):\n(WebKit::WebExtensionControllerConfiguration::createTemporaryStorageDirectoryPath):\n* Source/WebKit/UIProcess/Extensions/glib/WebExtensionControllerGLib.cpp: Added.\n(WebKit::WebExtensionController::initializePlatform):\n(WebKit::WebExtensionController::testResult):\n(WebKit::WebExtensionController::testEqual):\n(WebKit::WebExtensionController::testLogMessage):\n(WebKit::WebExtensionController::testSentMessage):\n(WebKit::WebExtensionController::testAdded):\n(WebKit::WebExtensionController::testStarted):\n(WebKit::WebExtensionController::testFinished):\n* Source/WebKit/UIProcess/Extensions/glib/WebExtensionDeclarativeNetRequestSQLiteStoreGLib.cpp: Added.\n(WebKit::WebExtensionDeclarativeNetRequestSQLiteStore::migrateData):\n* Source/WebKit/UIProcess/Extensions/glib/WebExtensionURLSchemeHandlerGLib.cpp: Added.\n(WebKit::WebExtensionURLSchemeHandler::WebExtensionURLSchemeHandler):\n(WebKit::WebExtensionURLSchemeHandler::platformStartTask):\n(WebKit::WebExtensionURLSchemeHandler::platformStopTask):\n(WebKit::WebExtensionURLSchemeHandler::platformTaskCompleted):\n* Source/WebKit/WebProcess/Extensions/API/WebExtensionAPINamespace.cpp:\n(WebKit::WebExtensionAPINamespace::runtime):\n(WebKit::WebExtensionAPINamespace::storage):\n* Source/WebKit/WebProcess/Extensions/API/glib/WebExtensionAPIEventGLib.cpp: Added.\n(WebKit::WebExtensionAPIEvent::invokeListeners):\n(WebKit::WebExtensionAPIEvent::invokeListenersWithJSONArgument):\n(WebKit::WebExtensionAPIEvent::invokeListenersWithJSArgument):\n(WebKit::WebExtensionAPIEvent::removeAllListeners):\n* Source/WebKit/WebProcess/Extensions/API/glib/WebExtensionAPIPortGLib.cpp: Added.\n(WebKit::WebExtensionAPIPort::add):\n* Source/WebKit/WebProcess/Extensions/API/glib/WebExtensionAPITestGLib.cpp: Added.\n(WebKit::WebExtensionAPITest::assertRejects):\n(WebKit::WebExtensionAPITest::assertResolves):\n(WebKit::WebExtensionAPITest::addTest):\n* Source/WebKit/WebProcess/Extensions/Bindings/JSWebExtensionWrapper.cpp:\n(WebKit::WebExtensionCallbackHandler::callbackFunction const): Use nullptr instead of nil.\n* Source/WebKit/WebProcess/Extensions/Bindings/glib/JSWebExtensionWrapperGLib.cpp: Added.\n(WebKit::toSortedJSONString):\n(WebKit::createClassWithoutProperties):\n(WebKit::JSWebExtensionAPIEvent::eventClassSingleton):\n(WebKit::JSWebExtensionAPIPort::portClassSingleton):\n* Source/WebKit/WebProcess/Extensions/glib/WebExtensionContextProxyGLib.cpp: Added.\n\nCanonical link: https://commits.webkit.org/324766@main\n"
    },
    {
      "commit": "844870fb1f610df6879dc89dffdb52fe0c1ff469",
      "tree": "54586557a9fe019249181463716378ac55e0ef85",
      "parents": [
        "56e2015c60f20fb03a510d081bb62120acb2c6c1"
      ],
      "author": {
        "name": "Zak Ridouh",
        "email": "zakr@apple.com",
        "time": "Mon Oct 26 22:35:28 2026"
      },
      "committer": {
        "name": "Zak Ridouh",
        "email": "zakr@apple.com",
        "time": "Mon Oct 26 22:35:28 2026"
      },
      "message": "[Site Isolation] Web Inspector: Opening Web Inspector during a cross-site iframe navigation loses that iframe\u0027s load\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d327325\n\u003crdar://problem/189864470\u003e\n\nReviewed by Basuke Suzuki.\n\nEnabling Page or Network instrumentation in a WebContent process only instrumented the frames in its frame tree, so an\niframe whose load was provisional there when Web Inspector opened never reported its commit or requests. Also instrument\nprovisional frames when enabling.\n\nTest: http/tests/site-isolation/inspector/page/enable-during-provisional-iframe-load-reports-the-load.html\n\n* LayoutTests/http/tests/site-isolation/inspector/page/enable-during-provisional-iframe-load-reports-the-load-expected.txt: Added.\n* LayoutTests/http/tests/site-isolation/inspector/page/enable-during-provisional-iframe-load-reports-the-load.html: Added.\n* Source/WebKit/WebProcess/Inspector/WebInspectorBackend.cpp:\n(WebKit::forEachLocalOrProvisionalFrame):\n(WebKit::WebInspectorBackend::enableNetworkInstrumentation):\n(WebKit::WebInspectorBackend::enablePageInstrumentation):\n\nCanonical link: https://commits.webkit.org/324765@main\n"
    },
    {
      "commit": "56e2015c60f20fb03a510d081bb62120acb2c6c1",
      "tree": "6cad784e61c8d1b849172a8b337e0a9f1c4d2ee7",
      "parents": [
        "2d79da8176e9bb6f8a7b5185e325619f020ac7c0"
      ],
      "author": {
        "name": "Richard Robinson",
        "email": "richard_robinson2@apple.com",
        "time": "Mon Oct 26 22:33:53 2026"
      },
      "committer": {
        "name": "Richard Robinson",
        "email": "richard_robinson2@apple.com",
        "time": "Mon Oct 26 22:33:53 2026"
      },
      "message": "Re-land [Swift Testing] Convert TextManipulation tests to Swift Testing\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d327009\nrdar://189633091\n\nReviewed by Aditya Keerthi.\n\nRe-land 322359@main, but with build speed fixes.\n\n* TestExpectations/apitests:\n* Tools/Scripts/webkitpy/api_tests/allowlist.txt:\n* Tools/TestWebKitAPI/PlatformCocoa.cmake:\n* Tools/TestWebKitAPI/SourcesCocoa.txt:\n* Tools/TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/TextManipulation.mm: Removed.\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/TextManipulation.swift: Added.\n(TextManipulationDelegate.items):\n(TextManipulationDelegate.itemCountWaiter):\n(TextManipulationDelegate._webView(_:didFind:)):\n(TextManipulationDelegate.waitForItems(_:)):\n(LegacyTextManipulationDelegate.items):\n(LegacyTextManipulationDelegate._webView(_:didFind:)):\n(TextManipulationTests.bodyInnerHTML):\n(TextManipulationTests.selectionDirectionProbe(_:)):\n(TextManipulationTests.startTextManipulationExitEarlyWithoutDelegate):\n(TextManipulationTests.startTextManipulationFindSimpleParagraphs):\n(TextManipulationTests.startTextManipulationFindMultipleParagraphsInSingleTextNode):\n(TextManipulationTests.startTextManipulationFindParagraphsWithMultipleTokens):\n(TextManipulationTests.startTextManipulationFindAttributeContent):\n(TextManipulationTests.startTextManipulationSupportsLegacyDelegateCallback):\n(TextManipulationTests.startTextManipulationFindNewlyInsertedParagraph):\n(TextManipulationTests.startTextManipulationFindNewlyDisplayedParagraph):\n(TextManipulationTests.startTextManipulationFindSameParagraphWithNewContent):\n(TextManipulationTests.startTextManipulationApplySingleExcluionRuleForElement):\n(TextManipulationTests.startTextManipulationApplyInclusionExclusionRulesForAttributes):\n(TextManipulationTests.startTextManipulationApplyInclusionExclusionRulesForClass):\n(TextManipulationTests.startTextManipulationApplyInclusionExclusionRulesForClassAndAttribute):\n(TextManipulationTests.startTextManipulationBreaksParagraphInBetweenListItems):\n(TextManipulationTests.startTextManipulationBreaksParagraphInBetweenFloatingListItems):\n(TextManipulationTests.startTextManipulationIncludesFullyClippedText):\n(TextManipulationTests.startTextManipulationFindsInsertedClippedText):\n(TextManipulationTests.viewportProximity):\n(TextManipulationTests.viewportProximityHorizontalDistance):\n(TextManipulationTests.viewportProximityCoverageBounds):\n(TextManipulationTests.viewportProximityWithSubscroller):\n(TextManipulationTests.viewportProximityAfterScrollingSubscroller):\n(TextManipulationTests.viewportProximityWithClippingAncestor):\n(TextManipulationTests.startTextManipulationTreatsInlineBlockLinksAndButtonsAndSpansAsParagraphs):\n(TextManipulationTests.startTextManipulationTreatsLinksInNavigationElementsAsParagraphs):\n(TextManipulationTests.startTextManipulationTreatsNestedInlineBlockListItemsAndLinksAsParagraphs):\n(TextManipulationTests.startTextManipulationExtractsUserInfo):\n(TextManipulationTests.startTextManipulationExtractsValuesFromButtonInputs):\n(TextManipulationTests.startTextManipulationExtractsValuesFromTextInputs):\n(TextManipulationTests.startTextManipulationDoesNotExtractUserModifiedText):\n(TextManipulationTests.startTextManipulationExtractsVisibleLineBreaksInTextAsExcludedTokens):\n(TextManipulationTests.startTextManipulationExtractsPrivateUseCharactersAsExcludedTokens):\n(TextManipulationTests.startTextManipulationExtractsValuesByNode):\n(TextManipulationTests.startTextManipulationExcludesTextRenderedAsIcons):\n(TextManipulationTests.startTextManipulationAvoidCrashWhenExtractingOrphanedPositions):\n(TextManipulationTests.removedElements):\n(TextManipulationTests.startTextManipulationExtractsHeadingElementsAsSeparateItems):\n(TextManipulationTests.startTextManipulationIgnoresSpaces):\n(TextManipulationTests.startTextManipulationExtractsTableCellsAsSeparateItems):\n(TextManipulationTests.startTextManipulationDoesNotFindContentInIframeIfIncludeSubframeIsNotSet):\n(TextManipulationTests.startTextManipulationFindsContentInIframeIfIncludeSubframeIsSet):\n(TextManipulationTests.startTextManipulationFindsContentInIframeInsertedLater):\n(TextManipulationTests.startTextManipulationDoesNotFindContentInNewMainFrame):\n(TextManipulationTests.completeTextManipulationReplaceSimpleSingleParagraph):\n(TextManipulationTests.completeTextManipulationTranslatedRTLParagraphUsesStaleSelectionDirection):\n(TextManipulationTests.legacyCompleteTextManipulationReplaceSimpleSingleParagraph):\n(TextManipulationTests.completeTextManipulationDisgardsTokens):\n(TextManipulationTests.completeTextManipulationReplaceTwoSimpleParagraphs):\n(TextManipulationTests.completeTextManipulationReplaceMultipleSimpleParagraphs):\n(TextManipulationTests.completeTextManipulationReplaceMultipleSimpleParagraphsAtOnce):\n(TextManipulationTests.completeTextManipulationReplaceMultipleSimpleParagraphsSeparatedByBR):\n(TextManipulationTests.completeTextManipulationReplaceParagraphsSeparatedByWrappedBR):\n(TextManipulationTests.completeTextManipulationPreservesWhitespacesBetweenItems):\n(TextManipulationTests.completeTextManipulationFailWhenBRIsInserted):\n(TextManipulationTests.completeTextManipulationAvoidCrashingWhenContentIsRemoved):\n(TextManipulationTests.completeTextManipulationShouldPreserveImagesAsExcludedTokens):\n(TextManipulationTests.completeTextManipulationShouldPreserveSVGAsExcludedTokens):\n(TextManipulationTests.completeTextManipulationShouldPreserveOrderOfBlockImage):\n(TextManipulationTests.completeTextManipulationShouldReplaceAttributeContent):\n(TextManipulationTests.completeTextManipulationShouldReplaceContentFollowedAfterImageInCSSTable):\n(TextManipulationTests.completeTextManipulationShouldReplaceTextContentWithMultipleTokens):\n(TextManipulationTests.completeTextManipulationShouldReplaceContentsAroundParagraphWithJustImage):\n(TextManipulationTests.completeTextManipulationShouldBatchItemCallback):\n(TextManipulationTests.completeTextManipulationReordersContent):\n(TextManipulationTests.completeTextManipulationCanSplitContent):\n(TextManipulationTests.completeTextManipulationCanMergeContent):\n(TextManipulationTests.completeTextManipulationFailWhenItemIdentifierIsDuplicated):\n(TextManipulationTests.completeTextManipulationCanHandleSubsetOfItemsToFail):\n(TextManipulationTests.completeTextManipulationReplaceContentInIframe):\n(TextManipulationTests.completeTextManipulationFailWhenContentIsChanged):\n(TextManipulationTests.completeTextManipulationFailWhenContentIsRemoved):\n(TextManipulationTests.completeTextManipulationFailWhenContentIsAdded):\n(TextManipulationTests.completeTextManipulationFailWhenContentIsChangedInIframe):\n(TextManipulationTests.completeTextManipulationSuccedsWhenContentOutOfParagraphIsAdded):\n(TextManipulationTests.completeTextManipulationFailWhenDocumentHasBeenNavigatedAway):\n(TextManipulationTests.completeTextManipulationFailWhenExclusionIsViolated):\n(TextManipulationTests.completeTextManipulationFailWhenExcludedContentAppearsMoreThanOnce):\n(TextManipulationTests.completeTextManipulationPreservesExcludedContent):\n(TextManipulationTests.completeTextManipulationDoesNotCreateMoreTextManipulationItems):\n(TextManipulationTests.completeTextManipulationCorrectParagraphRange):\n(TextManipulationTests.completeTextManipulationCanMergeContentAndPreserveLineBreaks):\n(TextManipulationTests.completeTextManipulationIgnoreWhiteSpacesBetweenParagraphs):\n(TextManipulationTests.completeTextManipulationDoesNotSkipTabCharacterAtLineWrap):\n(TextManipulationTests.completeTextManipulationShouldPreserveNodesAfterParagraphRange):\n(TextManipulationTests.completeTextManipulationSPreserveNodesBeforeParagraphRange):\n(TextManipulationTests.insertingContentIntoAlreadyManipulatedContentCreatesTextManipulationItem):\n(TextManipulationTests.completeTextManipulationInButtonsAndTextFields):\n(TextManipulationTests.completeTextManipulationForNewlyDisplayedParagraph):\n(TextManipulationTests.completeTextManipulationForNewlyDisplayedText):\n(TextManipulationTests.completeTextManipulationForManipulatedTextWithNewContent):\n(TextManipulationTests.completeTextManipulationForTitleElement):\n(TextManipulationTests.completeTextManipulationAvoidExtractingManipulatedTextAfterManipulation):\n(TextManipulationTests.completeTextManipulationAddsOverflowHiddenToAvoidBreakingLayout):\n(TextManipulationTests.completeTextManipulationParagraphsContainCollapsedSpaces):\n(TextManipulationTests.completeTextManipulationParagraphContainsCollapsedSpaces):\n(TextManipulationTests.completeTextManipulationShouldReplaceContentIgnoredByEditing):\n(TextManipulationTests.completeTextManipulationShouldOnlyChangeNodesInParagraphRange):\n(TextManipulationTests.completeTextManipulationParagraphBecomesHidden):\n(TextManipulationTests.completeTextManipulationSkipsEmptyContainers):\n(TextManipulationTests.completeTextManipulationReplacesShadowDOMContent):\n(TextManipulationTests.completeTextManipulationDoesNotFillAutoFilledField):\n(TextManipulationTests.textManipulationTokenDebugDescription):\n(TextManipulationTests.textManipulationTokenNotEqualToNil):\n(TextManipulationTests.textManipulationTokenEqualityWithEqualIdentifiers):\n(TextManipulationTests.textManipulationTokenEqualityWithDifferentIdentifiers):\n(TextManipulationTests.textManipulationTokenEqualityWithNilIdentifiers):\n(TextManipulationTests.textManipulationTokenEqualityWithEmptyIdentifiers):\n(TextManipulationTests.textManipulationTokenWithNilContent):\n(TextManipulationTests.textManipulationTokenWithEmptyContent):\n(TextManipulationTests.textManipulationTokenWithIdenticalContent):\n(TextManipulationTests.textManipulationTokenWithPointerEqualContent):\n(TextManipulationTests.textManipulationTokenWithTrailingSpace):\n(TextManipulationTests.textManipulationTokenEqualToSelf):\n(TextManipulationTests.textManipulationTokenNSObjectEqualityWithOtherToken):\n(TextManipulationTests.textManipulationTokenNSObjectEqualityWithNonToken):\n(TextManipulationTests.textManipulationItemDebugDescription):\n(TextManipulationTests.textManipulationItemEqualityToNilItem):\n(TextManipulationTests.textManipulationItemEqualityToSelf):\n(TextManipulationTests.textManipulationItemBasicEquality):\n(TextManipulationTests.textManipulationItemBasicEqualityWithMultipleTokens):\n(TextManipulationTests.textManipulationItemEqualitySimilarTokensWithDifferentContent):\n(TextManipulationTests.textManipulationItemEqualityWithOutOfOrderTokens):\n(TextManipulationTests.textManipulationItemEqualityWithPointerEqualTokens):\n(TextManipulationTests.textManipulationItemEqualityWithPointerEqualTokenArrays):\n(TextManipulationTests.textManipulationItemEqualityWithMismatchedTokenCounts):\n(TextManipulationTests.textManipulationItemEqualityWithDifferentTokenIdentifiers):\n(TextManipulationTests.textManipulationItemEqualityWithNilIdentifiers):\n(TextManipulationTests.textManipulationItemEqualityWithDifferentTokenExclusions):\n(TextManipulationTests.textManipulationItemNSObjectEqualityWithOtherItem):\n(TextManipulationTests.textManipulationItemNSObjectEqualityWithNonToken):\n\nCanonical link: https://commits.webkit.org/324764@main\n"
    },
    {
      "commit": "2d79da8176e9bb6f8a7b5185e325619f020ac7c0",
      "tree": "3c4d8e560b02f92c90b9a9bdeba918d319375841",
      "parents": [
        "a81c7724191d8178b5382dd4b661a4e16673d30b"
      ],
      "author": {
        "name": "Ryan Haddad",
        "email": "ryanhaddad@apple.com",
        "time": "Mon Oct 26 22:26:34 2026"
      },
      "committer": {
        "name": "Ryan Haddad",
        "email": "ryanhaddad@apple.com",
        "time": "Mon Oct 26 22:26:34 2026"
      },
      "message": "[ews-build] Merge-Queue pushes another author\u0027s commit to a pull request branch when the PR\u0027s changes have already landed\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d325974\nrdar://188931942\n\nReviewed by Jonathan Bedard.\n\nIf a pull request\u0027s changes land on main while Merge-Queue is building it, `git pull --rebase` in\nCanonicalize silently drops the PR\u0027s commits as already applied, leaving HEAD at the tip of main.\nThis causes it to rewrite the most recent commit on main with the PR owner as committer and force-push\nit to the PR branch (seen on PR 75236), leaving the PR in a confusing state for the author.\n\n* Tools/CISupport/ews-build/steps.py:\n(Canonicalize.__init__):\n(Canonicalize.run): Verify that the expected number of commits remain after rebasing. If not,\nleave a comment and block the pull request instead of canonicalizing and pushing.\n(Canonicalize.getResultSummary):\n* Tools/CISupport/ews-build/steps_unittest.py: Add tests\n\nCanonical link: https://commits.webkit.org/324763@main\n"
    },
    {
      "commit": "a81c7724191d8178b5382dd4b661a4e16673d30b",
      "tree": "f06714b560206a53cd13fe9b69967a1cd468fb3c",
      "parents": [
        "4e2a07134bf8ed7f79b484fa6be380d884cdbdf2"
      ],
      "author": {
        "name": "Ryan Haddad",
        "email": "ryanhaddad@apple.com",
        "time": "Mon Oct 26 22:24:44 2026"
      },
      "committer": {
        "name": "Ryan Haddad",
        "email": "ryanhaddad@apple.com",
        "time": "Mon Oct 26 22:24:44 2026"
      },
      "message": "[EWS] SaferCPP bot crashes with UnboundLocalError when a change deletes an expectations file\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d324165\nrdar://168157227\n\nReviewed by Aakash Jain.\n\nFindModifiedSaferCPPExpectations parses `git diff HEAD~1 -- \u0027*Expectations\u0027` line by line,\nmatching RE_EXPECTATIONS against each file\u0027s diff header to learn the project/checker for\nthe lines that follow. It only matched the \"+++\" header line. When a change deletes an entire\nexpectations file, git\u0027s unified diff gives that file a \"+++ /dev/null\" header instead of a path,\nso RE_EXPECTATIONS never matches and `project`/`checker` are never assigned before the deleted\nlines below try to use them, raising `UnboundLocalError: local variable \u0027project\u0027 referenced\nbefore assignment` and failing the build.\n\n* Tools/CISupport/ews-build/steps.py:\n(FindModifiedSaferCPPExpectations.run): Match RE_EXPECTATIONS against the \"---\" header too,\nwhich still carries the real path when a file is deleted, and guard the file-line branch so\nit can no longer run before `project`/`checker` are set.\n* Tools/CISupport/ews-build/steps_unittest.py:\n(TestFindModifiedSaferCPPExpectations.test_expectations_file_removed): Added.\n\nCanonical link: https://commits.webkit.org/324762@main\n"
    },
    {
      "commit": "4e2a07134bf8ed7f79b484fa6be380d884cdbdf2",
      "tree": "620a35830098251f02ab7cc228222b39950deec0",
      "parents": [
        "dabc6287622cf8a0bbb6d3bebf98ff30cb515745"
      ],
      "author": {
        "name": "Abrar Rahman Protyasha",
        "email": "a_protyasha@apple.com",
        "time": "Mon Oct 26 22:11:13 2026"
      },
      "committer": {
        "name": "Abrar Rahman Protyasha",
        "email": "a_protyasha@apple.com",
        "time": "Mon Oct 26 22:11:13 2026"
      },
      "message": "[macCatalyst] Block notification service in the web content process sandbox\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d328717\nrdar://177113165\n\nReviewed by Per Arne Vollan.\n\nThe web content process sandbox prohibits communication with the\nnotification service - on macOS and iOS - as of 274927@main, and the\nentitlement com.apple.developer.web-browser-engine.restrict.notifyd is\nwhat we currently key off of for this mechanism. macCatalyst web\ncontent processes had none of this, so notifyd was never blocked from\nthe web content processes in said platform.\n\nIn this patch, we bridge the gap for macCatalyst and enable notifyd\nblocking. Specifically, we:\n\n- Define ENABLE_NOTIFY_BLOCKING for macCatalyst. As a drive-by, we also\n  upstream the existing ENABLE_NOTIFY_BLOCKING definition from WKA.\n- Give macCatalyst web content processes the appropriate entitlement.\n- Start forwarding the embedded notifications allowlist to macCatalyst.\n- Remove a now obsolete PLATFORM(MAC) guard around the sandbox\u0027s notifyd\n  rule, so that, as on macOS, builds without the restricted entitlements\n  can still reach the notification service.\n\n* Source/WTF/wtf/PlatformEnableCocoa.h:\n* Source/WebKit/Scripts/process-entitlements.sh:\n* Source/WebKit/WebProcess/com.apple.WebProcess.sb.in:\n* Source/WebKit/WebProcess/com.apple.WebProcess.x86.sb.in:\n\nCanonical link: https://commits.webkit.org/324761@main\n"
    },
    {
      "commit": "dabc6287622cf8a0bbb6d3bebf98ff30cb515745",
      "tree": "c8b73e12f8b7197bcd4f4287866c6e62e1a43fcb",
      "parents": [
        "7265a14313b36525f3753dda383adc15fad3862a"
      ],
      "author": {
        "name": "Nikolas Zimmermann",
        "email": "nzimmermann@igalia.com",
        "time": "Mon Oct 26 21:50:21 2026"
      },
      "committer": {
        "name": "Nikolas Zimmermann",
        "email": "zimmermann@kde.org",
        "time": "Mon Oct 26 21:50:21 2026"
      },
      "message": "[LBSE] Update pixel test baselines\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d328985\n\nUnreviewed gardening.\n\nUpdate baselines after 324592@main.\n\n* LayoutTests/platform/mac-tahoe-wk2-lbse-text/TestExpectations:\n* LayoutTests/platform/mac-tahoe-wk2-pixel/svg/W3C-SVG-1.1/filters-displace-01-f-expected.png:\n* LayoutTests/platform/mac-tahoe-wk2-pixel/svg/W3C-SVG-1.1/filters-image-01-b-expected.png:\n* LayoutTests/platform/mac-tahoe-wk2-pixel/svg/W3C-SVG-1.1/struct-image-10-t-expected.png:\n* LayoutTests/platform/mac-tahoe-wk2-pixel/svg/dynamic-updates/SVGFEDisplacementMapElement-dom-in-attr-expected.png:\n* LayoutTests/platform/mac-tahoe-wk2-pixel/svg/dynamic-updates/SVGFEDisplacementMapElement-dom-in2-attr-expected.png:\n* LayoutTests/platform/mac-tahoe-wk2-pixel/svg/dynamic-updates/SVGFEDisplacementMapElement-dom-scale-attr-expected.png:\n* LayoutTests/platform/mac-tahoe-wk2-pixel/svg/dynamic-updates/SVGFEDisplacementMapElement-dom-xChannelSelector-attr-expected.png:\n* LayoutTests/platform/mac-tahoe-wk2-pixel/svg/dynamic-updates/SVGFEDisplacementMapElement-dom-yChannelSelector-attr-expected.png:\n* LayoutTests/platform/mac-tahoe-wk2-pixel/svg/dynamic-updates/SVGFEDisplacementMapElement-svgdom-in-prop-expected.png:\n* LayoutTests/platform/mac-tahoe-wk2-pixel/svg/dynamic-updates/SVGFEDisplacementMapElement-svgdom-in2-prop-expected.png:\n* LayoutTests/platform/mac-tahoe-wk2-pixel/svg/dynamic-updates/SVGFEDisplacementMapElement-svgdom-scale-prop-expected.png:\n* LayoutTests/platform/mac-tahoe-wk2-pixel/svg/dynamic-updates/SVGFEDisplacementMapElement-svgdom-xChannelSelector-prop-expected.png:\n* LayoutTests/platform/mac-tahoe-wk2-pixel/svg/dynamic-updates/SVGFEDisplacementMapElement-svgdom-yChannelSelector-prop-expected.png:\n* LayoutTests/platform/mac-tahoe-wk2-pixel/svg/dynamic-updates/SVGFEImageElement-dom-preserveAspectRatio-attr-expected.png:\n* LayoutTests/platform/mac-tahoe-wk2-pixel/svg/dynamic-updates/SVGFEImageElement-svgdom-preserveAspectRatio-prop-expected.png:\n* LayoutTests/platform/mac-tahoe-wk2-pixel/svg/filters/feImage-preserveAspectRatio-all-expected.png: Added.\n* LayoutTests/platform/mac-tahoe-wk2-pixel/svg/filters/feImage-preserveAspectratio-expected.png: Added.\n* LayoutTests/platform/mac-tahoe-wk2-pixel/svg/webarchive/svg-feimage-subresources-expected.png:\n\nCanonical link: https://commits.webkit.org/324760@main\n"
    },
    {
      "commit": "7265a14313b36525f3753dda383adc15fad3862a",
      "tree": "8c4b986709c92cc5879795d0a2548870434ff5dc",
      "parents": [
        "c7d71e811cbba72ce85f6455b1bf3a4a98ab7122"
      ],
      "author": {
        "name": "Mike Wyrzykowski",
        "email": "mwyrzykowski@apple.com",
        "time": "Mon Oct 26 21:26:45 2026"
      },
      "committer": {
        "name": "Mike Wyrzykowski",
        "email": "mwyrzykowski@apple.com",
        "time": "Mon Oct 26 21:26:45 2026"
      },
      "message": "[Regression](322535@main) Two finger zoom squishes some content\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d328494\nrdar://190690179\n\nReviewed by Abrar Rahman Protyasha and Matt Woodrow.\n\nViewport units now use the unzoomed view size when zooming, so they don\u0027t grow when\nzooming out below 1, and macOS pulls the layout viewport back onto the page like iOS.\n\nTest: view-gestures/zoom-keeps-viewport-units-the-size-of-the-view.html\n\n* LayoutTests/view-gestures/fixed-position-geometry-under-zoom-out-expected.txt:\n* LayoutTests/view-gestures/zoom-keeps-viewport-units-the-size-of-the-view-expected.txt: Added.\n* LayoutTests/view-gestures/zoom-keeps-viewport-units-the-size-of-the-view.html: Added.\n* LayoutTests/view-gestures/zoom-out-keeps-fixed-elements-in-the-view-expected.txt:\n* LayoutTests/view-gestures/zoom-out-keeps-fixed-elements-in-the-view.html:\n* Source/WebCore/page/LocalFrameView.cpp:\n(WebCore::hasDelegatedPageScale):\n(WebCore::LocalFrameView::calculateSizeForCSSViewportUnitsOverride const):\n(WebCore::LocalFrameView::sizeForCSSDynamicViewportUnits const):\n* Source/WebKit/UIProcess/Cocoa/WebPageProxyCocoa.mm:\n(WebKit::WebPageProxy::computeLayoutViewportRect const):\n\nCanonical link: https://commits.webkit.org/324759@main\n"
    },
    {
      "commit": "c7d71e811cbba72ce85f6455b1bf3a4a98ab7122",
      "tree": "111713cf853c085f8ec7157d2c194c57046845e9",
      "parents": [
        "48005609cfae303eca4d3279a6f8496ea63100bf"
      ],
      "author": {
        "name": "Ben Nham",
        "email": "nham@apple.com",
        "time": "Mon Oct 26 21:24:21 2026"
      },
      "committer": {
        "name": "Ben Nham",
        "email": "nham@apple.com",
        "time": "Mon Oct 26 21:24:21 2026"
      },
