)]}' { "log": [ { "commit": "6bd6d7813da4f9ad8cf98ddd6b6001584c3cb9f8", "tree": "116e334ba154d318dd2342f53b4028ecb903d391", "parents": [ "65f1020983d8e3aaba1454d3e1467f5b5fdab41f" ], "author": { "name": "Wenson Hsieh", "email": "wenson_hsieh@apple.com", "time": "Sat Jun 13 22:30:15 2026" }, "committer": { "name": "Wenson Hsieh", "email": "wenson_hsieh@apple.com", "time": "Sat Jun 13 22:30:15 2026" }, "message": "[Text Extraction] Concatenate all label text for form controls\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d317081\nrdar://179590407\n\nReviewed by Richard Robinson.\n\nConcatenate all relevant label text when extracting text representation for form controls. On\nhttps://nypost.com/account/settings, after entering an email and clicking Continue, the readonly\nemail input is labeled by both \"Email Address\" and \"Password\"; we currently only surface \"Password\"\nas the label text, which occasionally confuses the agent.\n\nAfter this change, the label text becomes \"Email Address Password\".\n\n* LayoutTests/fast/text-extraction/debug-text-extraction-form-controls-2-expected.txt:\n* LayoutTests/fast/text-extraction/debug-text-extraction-form-controls-2.html:\n* Source/WebCore/page/text-extraction/TextExtraction.cpp:\n(WebCore::TextExtraction::labelText):\n\nCanonical link: https://commits.webkit.org/315184@main\n" }, { "commit": "65f1020983d8e3aaba1454d3e1467f5b5fdab41f", "tree": "0de2868970aafc934392f10a22a06d5dc451723b", "parents": [ "5ab18c7407f7f53adb0596ba06ef05c7710ec2cf" ], "author": { "name": "Alex Christensen", "email": "achristensen@apple.com", "time": "Sat Jun 13 21:38:20 2026" }, "committer": { "name": "Alex Christensen", "email": "achristensen@apple.com", "time": "Sat Jun 13 21:38:20 2026" }, "message": "[Site Isolation] Only inform WKNavigationDelegate when main frame process crashes\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d317053\nrdar://177903694\n\nReviewed by Ben Nham.\n\nIn 2024 we discussed what would be the best user experience when an iframe process\ncrashes with site isolation enabled, a condition that had naver been seen before.\nWe decided doing nothing would be the best user experience, but just continuing to\nshow the frames that had not crashed. I even wrote some tests for it, for example\nhttp/tests/site-isolation/iframe-process-termination.html.\n\nIn 285735@main I broke this in order to get more crash data from WebKitTestRunner.\nIt is useful to continue to get those crashes when using WKPageNavigationClient,\nbut when using WKNavigationDelegate it is best to do nothing.\n\nBefore this change, when an iframe process crashes the whole page is reloaded, and\nwhen it happens multiple times Safari shows a banner that says an issue was hit\nmultiple times. After this change, in that case we just lose the iframe content\nbut the rest of the page continues functioning normally.\n\nTest: Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolation.mm\n\n* Source/WebCore/testing/Internals.cpp:\n(WebCore::Internals::getpid const):\n* Source/WebCore/testing/Internals.h:\n* Source/WebCore/testing/Internals.idl:\n* Source/WebKit/UIProcess/Cocoa/NavigationState.mm:\n(WebKit::NavigationState::NavigationClient::processDidTerminate):\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolation.mm:\n(TestWebKitAPI::(SiteIsolation, NonMainFrameProcessCrash)):\n\nCanonical link: https://commits.webkit.org/315183@main\n" }, { "commit": "5ab18c7407f7f53adb0596ba06ef05c7710ec2cf", "tree": "ddcc6a30eabc3cf80edde1636860e686888baa33", "parents": [ "bca38968985378ad75bc862236e68bbd71c85073" ], "author": { "name": "Charlie Wolfe", "email": "charliew@apple.com", "time": "Sat Jun 13 20:37:13 2026" }, "committer": { "name": "Charlie Wolfe", "email": "charliew@apple.com", "time": "Sat Jun 13 20:37:13 2026" }, "message": "UniqueIDBDatabase::createIndexAsync() is missing an early return on the null-manager path\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d317046\nrdar://179526370\n\nReviewed by Rupin Mittal.\n\nWhen m_manager is null the method invoked transaction.didCreateIndexAsync() but did not return,\nfalling through to manager-\u003erequestSpace() and dereferencing the null CheckedPtr. Add the missing\nreturn, matching every other null-manager check in the file.\n\n* Source/WebCore/Modules/indexeddb/server/UniqueIDBDatabase.cpp:\n(WebCore::IDBServer::UniqueIDBDatabase::createIndexAsync):\n\nCanonical link: https://commits.webkit.org/315182@main\n" }, { "commit": "bca38968985378ad75bc862236e68bbd71c85073", "tree": "a15662e9b763913d7b233af4e225c306fe660e59", "parents": [ "93518ed198a17261a6d6b1b1527c529a00f26efb" ], "author": { "name": "Cole Carley", "email": "ccarley2@apple.com", "time": "Sat Jun 13 18:54:34 2026" }, "committer": { "name": "Cole Carley", "email": "ccarley2@apple.com", "time": "Sat Jun 13 18:54:34 2026" }, "message": "Change Cole Carley\u0027s contributor status to WebKit reviewer\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d317026\nrdar://179511679\n\nReviewed by Zak Ridouh and Brandon Stewart.\n\nChange Cole Carley\u0027s contributor status to WebKit reviewer.\n\n* metadata/contributors.json:\n\nCanonical link: https://commits.webkit.org/315181@main\n" }, { "commit": "93518ed198a17261a6d6b1b1527c529a00f26efb", "tree": "f1bb5ad5abe0599c71590e75ee9223e2c80d4c47", "parents": [ "b4a7610d247da5708adc0e6c2b45feddc61d47aa" ], "author": { "name": "Sosuke Suzuki", "email": "sosuke@bun.com", "time": "Sat Jun 13 15:01:18 2026" }, "committer": { "name": "Sosuke Suzuki", "email": "sosuke@bun.com", "time": "Sat Jun 13 15:01:18 2026" }, "message": "[JSC] Add new DFG node for `StringIteratorPrototype.next`\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d316267\n\nReviewed by Yusuke Suzuki.\n\n314417@main restored the JS builtin for StringIteratorPrototype.next because\nbabel-wtb calls next() directly and inlining it at the call site is critical.\nThis patch implements the suggested better shape: next() becomes a C++ host\nfunction with JSStringIteratorNextIntrinsic, and DFG / FTL expand the call\ninto straight-line code: CheckStructure + GetInternalField x2 +\nStringIteratorNextWithUndefined + NewObject / PutByOffset for the iterator\nresult object + PutInternalField. The Index field is advanced after all\nnodes that can OSR exit so an exit cannot re-run next() with the advanced\nposition, and both the iterator and the result object stay eligible for\nObjectAllocationSinking. The JS builtin and its bytecode intrinsics are\nremoved again.\n\nStringIteratorNextWithUndefined is a sibling of the for-of StringIteratorNext\nnode sharing the same codegen. The only difference is that it produces\nundefined instead of the empty string placeholder when the iteration is done,\nas required for the result object\u0027s value. Keeping the nodes separate leaves\nthe for-of value SpecString-typed. Since this is the first tuple node with a\nboxed JSValue element, this adds jsValueTupleResultWithoutUsingChildren().\nThe intrinsic is 64-bit only; 32-bit keeps calling the C++ function.\n\n ToT Patched\n\nstring-iterator-for-of-ascii 26.7609+-0.1097 26.7133+-0.4403\nstring-iterator-for-of-surrogate-pairs 372.5698+-3.5469 370.5920+-3.6605\nstring-iterator-spread-surrogate-pairs 274.8831+-7.5499 270.4274+-9.2849\nstring-iterator-manual-next 105.5357+-1.0142 ^ 61.4561+-0.6055 ^ definitely 1.7173x faster\n\nTests: JSTests/microbenchmarks/string-iterator-manual-next.js\n JSTests/stress/string-iterator-next-intrinsic.js\n\n* JSTests/microbenchmarks/string-iterator-manual-next.js: Added.\n(sumCodePoints):\n* JSTests/stress/string-iterator-next-intrinsic.js: Added.\n(shouldBe):\n(shouldThrow):\n(stepShapes):\n(collect):\n(makeRope):\n(callNextWithBadThis):\n(mixed):\n* Source/JavaScriptCore/CMakeLists.txt:\n* Source/JavaScriptCore/DerivedSources-input.xcfilelist:\n* Source/JavaScriptCore/DerivedSources.make:\n* Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj:\n* Source/JavaScriptCore/builtins/StringIteratorPrototype.js: Removed.\n* Source/JavaScriptCore/bytecode/BytecodeIntrinsicRegistry.cpp:\n(JSC::BytecodeIntrinsicRegistry::BytecodeIntrinsicRegistry):\n* Source/JavaScriptCore/bytecode/BytecodeIntrinsicRegistry.h:\n* Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h:\n(JSC::BytecodeGenerator::emitIsShadowRealm):\n(JSC::BytecodeGenerator::emitIsStringIterator): Deleted.\n* Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp:\n(JSC::stringIteratorInternalFieldIndex): Deleted.\n(JSC::BytecodeIntrinsicNode::emit_intrinsic_getStringIteratorInternalField): Deleted.\n(JSC::BytecodeIntrinsicNode::emit_intrinsic_putStringIteratorInternalField): Deleted.\n* Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h:\n(JSC::DFG::AbstractInterpreter\u003cAbstractStateType\u003e::executeEffects):\n* Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp:\n(JSC::DFG::ByteCodeParser::handleIntrinsicCall):\n* Source/JavaScriptCore/dfg/DFGClobberize.h:\n(JSC::DFG::clobberize):\n* Source/JavaScriptCore/dfg/DFGCloneHelper.h:\n* Source/JavaScriptCore/dfg/DFGDoesGC.cpp:\n(JSC::DFG::doesGC):\n* Source/JavaScriptCore/dfg/DFGFixupPhase.cpp:\n(JSC::DFG::FixupPhase::fixupNode):\n* Source/JavaScriptCore/dfg/DFGNode.h:\n(JSC::DFG::Node::isTuple const):\n(JSC::DFG::Node::tupleSize const):\n* Source/JavaScriptCore/dfg/DFGNodeType.h:\n* Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp:\n* Source/JavaScriptCore/dfg/DFGSafeToExecute.h:\n(JSC::DFG::safeToExecute):\n* Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:\n* Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h:\n(JSC::DFG::SpeculativeJIT::jsValueTupleResultWithoutUsingChildren):\n* Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp:\n(JSC::DFG::SpeculativeJIT::compile):\n* Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp:\n(JSC::DFG::SpeculativeJIT::compile):\n* Source/JavaScriptCore/ftl/FTLCapabilities.cpp:\n(JSC::FTL::canCompile):\n* Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:\n(JSC::FTL::DFG::LowerDFGToB3::compileNode):\n(JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):\n* Source/JavaScriptCore/runtime/Intrinsic.h:\n* Source/JavaScriptCore/runtime/IteratorOperations.cpp:\n(JSC::createIteratorResultObjectStructure):\n(JSC::createIteratorResultObject):\n* Source/JavaScriptCore/runtime/IteratorOperations.h:\n* Source/JavaScriptCore/runtime/JSGlobalObject.h:\n(JSC::JSGlobalObject::iteratorResultObjectStructureConcurrently const):\n* Source/JavaScriptCore/runtime/StringIteratorPrototype.cpp:\n(JSC::StringIteratorPrototype::finishCreation):\n(JSC::JSC_DEFINE_HOST_FUNCTION):\n\nCanonical link: https://commits.webkit.org/315180@main\n" }, { "commit": "b4a7610d247da5708adc0e6c2b45feddc61d47aa", "tree": "71281eff326fc4e08b4fff07c0e08fc0acb8ce11", "parents": [ "693452d7e8af6e04dd3f6bd3719d91755f1de9a3" ], "author": { "name": "Chris Dumez", "email": "cdumez@apple.com", "time": "Sat Jun 13 13:21:57 2026" }, "committer": { "name": "Chris Dumez", "email": "cdumez@apple.com", "time": "Sat Jun 13 13:21:57 2026" }, "message": "CSSParserTokenRange::consumeLast() ignores its empty-range guard\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d316960\n\nReviewed by Darin Adler.