      "message": "IPC::Connection::flushSentMessages() should wait for a pending outgoing message\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d328552\nrdar://190766059\n\nReviewed by Kimmo Kinnunen.\n\nIPC::Connection::flushSentMessages() only checked whether m_outgoingMessages was empty. That isn\u0027t\nsufficient. sendOutgoingMessages() takes a message off the queue before sending it, so the queue can\nbe empty while that message is still being sent. On Cocoa, if the receiver\u0027s Mach port queue is full,\nmach_msg() times out and the message is parked in m_pendingOutgoingMachMessage. The queue can then be\nempty while there is still an unsent message.\n\nThis issue currently only affects tests, because only the Connection and StreamClientConnection\ntests call flushSentMessages(). However, future optimizations will make it more likely for those\ntests to hit this bug.\n\nTo fix this, track in m_hasOutgoingMessages whether the connection still has messages to send.\nIt is set when a message is queued. It stays set while sendOutgoingMessages() sends the message it\ntook off the queue, and while the platform has a message pending. It is cleared when the queue is\nempty and nothing is pending, or when the connection closes. flushSentMessages() waits until it is\ncleared.\n\nm_hasOutgoingMessages is guarded by m_outgoingMessagesLock, and it is the only outgoing message\nstate that flushSentMessages() reads. The rest of the state is owned by the connection queue, which\nupdates m_hasOutgoingMessages after every change. m_pendingOutgoingMachMessage is now annotated as\nowned by the connection queue.\n\nReplace canSendOutgoingMessages() and platformCanSendOutgoingMessages() with\nhasPendingOutgoingMessage(), which must be called on the connection queue. It reports a parked Mach\nmessage or an invalid send port on Cocoa, a pending socket write on GLib, and a pending pipe write on\nWindows.\n\nAs a result, flushSentMessages() also waits for a pending socket write on GLib and a pending pipe\nwrite on Windows. On Cocoa, after a send fails because the peer is gone, flushSentMessages() waits\nuntil the connection closes instead of returning NoError for the dropped message.\n\n* Source/WebKit/Platform/IPC/Connection.cpp:\n(IPC::Connection::flushSentMessages):\n(IPC::Connection::sendMessageImpl):\n(IPC::Connection::connectionDidClose):\n(IPC::Connection::sendOutgoingMessages):\n(IPC::Connection::didFinishSendingOutgoingMessage): Added.\n(IPC::Connection::canSendOutgoingMessages): Deleted.\n* Source/WebKit/Platform/IPC/Connection.h:\n* Source/WebKit/Platform/IPC/cocoa/ConnectionCocoa.mm:\n(IPC::Connection::platformInvalidate):\n(IPC::Connection::sendMessage):\n(IPC::Connection::hasPendingOutgoingMessage): Renamed from platformCanSendOutgoingMessages().\n(IPC::Connection::sendOutgoingMessage):\n(IPC::Connection::resumeSendSource):\n* Source/WebKit/Platform/IPC/glib/ConnectionGLib.cpp:\n(IPC::Connection::hasPendingOutgoingMessage): Renamed from platformCanSendOutgoingMessages().\n* Source/WebKit/Platform/IPC/unix/ConnectionUnix.cpp:\n(IPC::Connection::hasPendingOutgoingMessage): Renamed from platformCanSendOutgoingMessages().\n* Source/WebKit/Platform/IPC/win/ConnectionWin.cpp:\n(IPC::Connection::hasPendingOutgoingMessage): Renamed from platformCanSendOutgoingMessages().\n(IPC::Connection::sendOutgoingMessage):\n* Tools/TestWebKitAPI/Tests/IPC/ConnectionTests.cpp:\n(TestWebKitAPI::TEST_P(ConnectionTestABBA, FlushSentMessagesWithNothingToSendIsNoOp)): Added.\n(TestWebKitAPI::TEST_P(ConnectionTestABBA, FlushSentMessagesWaitsForParkedMessage)): Added.\n(TestWebKitAPI::TEST_P(ConnectionTestABBA, FlushSentMessagesAfterPeerIsGoneWaitsForClose)): Added.\n\nCanonical link: https://commits.webkit.org/324758@main\n"
    },
    {
      "commit": "48005609cfae303eca4d3279a6f8496ea63100bf",
      "tree": "54268b61d77173cc03dd27d08b9cad7394c47d18",
      "parents": [
        "827fcaf205321b9c87ca7a607a9ebc62a195ebf4"
      ],
      "author": {
        "name": "Dawn Morningstar",
        "email": "morningstar@apple.com",
        "time": "Mon Oct 26 20:55:36 2026"
      },
      "committer": {
        "name": "Dawn Morningstar",
        "email": "morningstar@apple.com",
        "time": "Mon Oct 26 20:55:36 2026"
      },
      "message": "[ iOS ] imported/w3c/web-platform-tests/webrtc/RTCPeerConnection-mandatory-getStats.https.html is a flaky failure\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d289121\nrdar://146159078\n\nUnreviewed test gardening.\n\nThe test fails on iOS the same way as on macOS: RTCTransportStats\u0027s remoteCertificateId is sometimes missing.\n\n* LayoutTests/platform/ios/TestExpectations:\n\nCanonical link: https://commits.webkit.org/324757@main\n"
    },
    {
      "commit": "827fcaf205321b9c87ca7a607a9ebc62a195ebf4",
      "tree": "67ccc70f79258f2e92d4a47e9f77ccee850335f4",
      "parents": [
        "67e4df0c71ad73b23cff5e7a5dca3ca855bcbf0e"
      ],
      "author": {
        "name": "Zak Ridouh",
        "email": "zakr@apple.com",
        "time": "Mon Oct 26 20:41:53 2026"
      },
      "committer": {
        "name": "Zak Ridouh",
        "email": "zakr@apple.com",
        "time": "Mon Oct 26 20:41:53 2026"
      },
      "message": "Web Inspector: Layout panel stops listing grid and flex containers after the page reloads or navigates without a process swap\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d327484\nrdar://189971660\n\nReviewed by Sihui Liu.\n\nThe Layout panel sets `layoutContextTypeChangedMode` to `All` so the backend reports grids and flex containers the\nfrontend has not seen. Each main-frame commit calls InspectorCSSAgent::reset(), which sets the mode back to `Observed`,\nand nothing sent `All` again. After a reload or a same-site navigation, the panel listed no grids, including ones that\nappear later, until it was hidden and shown again. A navigation that swapped the web process recovered only because the\nElements tab replaced its DOM tree view, which detached and attached the panel.\n\nCSSManager now sends the remembered mode to the page target when DOMManager reports a new document. InspectorCSSAgent\ncannot push nodes before the frontend has the document, so this is the earliest point where `All` can take effect.\nIt also covers a process swap, where a new InspectorCSSAgent starts in `Observed`. It builds on the remembered mode\nfrom bug 327031.\n\nTests: inspector/css/layoutContextTypeChangedMode-main-frame-navigation.html\n       http/tests/site-isolation/inspector/css/layout-context-type-changed-mode-main-frame-navigation.html\n\n* LayoutTests/http/tests/site-isolation/inspector/css/layout-context-type-changed-mode-main-frame-navigation-expected.txt: Added.\n* LayoutTests/http/tests/site-isolation/inspector/css/layout-context-type-changed-mode-main-frame-navigation.html: Added.\n* LayoutTests/inspector/css/layoutContextTypeChangedMode-main-frame-navigation-expected.txt: Added.\n* LayoutTests/inspector/css/layoutContextTypeChangedMode-main-frame-navigation.html: Added.\n* Source/WebInspectorUI/UserInterface/Controllers/CSSManager.js:\n(WI.CSSManager):\n(WI.CSSManager.prototype.initializeTarget): Comment only.\n(WI.CSSManager.prototype._handleDocumentUpdated): Added.\n\nCanonical link: https://commits.webkit.org/324756@main\n"
    },
    {
      "commit": "67e4df0c71ad73b23cff5e7a5dca3ca855bcbf0e",
      "tree": "30e445b91a847b6ef3b5179564623e80c02a584b",
      "parents": [
        "a647e38977957c6fd89a430759d9d51fa50bce2b"
      ],
      "author": {
        "name": "Devin Rousso",
        "email": "hi@devinrousso.com",
        "time": "Mon Oct 26 20:32:16 2026"
      },
      "committer": {
        "name": "Devin Rousso",
        "email": "hi@devinrousso.com",
        "time": "Mon Oct 26 20:32:16 2026"
      },
      "message": "[GStreamer][WebAudio] Wait for device monitor startup before querying output channels\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d328942\n\nReviewed by Philippe Normand.\n\nGStreamer 1.28 starts device providers asynchronously.\nAs a result, the output channel probe can read an incomplete device list and stop the monitor before startup finishes.\n\n* Source/WebCore/platform/audio/gstreamer/AudioDestinationGStreamer.cpp:\n(WebCore::maximumNumberOfOutputChannels):\nWait for `GST_MESSAGE_DEVICE_MONITOR_STARTED` before querying the devices and log completion.\n\nCanonical link: https://commits.webkit.org/324755@main\n"
    },
    {
      "commit": "a647e38977957c6fd89a430759d9d51fa50bce2b",
      "tree": "366a20b9453b1762fea0d381f0faa34eb424f563",
      "parents": [
        "3ed0a14c9890351d8369c4368cd1535618e5ea5b"
      ],
      "author": {
        "name": "Mike Wyrzykowski",
        "email": "mwyrzykowski@apple.com",
        "time": "Mon Oct 26 20:23:05 2026"
      },
      "committer": {
        "name": "Mike Wyrzykowski",
        "email": "mwyrzykowski@apple.com",
        "time": "Mon Oct 26 20:23:05 2026"
      },
      "message": "Unreviewed, reverting 324745@main (9ae3af91a3db)\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d327576\nrdar://189825751\n\nRemoteScrollingCoordinatorProxy::rootScrollingNodeID() is a flaky crash\n\nReland of 324576@main with visionOS regression addressed.\n\nReverted change:\n\n    Unreviewed, reverting 324576@main (de2d3ea41ff5)\n    https://bugs.webkit.org/show_bug.cgi?id\u003d328952\n    rdar://191030290\n    324745@main (9ae3af91a3db)\n\nCanonical link: https://commits.webkit.org/324754@main\n"
    },
    {
      "commit": "3ed0a14c9890351d8369c4368cd1535618e5ea5b",
      "tree": "d030b60858522a5ce9a5e6756c392d17a1209d7a",
      "parents": [
        "0966c69cc7f395c2a02d32bb6c34be02e13dda99"
      ],
      "author": {
        "name": "lilly",
        "email": "173393835+cupidsity@users.noreply.github.com",
        "time": "Mon Oct 26 20:17:22 2026"
      },
      "committer": {
        "name": "Lilly Le",
        "email": "info.aeslilly@gmail.com",
        "time": "Mon Oct 26 20:17:22 2026"
      },
      "message": "corner-shape: Ancestor overflow clip ignores corner-shape changes and clips square corners round\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d326574\n\nReviewed by Simon Fraser.\n\nStore the corner curvatures in CompositedClipData so shape-only changes are seen,\nand strip the radii on the non-mask path via contentsClippingRectForCornerShape().\n\nTests: imported/w3c/web-platform-tests/css/css-borders/corner-shape/corner-shape-ancestor-clip-dynamic-ref.html\n       imported/w3c/web-platform-tests/css/css-borders/corner-shape/corner-shape-ancestor-clip-dynamic.html\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-borders/corner-shape/corner-shape-ancestor-clip-dynamic-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-borders/corner-shape/corner-shape-ancestor-clip-dynamic-ref.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-borders/corner-shape/corner-shape-ancestor-clip-dynamic.html: Added.\n* Source/WebCore/rendering/LayerAncestorClippingStack.cpp:\n(WebCore::operator\u003c\u003c):\n* Source/WebCore/rendering/LayerAncestorClippingStack.h:\n(WebCore::CompositedClipData::CompositedClipData):\n* Source/WebCore/rendering/RenderLayerBacking.cpp:\n(WebCore::RenderLayerBacking::updateClippingStackLayerGeometry):\n* Source/WebCore/rendering/RenderLayerCompositor.cpp:\n(WebCore::RenderLayerCompositor::computeAncestorClippingStack const):\n\nCanonical link: https://commits.webkit.org/324753@main\n"
    },
    {
      "commit": "0966c69cc7f395c2a02d32bb6c34be02e13dda99",
      "tree": "0357c074dd3f65ee28895abe02dc69162166c12a",
      "parents": [
        "6d7114dc7abc5bf8e06c824598eae262655058e6"
      ],
      "author": {
        "name": "Charlie Wolfe",
        "email": "charliew@apple.com",
        "time": "Mon Oct 26 19:55:07 2026"
      },
      "committer": {
        "name": "Charlie Wolfe",
        "email": "charliew@apple.com",
        "time": "Mon Oct 26 19:55:07 2026"
      },
      "message": "Extend the existing 3P IP capping quirk to all google.com subdomains\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d328964\nrdar://190832074\n\nReviewed by Wenson Hsieh.\n\nGoogle owns large ranges of IP addresses, and may be affected by the existing heuristic.\n\n* Source/WebKit/NetworkProcess/cocoa/NetworkTaskCocoa.mm:\n(WebKit::NetworkTaskCocoa::setCookieTransformForFirstPartyRequest):\n\nCanonical link: https://commits.webkit.org/324752@main\n"
    },
    {
      "commit": "6d7114dc7abc5bf8e06c824598eae262655058e6",
      "tree": "b7580260b2c6beee4f8696798e9b1bc8828a6f94",
      "parents": [
        "2ede44ede04a371c4710a3cfaa3e363154fcc8d7"
      ],
      "author": {
        "name": "WebKit CI Build Triage",
        "email": "noreply@webkit.org",
        "time": "Mon Oct 26 19:48:38 2026"
      },
      "committer": {
        "name": "Jonathan Bedard",
        "email": "jbedard@apple.com",
        "time": "Mon Oct 26 19:48:38 2026"
      },
      "message": "REGRESSION(324731@main): Builds are failing with symbol(s) not found for architecture arm64\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d328968\nrdar://191033939\n\nUnreviewed build fix.\n\n* Source/WebCore/style/computed/StyleComputedStyleBase.h:\n\nCanonical link: https://commits.webkit.org/324751@main\n"
    },
    {
      "commit": "2ede44ede04a371c4710a3cfaa3e363154fcc8d7",
      "tree": "16a8dea1bfd962bd105a6c5e31b43f12a36433e8",
      "parents": [
        "38343c30eafb720e0cf3dfdc52b4080ca03db6a7"
      ],
      "author": {
        "name": "Sam Weinig",
        "email": "sam@webkit.org",
        "time": "Mon Oct 26 19:45:01 2026"
      },
      "committer": {
        "name": "Sam Weinig",
        "email": "sam@webkit.org",
        "time": "Mon Oct 26 19:45:01 2026"
      },
      "message": "[Image Redux] Use BitmapImage rather than Image for PromisedImageDragData\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d328785\n\nReviewed by Abrar Rahman Protyasha.\n\nRemove another use of Image::size() by storing a BitmapImage rather than an Image in WebViewImpl\u0027s\nPromisedImageDragData. Then use BitmapImage::size(), which is fine to call, to size the tiff data.\n\n* Source/WebKit/UIProcess/mac/WebViewImpl.h:\n* Source/WebKit/UIProcess/mac/WebViewImpl.mm:\n\nCanonical link: https://commits.webkit.org/324750@main\n"
    },
    {
      "commit": "38343c30eafb720e0cf3dfdc52b4080ca03db6a7",
      "tree": "213c8c0c5ee01c49977ee6454fd277dacdd15b5f",
      "parents": [
        "ba26031f03ce4de7fe6b52203a95a3e343f38757"
      ],
      "author": {
        "name": "Claudio Saavedra",
        "email": "csaavedra@igalia.com",
        "time": "Mon Oct 26 19:43:01 2026"
      },
      "committer": {
        "name": "Claudio Saavedra",
        "email": "csaavedra@igalia.com",
        "time": "Mon Oct 26 19:43:01 2026"
      },
      "message": "REGRESSION(304186@main): TaskPool hangs when a grouped worker stops before its repeat task arrives\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d328768\n\nReviewed by Sam Sneddon.\n\nTaskPool.wait() sends one _StopRepeat per worker to the main queue and one\nto each group queue. Grouped workers also poll the main queue, and exited\non a _StopRepeat received there. If the group\u0027s repeat task had not been\ndelivered yet, no stopped result was ever sent for it, so wait() blocked\nforever on repeat_pending_count. This hung webkitpy-test on a loaded\nWPE ARM64 bot.\n\nKeep grouped workers running after a main-queue _StopRepeat. They exit on\ntheir group queue\u0027s _StopRepeat, which is delivered after their repeat\ntasks.\n\n* Tools/Scripts/libraries/webkitcorepy/webkitcorepy/task_pool.py:\n(_Process.main):\n* Tools/Scripts/libraries/webkitcorepy/webkitcorepy/tests/task_pool_unittest.py:\n(TaskPoolUnittest.test_repeat_task_delivered_after_stop_forked):\n\nCanonical link: https://commits.webkit.org/324749@main\n"
    },
    {
      "commit": "ba26031f03ce4de7fe6b52203a95a3e343f38757",
      "tree": "c2efa70d8f47edf47308df0548c4ac124ba8b3c6",
      "parents": [
        "66ca9a065b550c6cd95e443cf884f372d8b37cdb"
      ],
      "author": {
        "name": "Qianlang Chen",
        "email": "qianlangchen@apple.com",
        "time": "Mon Oct 26 19:34:23 2026"
      },
      "committer": {
        "name": "Qianlang Chen",
        "email": "qianlangchen@apple.com",
        "time": "Mon Oct 26 19:34:23 2026"
      },
      "message": "Web Inspector: Console miscounts errors and keeps cleared messages when a page has workers or iframes\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d322364\nrdar://185652132\n\nReviewed by BJ Burg.\n\nOriginal patch by Alexey Proskuryakov \u003cap@apple.com\u003e; reworked to\nincorporate review feedback.\n\nA page can have several console targets: one per worker, and with Site\nIsolation one per frame. Each target\u0027s console agent stores and\ndeduplicates its own messages, but the frontend did not account for\nthat in two places.\n\nFirst, a repeated message was counted at the level of whichever target\nlogged most recently, so a repeated console.error() was not counted as\nan error if another target had logged in between. Track the last\nmessage level per target, as JavaScriptLogViewController already does\nfor the repeat count shown in the log.\n\nSecond, console.clear() emptied the whole log, but only the calling\ntarget\u0027s agent dropped its messages. The other targets\u0027 messages came\nback when Web Inspector was reopened, and logging one of them again\nonly updated the repeat count of a message no longer shown. Now, when\na target reports a console.clear(), send Console.clearMessages to\nevery other target.\n\nThe backend sends Console.messagesCleared with reason Frontend before\nit replies to Console.clearMessages. Ignore that event while one of\nthese clears to the target is still waiting for its reply: the log was\nalready cleared, and clearing it again would also remove anything\nlogged right after the console.clear().\n\nSkip targets without Console.setConsoleClearAPIEnabled (macOS 14.4\nand iOS 17.4 and earlier). Those backends report Console.clearMessages\nwith reason ConsoleAPI, so each resulting Console.messagesCleared would\nlook like another console.clear() and the targets would keep clearing\neach other.\n\nTests: http/tests/site-isolation/inspector/console/console-clear-in-subframe.html\n       http/tests/site-isolation/inspector/console/console-repeat-count-across-frames.html\n       http/tests/site-isolation/inspector/console/cross-origin-iframe-console-clear.html\n       http/tests/site-isolation/inspector/console/cross-origin-iframe-console-repeat-count.html\n       http/tests/site-isolation/inspector/worker/console-multiple-targets.html\n       inspector/console/console-clear-in-subframe.html\n       inspector/console/console-repeat-count-across-frames.html\n       inspector/worker/console-multiple-targets.html\n\n* LayoutTests/http/tests/site-isolation/inspector/console/console-clear-in-subframe-expected.txt: Added.\n* LayoutTests/http/tests/site-isolation/inspector/console/console-clear-in-subframe.html: Added.\n* LayoutTests/http/tests/site-isolation/inspector/console/console-repeat-count-across-frames-expected.txt: Added.\n* LayoutTests/http/tests/site-isolation/inspector/console/console-repeat-count-across-frames.html: Added.\n* LayoutTests/http/tests/site-isolation/inspector/console/cross-origin-iframe-console-clear-expected.txt: Added.\n* LayoutTests/http/tests/site-isolation/inspector/console/cross-origin-iframe-console-clear.html: Added.\n* LayoutTests/http/tests/site-isolation/inspector/console/cross-origin-iframe-console-repeat-count-expected.txt: Added.\n* LayoutTests/http/tests/site-isolation/inspector/console/cross-origin-iframe-console-repeat-count.html: Added.\n* LayoutTests/http/tests/site-isolation/inspector/console/resources/console-subframe.html: Added.\n* LayoutTests/http/tests/site-isolation/inspector/worker/console-multiple-targets-expected.txt: Added.\n* LayoutTests/http/tests/site-isolation/inspector/worker/console-multiple-targets.html: Added.\n* LayoutTests/inspector/console/console-clear-in-subframe-expected.txt: Added.\n* LayoutTests/inspector/console/console-clear-in-subframe.html: Added.\n* LayoutTests/inspector/console/console-repeat-count-across-frames-expected.txt: Added.\n* LayoutTests/inspector/console/console-repeat-count-across-frames.html: Added.\n* LayoutTests/inspector/console/resources/console-subframe.html: Added.\n* LayoutTests/inspector/worker/console-multiple-targets-expected.txt: Added.\n* LayoutTests/inspector/worker/console-multiple-targets.html: Added.\n* LayoutTests/inspector/worker/resources/worker-console-multiple-targets.js: Added.\n(onmessage):\n* Source/WebInspectorUI/UserInterface/Controllers/ConsoleManager.js:\n(WI.ConsoleManager):\n(WI.ConsoleManager.prototype.messageWasAdded):\n(WI.ConsoleManager.prototype.messagesCleared):\n(WI.ConsoleManager.prototype.messageRepeatCountUpdated):\n(WI.ConsoleManager.prototype._clearMessagesForOtherTargets):\n(WI.ConsoleManager.prototype._incrementMessageLevelCount):\n(WI.ConsoleManager.prototype._clearMessages):\n* Source/WebInspectorUI/UserInterface/Protocol/ConsoleObserver.js:\n(WI.ConsoleObserver.prototype.messagesCleared):\n\nCanonical link: https://commits.webkit.org/324748@main\n"
    },
    {
      "commit": "66ca9a065b550c6cd95e443cf884f372d8b37cdb",
      "tree": "fcbf3b3411f21a9515b16e2d5cd10ed8f826f739",
      "parents": [
        "279c63b3aedf4d0f9d9ae88d1b987ece4f0fad3b"
      ],
      "author": {
        "name": "Mike Wyrzykowski",
        "email": "mwyrzykowski@apple.com",
        "time": "Mon Oct 26 19:17:18 2026"
      },
      "committer": {
        "name": "Mike Wyrzykowski",
        "email": "mwyrzykowski@apple.com",
        "time": "Mon Oct 26 19:17:18 2026"
      },
      "message": "[WebXR][WebGPU] Projection layer created without depthStencilFormat returns an uncleared depthStencilTexture that the compositor reads\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d327533\nrdar://190068269\n\nReviewed by Dan Glastonbury.\n\nA WebXR projection layer created without a depth format now reports\nignoreDepthValues as true and hands out a null depthStencilTexture\ninstead of the compositor\u0027s depth stencil texture.\n\nWithholding that texture is not enough on its own. The depth textures\nbelong to the compositor\u0027s swapchain and are recycled across frames, so\na layer with no depthStencilFormat is handed a texture still holding\nwhatever depth a previous frame wrote. Nothing in the page can clear it\nnow that it is not exposed, and the compositor consumes depth\nunconditionally (.requestDepth is always true in\nPlatformXRCompositor.mm), so those stale values would be reprojected as\nif they were this layer\u0027s geometry. XRProjectionLayer::clearDepthTexture()\ntherefore clears each slice of the recycled swapchain depth texture at\nthe start of every frame for such a layer.\n\nThe clear value is FLT_MIN, not 0.0. The compositor renders reverse-Z,\nso the far plane is 0, but CompositorServices skips pixels at depth 0.0\nand composites them as transparent, which would punch a hole through the\nlayer. FLT_MIN is the nearest usable far value and matches what\nCompositorCoordinator::setUpDepthTextures() clears these same textures\nto at session start.\n\nThe clear is gated on the layer having no depthStencilFormat. When the\nlayer has one, XRSubImage::update gives the page a view onto this same\ntexture, so the page owns its contents and clearing it would be both\nwrong and a per-frame cost of a forced finalizeBlitCommandEncoder(), an\nextra command buffer, and one render pass per slice.\n\nTelling the compositor that such a layer has no depth at all would avoid\nthe per-frame clear entirely, but that is a follow-up.\n\nTest: imported/w3c/web-platform-tests/webxr/layers/xrProjectionLayer_ignoreDepthValues.https.html\nTest: imported/w3c/web-platform-tests/webxr/layers/xrGPUProjectionLayer_ignoreDepthValues.https.html\n\n* LayoutTests/imported/w3c/web-platform-tests/webxr/layers/xrGPUProjectionLayer_ignoreDepthValues.https-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/webxr/layers/xrGPUProjectionLayer_ignoreDepthValues.https.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/webxr/layers/xrProjectionLayer_ignoreDepthValues.https-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/webxr/layers/xrProjectionLayer_ignoreDepthValues.https.html: Added.\n* LayoutTests/platform/glib/TestExpectations: Skip both new tests on the GLIB ports.\n* Source/WebCore/Modules/webxr/XRGPUBinding.cpp:\n(WebCore::XRGPUBinding::createProjectionLayer):\n(WebCore::XRGPUBinding::getSubImage):\n* Source/WebCore/Modules/webxr/XRGPUSubImage.cpp:\n(WebCore::XRGPUSubImage::XRGPUSubImage):\n(WebCore::XRGPUSubImage::depthStencilTexture):\n* Source/WebCore/Modules/webxr/XRGPUSubImage.h:\n(WebCore::XRGPUSubImage::create):\n* Source/WebCore/Modules/webxr/XRProjectionLayer.cpp:\n(WebCore::XRProjectionLayer::ignoreDepthValues const):\n* Source/WebCore/Modules/webxr/XRProjectionLayer.h:\n* Source/WebCore/Modules/webxr/XRWebGLBinding.cpp:\n(WebCore::XRWebGLBinding::createProjectionLayer):\n* Source/WebGPU/WebGPU/XRProjectionLayer.h:\n* Source/WebGPU/WebGPU/XRProjectionLayer.mm:\n(WebGPU::Metal::XRProjectionLayer::clearDepthTexture):\n(WebGPU::Metal::XRProjectionLayer::startFrame):\n* Source/WebGPU/WebGPU/XRSubImage.mm:\n(WebGPU::Metal::XRSubImage::update):\n\nCanonical link: https://commits.webkit.org/324747@main\n"
    },
    {
      "commit": "279c63b3aedf4d0f9d9ae88d1b987ece4f0fad3b",
      "tree": "5ef8a557d8611b4ad3a4ea72787dcceadc76fa0d",
      "parents": [
        "9ae3af91a3db5245146bc662834f5f018cba1275"
      ],
      "author": {
        "name": "Vitor Roriz",
        "email": "vitor.roriz@apple.com",
        "time": "Mon Oct 26 19:16:35 2026"
      },
      "committer": {
        "name": "Vitor Roriz",
        "email": "vitor.roriz@apple.com",
        "time": "Mon Oct 26 19:16:35 2026"
      },
      "message": "Remove unnecessary RetainPtr .get() calls in text-scale code\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d328738\nrdar://190879332\n\nReviewed by Aditya Keerthi.\n\nAddresses post-landing review of https://commits.webkit.org/324569@main.\nRetainPtr converts to its pointer type implicitly, so these .get() calls are not needed.\n\n* Source/WebCore/platform/graphics/cocoa/FontCacheCocoa.mm:\n(WebCore::bodyTextSizeForContentSizeCategory):\n* Source/WebCore/testing/js/WebCoreTestSupport.cpp:\n(WebCoreTestSupport::textScaleFactorForContentSizeCategory):\n* Source/WebKit/UIProcess/Cocoa/WebProcessPoolCocoa.mm:\n(WebKit::preferredTextScaleFactor):\n(WebKit::WebProcessPool::unregisterNotificationObservers):\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/TextScaleMeta.mm:\n(TestWebKitAPI::TEST(TextScaleMeta, FollowsContentSizeCategory)):\n\nCanonical link: https://commits.webkit.org/324746@main\n"
    },
    {
      "commit": "9ae3af91a3db5245146bc662834f5f018cba1275",
      "tree": "8844ba5eed9c64fed795cc77a61be348f5f02057",
      "parents": [
        "679ab32b1908be168b435ab1a09deb3bee6cdd15"
      ],
      "author": {
        "name": "Mike Wyrzykowski",
        "email": "mwyrzykowski@apple.com",
        "time": "Mon Oct 26 19:15:27 2026"
      },
      "committer": {
        "name": "Mike Wyrzykowski",
        "email": "mwyrzykowski@apple.com",
        "time": "Mon Oct 26 19:15:27 2026"
      },
      "message": "Unreviewed, reverting 324576@main (de2d3ea41ff5)\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d328952\nrdar://191030290\n\nRevert 324576@main as it causes a crash on visionOS\n\nReverted change:\n\n    RemoteScrollingCoordinatorProxy::rootScrollingNodeID() is a flaky crash\n    https://bugs.webkit.org/show_bug.cgi?id\u003d327576\n    rdar://189825751\n    324576@main (de2d3ea41ff5)\n\nCanonical link: https://commits.webkit.org/324745@main\n"
    },
    {