\n\nThe empty-range guard in consumeLast() was missing a `return`, so the\nresult of eofToken() was discarded and control fell through to\nWTF::consumeLast(m_tokens). On an empty span that calls span::back()\n(forming an out-of-bounds pointer, likely crashing) and\nspan::first(size() - 1) with size() - 1 \u003d\u003d SIZE_MAX (corrupting the\nspan length), instead of returning the EOF sentinel. Add the missing\n`return` so the method honors the same EOF contract as consume() in the\nheader.\n\nNo test case is added because the buggy path is not reachable through\nnormal CSS parsing: the only in-tree caller of consumeLast()\n(consumeTrailingImportantAndWhitespace() in CSSParser.cpp) trims\ntrailing whitespace and guards with range.size() \u003c 2 before calling it,\nso the range is never empty at the call site. There is no CSS input\nthat drives consumeLast() onto an empty range, hence no observable\nbehavior a layout or API test could assert against. This is a latent\ndefect fixed to make the method honor its documented EOF contract for\nany future caller.\n\n* Source/WebCore/css/parser/CSSParserTokenRange.cpp:\n(WebCore::CSSParserTokenRange::consumeLast):\n\nCanonical link: https://commits.webkit.org/315179@main\n" }, { "commit": "693452d7e8af6e04dd3f6bd3719d91755f1de9a3", "tree": "2e514d0b592f12b8dcfd6228d4276c2d0bb8a6f3", "parents": [ "1683eb4fed1d7082bf4c1da27d39200bd739b9b9" ], "author": { "name": "Chris Dumez", "email": "cdumez@apple.com", "time": "Sat Jun 13 13:19:28 2026" }, "committer": { "name": "Chris Dumez", "email": "cdumez@apple.com", "time": "Sat Jun 13 13:19:28 2026" }, "message": "REGRESSION(235201@main): WKProcessAssertionBackgroundTaskManager can never cancel its pending release task\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d316889\n\nReviewed by Per Arne Vollan.\n\n-[WKProcessAssertionBackgroundTaskManager _scheduleReleaseTask] schedules a task\nthat releases the background assertion 2 seconds after the UI assertion\u0027s\nexpiration handler fires. This task is meant to be cancelled by\n_cancelPendingReleaseTask when the application returns to the foreground.\n\n235201@main (\"Introduce WorkQueue::main() to get the main thread\u0027s work queue\")\nrewrote _scheduleReleaseTask to dispatch the work via\nWorkQueue::main().dispatchAfter() instead of dispatch_block_create() +\ndispatch_after(). In doing so it dropped the assignment to the\n_pendingTaskReleaseTask ivar. As a result _pendingTaskReleaseTask stayed null,\nso _cancelPendingReleaseTask always took its early\n`if (!_pendingTaskReleaseTask) return;` path and the dispatch_block_cancel() was\nnever reached. The background assertion was then released ~2 seconds later even\nthough the app had already come back to the foreground, leaving the Web\nprocesses unable to take foreground activities.\n\nRestore the cancellable task by creating it with dispatch_block_create() (which\ndispatch_block_cancel() requires) and storing it in _pendingTaskReleaseTask so it\ncan actually be cancelled. The block is held in an OSObjectPtr\u003cdispatch_block_t\u003e\nthat adopts the +1 returned by dispatch_block_create(), so the manual\nBlock_release() dance the original code needed is no longer necessary.\n\n* Source/WebKit/UIProcess/Cocoa/ProcessAssertionCocoa.mm:\n(-[WKProcessAssertionBackgroundTaskManager _scheduleReleaseTask]):\n(-[WKProcessAssertionBackgroundTaskManager _cancelPendingReleaseTask]):\n\nCanonical link: https://commits.webkit.org/315178@main\n" }, { "commit": "1683eb4fed1d7082bf4c1da27d39200bd739b9b9", "tree": "99e688d9a67ef1c46b61ea29be0889487bbdbc4a", "parents": [ "0dde5cddb126e5c9fc51f61d9984a389c19b3c71" ], "author": { "name": "Chris Dumez", "email": "cdumez@apple.com", "time": "Sat Jun 13 13:14:09 2026" }, "committer": { "name": "Chris Dumez", "email": "cdumez@apple.com", "time": "Sat Jun 13 13:14:09 2026" }, "message": "random() crashes when one of its arguments is invalid at computed-value time\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d316972\n\nReviewed by Darin Adler.\n\nThe evaluator for random() in CSSCalcTree+Evaluation.cpp evaluated its `max`\nargument but then re-checked `min` (already known to be engaged from the check\nabove) instead of `max`. As a result, a `max` argument that fails to evaluate at\ncomputed-value time -- e.g. an anchor-size() used on a non-out-of-flow element,\nwhich resolves to nothing -- was not caught, and the subsequent `*max` then\ndereferenced a disengaged std::optional\u003cdouble\u003e. With hardened libc++ this traps\n(SIGTRAP) and crashes the WebContent process; otherwise it reads uninitialized\nmemory and produces a garbage result.\n\nFix this by checking the result of evaluating `max`. When any argument fails to\nresolve, random() correctly evaluates to nothing, making the declaration invalid\nat computed-value time so the property falls back to its initial value.\n\nTest: imported/w3c/web-platform-tests/css/css-values/random-unresolvable-argument.tentative.html\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-values/random-unresolvable-argument.tentative-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-values/random-unresolvable-argument.tentative.html: Added.\n* Source/WebCore/css/calc/CSSCalcTree+Evaluation.cpp:\n(WebCore::CSSCalc::evaluate):\n\nCanonical link: https://commits.webkit.org/315177@main\n" }, { "commit": "0dde5cddb126e5c9fc51f61d9984a389c19b3c71", "tree": "49b96f6512917a06be592faa307fcb1db3b75ee7", "parents": [ "e5f479b8defece24fe4d83a4d0ea33456dc0ba45" ], "author": { "name": "Sosuke Suzuki", "email": "sosuke@bun.sh", "time": "Sat Jun 13 13:04:05 2026" }, "committer": { "name": "Sosuke Suzuki", "email": "sosuke@bun.com", "time": "Sat Jun 13 13:04:05 2026" }, "message": "[JSC] Add `emitBytecodeInConditionContext` for nullish coalescing\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d316090\n\nReviewed by Yusuke Suzuki.\n\n`if (a ?? b)` materialized the result into a temporary and tested it\nwith `jfalse`, defeating the condition-context lowering of the\nright-hand side (e.g. `\u0026\u0026`, `||`, `!`).\n\nImplement CoalesceNode::emitBytecodeInConditionContext: test the\nleft-hand side with a fused `jundefined_or_null`, branch directly on\nits truthiness when non-nullish, and otherwise emit the right-hand\nside in the condition context. When the coalesce has absorbed an\noptional chain (`o?.x ?? b`), the nullish label doubles as the chain\u0027s\nbail-out target.\n\nBefore:\n if (a ?? b)\n [ 0] enter\n [ 1] mov loc5, arg1\n [ 4] jnundefined_or_null loc5, -\u003e10\n [ 7] mov loc5, arg2\n [10] jfalse loc5, -\u003e15\n\nAfter:\n [ 0] enter\n [ 1] jundefined_or_null arg1, -\u003e9\n [ 4] jfalse arg1, -\u003e14\n [ 7] jmp -\u003e12\n [ 9] jfalse arg2, -\u003e14\n\nTests: JSTests/stress/nullish-coalescing-in-condition-context-edge-cases.js\n JSTests/stress/nullish-coalescing-in-condition-context.js\n\n* JSTests/stress/nullish-coalescing-in-condition-context-edge-cases.js: Added.\n(shouldBe):\n(testMasqLhs):\n(testMasqRhs):\n(testMasqNot):\n(testMasqWhile):\n(testMasqOSR):\n(const.counting.get x):\n(testGetterOnce):\n(testCallOnce):\n(i.shouldBe.testCallOnce.f):\n(rhsEffect):\n(testRhsSkipped):\n(const.trapped.valueOf):\n(const.trapped.toString):\n(const.trapped.Symbol.toPrimitive):\n(testNoToPrimitive):\n(testPrim):\n(testAssignLhs):\n(testNestedChains):\n(testThisBinding):\n(const.thisObj.m):\n(testDeleteChain):\n(testThrowingGetter):\n(const.throwing.get x):\n(testWithScope):\n(testDirectEval):\n(clobber):\n(testRegisterPressure):\n(testComposed):\n* JSTests/stress/nullish-coalescing-in-condition-context.js: Added.\n(shouldBe):\n(testNot):\n(testRhsAnd):\n(testRhsOr):\n(testRhsNot):\n(testRhsRel):\n(testRhsEq):\n(testNested):\n(testTernaryCond):\n(testOuterAnd):\n(testOuterOr):\n(testWhile):\n(testFor):\n(testDoWhile):\n(testCommaLhs):\n(i.shouldBe.testWhile.next):\n(testOptChain):\n(testOptChainCall):\n(testOptChainDeep):\n(testOptChainRhsAnd):\n(i.shouldBe.testOptChainCall.f):\n(testOrder):\n(testOrderShortCircuit):\n(testOrderInRhsAnd):\n(testThrowLhs):\n(testThrowRhs):\n(gen):\n(async asyncFn):\n(async for):\n(testSwitch):\n* Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp:\n(JSC::CoalesceNode::emitBytecodeInConditionContext):\n* Source/JavaScriptCore/parser/Nodes.h:\n\nCanonical link: https://commits.webkit.org/315176@main\n" }, { "commit": "e5f479b8defece24fe4d83a4d0ea33456dc0ba45", "tree": "3f4da0d67cb66fd8ee6937c4e3c40454d1d1a09f", "parents": [ "e1dc9fc42179b762cf2a0de43a9693501bcf6613" ], "author": { "name": "Sosuke Suzuki", "email": "sosuke@bun.sh", "time": "Sat Jun 13 12:58:16 2026" }, "committer": { "name": "Sosuke Suzuki", "email": "sosuke@bun.com", "time": "Sat Jun 13 12:58:16 2026" }, "message": "[JSC] `InlineCacheHandler` layout static_assert fails on Windows ARM64\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d317068\n\nReviewed by Yusuke Suzuki.\n\nThe layout-drift guard added in bug 316163 asserts offsetOfUid() \u003d\u003d 40 on\nARM64 release builds. On the MSVC ABI (clang-cl, aarch64-pc-windows-msvc),\nthe standard [[no_unique_address]] attribute is accepted but has no effect,\nso RefCountedBase\u0027s NO_UNIQUE_ADDRESS RefCountDebugger member occupies\nstorage, every InlineCacheHandler field shifts by 8, and offsetOfUid() is\n48. Any Windows ARM64 release build that reaches this header fails to\ncompile.