      "commit": "679ab32b1908be168b435ab1a09deb3bee6cdd15",
      "tree": "cb287eb8fe2b729b6ac762b1a00a3b8d113e0757",
      "parents": [
        "0cfab008b32f20980edb2a66637355e1ac815c3c"
      ],
      "author": {
        "name": "Jean-Yves Avenard",
        "email": "jya@apple.com",
        "time": "Mon Oct 26 19:14:11 2026"
      },
      "committer": {
        "name": "Jean-Yves Avenard",
        "email": "jean-yves.avenard@apple.com",
        "time": "Mon Oct 26 19:14:11 2026"
      },
      "message": "Some audio codecs can\u0027t be decoded by the MediaSamplesDecoder\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d328412\nrdar://190670359\n\nReviewed by Youenn Fablet.\n\n1) MediaSamplesDecoder only reached AudioDecoder through a WebCodecs codec string, so audio outside\n   that list (AC-3, E-AC-3, AAC-LD, AAC-ELD and others) couldn\u0027t be decoded by it.\n\n2) It also rejected Opus with more than two channels on every platform, even though AudioDecoder\n   decodes multichannel Opus.\n\n3) createFormatDescriptionFromTrackInfo() described all encoded PCM as 32-bit float.\n\nAudioDecoder can now be created from an AudioInfo. On Cocoa the AudioSampleBufferConverter is given\nthe format description createFormatDescriptionFromTrackInfo() builds from it, and canDecode() runs\nthe same converter setup the decoder will, through the new AudioSampleBufferConverter::canConvert();\nelsewhere AudioDecoder maps the AudioInfo to a codec string and Config. Neither applies the Opus\npre-skip, MediaSamplesDecoder trims the output. An AAC AudioInfo\u0027s cookie is CoreMedia\u0027s magic\ncookie, an ES_Descriptor: it is used as is on Cocoa, and its AudioSpecificConfig is extracted\nelsewhere. A raw AudioSpecificConfig, which only the tests provided, is no longer accepted.\n\nFor 2), multichannel Opus is accepted wherever AudioDecoder supports it: on Cocoa when\nHAVE(OPUS_DECODE_MULTICHANNEL), and with GStreamer since 324690@main.\n\nFor 3), createFormatDescriptionFromTrackInfo() now uses the PCM bit depth.\n\nAudioSampleBufferConverter now owns its AudioConverter through UniqueAudioConverter, which disposes\nof it, instead of disposing of it by hand on every path.\n\n* Source/WebCore/platform/AudioDecoder.cpp:\n(WebCore::audioDecoderConfiguration): Moved from MediaSamplesDecoder.cpp. Accept multichannel Opus\nand require an ES_Descriptor for AAC.\n(WebCore::AudioDecoder::canDecode): Added.\n(WebCore::AudioDecoder::create): Added AudioInfo variant.\n* Source/WebCore/platform/AudioDecoder.h:\n* Source/WebCore/platform/MediaSamplesDecoder.cpp:\n(WebCore::canDecodeAudio): Use AudioDecoder::canDecode(const AudioInfo\u0026).\n(WebCore::MediaSamplesDecoder::canDecode): Ditto.\n(WebCore::MediaSamplesDecoder::createAudio): Create the AudioDecoder from the AudioInfo.\n(WebCore::audioDecoderConfiguration): Moved to AudioDecoder.cpp.\n* Source/WebCore/platform/MediaSamplesDecoder.h:\n* Source/WebCore/platform/audio/cocoa/AudioDecoderCocoa.cpp:\n(WebCore::AudioDecoderCocoa::create): Added AudioInfo variant.\n(WebCore::isAAC): Added.\n(WebCore::createInputFormatDescription): Added.\n(WebCore::outputDescription): Added.\n(WebCore::converterOptions): Added.\n(WebCore::AudioDecoderCocoa::canDecode): Added.\n(WebCore::InternalAudioDecoderCocoa::initialize): Use isAAC() and createConverter(); added AudioInfo variant.\n(WebCore::InternalAudioDecoderCocoa::createConverter): Added, from initialize().\n* Source/WebCore/platform/audio/cocoa/AudioDecoderCocoa.h:\n* Source/WebCore/platform/audio/cocoa/AudioSampleBufferConverter.h:\n(WebCore::UniqueAudioConverter): Added.\n* Source/WebCore/platform/audio/cocoa/AudioSampleBufferConverter.mm:\n(WebCore::AudioSampleBufferConverter::~AudioSampleBufferConverter): The converter is disposed of by UniqueAudioConverter.\n(WebCore::UniqueAudioConverter::Deleter::operator() const): Added.\n(WebCore::createAudioConverter): Added, from initAudioConverterForSourceFormatDescription().\n(WebCore::AudioSampleBufferConverter::canConvert): Added.\n(WebCore::AudioSampleBufferConverter::initAudioConverterForSourceFormatDescription): Use createAudioConverter();\nconfigure the new converter and only keep it once that succeeded.\n* Source/WebCore/platform/graphics/cocoa/CMUtilities.mm:\n(WebCore::encodedPCMFormat): Added.\n(WebCore::createFormatDescriptionFromTrackInfo): Describe encoded PCM from its bit depth; require a cookie for FLAC.\n* Tools/TestWebKitAPI/Resources/cocoa/aac-eld.m4a: Added.\n* Tools/TestWebKitAPI/Resources/cocoa/aac-ld.m4a: Added.\n* Tools/TestWebKitAPI/Resources/cocoa/opus-5.1.webm: Added, copied from LayoutTests/webaudio/resources/media.\n* Tools/TestWebKitAPI/Tests/WebCore/cocoa/MediaSamplesDecoderTests.mm:\ncanDecode() now creates the decoder\u0027s converter, so the tests need real codec configuration data\nfor it to succeed: the Opus, Vorbis and AAC track infos come from parsed media files.\n(TestWebKitAPI::parseFLACFile): Deleted; MediaSamplesDecoder now takes the \u0027dfLa\u0027 magic cookie as is.\n(TestWebKitAPI::wrappedAACCookie): Deleted.\n(TestWebKitAPI::flacCookie): Added.\n(TestWebKitAPI::firstTrackInfo): Added.\n(TestWebKitAPI::TEST(MediaSamplesDecoder, CanDecodeFilters)): Use the Opus track info of opus.webm.\n(TestWebKitAPI::TEST(MediaSamplesDecoder, CanDecodeSupportedCodecs)): Use a real FLAC cookie, the Vorbis track\ninfo of vbr-96kbps-44khz.ogg and the AAC track infos of silence-long.m4a and of afconvert-encoded AAC-LD and\nAAC-ELD files; add AC-3 and E-AC-3.\n(TestWebKitAPI::TEST(MediaSamplesDecoder, CanDecodeMultichannelOpus)): Added.\n(TestWebKitAPI::TEST(MediaSamplesDecoder, CanDecodeRejectsUnsupportedTracks)): AAC-LD is now supported; FLAC with\nan unparseable cookie isn\u0027t.\n(TestWebKitAPI::TEST(MediaSamplesDecoder, FrameCountMatchesWebAudioFLAC)): Parse the file without converting its cookie.\n\nCanonical link: https://commits.webkit.org/324744@main\n"
    },
    {
      "commit": "0cfab008b32f20980edb2a66637355e1ac815c3c",
      "tree": "44a7861ff298e34a16bba2511ba2a538b4531801",
      "parents": [
        "78dd38eaa6bd5f7318dd1e4b708c810a4a44a5db"
      ],
      "author": {
        "name": "Charlie Wolfe",
        "email": "charliew@apple.com",
        "time": "Mon Oct 26 19:07:01 2026"
      },
      "committer": {
        "name": "Charlie Wolfe",
        "email": "charliew@apple.com",
        "time": "Mon Oct 26 19:07:01 2026"
      },
      "message": "Add a WKA-side stub for the cookie allowlist added in 324047@main\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d328414\nrdar://190672008\n\nReviewed by Matthew Finkel.\n\n* Source/WebCore/page/Quirks.cpp:\n(WebCore::Quirks::shouldExemptCookieFromITPDataRemoval):\n* Source/WebCore/page/Quirks.h:\n* Source/WebKit/NetworkProcess/cocoa/NetworkStorageSessionCocoa.mm:\n(WebKit::NetworkStorageSession::deleteCookiesForHostnames):\n(WebKit::isAllowlistedCookieName): Deleted.\n\nCanonical link: https://commits.webkit.org/324743@main\n"
    },
    {
      "commit": "78dd38eaa6bd5f7318dd1e4b708c810a4a44a5db",
      "tree": "6cdfd0a62f49b829184ebb3fe6455aaa5de77afb",
      "parents": [
        "6191bcefeb9c259a5ac90587d61d36917e8064db"
      ],
      "author": {
        "name": "Sihui Liu",
        "email": "sihui_liu@apple.com",
        "time": "Mon Oct 26 19:04:00 2026"
      },
      "committer": {
        "name": "Sihui Liu",
        "email": "sihui_liu@apple.com",
        "time": "Mon Oct 26 19:04:00 2026"
      },
      "message": "[Site Isolation] Canceling a back/forward navigation resets the back/forward list cursor to a stale entry\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d328426\nrdar://190935993\n\nReviewed by Basuke Suzuki.\n\nHistoryController::goToItem() moves the back/forward cursor to the target item before any frame\ncommits. If the traversal is then canceled, FrameLoader moves the cursor back to the main frame\u0027s\nHistoryController::currentItem(). It does this in checkLoadCompleteForThisFrame() for a failed\nprovisional load and in continueLoadAfterNavigationPolicy() for a policy punt.\n\nWith UI-process back/forward item loading, a subframe navigation or traversal only updates the\nnavigated frame\u0027s item, so the main frame\u0027s item can be several entries old. In\nhttp/tests/navigation/forward-and-cancel.html, going forward in the child frame and then calling\nwindow.stop() left the cursor one entry before the one the traversal started from, so the next\nhistory.forward() went to the wrong entry. The navigated frame\u0027s own item is not a correct\nsubstitute either: a cross-site iframe\u0027s process may not host the main frame, and a provisional\nframe in a new process has no current item.\n\nThe UI process creates the traversal\u0027s API::Navigation with the item the traversal started from, so\nit now owns the restore. When UI-process back/forward item loading is enabled, FrameLoader in\nWebContent process skips both resets. WebPageProxy in UI process instead moves the cursor back to\nAPI::Navigation::fromItem() when a frame of the traversal fails its provisional load or its\nnavigation policy is Ignore or Download, as long as no frame of the traversal has committed and the\ncursor is still at the traversal\u0027s target. A frame that applies the traversal without a load\n(FrameTraversalResult::Taken, e.g. a same-document traversal) counts as committed.\n\n* LayoutTests/platform/ios-site-isolation/TestExpectations: Remove the failure expectation; the test\n  now passes under Site Isolation.\n* LayoutTests/platform/mac-site-isolation/TestExpectations: Ditto.\n* Source/WebCore/loader/FrameLoader.cpp:\n(WebCore::FrameLoader::checkLoadCompleteForThisFrame):\n(WebCore::FrameLoader::continueLoadAfterNavigationPolicy):\n* Source/WebKit/UIProcess/API/APINavigation.h:\n(API::Navigation::setBackForwardTraversalDidCommitInAnyFrame):\n(API::Navigation::backForwardTraversalDidCommitInAnyFrame const):\n* Source/WebKit/UIProcess/WebPageProxy.cpp:\n(WebKit::WebPageProxy::sendGoToBackForwardItemForFrame):\n(WebKit::WebPageProxy::restoreBackForwardListCurrentItemAfterCanceledTraversal):\n(WebKit::WebPageProxy::receivedPolicyDecision):\n(WebKit::WebPageProxy::didFailProvisionalLoadForFrameShared):\n(WebKit::WebPageProxy::didCommitLoadForFrame):\n* Source/WebKit/UIProcess/WebPageProxy.h:\n\nCanonical link: https://commits.webkit.org/324742@main\n"
    },
    {
      "commit": "6191bcefeb9c259a5ac90587d61d36917e8064db",
      "tree": "284b666472f35924497a3a8a8648c768382d6ff4",
      "parents": [
        "12ba8059d9f509d5633a1d2f412a0c9a8fc6b306"
      ],
      "author": {
        "name": "Antti Koivisto",
        "email": "antti@apple.com",
        "time": "Mon Oct 26 18:53:33 2026"
      },
      "committer": {
        "name": "Antti Koivisto",
        "email": "koivisto@iki.fi",
        "time": "Mon Oct 26 18:53:33 2026"
      },
      "message": "Read non-inherited parent style from the parent in text decoration and text extraction code\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d328471\nrdar://problem/190721617\n\nReviewed by Alan Baradlay.\n\nFollow-up to 8c7db9bd1c95. RenderText::style() returns its parent\u0027s style, so text decoration painting\nand text extraction read non-inherited parent properties (decorations, display, pseudo-element flags,\nopacity) through a text renderer. Text is going to get its own anonymous style, and those reads would\nthen see initial values.\n\nRead the parent\u0027s style explicitly. No behavior change.\n\n* Source/WebCore/page/text-extraction/TextExtraction.cpp:\n(WebCore::TextExtraction::paintsVisibleContent):\n(WebCore::TextExtraction::extractRenderedTokens):\n* Source/WebCore/rendering/TextDecorationPainter.cpp:\n(WebCore::collectStylesForRenderer):\n\nCanonical link: https://commits.webkit.org/324741@main\n"
    },
    {
      "commit": "12ba8059d9f509d5633a1d2f412a0c9a8fc6b306",
      "tree": "008a0acb22ca2095c7260a7701fd9915a213de98",
      "parents": [
        "b5d0911616c296f509173682ac6239d153b54c47"
      ],
      "author": {
        "name": "Sam Weinig",
        "email": "sam@webkit.org",
        "time": "Mon Oct 26 18:52:28 2026"
      },
      "committer": {
        "name": "Sam Weinig",
        "email": "sam@webkit.org",
        "time": "Mon Oct 26 18:52:28 2026"
      },
      "message": "[Image Redux] Move ImageAdapter\u0027s static tiffRepresentation() into a new NativeImageCocoa\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d328847\n\nReviewed by Darin Adler.\n\nMove conversion from NativeImage to tiff data into its own new files, NativeImageCocoa.h/mm. This\nfunctionality has no dependency on Image, so being in ImageAdapter is unnecessary. While moving them,\nadd an overload that takes a single NativeImage to avoid Vector allocation in a few cases.\n\n* Source/WebCore/PlatformCocoa.cmake:\n* Source/WebCore/SourcesCocoa.txt:\n* Source/WebCore/WebCore.xcodeproj/project.pbxproj:\n* Source/WebCore/platform/audio/cocoa/MediaSessionManagerCocoa.mm:\n* Source/WebCore/platform/graphics/ImageAdapter.h:\n* Source/WebCore/platform/graphics/cocoa/ImageAdapterCocoa.mm:\n* Source/WebCore/platform/graphics/cocoa/NativeImageCocoa.h: Added.\n* Source/WebCore/platform/graphics/cocoa/NativeImageCocoa.mm: Added.\n* Source/WebKit/Platform/ios/PlaybackSessionInterfaceLMK.mm:\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/LoadAndDecodeImage.mm:\n\nCanonical link: https://commits.webkit.org/324740@main\n"
    },
    {
      "commit": "b5d0911616c296f509173682ac6239d153b54c47",
      "tree": "19d9457aa55c0b3d1919fe4e47e8c9b4331e40d5",
      "parents": [
        "15ab57a66f90f805ad8c8b6f42c9a54a8158ab2f"
      ],
      "author": {
        "name": "Joanne Pan",
        "email": "joanne_pan2@apple.com",
        "time": "Mon Oct 26 18:50:41 2026"
      },
      "committer": {
        "name": "Joanne Pan",
        "email": "joanne_pan2@apple.com",
        "time": "Mon Oct 26 18:50:41 2026"
      },
      "message": "[AXCustomColorMode] Classify only the drawn part of a bitmap when inverting it at paint time, and allow inverting background images\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d328533\nrdar://190755177\n\nReviewed by Simon Fraser.\n\nPaint time bitmap inversion classifies the whole image, and raster background images are\nonly inverted when drawn through cross-fade(). Icons drawn from a raster sprite sheet as a\nbackground image are otherwise never inverted. Classify only the drawn part of the bitmap\nwhen it is not the whole image, and let WebKitAdditions decide whether to invert a raster\nbackground image.\n\n* Source/WebCore/platform/graphics/NativeImage.h:\n* Source/WebCore/platform/graphics/cg/GraphicsContextCG.cpp:\n(WebCore::GraphicsContextCG::drawNativeImage):\n* Source/WebCore/platform/graphics/cg/NativeImageCG.cpp:\n(WebCore::NativeImage::paintTimeTransformation const):\n* Source/WebCore/rendering/BackgroundPainter.cpp:\n(WebCore::BackgroundPainter::paintFillLayerImpl):\n\nCanonical link: https://commits.webkit.org/324739@main\n"
    },
    {
      "commit": "15ab57a66f90f805ad8c8b6f42c9a54a8158ab2f",
      "tree": "495a12efe1779b5ec91bf518d091b80cea953952",
      "parents": [
        "668b6141e5fc2b8aaba1d197d50d92a1b1430945"
      ],
      "author": {
        "name": "Elliott Williams",
        "email": "emw@apple.com",
        "time": "Mon Oct 26 18:26:49 2026"
      },
      "committer": {
        "name": "Elliott Williams",
        "email": "emw@apple.com",
        "time": "Mon Oct 26 18:26:49 2026"
      },
      "message": "[webkitscmpy] Add type annotations to git-webkit\u0027s command infrastructure\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d326855\n\nReviewed by Jonathan Bedard.\n\nAnnotate the parts of webkitscmpy.program that the git-webkit commands build on:\nprogram.main(), the Command and FilteredCommand base classes, the canonicalize\ncommand and its filter-branch scripts, and the diff command and its viewers.\nThe commands themselves are annotated separately. mypy.ini still lists these\nmodules as unannotated, until a later change annotates the rest of webkitscmpy and\nremoves that list.\n\nCommand declares the interface every command implements: parser() returns None\nand main() returns an exit status. program.main() passes main() whichever\nrepository it found (local, remote or none), so Command.main() takes it as Any\nand subclasses keep declaring the kinds of repository they support. Most of\nprogram.main()\u0027s settings may also be a function of the repository, which the\nannotations now say.\n\nMost changes only add annotations. Code changes are limited to those mypy needs\nto follow the code (renaming variables that held values of two different\ntypes, and asserting invariants where a None would already have crashed), plus\nthese fixes to bugs that mypy pointed out:\n\n- FilteredCommand.replace() substituted integer revisions into the arguments\n  passed to svn, which subprocess rejects. It now substitutes strings.\n- `git-webkit diff` crashed when reading a diff from stdin outside a git\n  checkout, while looking up the configured diff viewer. It now falls back to\n  the default viewer.\n- FilteredCommand.pager() runs `more` by name when it can\u0027t find its path,\n  instead of passing None to subprocess.\n\n* Tools/Scripts/libraries/webkitscmpy/webkitscmpy/program/__init__.py:\n(main):\n* Tools/Scripts/libraries/webkitscmpy/webkitscmpy/program/canonicalize/__init__.py:\n(IdentifierTrailer.from_template):\n(IdentifierTrailer.from_json):\n(IdentifierTrailer.to_json):\n(Canonicalize.parser):\n(Canonicalize.main):\n* Tools/Scripts/libraries/webkitscmpy/webkitscmpy/program/canonicalize/committer.py:\n(canonicalize):\n(main):\n* Tools/Scripts/libraries/webkitscmpy/webkitscmpy/program/canonicalize/message.py:\n(main):\n* Tools/Scripts/libraries/webkitscmpy/webkitscmpy/program/command.py:\n(Command):\n(Command.write_branch_variables):\n(Command.parser):\n(Command.main):\n(FilteredCommand.parser):\n(FilteredCommand.pager):\n(FilteredCommand.replace):\n(FilteredCommand.main):\n(FilteredCommand):\n(FilteredCommand.replace_line):\n(FilteredCommand.main.replace_line): Deleted.\n* Tools/Scripts/libraries/webkitscmpy/webkitscmpy/program/diff/__init__.py:\n(Diff):\n(Diff.viewers):\n(Diff.parser):\n(Diff.default_viewer):\n(Diff.main):\n* Tools/Scripts/libraries/webkitscmpy/webkitscmpy/program/diff/diff.py:\n(DiffMeta):\n(DiffMeta.__str__):\n(DiffBase.__init__):\n(DiffBase.add_line):\n(DiffBase.add_lines):\n(DiffBase.add_file):\n* Tools/Scripts/libraries/webkitscmpy/webkitscmpy/program/diff/editor_diff.py:\n(EditorDiff):\n(EditorDiff.__init__):\n(EditorDiff.add_line):\n(EditorDiff.__enter__):\n(EditorDiff.__exit__):\n* Tools/Scripts/libraries/webkitscmpy/webkitscmpy/program/diff/html_diff.py:\n(Section.from_header):\n(Section.__init__):\n(Section.header):\n(Section.line):\n(title_for):\n(commit_message_line):\n(__init__):\n(_start_div):\n(_end_div):\n(add_line):\n(__enter__):\n(__exit__):\n(__exit__._Handler.do_GET):\n(__exit__._Handler.do_POST):\n(__exit__._Handler.log_message):\n(__exit__._wait_for_enter):\n* Tools/Scripts/libraries/webkitscmpy/webkitscmpy/program/diff/terminal_diff.py:\n(TerminalDiff.__init__):\n(TerminalDiff.__enter__):\n(TerminalDiff.__exit__):\n(TerminalDiff.add_line):\n\nCanonical link: https://commits.webkit.org/324738@main\n"
    },
    {
      "commit": "668b6141e5fc2b8aaba1d197d50d92a1b1430945",
      "tree": "57fb90770f36afc35550a53e2beff17b7c2a3750",
      "parents": [
        "7832e68e7fc6892c76b9b1656f0722a6de549a58"
      ],
      "author": {
        "name": "Sam Weinig",
        "email": "sam@webkit.org",
        "time": "Mon Oct 26 18:25:44 2026"
      },
      "committer": {
        "name": "Sam Weinig",
        "email": "sam@webkit.org",
        "time": "Mon Oct 26 18:25:44 2026"
      },
      "message": "[Image Redux] Replace GraphicsContext::drawImage() and drawBitmapImage() with Image::draw() and BitmapImage::draw()\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d328845\n\nReviewed by Darin Adler.\n\nThere is no reason for GraphicsContext to know about Image or BitmapImage. The existing GraphicsContext\nfunctions that take an Image or BitmapImage just turn around and call the Image/BitmapImage::draw().\n\nInstead, callers now call Image::draw()/BitmapImage::draw() directly, avoiding the hop.\n\nTo make this have no behavior change, a check in Image::draw() for paintingDisabled() was added to\nhandle the case that was previously handled by no-op implementations in the NullGraphicsContext.\n\nWhile making the change, the draw() functions that take a FloatPoint now have a default value for\nthe parameter allowing a few callers to stop passing in FloatPoint::zero().\n\n* Source/WebCore/Modules/WebGPU/GPUQueue.cpp:\n* Source/WebCore/Modules/async-clipboard/ClipboardItemBindingsDataSource.cpp:\n* Source/WebCore/accessibility/AccessibilityObject.cpp:\n* Source/WebCore/html/ImageBitmap.cpp:\n* Source/WebCore/html/canvas/CanvasRenderingContext2DBase.cpp:\n* Source/WebCore/html/canvas/CanvasRenderingContext2DBase.h:\n* Source/WebCore/html/canvas/WebGLRenderingContextBase.cpp:\n* Source/WebCore/inspector/InspectorFontData.cpp:\n* Source/WebCore/page/FrameConsoleClient.cpp:\n* Source/WebCore/page/cocoa/DragControllerCocoa.mm:\n* Source/WebCore/platform/ScrollView.cpp:\n* Source/WebCore/platform/graphics/BifurcatedGraphicsContext.cpp:\n* Source/WebCore/platform/graphics/BifurcatedGraphicsContext.h:\n* Source/WebCore/platform/graphics/BitmapImage.cpp:\n* Source/WebCore/platform/graphics/BitmapImage.h:\n* Source/WebCore/platform/graphics/GraphicsContext.cpp:\n* Source/WebCore/platform/graphics/GraphicsContext.h:\n* Source/WebCore/platform/graphics/Image.cpp:\n* Source/WebCore/platform/graphics/Image.h:\n* Source/WebCore/platform/graphics/ImageAdapter.h:\n* Source/WebCore/platform/graphics/NullGraphicsContext.h:\n* Source/WebCore/platform/graphics/cg/ImageUtilitiesCG.cpp:\n* Source/WebCore/platform/graphics/cg/PDFDocumentImage.cpp:\n* Source/WebCore/platform/graphics/cg/PDFDocumentImage.h:\n* Source/WebCore/platform/graphics/cocoa/GraphicsContextCocoa.mm:\n* Source/WebCore/platform/graphics/cocoa/ImageAdapterCocoa.mm:\n* Source/WebCore/platform/graphics/gstreamer/VideoFrameGStreamer.cpp:\n* Source/WebCore/platform/graphics/win/cairo/ImageAdapterWinCairo.cpp:\n* Source/WebCore/rendering/RenderImage.cpp:\n* Source/WebCore/rendering/RenderTheme.cpp:\n* Source/WebCore/rendering/RenderTheme.h:\n* Source/WebCore/rendering/ios/RenderThemeIOS.mm:\n* Source/WebCore/rendering/mac/RenderThemeMac.mm:\n* Source/WebCore/style/values/images/kinds/StyleImage.cpp:\n* Source/WebCore/svg/graphics/SVGImage.cpp:\n* Source/WebCore/svg/graphics/SVGImage.h:\n* Source/WebKit/WebProcess/InjectedBundle/InjectedBundleHitTestResult.cpp:\n* Source/WebKit/WebProcess/Plugins/PluginView.cpp:\n* Source/WebKit/WebProcess/WebPage/WebFoundTextRangeController.cpp:\n* Source/WebKit/WebProcess/WebPage/ios/FindIndicatorIOS.cpp:\n* Tools/TestWebKitAPI/Tests/WebCore/cocoa/BifurcatedGraphicsContextTestsCG.cpp:\n\nCanonical link: https://commits.webkit.org/324737@main\n"
    },
    {
      "commit": "7832e68e7fc6892c76b9b1656f0722a6de549a58",
      "tree": "a4e7ef0040c0f60d8b4a8829e0e0e68c07088bb4",
      "parents": [
        "85632794b36923bdb42ad94825e4e6df97a50240"
      ],
      "author": {
        "name": "Elliott Williams",
        "email": "emw@apple.com",
        "time": "Mon Oct 26 18:23:40 2026"
      },
      "committer": {
        "name": "Elliott Williams",
        "email": "emw@apple.com",
        "time": "Mon Oct 26 18:23:40 2026"
      },
      "message": "[CMake] Build the API test binaries run-api-tests expects on iOS simulators\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d328757\n\nReviewed by Alex Christensen.\n\nrun-api-tests spawns bare TestWTF, TestWebKitAPI, TestIPC and TestWGSL\nexecutables inside the simulator and drives them through the Swift test\nrunner (--list-tests, --filter).\n\nThe iOS build instead made app bundles around the generic gtest main and\ncompiled about a tenth of the iOS tests.\n\nFix by sharing macOS machinery with iOS, and spawning standalone\nexecutables. Split API test source lists into shared, macOS and iOS\nparts.\n\nMatch code signing semantics. Like other simulated executables,\nTestWebKitAPI\u0027s custom entitlements go into a section\n(__TEXT,__entitlements) for the runtime to read. The system entitlement\nis just `get-task-allow` to support debugging, which our CMake build\nsets by default.\n\nThe iOS build now discovers the same tests as Xcode, bar a few extras.\nUserContentControllerTests.swift is left out until the iOS WebKit module\ncan build WKUserContentController.swift, which needs the C++ interop the\nmacOS build uses.\n\n* Source/cmake/WebKitEntitlements.cmake:\n* Tools/TestWebKitAPI/CMakeLists.txt:\n* Tools/TestWebKitAPI/PlatformCocoa.cmake:\n* Tools/TestWebKitAPI/Scripts/process-entitlements.sh:\n\nCanonical link: https://commits.webkit.org/324736@main\n"
    },
    {
      "commit": "85632794b36923bdb42ad94825e4e6df97a50240",
      "tree": "f1e2bc7e3dde9130c4672475dbdd6a4ce54f176b",
      "parents": [
        "4e5e85063690ee6d9ff73f0838ccb0e2beab7d84"
      ],
      "author": {
        "name": "Elliott Williams",
        "email": "emw@apple.com",
        "time": "Mon Oct 26 18:21:03 2026"
      },
      "committer": {
        "name": "Elliott Williams",
        "email": "emw@apple.com",
        "time": "Mon Oct 26 18:21:03 2026"
      },
      "message": "[CMake] Add PhoneNumberPossessionTypes to the iOS Swift module map\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d328758\n\nReviewed by Zak Ridouh.\n\nFix iOS build failure after PhoneNumberPossessionController.swift was added:\n\n    \u0027PhoneNumberPossessionCanRequestCompletionHandler\u0027 is not a member type of enum \u0027__ObjC.WebKit\u0027\"\n\n* Source/WebKit/PlatformCocoa.cmake:\n\nCanonical link: https://commits.webkit.org/324735@main\n"
    },
    {
      "commit": "4e5e85063690ee6d9ff73f0838ccb0e2beab7d84",
      "tree": "d82ce3bced29896fd947541b13ffe79bcba4e91b",
      "parents": [
        "59e81f3e123184151f7ebb18186d3b17ca454ead"
      ],
      "author": {
        "name": "Yusuke Suzuki",
        "email": "ysuzuki@apple.com",
        "time": "Mon Oct 26 18:17:25 2026"
      },
      "committer": {
        "name": "Yusuke Suzuki",
        "email": "ysuzuki@apple.com",
        "time": "Mon Oct 26 18:17:25 2026"
      },