\n\nAdd !OS(WINDOWS) to the guard\u0027s condition. The differing offset is a\nlegitimate ABI difference rather than a layout drift, and hard-coding the\nMSVC-specific value would break again if the Windows port later maps\nNO_UNIQUE_ADDRESS to [[msvc::no_unique_address]]. The guard keeps\nprotecting the primary ARM64 targets.\n\nWe could instead map NO_UNIQUE_ADDRESS to [[msvc::no_unique_address]] so\nthe layout matches other platforms, but that affects the whole Windows\nport, so this patch does not go there.\n\n* Source/JavaScriptCore/bytecode/InlineCacheHandler.h:\n\nCanonical link: https://commits.webkit.org/315175@main\n" }, { "commit": "e1dc9fc42179b762cf2a0de43a9693501bcf6613", "tree": "d8357a7a49987a892779c9a77e8256a7d3907662", "parents": [ "477b66cb9bab2506570c1856bfe360d2c8d14fcc" ], "author": { "name": "Nikolas Zimmermann", "email": "nzimmermann@igalia.com", "time": "Sat Jun 13 12:32:16 2026" }, "committer": { "name": "Nikolas Zimmermann", "email": "zimmermann@kde.org", "time": "Sat Jun 13 12:32:16 2026" }, "message": "[LBSE] REGRESSION(315171@main): Skip three compositing tests that depend on conditional layer creation\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d317074\n\nUnreviewed.\n\nSkipp three LBSE-specific SVG tests that are currently failing, and become fully functional once PR 59346 lands.\n\n* LayoutTests/TestExpectations:\n\nCanonical link: https://commits.webkit.org/315174@main\n" }, { "commit": "477b66cb9bab2506570c1856bfe360d2c8d14fcc", "tree": "6d22d71c05ea67bbce09746bb78336a415320aff", "parents": [ "c3aca8ab0133d23a5dab22681ac48710c149b947" ], "author": { "name": "Alan Baradlay", "email": "zalan@apple.com", "time": "Sat Jun 13 12:29:13 2026" }, "committer": { "name": "Alan Baradlay", "email": "zalan@apple.com", "time": "Sat Jun 13 12:29:13 2026" }, "message": "Text changes that don\u0027t modify the text element size in flex layout on new compositing layer don\u0027t trigger re-render.\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d316820\n\u003crdar://problem/179292409\u003e\n\nReviewed by Simon Fraser.\n\nA text change inside a composited box that align-content has centered is not repainted:\nthe render tree is up to date, but the old text stays on screen. See the test reduction\nin the bug.\n\nalign-content on a block container is applied as a post-layout pass: children are placed\nin flow first, then shifted by the centering amount. estimateLogicalTopPosition() does not\nmodel that shift, so on the next relayout the container re-seats the composited box from its\nleftover centered top back to the flow estimate, recording that shift as the layout delta.\nThe descendant then relayouts and, to recover its old (last paint) position, adjusts its\nrepaint rect by the layout delta. But that delta is measured in the ancestor (layout-root)\ncoordinate space, while the descendant\u0027s repaint resolves against its repaint container — so\nthe adjustment pushes the invalidation outside the container\u0027s layer and the new text is\nnever painted.\n\nReset the layout delta to 0 at every repaint container in computeOffsets(), so a descendant\nonly ever accumulates movement that happened within that container.\n\n* LayoutTests/fast/repaint/align-content-center-in-composited-layer-expected.html: Added.\n* LayoutTests/fast/repaint/align-content-center-in-composited-layer.html: Added.\n* LayoutTests/fast/repaint/layer-repaint-with-layout-delta-1-expected.html: Added.\n* LayoutTests/fast/repaint/layer-repaint-with-layout-delta-1.html: Added.\n* LayoutTests/fast/repaint/layer-repaint-with-layout-delta-2-expected.html: Added.\n* LayoutTests/fast/repaint/layer-repaint-with-layout-delta-2.html: Added.\n* LayoutTests/platform/mac-wk1/TestExpectations:\n* Source/WebCore/rendering/RenderLayoutState.cpp:\n(WebCore::RenderLayoutState::computeOffsets): Reset to 0 at repaint containers.\n(WebCore::RenderLayoutState::addLayoutDelta):\n(WebCore::RenderLayoutState::layoutDeltaMatches const):\n* Source/WebCore/rendering/RenderLayoutState.h: Rename the member and document what it is.\n(WebCore::RenderLayoutState::layoutDelta const):\n\nCanonical link: https://commits.webkit.org/315173@main\n" }, { "commit": "c3aca8ab0133d23a5dab22681ac48710c149b947", "tree": "5c5edbee009c9425341cc152bf37cc0098287f41", "parents": [ "6fd2e01a5273642242a6a11bc3345348eb2b7319" ], "author": { "name": "Nikolas Zimmermann", "email": "nzimmermann@igalia.com", "time": "Sat Jun 13 10:46:53 2026" }, "committer": { "name": "Nikolas Zimmermann", "email": "zimmermann@kde.org", "time": "Sat Jun 13 10:46:53 2026" }, "message": "[LBSE] Hit-test SVG text per glyph in its SVG coordinate system\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d317072\n\nReviewed by Rob Buis.\n\nRenderSVGText::nodeAtPoint forwarded locationInContainer and accumulatedOffset\nstraight to RenderBlock. That works for the hitTestChildrenInDOMOrderForSVG\npath, which queries only in the Foreground phase with the point already in\nSVG space. But a (force-created) text layer is hit-tested via RenderObject\u0027s\nhitTest(): the point arrives in the layer\u0027s own space with a zero offset, and\nthe Float and ChildBlockBackgrounds phases run too. Since the\ninline text fragments use absolute positions in the element\u0027s SVG coordinate\nsystem, the unshifted point missed every glyph -\u003e on-glyph clicks only appeared\nto work because those extra phases fell back to RenderBlock and hit the text\u0027s\nblock box, which also wrongly claimed off-glyph points inside the box....\n\nThe fix mirrors RenderSVGShape::nodeAtPoint. It bails out unless hitTestAction\nis Foreground, so the block-box phases never run, and expresses the query in\nthe SVG coordinate system by shifting both the location (rect-preserving, so\neventSender rect-based tests keep their tolerance) and the offset by\ncoordinateSystemOriginTranslation (\u003d nominalSVGLayoutLocation -\nadjustedLocation). The forwarded offset becomes nominal - location(), matching\nthe hitTestChildrenInDOMOrderForSVG path.\n\nUnchanged test results in the conditional layer creation mode (not upstream yet),\nand fixes all svg/hittest/text-* + svg/custom/pointer-events-text-css-transform\nwhen forcing layer creation.\n\n* Source/WebCore/rendering/svg/RenderSVGText.cpp:\n(WebCore::RenderSVGText::nodeAtPoint):\n\nCanonical link: https://commits.webkit.org/315172@main\n" }, { "commit": "6fd2e01a5273642242a6a11bc3345348eb2b7319", "tree": "be4682fb74f6e27c88063d4fc6258dc79db50e00", "parents": [ "21b46f50939e307338b866ac8548e02d98f6a73f" ], "author": { "name": "Nikolas Zimmermann", "email": "nzimmermann@igalia.com", "time": "Sat Jun 13 09:57:57 2026" }, "committer": { "name": "Nikolas Zimmermann", "email": "zimmermann@kde.org", "time": "Sat Jun 13 09:57:57 2026" }, "message": "[LBSE] Include descendant transforms in SVG visual overflow\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d317071\n\nReviewed by Rob Buis.\n\nThe SVG visual overflow rect ignored the transforms of non-layer\ndescendants. Such a descendant paints directly into its container, so its\ntransformed bounds belong to the container\u0027s overflow. Ignoring them\nunder-sized the box and clipped content whose painted position is shifted by\na nested transformed \u003cg\u003e or nested \u003csvg\u003e with viewBox.\n\nThe fix stops computeVisualOverflowRect from passing IgnoreTransformations so\ndescendant transforms are included, while objectBoundingBoxWithoutTransformations\nkeeps its flattened convention.\n\nBecause computeAccumulatedTransform stops at the parent of stopAtRenderer, it\nbaked that renderer\u0027s own transform into the result - this is necessary for\ngetCTM()/getScreenCTM() but double-counts in the bounding-box recursion once\nthe container is mapped by its parent, so a new StopAtRendererTransform enum\n(default Include) lets that recursion pass Exclude.\n\nFinally, the viewport-container overflow clip is now requested at origin (0,0)\nso it lands in the box\u0027s local space fixing overflow clipping both under\nconditional and forced layer creation.\n\n* Source/WebCore/rendering/svg/SVGBoundingBoxComputation.cpp:\n(WebCore::SVGBoundingBoxComputation::handleRootOrContainer const):\n(WebCore::SVGBoundingBoxComputation::computeVisualOverflowRect):\n* Source/WebCore/rendering/svg/SVGTransformComputation.h:\n(WebCore::SVGTransformComputation::computeAccumulatedTransform const):\n\nCanonical link: https://commits.webkit.org/315171@main\n" }, { "commit": "21b46f50939e307338b866ac8548e02d98f6a73f", "tree": "0eb2311d82d1546faa4c6d6f92b51b3bc16fc34a", "parents": [ "eff90f74db57d243c062b7ced375361f06da78c0" ], "author": { "name": "Sosuke Suzuki", "email": "sosuke@bun.sh", "time": "Sat Jun 13 07:31:07 2026" }, "committer": { "name": "Sosuke Suzuki", "email": "sosuke@bun.com", "time": "Sat Jun 13 07:31:07 2026" }, "message": "[JSC] DFG `RegExpSearch` constant folding drops `TypeError` for non-writable lastIndex\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d316496\n\nReviewed by Yusuke Suzuki.\n\nRegExp.prototype[@@search] writes lastIndex (it sets it to 0 and restores it\nafterwards), so it throws a TypeError when lastIndex is not writable. The\nRegExpSearch DFG node speculates on this, but constant folding in\nDFGStrengthReductionPhase dropped that speculation: after tier-up, making\nlastIndex non-writable returned a result instead of throwing. Reachable via\nboth String.prototype.search and RegExp.prototype[Symbol.search].\n\nFix this with a new watchpoint set on JSGlobalObject, fired by\nRegExpObject::defineOwnProperty when a lastIndex is made non-writable. The\nfold just registers the watchpoint, so the generated code is exactly the\nsame as before this change. If the watchpoint has already been invalidated,\nthe fold instead emits a runtime guard that stores lastIndex back to itself,\nwhich exits when lastIndex is not writable.\n\nTests: JSTests/stress/regexp-search-strength-reduction-lastIndex-frozen-mid-execution.js\n JSTests/stress/regexp-search-strength-reduction-lastIndex-not-writable.js\n\n* JSTests/stress/regexp-search-strength-reduction-lastIndex-frozen-mid-execution.js: Added.\n(shouldBe):\n(shouldThrow):\n(search):\n(benign):\n(shouldThrow.search):\n* JSTests/stress/regexp-search-strength-reduction-lastIndex-not-writable.js: Added.\n(shouldBe):\n(shouldThrow):\n(stringSearch):\n(symbolSearch):\n(lateSearch):\n(nonThrowingSearch):\n* Source/JavaScriptCore/dfg/DFGStrengthReductionPhase.cpp:\n(JSC::DFG::StrengthReductionPhase::handleNode):\n* Source/JavaScriptCore/runtime/JSGlobalObject.cpp:\n(JSC::JSGlobalObject::JSGlobalObject):\n* Source/JavaScriptCore/runtime/JSGlobalObject.h:\n(JSC::JSGlobalObject::regExpLastIndexWritableWatchpointSet):\n* Source/JavaScriptCore/runtime/RegExpObject.cpp:\n(JSC::RegExpObject::defineOwnProperty):\n\nCanonical link: https://commits.webkit.org/315170@main\n" }, { "commit": "eff90f74db57d243c062b7ced375361f06da78c0", "tree": "aef30408ae21fcfdaa38c4945161acc319faa034", "parents": [ "b1f2174caabb523dc409920affacad770d003514" ], "author": { "name": "Sosuke Suzuki", "email": "sosuke@bun.sh", "time": "Sat Jun 13 07:20:22 2026" }, "committer": { "name": "Sosuke Suzuki", "email": "sosuke@bun.com", "time": "Sat Jun 13 07:20:22 2026" }, "message": "[JSC] `String#replace`, `String#replaceAll` and `String#split` RegExp paths miss observable side effects\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d316627\n\nReviewed by Yusuke Suzuki.\n\nThis fixes three problems:\n\n1. stringProtoFuncReplace never rechecked isSymbolReplaceFastAndNonObservable()\n after ToString(this), so its side effects (e.g. overriding\n RegExp.prototype.exec) were ignored. Recheck, the same way String#search\n does, via regExpReplaceGeneric extracted from regExpProtoFuncReplace.\n\n2. stringProtoFuncReplaceAll had the same problem. Apply the same fix.\n\n3. The no-@@split fallback in operationStringSplitRegExp evaluated\n ToString(separator) before ToUint32(limit). The spec evaluates the limit\n first.\n\nTests: JSTests/stress/dfg-string-split-regexp-no-split-fallback-evaluation-order.js\n JSTests/stress/string-replace-regexp-fast-path-tostring-side-effects.js\n JSTests/stress/string-replaceall-regexp-fast-path-tostring-side-effects.js\n\n* JSTests/stress/dfg-string-split-regexp-no-split-fallback-evaluation-order.js: Added.\n(shouldBe):\n(valueOf):\n(re.toString):\n(let.limit.valueOf):\n* JSTests/stress/string-replace-regexp-fast-path-tostring-side-effects.js: Added.\n(shouldBe):\n(throw.new.Error.let.obj.toString.RegExp.prototype.exec):\n(throw.new.Error):\n(shouldBe.RegExp.prototype.exec):\n* JSTests/stress/string-replaceall-regexp-fast-path-tostring-side-effects.js: Added.\n(shouldBe):\n(throw.new.Error):\n(shouldBe.let.obj.toString.RegExp.prototype.exec):\n* Source/JavaScriptCore/dfg/DFGOperations.cpp:\n(JSC::DFG::JSC_DEFINE_JIT_OPERATION):\n* Source/JavaScriptCore/runtime/StringPrototype.cpp:\n(JSC::JSC_DEFINE_HOST_FUNCTION):\n\nCanonical link: https://commits.webkit.org/315169@main\n" }, { "commit": "b1f2174caabb523dc409920affacad770d003514", "tree": "98f42b32a979a1eb6e6d3fbe4d0d886ec1bf2bb3", "parents": [ "48ce85bc3d81de0f933ccbc2cf280efe67621b6b" ], "author": { "name": "Ben Nham", "email": "nham@apple.com", "time": "Sat Jun 13 06:45:30 2026" }, "committer": { "name": "Ben Nham", "email": "nham@apple.com", "time": "Sat Jun 13 06:45:30 2026" }, "message": "WKJSHandle keeps documents alive after navigation\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d316933\nrdar://170087117\n\nReviewed by Ryosuke Niwa.\n\nWKJSHandle extends the lifetime of the document it is associated with. This is not intended and can\nlead to unwanted memory accumulation. For instance:\n\n1. WKJSHandle wraps a DOM node, which keeps the DOM node alive forever (due to the strong handle map)\n2. JSNode holds a strong reference to the underlying C++ Node\n3. Node keeps Document alive (through incrementReferencingNodeCount)\n4. Document never dies for the lifetime of WKJSHandle in the UIProcess\n\nInstead, the handle should only live for as long as its associated document. To do this, each\nJSDOMGlobalObject now keeps track of associated handles and adds it to the GC set in its\nvisitChildren.\n\nTests: Tools/TestWebKitAPI/Tests/WebKit/WKWebView/JSHandle.mm\n\n* Source/WebCore/bindings/js/JSDOMGlobalObject.cpp:\n(WebCore::JSDOMGlobalObject::visitChildrenImpl):\n(WebCore::JSDOMGlobalObject::addJSHandle):\n(WebCore::JSDOMGlobalObject::refJSHandle):\n(WebCore::JSDOMGlobalObject::derefJSHandle):\n* Source/WebCore/bindings/js/JSDOMGlobalObject.h:\n* Source/WebCore/page/WebKitJSHandle.cpp:\n(WebCore::handleToGlobalMap):\n(WebCore::globalObjectForIdentifier):\n(WebCore::WebKitJSHandle::jsHandleSentToAnotherProcess):\n(WebCore::WebKitJSHandle::jsHandleDestroyed):\n(WebCore::WebKitJSHandle::objectForIdentifier):\n(WebCore::WebKitJSHandle::WebKitJSHandle):\n(WebCore::handleMap): Deleted.\n* Source/WebCore/page/WebKitJSHandle.h:\n* Source/WebKit/UIProcess/API/Cocoa/WKPreferences.mm:\n(-[WKPreferences _setUsesPageCache:]):\n(-[WKPreferences _usesPageCache]):\n* Source/WebKit/UIProcess/API/Cocoa/WKPreferencesPrivate.h:\n* Source/WebKit/UIProcess/API/Cocoa/WKWebViewPrivateForTesting.h:\n* Source/WebKit/UIProcess/API/Cocoa/WKWebViewTesting.mm:\n(-[WKWebView _numberOfLiveDocumentsForTesting:]):\n* Source/WebKit/UIProcess/WebPageProxyTesting.cpp:\n(WebKit::WebPageProxyTesting::numberOfLiveDocuments):\n* Source/WebKit/UIProcess/WebPageProxyTesting.h:\n* Source/WebKit/WebProcess/WebPage/WebFrame.cpp:\n(WebKit::nodeFromJSHandleIdentifier):\n* Source/WebKit/WebProcess/WebPage/WebPageTesting.cpp:\n(WebKit::WebPageTesting::numberOfLiveDocuments):\n* Source/WebKit/WebProcess/WebPage/WebPageTesting.h:\n* Source/WebKit/WebProcess/WebPage/WebPageTesting.messages.in:\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/JSHandle.mm:\n(TestWebKitAPI::TEST(JSHandle, Basic)):\n(TestWebKitAPI::TEST(JSHandle, HandleDoesNotKeepDocumentAliveAfterNavigation)):\n\nCanonical link: https://commits.webkit.org/315168@main\n" }, { "commit": "48ce85bc3d81de0f933ccbc2cf280efe67621b6b", "tree": "8e4bb228d5614ea1ffc7105128e3ecefdff1a661", "parents": [ "82b8665ef1c3c2c4ec385d1cab7132e3e71056e6" ], "author": { "name": "Claudio Saavedra", "email": "csaavedra@igalia.com", "time": "Sat Jun 13 06:30:31 2026" }, "committer": { "name": "Claudio Saavedra", "email": "csaavedra@igalia.com", "time": "Sat Jun 13 06:30:31 2026" }, "message": "Non-unified build fixes for June 13th, 2026\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d317066\n\nUnreviewed build fixes.\n\n* Source/WebCore/html/FallbackPopupMenu.cpp:\n\nCanonical link: https://commits.webkit.org/315167@main\n" }, { "commit": "82b8665ef1c3c2c4ec385d1cab7132e3e71056e6", "tree": "87033eb5bc8c29c01aa04e3c1f8bbbb08baa634b", "parents": [ "ef55119cddcbf08cf5e71d11d79edd6c7d5bbfbd" ], "author": { "name": "Yusuke Suzuki", "email": "ysuzuki@apple.com", "time": "Sat Jun 13 04:42:12 2026" }, "committer": { "name": "Yusuke Suzuki", "email": "ysuzuki@apple.com", "time": "Sat Jun 13 04:42:12 2026" }, "message": "[JSC] Use UCAL_TZ_TRANSITION_PREVIOUS_INCLUSIVE in getNamedTimeZoneEpochNanoseconds\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d317058\nrdar://179540818\n\nReviewed by Yijia Huang.\n\nWhen you ask Temporal to resolve a wall-clock datetime in a named time zone,\nJSC asks ICU what UTC instant that local time corresponds to. ICU does this\nthrough a calendar object: set the wall fields, read back ucal_getMillis.\nCompute the offset at that instant. If icuEpochMs + offset \u003d\u003d localMs, the\nlocal time is valid (single candidate, normal case). If they don\u0027t match,\nthe local time does not exist, so it falls in a DST spring-forward gap\n(so that time does not exist in the world!!!), and the spec says we need to\nrecord the two bracket offsets (pre-gap beforeNs, post-gap afterNs) so\ndisambiguation later can pick which side to land on.\n\nTo obtain beforeNs, we need the offset of the era immediately before this gap.\nThe current code\u0027s strategy:\n\n1. ucal_setMillis(cal, icuEpochMs) - point the calendar at the gap.\n2. ucal_getTimeZoneTransitionDate(cal, UCAL_TZ_TRANSITION_PREVIOUS, ...) - find the transition that opened this gap.\n3. Read the offset 1ms earlier (transitionMs - 1.0) — that\u0027s the pre-gap offset.\n\nBut UCAL_TZ_TRANSITION_PREVIOUS is strictly less than the calendar\u0027s current millis.\nSo if the current time is exact point of this boundary, we will not get\nthat time point.\n\nThis patch fixes a bug with UCAL_TZ_TRANSITION_PREVIOUS_INCLUSIVE.\n\nTest: JSTests/stress/temporal-zdt-apia-dateline-gap.js\n\n* JSTests/stress/temporal-zdt-apia-dateline-gap.js: Added.\n(shouldBe):\n(shouldThrowRangeError):\n* Source/JavaScriptCore/runtime/temporal/core/TimeZoneICUBridge.cpp:\n(JSC::TemporalCore::getNamedTimeZoneEpochNanoseconds):\n\nCanonical link: https://commits.webkit.org/315166@main\n" }, { "commit": "ef55119cddcbf08cf5e71d11d79edd6c7d5bbfbd", "tree": "31c5bdd1ec4804993c3a3ed7033d659c3be64a1c", "parents": [ "eb5b87025b457ab132440561374b8e2508f0ae03" ], "author": { "name": "Marta Darbinyan", "email": "darbinyan@apple.com", "time": "Sat Jun 13 04:10:00 2026" }, "committer": { "name": "Marta Darbinyan", "email": "darbinyan@apple.com", "time": "Sat Jun 13 04:10:00 2026" }, "message": "[Gardening]: [macOS x86_64] imported/w3c/web-platform-tests/css/css-images tests are image diff failures\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d317061\nrdar://179543881\n\nUnreviewed test gardening\n\n* LayoutTests/platform/mac-wk2/TestExpectations:\n\nCanonical link: https://commits.webkit.org/315165@main\n" }, { "commit": "eb5b87025b457ab132440561374b8e2508f0ae03", "tree": "b124cfb57aa446cda98094ea9d06fea1702b5d51", "parents": [ "a9810613686c552010aa8877434aae64943f4a1d" ], "author": { "name": "Sihui Liu", "email": "sihui_liu@apple.com", "time": "Sat Jun 13 04:06:41 2026" }, "committer": { "name": "Sihui Liu", "email": "sihui_liu@apple.com", "time": "Sat Jun 13 04:06:41 2026" }, "message": "Remove dumpResourceResponseMIMETypes from InjectedBundle/TestRunner.h\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d317032\nrdar://179518087\n\nReviewed by Per Arne Vollan.