      "message": "[JSC] Merge BytecodeGeneratorBase into BytecodeGenerator\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d328770\nrdar://190893912\n\nReviewed by Sosuke Suzuki.\n\nWe introduced BytecodeGeneratorBase originally because we shared it\nbetween JS and Wasm. But now Wasm directly interprets binary via IPInt,\nthus we no longer use this for Wasm. Just merge them for JS.\n\n* Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj:\n* Source/JavaScriptCore/SaferCPPExpectations/UncountedLocalVarsCheckerExpectations:\n* Source/JavaScriptCore/bytecode/BytecodeDumper.cpp:\n(JSC::BytecodeDumperBase\u003cInstructionStreamType\u003e::dumpValue):\n* Source/JavaScriptCore/bytecode/BytecodeDumper.h:\n* Source/JavaScriptCore/bytecode/BytecodeGeneratorification.cpp:\n* Source/JavaScriptCore/bytecode/BytecodeList.rb:\n* Source/JavaScriptCore/bytecode/Fits.h:\n* Source/JavaScriptCore/bytecode/UnlinkedCodeBlock.h:\n* Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp:\n(JSC::Label::setLocation):\n(JSC::BytecodeGenerator::allocateCalleeSaveSpace):\n(JSC::BytecodeGenerator::BytecodeGenerator):\n(JSC::BytecodeGenerator::emitJump):\n(JSC::BytecodeGenerator::fuseCompareAndJump):\n(JSC::BytecodeGenerator::fuseTestAndJmp):\n(JSC::BytecodeGenerator::emitJumpIfTrue):\n(JSC::BytecodeGenerator::emitJumpIfFalse):\n(JSC::BytecodeGenerator::emitJumpIfNotFunctionCall):\n(JSC::BytecodeGenerator::emitJumpIfNotFunctionApply):\n(JSC::BytecodeGenerator::emitJumpIfNotReflectConstruct):\n(JSC::BytecodeGenerator::emitJumpIfNotEvalFunction):\n(JSC::BytecodeGenerator::emitJumpIfEmptyPropertyNameEnumerator):\n(JSC::BytecodeGenerator::emitJumpIfSentinelString):\n(JSC::BytecodeGenerator::emitWideJumpIfNotFunctionHasOwnProperty):\n(JSC::BytecodeGenerator::emitExpectedFunctionSnippet):\n(JSC::BytecodeGenerator::emitRequireObjectCoercible):\n(JSC::BytecodeGenerator::emitRequireObjectCoercibleForDestructuring):\n(JSC::BytecodeGenerator::emitIteratorClose):\n(JSC::GenericLabel\u003cJSGeneratorTraits\u003e::setLocation): Deleted.\n* Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h:\n* Source/JavaScriptCore/bytecompiler/BytecodeGeneratorBase.h: Removed.\n* Source/JavaScriptCore/bytecompiler/BytecodeGeneratorInlines.h: Renamed from Source/JavaScriptCore/bytecompiler/BytecodeGeneratorBaseInlines.h.\n(JSC::shrinkToFit):\n(JSC::BytecodeGenerator::newLabel):\n(JSC::BytecodeGenerator::newEmittedLabel):\n(JSC::BytecodeGenerator::reclaimFreeRegisters):\n(JSC::BytecodeGenerator::emitLabel):\n(JSC::BytecodeGenerator::recordOpcode):\n(JSC::BytecodeGenerator::writeOpcode):\n(JSC::BytecodeGenerator::newRegister):\n(JSC::BytecodeGenerator::newTemporary):\n(JSC::BytecodeGenerator::newTemporaries):\n(JSC::BytecodeGenerator::addVar):\n* Source/JavaScriptCore/bytecompiler/Label.h:\n(JSC::BoundLabel::BoundLabel):\n(JSC::BoundLabel::target):\n(JSC::BoundLabel::saveTarget):\n(JSC::BoundLabel::operator int):\n(JSC::Label::bind):\n(JSC::Label::ref):\n(JSC::Label::deref):\n(JSC::Label::refCount const):\n(JSC::Label::hasOneRef const):\n(JSC::Label::isForward const):\n(JSC::Label::isBound const):\n(JSC::Label::location const):\n(JSC::Label::unresolvedJumps const):\n(JSC::BoundLabel::commitTarget):\n(JSC::GenericBoundLabel::GenericBoundLabel): Deleted.\n(JSC::GenericBoundLabel::target): Deleted.\n(JSC::GenericBoundLabel::saveTarget): Deleted.\n(JSC::GenericBoundLabel::commitTarget): Deleted.\n(JSC::GenericBoundLabel::operator int): Deleted.\n(JSC::GenericLabel::bind): Deleted.\n(JSC::GenericLabel::ref): Deleted.\n(JSC::GenericLabel::deref): Deleted.\n(JSC::GenericLabel::refCount const): Deleted.\n(JSC::GenericLabel::hasOneRef const): Deleted.\n(JSC::GenericLabel::isForward const): Deleted.\n(JSC::GenericLabel::isBound const): Deleted.\n(JSC::GenericLabel::location const): Deleted.\n(JSC::GenericLabel::unresolvedJumps const): Deleted.\n* Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp:\n* Source/JavaScriptCore/wasm/WasmFunctionIPIntMetadataGenerator.h:\n* Source/JavaScriptCore/wasm/WasmIPIntGenerator.cpp:\n\nCanonical link: https://commits.webkit.org/324734@main\n"
    },
    {
      "commit": "59e81f3e123184151f7ebb18186d3b17ca454ead",
      "tree": "bfe7f6131a0e47b50db08b210a8ff561b6171a27",
      "parents": [
        "17d262face05c3688429964140bcde2499f31a31"
      ],
      "author": {
        "name": "Yusuke Suzuki",
        "email": "ysuzuki@apple.com",
        "time": "Mon Oct 26 18:15:39 2026"
      },
      "committer": {
        "name": "Yusuke Suzuki",
        "email": "ysuzuki@apple.com",
        "time": "Mon Oct 26 18:15:39 2026"
      },
      "message": "[JSC] Make RegExp Matched Array creation faster\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d328828\nrdar://190940940\n\nReviewed by Sosuke Suzuki.\n\nThis patch makes RegExp Matched Array creation faster by\nsetting necessary fields when creating a butterfly.\nThis makes a lot of things unnecessary (e.g. write-barrier).\n\n* Source/JavaScriptCore/runtime/JSArray.cpp:\n(JSC::JSArray::tryCreateUninitializedRestrictedButterfly):\n(JSC::JSArray::tryCreateUninitializedRestricted):\n* Source/JavaScriptCore/runtime/JSArray.h:\n* Source/JavaScriptCore/runtime/RegExpMatchesArray.cpp:\n(JSC::tryCreateUninitializedRegExpMatchesArrayHavingABadTime):\n(JSC::createEmptyRegExpMatchesArray):\n(JSC::createRegExpMatchesArrayWithGroupsOrIndices):\n(JSC::createRegExpMatchesArrayForPlainRegExpHavingABadTime):\n* Source/JavaScriptCore/runtime/RegExpMatchesArray.h:\n(JSC::initializeRegExpMatchesArrayOutOfLineProperties):\n(JSC::tryCreateUninitializedRegExpMatchesArray):\n(JSC::createRegExpMatchesArrayForPlainRegExp):\n\nCanonical link: https://commits.webkit.org/324733@main\n"
    },
    {
      "commit": "17d262face05c3688429964140bcde2499f31a31",
      "tree": "0ae9d6d01a146380c80542f5bd59c0d5f85b945e",
      "parents": [
        "7c30bd2feda4f536942909455a7c50896e2a99e7"
      ],
      "author": {
        "name": "Antti Koivisto",
        "email": "antti@apple.com",
        "time": "Mon Oct 26 18:09:33 2026"
      },
      "committer": {
        "name": "Antti Koivisto",
        "email": "koivisto@iki.fi",
        "time": "Mon Oct 26 18:09:33 2026"
      },
      "message": "[SVG text] Remove SVGTextLayoutEngine\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d328929\nrdar://problem/191014795\n\nReviewed by Sam Weinig and Alan Baradlay.\n\nSVGTextLayoutAlgorithm has been enabled by default since 324088@main. This patch removes the old\nSVGTextLayoutEngine path and the SVG2TextLayoutAlgorithmEnabled flag.\n\nWith the old engine gone, RenderSVGText no longer tracks layout attributes across subtree mutations.\nThe new algorithm rebuilds the positioning on each layout and only caches text metrics, which now live\ndirectly on RenderSVGInlineText.\n\n* LayoutTests/svg/text/display-contents-in-text-crash.html:\n* Source/WTF/Scripts/Preferences/UnifiedWebPreferences.yaml:\n* Source/WebCore/Headers.cmake:\n* Source/WebCore/SaferCPPExpectations/UncheckedCallArgsCheckerExpectations:\n* Source/WebCore/SaferCPPExpectations/UncheckedLocalVarsCheckerExpectations:\n* Source/WebCore/Sources.txt:\n* Source/WebCore/WebCore.xcodeproj/project.pbxproj:\n* Source/WebCore/layout/integration/inline/LayoutIntegrationLineLayout.h:\n* Source/WebCore/rendering/svg/RenderSVGInlineText.cpp:\n(WebCore::RenderSVGInlineText::RenderSVGInlineText):\n(WebCore::RenderSVGInlineText::setTextInternal):\n(WebCore::RenderSVGInlineText::characterStartsNewTextChunk const): Deleted.\n* Source/WebCore/rendering/svg/RenderSVGInlineText.h:\n(WebCore::RenderSVGInlineText::textMetrics):\n(WebCore::RenderSVGInlineText::textMetrics const):\n(WebCore::RenderSVGInlineText::layoutAttributes): Deleted.\n(WebCore::RenderSVGInlineText::layoutAttributes const): Deleted.\n* Source/WebCore/rendering/svg/RenderSVGText.cpp:\n(WebCore::RenderSVGText::~RenderSVGText):\n(WebCore::RenderSVGText::layout):\n(WebCore::RenderSVGText::computePerCharacterLayoutInformation):\n(WebCore::collectLayoutAttributes): Deleted.\n(WebCore::findPreviousAndNextAttributes): Deleted.\n(WebCore::RenderSVGText::shouldHandleSubtreeMutations const): Deleted.\n(WebCore::RenderSVGText::subtreeChildWasAdded): Deleted.\n(WebCore::checkLayoutAttributesConsistency): Deleted.\n(WebCore::RenderSVGText::willBeDestroyed): Deleted.\n(WebCore::RenderSVGText::subtreeChildWillBeRemoved): Deleted.\n(WebCore::RenderSVGText::subtreeChildWasRemoved): Deleted.\n(WebCore::RenderSVGText::subtreeTextDidChange): Deleted.\n(WebCore::layoutCharactersInDisplayBoxes): Deleted.\n(WebCore::RenderSVGText::usesSVGTextLayoutAlgorithm const): Deleted.\n* Source/WebCore/rendering/svg/RenderSVGText.h:\n* Source/WebCore/rendering/svg/SVGTextChunk.cpp: Removed.\n* Source/WebCore/rendering/svg/SVGTextChunk.h: Removed.\n* Source/WebCore/rendering/svg/SVGTextChunkBuilder.cpp: Removed.\n* Source/WebCore/rendering/svg/SVGTextChunkBuilder.h: Removed.\n* Source/WebCore/rendering/svg/SVGTextFragment.h:\n* Source/WebCore/rendering/svg/SVGTextLayoutAlgorithm.cpp:\n(WebCore::textMetrics):\n(WebCore::valueAt):\n(WebCore::ensureTextMetrics):\n(WebCore::SVGTextLayoutAlgorithm::resolveCharacterPositioning):\n* Source/WebCore/rendering/svg/SVGTextLayoutAttributes.cpp: Removed.\n* Source/WebCore/rendering/svg/SVGTextLayoutAttributes.h: Removed.\n* Source/WebCore/rendering/svg/SVGTextLayoutAttributesBuilder.cpp: Removed.\n* Source/WebCore/rendering/svg/SVGTextLayoutAttributesBuilder.h: Removed.\n* Source/WebCore/rendering/svg/SVGTextLayoutEngine.cpp: Removed.\n* Source/WebCore/rendering/svg/SVGTextLayoutEngine.h: Removed.\n* Source/WebCore/rendering/svg/SVGTextLayoutEngineBaseline.h:\n* Source/WebCore/rendering/svg/SVGTextLayoutEngineSpacing.h:\n* Source/WebCore/rendering/svg/SVGTextMetrics.cpp:\n* Source/WebCore/rendering/svg/SVGTextMetrics.h:\n* Source/WebCore/rendering/svg/SVGTextMetricsBuilder.cpp: Removed.\n* Source/WebCore/rendering/svg/SVGTextMetricsBuilder.h: Removed.\n* Source/WebCore/rendering/svg/SVGTextQuery.cpp:\n(WebCore::SVGTextQuery::modifyStartEndPositionsRespectingLigatures const):\n(WebCore::SVGTextQuery::characterNumberAtPositionCallback const):\n* Source/WebCore/rendering/updating/RenderTreeBuilderSVG.cpp:\n(WebCore::RenderTreeBuilder::SVG::attach):\n(WebCore::RenderTreeBuilder::SVG::detach):\n* Source/WebKit/WebKitUIProcessPrefix.h:\n\nCanonical link: https://commits.webkit.org/324732@main\n"
    },
    {
      "commit": "7c30bd2feda4f536942909455a7c50896e2a99e7",
      "tree": "570c67ba2f41b6ca3b92f853037eec5fdcf7668e",
      "parents": [
        "5c94e3715b0662e39d07b8e52ecd76c85d7ef474"
      ],
      "author": {
        "name": "Antti Koivisto",
        "email": "antti@apple.com",
        "time": "Mon Oct 26 17:52:13 2026"
      },
      "committer": {
        "name": "Charlie Wolfe",
        "email": "charliew@apple.com",
        "time": "Mon Oct 26 17:52:13 2026"
      },
      "message": "[UsedStyle] Skip border and padding evaluation for boxes without them\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d328306\nrdar://190600372\n\nReviewed by Charlie Wolfe.\n\nLayout asks for border widths and padding constantly, and most boxes have neither. Each request\nconstructs a UsedStyle and evaluates the value with zoom and device pixel snapping.\n\nComputedStyle now carries two flags: all effective border widths are zero, and all padding edges are\nknown zeros. Zero is zero under any zoom and device scale factor, so the flags only depend on the style\nvalues. The border and padding setters keep them current.\n\nThe RenderBoxModelObject border and padding getters test the flag before constructing a UsedStyle. The\nUsedStyle border getters test it too, which also covers painting and ::first-line styles.\n\nSpeedometer 3 A/B: +0.4% overall, about +1% on the NewsSite suites.\n\n* Source/WebCore/css/CSSProperties.json:\n\nThe border width and style longhands, border-image-width and the padding longhands update the flags.\n\n* Source/WebCore/css/scripts/process-css-properties.py:\n\nAdd computed-style-setter-did-set-function, a function the generated setter calls after the value changes.\n\n* Source/WebCore/rendering/RenderBoxModelObject.cpp:\n(WebCore::RenderBoxModelObject::borderWidths const):\n(WebCore::RenderBoxModelObject::borderTop const):\n(WebCore::RenderBoxModelObject::borderBottom const):\n(WebCore::RenderBoxModelObject::borderLeft const):\n(WebCore::RenderBoxModelObject::borderRight const):\n(WebCore::RenderBoxModelObject::borderBefore const):\n(WebCore::RenderBoxModelObject::borderAfter const):\n(WebCore::RenderBoxModelObject::borderStart const):\n(WebCore::RenderBoxModelObject::borderEnd const):\n(WebCore::RenderBoxModelObject::computedCSSPaddingTop const):\n(WebCore::RenderBoxModelObject::computedCSSPaddingBottom const):\n(WebCore::RenderBoxModelObject::computedCSSPaddingLeft const):\n(WebCore::RenderBoxModelObject::computedCSSPaddingRight const):\n(WebCore::RenderBoxModelObject::computedCSSPaddingBefore const):\n(WebCore::RenderBoxModelObject::computedCSSPaddingAfter const):\n(WebCore::RenderBoxModelObject::computedCSSPaddingStart const):\n(WebCore::RenderBoxModelObject::computedCSSPaddingEnd const):\n* Source/WebCore/rendering/style/UsedStyle.h:\n(WebCore::UsedStyle::borderTopWidth const):\n(WebCore::UsedStyle::borderRightWidth const):\n(WebCore::UsedStyle::borderBottomWidth const):\n(WebCore::UsedStyle::borderLeftWidth const):\n(WebCore::UsedStyle::borderWidthStart const):\n(WebCore::UsedStyle::borderWidthEnd const):\n(WebCore::UsedStyle::borderWidthBefore const):\n(WebCore::UsedStyle::borderWidthAfter const):\n(WebCore::UsedStyle::borderWidths const):\n* Source/WebCore/style/computed/StyleComputedStyle+GettersInlines.h:\n* Source/WebCore/style/computed/StyleComputedStyleBase+ConstructionInlines.h:\n(WebCore::Style::ComputedStyleBase::ComputedStyleBase):\n(WebCore::Style::ComputedStyleBase::NonInheritedFlags::copyNonInheritedFrom):\n* Source/WebCore/style/computed/StyleComputedStyleBase+GettersInlines.h:\n(WebCore::Style::ComputedStyleBase::hasZeroEffectiveBorderWidths const):\n(WebCore::Style::ComputedStyleBase::hasZeroPadding const):\n* Source/WebCore/style/computed/StyleComputedStyleBase+SettersInlines.h:\n(WebCore::Style::ComputedStyleBase::setBorderImage):\n(WebCore::Style::ComputedStyleBase::setPaddingBox):\n(WebCore::Style::ComputedStyleBase::setBorderTop):\n(WebCore::Style::ComputedStyleBase::setBorderRight):\n(WebCore::Style::ComputedStyleBase::setBorderBottom):\n(WebCore::Style::ComputedStyleBase::setBorderLeft):\n* Source/WebCore/style/computed/StyleComputedStyleBase.cpp:\n(WebCore::Style::ComputedStyleBase::computeHasZeroEffectiveBorderWidths const):\n(WebCore::Style::ComputedStyleBase::computeHasZeroPadding const):\n(WebCore::Style::ComputedStyleBase::updateHasZeroEffectiveBorderWidths):\n(WebCore::Style::ComputedStyleBase::updateHasZeroPadding):\n(WebCore::Style::ComputedStyleBase::NonInheritedFlags::dumpDifferences const):\n* Source/WebCore/style/computed/StyleComputedStyleBase.h:\n* Tools/Scripts/webkitpy/style/checkers/jsonchecker.py:\n\nCanonical link: https://commits.webkit.org/324731@main\n"