\n\n`dumpResourceResponseMIMETypes` was removed from TestRunner.idl when `dumpResourceResponseMIMETypes` became a\nwebkit-test-runner directive instead of a JS testRunner API for Site Isolation support (314790@main); and\nthe `dumpResourceResponseMIMETypes` functions in TestRunner.h have become dead code.\n\n* Tools/WebKitTestRunner/InjectedBundle/TestRunner.h:\n(WTR::TestRunner::dumpProgressFinishedCallback):\n(WTR::TestRunner::shouldDumpProgressFinishedCallback const):\n(WTR::TestRunner::dumpResourceResponseMIMETypes): Deleted.\n(WTR::TestRunner::resourceResponseMIMETypesToDump const): Deleted.\n\nCanonical link: https://commits.webkit.org/315164@main\n" }, { "commit": "a9810613686c552010aa8877434aae64943f4a1d", "tree": "ca1238856fbe6f734d45d1de5d6e7ad329f85b5b", "parents": [ "df9b96dca12de3103a34bee078f72a562c95a041" ], "author": { "name": "Sihui Liu", "email": "sihui_liu@apple.com", "time": "Sat Jun 13 04:04:54 2026" }, "committer": { "name": "Sihui Liu", "email": "sihui_liu@apple.com", "time": "Sat Jun 13 04:04:54 2026" }, "message": "Use requesting origin instead of active origin for DeviceOrientation permission request\nrdar://168597925\n\nReviewed by Chris Dumez.\n\nThe current implementation uses active origin (origin being navigating to) instead of requesting origin in permission\nprompt, and this might lead to permission being granted to a wrong origin.\n\nAPI test: DeviceOrientation.PermissionOriginDuringPendingNavigation\n\n* Source/WebCore/page/Frame.cpp:\n* Source/WebKit/Shared/FrameInfoData.cpp:\n(WebKit::legacyEmptyFrameInfo):\n* Source/WebKit/Shared/FrameInfoData.h:\n* Source/WebKit/Shared/FrameInfoData.serialization.in:\n* Source/WebKit/UIProcess/Cocoa/UIDelegate.mm:\n(WebKit::UIDelegate::UIClient::shouldAllowDeviceOrientationAndMotionAccess):\n* Source/WebKit/UIProcess/ProvisionalPageProxy.cpp:\n(WebKit::ProvisionalPageProxy::cancel):\n* Source/WebKit/UIProcess/WebsiteData/WebDeviceOrientationAndMotionAccessController.cpp:\n(WebKit::WebDeviceOrientationAndMotionAccessController::shouldAllowAccess):\n* Source/WebKit/WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp:\n(WebKit::WebFrameLoaderClient::navigationActionData const):\n* Source/WebKit/WebProcess/WebPage/WebFrame.cpp:\n(WebKit::WebFrame::info const):\n* Source/WebKit/WebProcess/WebPage/WebPage.cpp:\n(WebKit::WebPage::getFrameTreeForBackForwardCacheEntry):\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/DeviceOrientation.mm:\n((DeviceOrientation, PermissionOriginDuringPendingNavigation)):\n\nOriginally-landed-as: 305413.367@rapid/safari-7624.2.5.110-branch (322ddc5). rdar://176067147\nCanonical link: https://commits.webkit.org/315163@main\n" }, { "commit": "df9b96dca12de3103a34bee078f72a562c95a041", "tree": "bde821af144b968cfad74033586108114f7fceb0", "parents": [ "56a333e3cbe184825524ba8566a737c31caef31f" ], "author": { "name": "Charlie Wolfe", "email": "charliew@apple.com", "time": "Sat Jun 13 03:24:23 2026" }, "committer": { "name": "Charlie Wolfe", "email": "charliew@apple.com", "time": "Sat Jun 13 03:24:23 2026" }, "message": "Possible null dereference in `CredentialsContainer::preventSilentAccess`\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d317045\nrdar://179526084\n\nReviewed by Aditya Keerthi.\n\n* Source/WebCore/Modules/credentialmanagement/CredentialsContainer.cpp:\n(WebCore::CredentialsContainer::preventSilentAccess const):\n\nCanonical link: https://commits.webkit.org/315162@main\n" }, { "commit": "56a333e3cbe184825524ba8566a737c31caef31f", "tree": "a2bebf84a19e8304224a9e3b97bdfe0e10fa9f85", "parents": [ "f2a866573ce590d22793c2a16af29b27558743e0" ], "author": { "name": "Marta Darbinyan", "email": "darbinyan@apple.com", "time": "Sat Jun 13 03:03:25 2026" }, "committer": { "name": "Marta Darbinyan", "email": "darbinyan@apple.com", "time": "Sat Jun 13 03:03:25 2026" }, "message": "[gardening]: [macOS release] imported/w3c/web-platform-tests/web-locks/acquire.https.any.sharedworker.html is flaky crash\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d317031\nrdar://179515644\n\nUnreviewed test gardening\n\n* LayoutTests/platform/mac-wk2/TestExpectations:\n\nCanonical link: https://commits.webkit.org/315161@main\n" }, { "commit": "f2a866573ce590d22793c2a16af29b27558743e0", "tree": "71695e57c09dcbe182e4a89113b5d92eeb8913c2", "parents": [ "5ec3ee11b4e748352b0d658bf9e98113a91ed172" ], "author": { "name": "Geoffrey Garen", "email": "ggaren@apple.com", "time": "Sat Jun 13 02:23:04 2026" }, "committer": { "name": "Geoffrey Garen", "email": "ggaren@apple.com", "time": "Sat Jun 13 02:23:04 2026" }, "message": "[Build Speed] Header hygiene: Include What You Use\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d317035\nrdar://179518779\n\nReviewed by Mike Wyrzykowski and Brandon Stewart.\n\nThis prevents surprising build failures when adding / move files, or when the\nCMake adaptive unified build decides to build in \"no bundle\" mode.\n\nCanonical link: https://commits.webkit.org/315160@main\n" }, { "commit": "5ec3ee11b4e748352b0d658bf9e98113a91ed172", "tree": "d1db9abb049b3ca82e76dfe0ff59b191ab6e4df4", "parents": [ "a484a181f9e1dbb3ff49ace9819f4d7f8756c97d" ], "author": { "name": "Per Arne Vollan", "email": "pvollan@apple.com", "time": "Sat Jun 13 01:48:36 2026" }, "committer": { "name": "Per Arne Vollan", "email": "pvollan@apple.com", "time": "Sat Jun 13 01:48:36 2026" }, "message": "Move sandbox extension check related to local file loads from the WebContent process to the Networking process\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d309315\nrdar://171855309\n\nReviewed by Sihui Liu and Darin Adler.\n\nThis patch moves the check from the WebContent process to the Networking process, since the check\nin the WebContent process can be circumvented.\n\nTests: Tools/TestWebKitAPI/Tests/WebKit/WKPage/cocoa/FetchLocalFile.mm\n\n* Source/WTF/wtf/FileSystem.cpp:\n(WTF::FileSystemImpl::removeTrailingSlash):\n(WTF::FileSystemImpl::isAncestor):\n* Source/WTF/wtf/FileSystem.h:\n* Source/WTF/wtf/PlatformEnableCocoa.h:\n* Source/WebKit/NetworkProcess/NetworkProcess.h:\n* Source/WebKit/NetworkProcess/NetworkProcessCreationParameters.h:\n* Source/WebKit/NetworkProcess/NetworkProcessCreationParameters.serialization.in:\n* Source/WebKit/NetworkProcess/NetworkResourceLoadParameters.cpp:\n(WebKit::NetworkResourceLoadParameters::createSandboxExtensionHandlesIfNecessary):\n(WebKit::networkProcessHasAccessViaSandboxExtension): Deleted.\n* Source/WebKit/NetworkProcess/NetworkResourceLoadParameters.h:\n* Source/WebKit/NetworkProcess/NetworkResourceLoader.cpp:\n(WebKit::NetworkResourceLoader::isLocalFileLoadAllowedWithoutSandboxExtension):\n(WebKit::NetworkResourceLoader::startNetworkLoad):\n* Source/WebKit/NetworkProcess/NetworkResourceLoader.h:\n* Source/WebKit/NetworkProcess/cocoa/NetworkProcessCocoa.mm:\n(WebKit::NetworkProcess::platformInitializeNetworkProcessCocoa):\n* Source/WebKit/Shared/WebProcessCreationParameters.h:\n* Source/WebKit/Shared/WebProcessCreationParameters.serialization.in:\n* Source/WebKit/UIProcess/Cocoa/WebProcessPoolCocoa.mm:\n(WebKit::WebProcessPool::platformInitializeWebProcess):\n* Source/WebKit/UIProcess/Network/NetworkProcessProxy.cpp:\n(WebKit::NetworkProcessProxy::sendCreationParametersToNewProcess):\n* Source/WebKit/WebProcess/Network/WebLoaderStrategy.cpp:\n(WebKit::WebLoaderStrategy::scheduleLoadFromNetworkProcess):\n* Source/WebKit/WebProcess/WebProcess.h:\n* Source/WebKit/WebProcess/cocoa/WebProcessCocoa.mm:\n(WebKit::WebProcess::accessibilityFocusedUIElement):\n* Tools/TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:\n* Tools/TestWebKitAPI/Tests/WebKit/WKPage/cocoa/FetchLocalFile.mm:\n(TEST(WebKit, FetchLocalFile)):\n(TEST(WebKit, FetchLocalFileFromTempDirectory)):\n\nCanonical link: https://commits.webkit.org/315159@main\n" }, { "commit": "a484a181f9e1dbb3ff49ace9819f4d7f8756c97d", "tree": "556a92acc6033ee097a53b73450adb44978741b5", "parents": [ "720fc1082286802ee65af48d21b4a5dbac84ef5b" ], "author": { "name": "Justin Michaud", "email": "jmichaud@igalia.com", "time": "Sat Jun 13 01:34:16 2026" }, "committer": { "name": "Justin Michaud", "email": "jmichaud@igalia.com", "time": "Sat Jun 13 01:34:16 2026" }, "message": "Support pleiades on linux\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d316861\n\nReviewed by Yusuke Suzuki.\n\nThis is a small workaround to get pleiades working on linux.\n\nCanonical link: https://commits.webkit.org/315158@main\n" }, { "commit": "720fc1082286802ee65af48d21b4a5dbac84ef5b", "tree": "f149ed55e73b18c87b58ec115906d87b9164c80b", "parents": [ "a0e66562a406842faba3ce1ef40acc671cf0a1f7" ], "author": { "name": "Ahmad Saleem", "email": "ahmad.saleem792+github@gmail.com", "time": "Sat Jun 13 01:27:46 2026" }, "committer": { "name": "Ahmad Saleem", "email": "ahmad.saleem792@gmail.com", "time": "Sat Jun 13 01:27:46 2026" }, "message": "Synthetic bold adds advance width to zero-advance glyphs\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d316951\nrdar://179418570\n\nReviewed by Darin Adler and Brent Fulgham.\n\nThis patch aligns WebKit with Gecko / Firefox and Blink / Chromium.\n\nSynthetic bold padded every glyph\u0027s advance by syntheticBoldOffset()\n(fontSize / 36), including glyphs whose real advance is 0 (combining\nmarks, zero-width spaces, empty/zero-width fonts). A run of such glyphs\nmeasured N * fontSize / 36 wide instead of 0, e.g. a bold heading in a\nzero-advance font reserved a visible gap not present in other engines.\n\nA zero-advance glyph draws in place and must not advance the pen.\nLetter-spacing already guards this with `if (advance.width())`; apply the\nsame guard to synthetic bold in both text paths. The simplified-measuring\npath asserts no synthetic bold, so it needs no change.\n\nTest: css/css-fonts/synthetic-bold-zero-advance-glyph.html\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-fonts/synthetic-bold-zero-advance-glyph-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-fonts/synthetic-bold-zero-advance-glyph.html: Added.\n(WebCore::ComplexTextController::enclosingGlyphBoundsForTextRun):\n* Source/WebCore/platform/graphics/WidthIterator.cpp:\n(WebCore::WidthIterator::applyCSSVisibilityRules):\n\nCanonical link: https://commits.webkit.org/315157@main\n" }, { "commit": "a0e66562a406842faba3ce1ef40acc671cf0a1f7", "tree": "c6190490927967b4eb4323bb044b7201fe947e45", "parents": [ "3a451b677717137eaa41e5831f6372862213d766" ], "author": { "name": "Sammy Gill", "email": "sammy.gill@apple.com", "time": "Sat Jun 13 01:02:16 2026" }, "committer": { "name": "Sammy Gill", "email": "sgill26@apple.com", "time": "Sat Jun 13 01:02:16 2026" }, "message": "[GFC] Layout out-of-flow descendants in the modern grid path\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d316727\nrdar://179129558\n\nReviewed by Alan Baradlay.\n\nOne of the things that we currently bail on when deciding whether or not\nwe can run layout via GFC is if any of the children of the grid are out\nof flow. If we find such a box then we decide that we cannot run GFC.\nOne scenario we currently fail to take into consideration is when some\nout of flow descendant ends up having the grid as the containing block.\nUnfortunately, this results in that box not running layout which means a\ncrash in debug builds due to a dirty render tree at the end of layout\nand blank content in release.\n\nTo fix this we can call back into the old layoutOutOfFlowBoxes API on\nRenderGrid during integration. In order to properly due so we need to\nmake sure the renderer has its columns and rows positions set correctly\nso that it can map any positions the OOF box may have to the correct\nlocation in the grid.\n\nAlso fix the grid container height not being set for the definite block-axis case in\nupdateFormattingContextRootRenderer, which caused positioned descendants to compute\nincorrect containing block sizes since they relied on the renderer\u0027s\nheight. We already did this in the case where the grid had an\nindefinite/intrinsic height but did not when it was fixed.\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-grid/abspos/positioned-grid-descendant-containing-block-001-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-grid/abspos/positioned-grid-descendant-containing-block-001.html: Added.\nOne explicit row and column. Descendant has auto row and column\nplacement with fixed width and height.\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-grid/abspos/positioned-grid-descendant-containing-block-002-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-grid/abspos/positioned-grid-descendant-containing-block-002.html: Added.\nSame as 001 but the descendant is a bit more nested.\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-grid/abspos/positioned-grid-descendant-containing-block-003-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-grid/abspos/positioned-grid-descendant-containing-block-003.html: Added.\nOne explicit row and column. Descendant has auto row and column\nplacement along with percent width and height.\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-grid/abspos/positioned-grid-descendant-containing-block-004-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-grid/abspos/positioned-grid-descendant-containing-block-004.html: Added.\nTwo explicit rows and columns. Descendant has auto row and column\nplacement along with auto width and height. It also has 0 for the top\nand left insets and 100px for the right and bottom insets.\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-grid/abspos/positioned-grid-descendant-containing-block-005-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-grid/abspos/positioned-grid-descendant-containing-block-005.html: Added.\nSame as 004 but 0 for all the insets.\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-grid/abspos/positioned-grid-descendant-containing-block-006-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-grid/abspos/positioned-grid-descendant-containing-block-006.html: Added.\nTwo explicit columns and one explicit row. Descendant has auto row\nplacement with column placement specified as span 2 / span 3. According\nto the spec this should be treated as auto. Also has percent width and\nheight.\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-grid/abspos/positioned-grid-descendant-containing-block-007-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-grid/abspos/positioned-grid-descendant-containing-block-007.html: Added.\nTwo explicit columns and one explicit row. Descendant has auto row\nplacement along with column placement that spans outside the grid which\nshould be treated as auto according to the spec. Also has percent width\nand height.\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-grid/abspos/positioned-grid-descendant-containing-block-008-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-grid/abspos/positioned-grid-descendant-containing-block-008.html: Added.\nOne explicit column and row along with padding on the grid. Descendant\nhas auto row and column placement with percent width and height.\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-grid/abspos/positioned-grid-descendant-containing-block-009-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-grid/abspos/positioned-grid-descendant-containing-block-009.html: Added.\nOne explicit column and row along with padding on the grid. Descendant\nhas explicit row and column placement with percent width and height.\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-grid/abspos/positioned-grid-descendant-containing-block-010-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-grid/abspos/positioned-grid-descendant-containing-block-010.html: Added.\nTwo explicit columns and rows along with padding on the grid. Descendant\nhas explicit placement in the first row and column along with percent\nwidth and height.\n\nTests 011-013 exercise similar to the above but with auto height on the\ngrid.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-grid/abspos/positioned-grid-descendant-containing-block-011-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-grid/abspos/positioned-grid-descendant-containing-block-011.html: Added.\nOne fixed column and row. Descendant has auto rows and columns along\nwith percent width and height.\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-grid/abspos/positioned-grid-descendant-containing-block-012-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-grid/abspos/positioned-grid-descendant-containing-block-012.html: Added.\nOne fixed column and row and padding on the grid. Desendant has auto\nrow and columns with percent width and height.\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-grid/abspos/positioned-grid-descendant-containing-block-013-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-grid/abspos/positioned-grid-descendant-containing-block-013.html: Added.\nTwo fixed rows and columns along with padding. Descendant has explicit\nrow and column position in the first row and column. Also has percent\nwidth and height.\n\nTests 014-016 are similar to above but are testing items that span\nmultiple rows/columns.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-grid/abspos/positioned-grid-descendant-containing-block-014.html: Added.\nTwo fixed row and columns. Descendant is placed in two columns and one\nrow.\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-grid/abspos/positioned-grid-descendant-containing-block-015.html: Added.\nTwo fixed rows and columns. Descendant is placed in one column and two\nrows.\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-grid/abspos/positioned-grid-descendant-containing-block-016.html: Added.\nTwo fixed rows and columns. Descendant is placed in both rows and\ncolumns.\n\nCanonical link: https://commits.webkit.org/315156@main\n" }, { "commit": "3a451b677717137eaa41e5831f6372862213d766", "tree": "76e2f1dd3a1e82e87fabb5255fd244e7cc639dff", "parents": [ "623c0e15657a220517d692c021c36f39f2ae74a5" ], "author": { "name": "Mike Wyrzykowski", "email": "mwyrzykowski@apple.com", "time": "Sat Jun 13 00:58:25 2026" }, "committer": { "name": "Mike Wyrzykowski", "email": "mwyrzykowski@apple.com", "time": "Sat Jun 13 00:58:25 2026" }, "message": "Transforming the camera instead of the model leads to undesirable lighting effects\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d317040\nrdar://179522538\n\nUnreviewed, revert of 312407@main\n\n* Source/WebKit/GPUProcess/graphics/Model/ModelRenderer.swift:\n(ImplicitFragmentInPlace.setBackgroundColor(_:)):\n(ImplicitFragmentInPlace.setCameraTransformForModelTransform(_:)): Deleted.\n* Source/WebKit/GPUProcess/graphics/Model/USDModel.swift:\n(WKBridgeReceiver.meshTransforms):\n(WKBridgeReceiver.modelTransform):\n(render(with:commandBuffer:)):\n(updateMesh(_:)):\n(setTransform(_:)):\n\nCanonical link: https://commits.webkit.org/315155@main\n" }, { "commit": "623c0e15657a220517d692c021c36f39f2ae74a5", "tree": "0533298952a735bde1c5543cb2b631ee9cb002c3", "parents": [ "c9fd2061194516867d04c3219d9dfe078ecdd1cc" ], "author": { "name": "Fady Farag", "email": "com.webkit.iidmsa@gmail.com", "time": "Sat Jun 13 00:22:05 2026" }, "committer": { "name": "Fady Farag", "email": "com.webkit.iidmsa@gmail.com", "time": "Sat Jun 13 00:22:05 2026" }, "message": "Add WebKit logo on `perf.webkit.org`\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d315816\nrdar://178203077\n\nReviewed by Dewei Zhu.\n\nAdopt the refreshed WebKit logo design into the website.\n\n* Websites/perf.webkit.org/public/apple-touch-icon.png: Added.\n* Websites/perf.webkit.org/public/favicon.ico: Added.\n* Websites/perf.webkit.org/public/favicon.png: Added.\n* Websites/perf.webkit.org/public/index.html:\n* Websites/perf.webkit.org/public/v2/index.html:\n* Websites/perf.webkit.org/public/v3/index.html:\n\nCanonical link: https://commits.webkit.org/315154@main\n" }, { "commit": "c9fd2061194516867d04c3219d9dfe078ecdd1cc", "tree": "ad5c634a0a0ffd97c6f1657b35fd6ef261a0f97f", "parents": [ "88998f5c20c9a9ed2363bfa4367581529086f140" ], "author": { "name": "Mike Wyrzykowski", "email": "mwyrzykowski@apple.com", "time": "Fri Jun 12 23:24:49 2026" }, "committer": { "name": "Mike Wyrzykowski", "email": "mwyrzykowski@apple.com", "time": "Fri Jun 12 23:24:49 2026" }, "message": "Unreviewed, build fix after 315139@main\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d317043\nrdar://179524986\n\nUnreviewed, build fix after 315139@main\n\n* Source/WebKit/WebProcess/Model/WebModelPlayer.mm:\n(WebKit::WebModelPlayer::reload):\n\nCanonical link: https://commits.webkit.org/315153@main\n" }, { "commit": "88998f5c20c9a9ed2363bfa4367581529086f140", "tree": "ac668a66df480c202b75442b18ba436d919c5808", "parents": [ "4401bf8b0133fd4f34e2f8f7004daf92fc9ff6db" ], "author": { "name": "Alex Christensen", "email": "achristensen@apple.com", "time": "Fri Jun 12 23:11:31 2026" }, "committer": { "name": "Alex Christensen", "email": "achristensen@apple.com", "time": "Fri Jun 12 23:11:31 2026" }, "message": "Remove WKJSHandle serialization code\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d316953\nrdar://179416806\n\nReviewed by Ryosuke Niwa.