    },
    {
      "commit": "5c94e3715b0662e39d07b8e52ecd76c85d7ef474",
      "tree": "fe710c4debbf522446ac9649a0bff48999f5ba16",
      "parents": [
        "1ae8574624c2e78ee53e6b5f971e80eb2d3bcf8b"
      ],
      "author": {
        "name": "Claudio Saavedra",
        "email": "csaavedra@igalia.com",
        "time": "Mon Oct 26 17:51:11 2026"
      },
      "committer": {
        "name": "Claudio Saavedra",
        "email": "csaavedra@igalia.com",
        "time": "Mon Oct 26 17:51:11 2026"
      },
      "message": "GCC 16 warns about the IsSmartPtr specializations for Calc types\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d328860\n\nReviewed by Sam Weinig.\n\nThe IsSmartPtr specializations for UnevaluatedCalc and\nUnevaluatedCalculation are constrained by the CSS::Calc and Style::Calc\nconcepts, which look up T::Raw and T::CSS and so require T to be\ncomplete. WeakPtr, WeakRef and others check IsSmartPtr for\nforward-declared types, and GCC 16 warns with -Wsfinae-incomplete once\nthose types are defined. Specialize IsSmartPtr on the templates\ndirectly, which needs no member lookup.\n\n* Source/WebCore/css/values/primitives/CSSUnevaluatedCalc.h:\n* Source/WebCore/style/values/primitives/StyleUnevaluatedCalculation.h:\n\nCanonical link: https://commits.webkit.org/324730@main\n"
    },
    {
      "commit": "1ae8574624c2e78ee53e6b5f971e80eb2d3bcf8b",
      "tree": "bf3d885526354a08917a5b523167d47c37023017",
      "parents": [
        "ad3ad2c6ea70e8007640195478d3c873b19d02f7"
      ],
      "author": {
        "name": "Marcus Plutowski",
        "email": "marcus_plutowski@apple.com",
        "time": "Mon Oct 26 17:39:52 2026"
      },
      "committer": {
        "name": "Marcus Plutowski",
        "email": "marcus_plutowski@apple.com",
        "time": "Mon Oct 26 17:39:52 2026"
      },
      "message": "[libpas] Retune designated intrinsic size-class table\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d328282\nrdar://problem/190571393\n\nReviewed by Yusuke Suzuki.\n\nThis was hand-tuned when libpas was first implemented; now it is hand-tuned\nagain, in expectation of some slight performance win.\nSeveral indices which previously mapped to a single size-class now map to\ndistinct classes. This is generally good for performance due to better locality.\nIt does bear a risk of decreasing page utilization, as these size-classes will\nno longer be able to share one another\u0027s pages, but in practice these classes\nhave been observed to have sufficient traffic to avoid that issue.\n\nChanges:\n  - Indices 7-8   split from s.c. 128 to s.c. 112, 128\n  - Indices 9-10  split from s.c. 160 to s.c. 144, 160\n  - Indices 17-19 split from s.c. 304 to s.c. 272, 304\n  - Indices 23-26 split from s.c. 416 to s.c. 384, 416\n\n* Source/bmalloc/libpas/src/libpas/pas_designated_intrinsic_heap.c:\n(pas_designated_intrinsic_heap_initialize):\n\nCanonical link: https://commits.webkit.org/324729@main\n"
    },
    {
      "commit": "ad3ad2c6ea70e8007640195478d3c873b19d02f7",
      "tree": "92b35b6c303adb5e73dcff2ba1236eb07b3dbd0f",
      "parents": [
        "37e902137268cc974626898e099dbc5581e6f344"
      ],
      "author": {
        "name": "Marcus Plutowski",
        "email": "marcus_plutowski@apple.com",
        "time": "Mon Oct 26 17:37:54 2026"
      },
      "committer": {
        "name": "Marcus Plutowski",
        "email": "marcus_plutowski@apple.com",
        "time": "Mon Oct 26 17:37:54 2026"
      },
      "message": "[libpas] Hold small-seg pages longer before decommit\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d328277\nrdar://problem/190568833\n\nReviewed by Yusuke Suzuki and Mark Lam.\n\nThis patch gives segregated directories for small segregated pages\nan additional epoch-offset, allowing their physical memory to survive\nlonger after it becomes free.\nThis epoch-offset is 900ms on Mac (bringing the total epoch deadline\nto 1.5s) and 450ms on other platforms (bringing the total to 750ms).\n\nThe offset was chosen empirically, and is expected to yield around an\n0.5% SP3 improvement on recent macOS platforms, without a significant\nmemory cost. Increasing the epoch for all pages to the same number gives\na similiar degree of performance uplift, but at a significant memory\ncost (\u003e4% on some benchmarks), suggesting that there is not much upside\nto increasing the epoch-offset for non-small-segregated pages at this time.\nAbove ~1s, further increasing the epoch-offset, even for\nsmall-segregated pages, does not give significant performance increases,\nbut does begin to hurt memory usage as as cold pages are retained for\nincreasingly long periods of time.\n\n* Source/bmalloc/libpas/src/libpas/pas_page_sharing_participant.c:\n  add 900ms delay on macOS\n* Source/bmalloc/libpas/src/test/TestHarness.cpp:\n(EpochIsCounter::EpochIsCounter): override epochs before running test\n\nCanonical link: https://commits.webkit.org/324728@main\n"
    },
    {
      "commit": "37e902137268cc974626898e099dbc5581e6f344",
      "tree": "d0f4d6c6846866a73cd0565a3efb8c8f895dc7d2",
      "parents": [
        "b92d6a6beae6e2dcd9ca1e23a00a4b7966ba2f77"
      ],
      "author": {
        "name": "Marcus Plutowski",
        "email": "marcus_plutowski@apple.com",
        "time": "Mon Oct 26 17:36:38 2026"
      },
      "committer": {
        "name": "Marcus Plutowski",
        "email": "marcus_plutowski@apple.com",
        "time": "Mon Oct 26 17:36:38 2026"
      },
      "message": "[libpas] Decrease untagged medium-seg min-objs from 11 to 7\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d328674\nrdar://190851334\n\nReviewed by Yusuke Suzuki.\n\nPractically this means raising the maximum medium-segregated object size\nfrom 11776B to 18432B.\nBefore:\n```\nPage Configs:          page  payload align min-objs  max obj handicap\ngranule  view-cache +MTE\nMedium Segregated   131072B  131072B  512B       11   11776B     1.05\n16384B  cap 12        0\n```\nafter:\n```\nPage Configs:          page  payload align min-objs  max obj handicap\ngranule  view-cache +MTE\nMedium Segregated   131072B  131072B  512B        7   18432B     1.05\n16384B  cap 12        0\n```\nThis is motivated by the 16k size class, which includes a number of\nobject-types like MarkedBlocks. Prior to this change, these were\nallocated from bitfit heaps.\nThis is less than ideal especially for aligned 16k objects which often\ngo down annoying failure routes, e.g. because each view only keeps track\nof  doesn’t remember whether whether there’s a large enough slot,\nwithout regards to whether or not it’s sufficiently aligned. Segregated\nheaps avoid this issue entirely.\nI previously raised PAS_MIN_OBJECTS_PER_PAGE from 6 to 12 (and later 11)\nlargely for the benefit of small heaps; now that we can more easily\ncontrol the heap-cutoffs separately, we can bring the medium-segregated\ncap back upwards again.\n\nEmpirically this seems to have minor top-line benefits for performance\nand memory.\n\nNo new tests since no behavior change.\n\n* Source/bmalloc/libpas/src/libpas/bmalloc_heap_config.h: MOPP 7-\u003e11\n\nCanonical link: https://commits.webkit.org/324727@main\n"
    },
    {
      "commit": "b92d6a6beae6e2dcd9ca1e23a00a4b7966ba2f77",
      "tree": "62f8fa02611593d3d432d797d6ff13650d5447e5",
      "parents": [
        "adc1832416a2d1187ef15eb9f8c32bc6add0771f"
      ],
      "author": {
        "name": "Marcus Plutowski",
        "email": "marcus_plutowski@apple.com",
        "time": "Mon Oct 26 17:35:29 2026"
      },
      "committer": {
        "name": "Marcus Plutowski",
        "email": "marcus_plutowski@apple.com",
        "time": "Mon Oct 26 17:35:29 2026"
      },
      "message": "Extend first-character filter to support some rope strings\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d328389\nrdar://190653722\n\nReviewed by Yusuke Suzuki.\n\nThe first-character filter added in 317836@main lets DFG and FTL\nquickly bail out when a regex mismatches on the 0th byte, without\ncalling into C++.\n\nThis patch extends that to two new scenarios:\n  1. DFG and FTL can now read the first byte of 8-bit substring ropes;\n     previously, any rope access would require an operation call.\n     This doesn\u0027t cover 16-bit strings or concatenation ropes.\n  2. DFG RegExpMatchFast now references the first-character table\n     at codegen time for known regexes. Previously RegExpMatchFast\n     always lowered to an operation call.\n\nFTL already had to know how to read substring ropes in order to do\nstring switch lowering, so this patch pulls out that logic into a shared\nhelper.\n\nAltogether this patch speeds up lexer-style code which tries a chain of\nanchored patterns on successive slices.\n\nTest: regexp-anchored-first-char-filter-substring-rope.js\n\n* Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:\n(JSC::DFG::SpeculativeJIT::compileRegExpMatchFast):\n(JSC::DFG::SpeculativeJIT::emitSwitchStringOnString):\n* Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp:\n(JSC::DFG::SpeculativeJIT::emitRegExpAnchoredFirstCharacterFilterGuards):\n* Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:\n(JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):\n* JSTests/stress/regexp-anchored-first-char-filter-substring-rope.js: Added.\n(shouldBe):\n(match):\n(check):\n(i.re.lastIndex.i.100.0.valueOf):\n(k.lastIndexes.push.k.0.valueOf):\n(exec):\n(classify.scan):\n(classify):\n\nCanonical link: https://commits.webkit.org/324726@main\n"
    },
    {
      "commit": "adc1832416a2d1187ef15eb9f8c32bc6add0771f",
      "tree": "f0eba1e312876c08d4e31a9649d948c020d18d4b",
      "parents": [
        "92906e432fd1e018cebe29d98d665d397d161f4a"
      ],
      "author": {
        "name": "Dominic Mazzoni",
        "email": "dm_mazzoni@apple.com",
        "time": "Mon Oct 26 17:23:03 2026"
      },
      "committer": {
        "name": "Dominic Mazzoni",
        "email": "dm_mazzoni@apple.com",
        "time": "Mon Oct 26 17:23:03 2026"
      },
      "message": "AX: On iOS, [AXRemoteElementInstance initWithUUID:...] can deadlock when XCTest takes snapshot of accessibility tree\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d328603\nrdar://190780652\n\nReviewed by Tyler Wilcock.\n\nThe issue happens with XCTest takes a snapshot of the page\u0027s accessibility tree on a page with a cross-site iframe.\n\nOne of the XCTest accessibility calls triggers building the whole accessibility tree, including building a AXRemoteElement for a cross-process iframe. Inside AXRuntime, initializing an AXRemoteElement tries to take a lock that was already held further up the call stack.\n\nThis should also be addressed in AXRuntime, but the workaround is to not initialize a AXRemoteElement from within the call stack of an accessibility query, and instead just defer it.\n\nTest: http/tests/site-isolation/accessibility/remote-frame-built-during-remote-element-lookup.html\n\n* LayoutTests/http/tests/site-isolation/accessibility/remote-frame-built-during-remote-element-lookup-expected.txt: Added.\n* LayoutTests/http/tests/site-isolation/accessibility/remote-frame-built-during-remote-element-lookup.html: Added.\n* LayoutTests/platform/ios/TestExpectations:\n* Source/WebCore/accessibility/ios/AccessibilityObjectIOS.mm:\n(WebCore::AXRemoteFrame::initializePlatformElementWithRemoteToken):\n* Tools/WebKitTestRunner/InjectedBundle/AccessibilityUIElement.h:\n(WTR::AccessibilityUIElement::readFrameDuringRemoteElementLookup):\n* Tools/WebKitTestRunner/InjectedBundle/Bindings/AccessibilityUIElement.idl:\n* Tools/WebKitTestRunner/InjectedBundle/ios/AccessibilityUIElementIOS.h:\n* Tools/WebKitTestRunner/InjectedBundle/ios/AccessibilityUIElementIOS.mm:\n(WTR::AccessibilityUIElementIOS::readFrameDuringRemoteElementLookup):\n* Source/WebCore/PAL/pal/spi/ios/AXRuntimeSPI.h:\n\nCanonical link: https://commits.webkit.org/324725@main\n"
    },
    {
      "commit": "92906e432fd1e018cebe29d98d665d397d161f4a",
      "tree": "91bb697046fef08a5b736cd7d3edbd09d86badd3",
      "parents": [
        "4e677ed00510019ee022da00c4c297848c449aba"
      ],
      "author": {
        "name": "WebKit Revert Bot",
        "email": "revert-bot@webkit.org",
        "time": "Mon Oct 26 17:05:01 2026"
      },
      "committer": {
        "name": "Charlie Wolfe",
        "email": "charliew@apple.com",
        "time": "Mon Oct 26 17:05:01 2026"
      },
      "message": "Unreviewed, reverting 323176@main (0c2a3f82bdd8)\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d328570\n\nCaused flaky test failures\n\nReverted change:\n\n    First paint after paint holding ends is delayed by WebCore timers that are already due\n    https://bugs.webkit.org/show_bug.cgi?id\u003d326534\n    323176@main (0c2a3f82bdd8)\n\nCanonical link: https://commits.webkit.org/324724@main\n"
    }
  ],
  "next": "4e677ed00510019ee022da00c4c297848c449aba"
}