\n\n_WKJSHandle was the SPI prototype, and it had serialization code to\nwork with _WKRemoteObjectRegistry to help Safari transition away from\nthe injected bundle SPI. That transition code is no longer needed,\nso remove it. We keep the SPI as just a stub to keep old Safari running\nwith new WebKit.\n\nTests: Tools/TestWebKitAPI/Tests/WebKit/WKWebView/JSHandlePlugIn.mm\n Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolation.mm\n Tools/TestWebKitAPI/Tests/WebKit/WKWebView/TextExtractionTests.mm\n Tools/TestWebKitAPI/Tests/WebKit/WKWebView/WKWebViewSnapshot.mm\n Tools/TestWebKitAPI/Tests/WebKit/WKWebView/WritingTools.mm\n\n* Source/WebKit/UIProcess/API/APIJSHandle.cpp:\n(API::JSHandle::~JSHandle):\n* Source/WebKit/UIProcess/API/APIJSHandle.h:\n* Source/WebKit/UIProcess/API/Cocoa/WKJSHandle.mm:\n(-[WKJSHandle initWithCoder:]): Deleted.\n(-[WKJSHandle encodeWithCoder:]): Deleted.\n(+[_WKJSHandle supportsSecureCoding]):\n(-[_WKJSHandle initWithCoder:]):\n(-[_WKJSHandle encodeWithCoder:]): Deleted.\n* Source/WebKit/UIProcess/API/Cocoa/_WKJSHandle.h:\n* Source/WebKit/WebProcess/InjectedBundle/API/Cocoa/WKWebProcessPlugInFrame.mm:\n(+[WKWebProcessPlugInFrame jsHandleFromValue:withContext:]):\n* Source/WebKit/WebProcess/InjectedBundle/API/Cocoa/WKWebProcessPlugInFramePrivate.h:\n* Tools/TestWebKitAPI/PlatformMac.cmake:\n* Tools/TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/JSHandlePlugIn.mm:\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/JSHandlePlugInProtocol.h: Removed.\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/TextExtractionTests.mm:\n(-[JSHandleReceiver receiveDictionaryFromWebProcess:]): Deleted.\n(TestWebKitAPI::InjectedBundle)):\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/WritingTools.mm:\n\nCanonical link: https://commits.webkit.org/315152@main\n" }, { "commit": "4401bf8b0133fd4f34e2f8f7004daf92fc9ff6db", "tree": "029c4120b5dc8397394b6fc21c145ecbf5165e0c", "parents": [ "67f1900d8045336f14fcfa70940ea97fbb22b6f1" ], "author": { "name": "Yusuke Suzuki", "email": "ysuzuki@apple.com", "time": "Fri Jun 12 23:09:29 2026" }, "committer": { "name": "Yusuke Suzuki", "email": "ysuzuki@apple.com", "time": "Fri Jun 12 23:09:29 2026" }, "message": "[JSC] Reland global liveness MovHint removal\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d316804\nrdar://179252499\n\nReviewed by Yijia Huang.\n\nThe previous attempt at this (295369@main) was reverted because removing\npruneByLiveness from the OSR availability iteration loop caused a bug,\nstale heap entries (whose base nodes have a valid stack flush via PutStackSinking,\nso they no longer need materialization) would accumulate in availabilityAtHead\nand reach FTLs buildExitArguments, where they crash the \"Could not find\nmaterialization\" assertion. That fix needs more work and is left for a\nseparate change.\n\nThis patch only relands the MovHint removal improvement. The phase now\nperforms a global backward liveness analysis instead of the prior\nsingle-successor-walk heuristic.\n\n* Source/JavaScriptCore/dfg/DFGMovHintRemovalPhase.cpp:\n\nCanonical link: https://commits.webkit.org/315151@main\n" }, { "commit": "67f1900d8045336f14fcfa70940ea97fbb22b6f1", "tree": "2db4cb7f43bc62d2b7ee6a46531d87f01990b826", "parents": [ "c39df7216dbe6d88871b5e3ced55096c090ff27c" ], "author": { "name": "Wenson Hsieh", "email": "wenson_hsieh@apple.com", "time": "Fri Jun 12 23:06:19 2026" }, "committer": { "name": "Wenson Hsieh", "email": "wenson_hsieh@apple.com", "time": "Fri Jun 12 23:06:19 2026" }, "message": "[Automatic Password Upgrades] Web process sometimes crashes when mapping stale node ID to JS handle\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d317014\nrdar://179507309\n\nReviewed by Abrar Rahman Protyasha.\n\nAdd a missing null check for the document\u0027s `globalObject`, before attempting to resolve it to a\nnode handle.\n\nTest: TextExtractionTests.RequestJSHandleForNodeInDetachedSubframe\n\n* Source/WebKit/WebProcess/WebPage/WebFrame.cpp:\n(WebKit::createJSHandle):\n(WebKit::WebFrame::createAndPrepareToSendJSHandle const):\n(WebKit::WebFrame::requestJSHandleForExtractedText):\n(WebKit::WebFrame::requestContainerJSHandleForExtractedText):\n(WebKit::WebFrame::requestContainerJSHandleForSearchTexts):\n(WebKit::WebFrame::getNodeForSelectorPaths):\n* Source/WebKit/WebProcess/WebPage/WebFrame.h:\n* Source/WebKit/WebProcess/WebPage/WebPage.cpp:\n(WebKit::WebPage::hitTestAtPoint):\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/TextExtractionTests.mm:\n(TestWebKitAPI::RequestJSHandleForNodeInDetachedSubframe)):\n\nCanonical link: https://commits.webkit.org/315150@main\n" }, { "commit": "c39df7216dbe6d88871b5e3ced55096c090ff27c", "tree": "e88923751dec44edab2e9c1cac5cb15431f8fb90", "parents": [ "9414a9722a8439557c0c3972eec476dc922a1566" ], "author": { "name": "Karl Dubost", "email": "karlcow@apple.com", "time": "Fri Jun 12 23:05:40 2026" }, "committer": { "name": "Karl Dubost", "email": "karlcow@apple.com", "time": "Fri Jun 12 23:05:40 2026" }, "message": "rename rendering/svg/SVGPathData.{h,cpp} to SVGPathFromElement.{h,cpp}\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d316966\nrdar://179478197\n\nReviewed by Nikolas Zimmermann.\n\nThis just renames SVGPathData to SVGPathFromElement to avoid\na name clash when it is time to implement Mixin SVGPathData.\nhttps://w3c.github.io/svgwg/specs/paths/#InterfaceSVGPathData\n\n* Source/WebCore/SaferCPPExpectations/UncheckedLocalVarsCheckerExpectations:\n* Source/WebCore/Sources.txt:\n* Source/WebCore/WebCore.xcodeproj/project.pbxproj:\n* Source/WebCore/rendering/PathOperation.cpp:\n* Source/WebCore/rendering/svg/RenderSVGModelObject.cpp:\n* Source/WebCore/rendering/svg/RenderSVGShape.cpp:\n* Source/WebCore/rendering/svg/RenderSVGTextPath.cpp:\n* Source/WebCore/rendering/svg/SVGPathFromElement.cpp: Renamed from Source/WebCore/rendering/svg/SVGPathData.cpp.\n(WebCore::pathFromCircleElement):\n(WebCore::pathFromEllipseElement):\n(WebCore::pathFromLineElement):\n(WebCore::pathFromPathElement):\n(WebCore::pathFromPolygonElement):\n(WebCore::pathFromPolylineElement):\n(WebCore::pathFromRectElement):\n(WebCore::pathFromUseElement):\n(WebCore::pathFromGraphicsElement):\n* Source/WebCore/rendering/svg/SVGPathFromElement.h: Renamed from Source/WebCore/rendering/svg/SVGPathData.h.\n* Source/WebCore/rendering/svg/legacy/LegacyRenderSVGShape.cpp:\n* Source/WebCore/svg/SVGAnimateMotionElement.cpp:\n* Source/WebCore/svg/SVGGraphicsElement.cpp:\n\nCanonical link: https://commits.webkit.org/315149@main\n" }, { "commit": "9414a9722a8439557c0c3972eec476dc922a1566", "tree": "dc014d9c2f4b1beaff4444dd4e5453cf129d3841", "parents": [ "4705fbbff35e8b996b2b5451f4112f151a2fdd70" ], "author": { "name": "Ryosuke Niwa", "email": "rniwa@webkit.org", "time": "Fri Jun 12 23:04:38 2026" }, "committer": { "name": "Ryosuke Niwa", "email": "rniwa@webkit.org", "time": "Fri Jun 12 23:04:38 2026" }, "message": "REGRESSION: Use-after-free in Node::m_shadowIncludingRoot via destructor cascade not propagating into shadow roots\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d312712\nrdar://175103172\n\nReviewed by Geoffrey Garen.\n\nWhen a document is torn down via Document::removedLastRef through removeDetachedChildrenInContainer,\nthe \u003chtml\u003e element is removed from the document. Since \u003chtml\u003e is still in tree scope at this point,\nnotifyChildNodeRemoved is called, which walks the entire subtree - including shadow roots - and sets\nm_shadowIncludingRoot to \u003chtml\u003e for all descendants. This is correct at that moment.\n\nThen \u003chtml\u003e is freed when the loop\u0027s RefPtr releases it (children don\u0027t ref-count their parents -\nm_parentNode is CheckedPtr). This triggers a destructor cascade: ~ContainerNode(\u003chtml\u003e) via\nremoveDetachedChildrenInContainer(\u003chtml\u003e) processes \u003cbody\u003e, then ~ContainerNode(\u003cbody\u003e) processes\nthe \u003cvideo\u003e element, and so on. Each step calls resetShadowIncludingRoot() on the direct child,\nfixing that node\u0027s cache. However, since IsConnected and IsInShadowTree flags were cleared during\nthe initial notifyChildNodeRemoved walk, isInTreeScope() returns false, so notifyChildNodeRemoved\nis skipped in this case. This means the shadow root and its descendants are never updated -\nm_shadowIncludingRoot of these nodes still point to the now-freed \u003chtml\u003e.\n\nNodes kept alive by mechanisms other than JS wrappers - such as HTMLMediaElement which survives as\nan ActiveDOMObject - retain their shadow DOM with dangling m_shadowIncludingRoot pointers. When\nthese nodes are subsequently used (e.g., VTT cue display tree updates via an event loop task), the\nstale pointer is dereferenced, causing an use-after-free.\n\nThis PR fixes this use-after-free bug by updating m_shadowIncludingRoot for removed subtrees when\nthe root\u0027s refCount is greater than 1 (i.e. there is an external reference to the node beyond the\nRefPtr in removeDetachedChildrenInContainer).\n\nNo new tests since existing media tests such as media/track/webvtt-parser-does-not-leak.html would\nhit debug assertions without this fix, and this bug requires a node to be kept alive by C++ code.\n\n* Source/WebCore/dom/ContainerNodeAlgorithms.cpp:\n(WebCore::removeDetachedChildrenInContainer):\n* Source/WebCore/dom/Node.cpp:\n(WebCore::Node::updateShadowIncludingRootForSubtree):\n* Source/WebCore/dom/Node.h:\n\nOriginally-landed-as: 305413.700@safari-7624-branch (5d07bda85f02). rdar://176059252\nCanonical link: https://commits.webkit.org/315148@main\n" }, { "commit": "4705fbbff35e8b996b2b5451f4112f151a2fdd70", "tree": "72c42730bfd1df7255bd7f09cb77b7cd6215c726", "parents": [ "6edbf3f983bd75b1ca65ebecdf0c812b404b48d5" ], "author": { "name": "Brent Fulgham", "email": "bfulgham@apple.com", "time": "Fri Jun 12 23:03:59 2026" }, "committer": { "name": "Brent Fulgham", "email": "bfulgham@webkit.org", "time": "Fri Jun 12 23:03:59 2026" }, "message": "Split JSDOMWindow.cpp into smaller bits to improve build parallelism\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d316818\nrdar://179292668\n\nReviewed by Geoffrey Garen.\n\nOne a decent M2 Ultra build, JSDOMWindow.cpp is taking roughly 40 seconds to compile. This\nis happening at the tail end of the WebCore step of the build, and is blocking linking and\nfurther build steps from starting. This represents ~17 seconds of wasted time since only a\nsingle core is working, and other tasks are blocked.\n\nWe can improve matters by splitting this single large compilation unit into smaller pieces\nthat can build in parallel.\n\nThis change shortened overall build time be ~75 seconds on a local build since more\npost-WebCore work was able to start earlier.\n\n* Source/WebCore/CMakeLists.txt:\n* Source/WebCore/DerivedSources-output.xcfilelist:\n* Source/WebCore/Sources.txt:\n* Source/WebCore/WebCore.xcodeproj/project.pbxproj:\n* Source/WebCore/WebCoreMacros.cmake:\n* Source/WebCore/bindings/scripts/CodeGenerator.pm:\n(new):\n(IgnoreStandaloneConstructorAttributes):\n* Source/WebCore/bindings/scripts/CodeGeneratorJS.pm:\n(AddToImplIncludes):\n(AddToAuxImplIncludes):\n(UseStandaloneConstructorAttributes):\n(GenerateRuntimeEnableConditionalString):\n(GenerateAttributeGetterAndSetterDeclaration):\n(GenerateAttributeGetterDefinition):\n(WriteData):\n* Source/WebCore/bindings/scripts/IDLAttributes.json:\n* Source/WebCore/bindings/scripts/generate-bindings-all.pl:\n(spawnGenerateBindingsIfNeeded):\n* Source/WebCore/bindings/scripts/generate-bindings.pl:\n(generateBindings):\n* Source/WebCore/bindings/scripts/test/DOMWindow.idl:\n* Source/WebCore/bindings/scripts/test/JS/JSDOMWindow.cpp:\n(WebCore::JSDOMWindowDOMConstructor::prototypeForStructure):\n(WebCore::jsDOMWindow_DOMWindowConstructorGetter): Deleted.\n(WebCore::jsDOMWindow_ExposedStarConstructorGetter): Deleted.\n(WebCore::jsDOMWindow_ExposedToWorkerAndWindowConstructorGetter): Deleted.\n(WebCore::jsDOMWindow_TestConditionalConstructorGetter): Deleted.\n(WebCore::jsDOMWindow_TestConditionalIncludesConstructorGetter): Deleted.\n(WebCore::jsDOMWindow_TestConditionallyReadWriteConstructorGetter): Deleted.\n(WebCore::jsDOMWindow_TestDefaultToJSONConstructorGetter): Deleted.\n(WebCore::jsDOMWindow_TestDefaultToJSONFilteredByExposedConstructorGetter): Deleted.\n(WebCore::jsDOMWindow_TestEnabledBySettingConstructorGetter): Deleted.\n(WebCore::jsDOMWindow_TestEnabledForContextConstructorGetter): Deleted.\n(WebCore::jsDOMWindow_TestInterfaceConstructorGetter): Deleted.\n(WebCore::jsDOMWindow_TestNodeConstructorGetter): Deleted.\n(WebCore::jsDOMWindow_TestObjectConstructorGetter): Deleted.\n(WebCore::jsDOMWindow_TestPromiseRejectionEventConstructorGetter): Deleted.\n* Source/WebCore/bindings/scripts/test/JS/JSDOMWindowConstructorAttributes.cpp: Added.\n(WebCore::jsDOMWindow_DOMWindowConstructorGetter):\n(WebCore::JSC_DEFINE_CUSTOM_GETTER):\n(WebCore::jsDOMWindow_ExposedStarConstructorGetter):\n(WebCore::jsDOMWindow_ExposedToWorkerAndWindowConstructorGetter):\n(WebCore::jsDOMWindow_TestConditionalConstructorGetter):\n(WebCore::jsDOMWindow_TestConditionalIncludesConstructorGetter):\n(WebCore::jsDOMWindow_TestConditionallyReadWriteConstructorGetter):\n(WebCore::jsDOMWindow_TestDefaultToJSONConstructorGetter):\n(WebCore::jsDOMWindow_TestDefaultToJSONFilteredByExposedConstructorGetter):\n(WebCore::jsDOMWindow_TestEnabledBySettingConstructorGetter):\n(WebCore::jsDOMWindow_TestEnabledForContextConstructorGetter):\n(WebCore::jsDOMWindow_TestInterfaceConstructorGetter):\n(WebCore::jsDOMWindow_TestNodeConstructorGetter):\n(WebCore::jsDOMWindow_TestObjectConstructorGetter):\n(WebCore::jsDOMWindow_TestPromiseRejectionEventConstructorGetter):\n* Source/WebCore/bindings/scripts/test/JS/JSTestEnabledForContext.cpp:\n* Source/WebCore/page/DOMWindow.idl:\n\nCanonical link: https://commits.webkit.org/315147@main\n" }, { "commit": "6edbf3f983bd75b1ca65ebecdf0c812b404b48d5", "tree": "bbef9dc3c48418a2d0464ca8a434342c7d393168", "parents": [ "7f60f0c0ee1d8d2594f04fca8b875305409a7e33" ], "author": { "name": "Karl Dubost", "email": "karlcow@apple.com", "time": "Fri Jun 12 22:52:39 2026" }, "committer": { "name": "Karl Dubost", "email": "karlcow@apple.com", "time": "Fri Jun 12 22:52:39 2026" }, "message": "Differential text-alignment while stretching\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d61855\nrdar://94161279\n\nReviewed by Nikolas Zimmermann.\n\nWhen an SVG \u003ctext\u003e or \u003ctspan\u003e carries a list-valued x or y attribute,\nWebKit splits its content into one chunk per listed value. Each\nSVGTextChunk independently carried the element\u0027s textLength and applied\nlengthAdjust\u003d\"spacingAndGlyphs\" on its own, so every glyph was scaled to\nfill the full target length — the glyphs piled up on top of each other\nand rendered as a horizontal black bar.\n\nFirefox and Chrome render it correctly.\n\nSVG 2 §11.10 scopes textLength to \"this element\": \"the adjustments on\nall character data within this element are controlled by the value of\n\u0027textLength\u0027 on this element exclusively\". Apply\nlengthAdjust\u003d\"spacingAndGlyphs\" once across the group of chunks that\nshare an owning text content element: compute one scale and one pivot\nover the group, write a single transform to every box in every chunk,\nand skip per-chunk textLength application for the group. Single-chunk\nelements (the common case) keep the existing fast path unchanged.\n\nThree related cases remain unhandled and are pinned with FIXME + WPT:\n* lengthAdjust\u003d\"spacing\" with list-valued x/y,\n* nested \u003ctspan textLength\u003e inside \u003ctext textLength\u003e,\n* and the inline-size / forced-line-break guards that per §11.10 disable\n textLength entirely.\n\nTests: imported/w3c/web-platform-tests/svg/text/reftests/textLength-list-x-spacingAndGlyphs-expected.svg\n imported/w3c/web-platform-tests/svg/text/reftests/textLength-list-x-spacingAndGlyphs-ref.svg\n imported/w3c/web-platform-tests/svg/text/reftests/textLength-list-x-spacingAndGlyphs.svg\n imported/w3c/web-platform-tests/svg/text/reftests/textLength-list-y-spacing-expected.svg\n imported/w3c/web-platform-tests/svg/text/reftests/textLength-list-y-spacing-ref.svg\n imported/w3c/web-platform-tests/svg/text/reftests/textLength-list-y-spacing.svg\n imported/w3c/web-platform-tests/svg/text/reftests/textLength-list-y-spacingAndGlyphs-expected.svg\n imported/w3c/web-platform-tests/svg/text/reftests/textLength-list-y-spacingAndGlyphs-ref.svg\n imported/w3c/web-platform-tests/svg/text/reftests/textLength-list-y-spacingAndGlyphs.svg\n\n* LayoutTests/TestExpectations:\n* LayoutTests/imported/w3c/web-platform-tests/svg/text/reftests/textLength-list-x-spacingAndGlyphs-expected.svg: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/text/reftests/textLength-list-x-spacingAndGlyphs-ref.svg: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/text/reftests/textLength-list-x-spacingAndGlyphs.svg: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/text/reftests/textLength-list-y-spacing-expected.svg: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/text/reftests/textLength-list-y-spacing-ref.svg: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/text/reftests/textLength-list-y-spacing.svg: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/text/reftests/textLength-list-y-spacingAndGlyphs-expected.svg: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/text/reftests/textLength-list-y-spacingAndGlyphs-ref.svg: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/text/reftests/textLength-list-y-spacingAndGlyphs.svg: Added.\n* Source/WebCore/rendering/svg/SVGTextChunk.cpp:\n(WebCore::SVGTextChunk::SVGTextChunk):\n(WebCore::SVGTextChunk::layout const):\n* Source/WebCore/rendering/svg/SVGTextChunk.h:\n* Source/WebCore/rendering/svg/SVGTextChunkBuilder.cpp:\n(WebCore::SVGTextChunkBuilder::layoutTextChunks):\n(WebCore::SVGTextChunkBuilder::applyElementLevelTextLength):\n* Source/WebCore/rendering/svg/SVGTextChunkBuilder.h:\n\nCanonical link: https://commits.webkit.org/315146@main\n" }, { "commit": "7f60f0c0ee1d8d2594f04fca8b875305409a7e33", "tree": "90de519ec7806cf027a3a3f214ffccc09cc5f194", "parents": [ "adb3736972fd2ba8dab6ad3de8dc6a0c0406f4be" ], "author": { "name": "Keith Miller", "email": "keith_miller@apple.com", "time": "Fri Jun 12 22:47:29 2026" }, "committer": { "name": "Keith Miller", "email": "keith_miller@apple.com", "time": "Fri Jun 12 22:47:29 2026" }, "message": "[JSC] Remove extra prints from JSTests\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d317027\nrdar://179512404\n\nReviewed by Yusuke Suzuki and Brandon Stewart.\n\nCanonical link: https://commits.webkit.org/315145@main\n" }, { "commit": "adb3736972fd2ba8dab6ad3de8dc6a0c0406f4be", "tree": "920c51eed29998d5ae8b625a87d55c92dd832045", "parents": [ "0ac4fe29c728f3a1e8de18ffeac88c3b18c6d40a" ], "author": { "name": "Vassili Bykov", "email": "v_bykov@apple.com", "time": "Fri Jun 12 22:33:53 2026" }, "committer": { "name": "Vassili Bykov", "email": "v_bykov@apple.com", "time": "Fri Jun 12 22:33:53 2026" }, "message": "Mark myself (ast-hugger) as a reviewer\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d317024\nrdar://179510585\n\nReviewed by Dan Hecht, Keith Miller, and Pascoe.\n\nUpdating my status after receiving the approval.\n\n* metadata/contributors.json:\n\nCanonical link: https://commits.webkit.org/315144@main\n" }, { "commit": "0ac4fe29c728f3a1e8de18ffeac88c3b18c6d40a", "tree": "7ee1d10646511d354fea66a9e48000071eb7b5bc", "parents": [ "c7fe05eb98f63f711766aa2822520c8557a1f404" ], "author": { "name": "Jonathan Bedard", "email": "jbedard@apple.com", "time": "Fri Jun 12 22:22:13 2026" }, "committer": { "name": "Jonathan Bedard", "email": "jbedard@apple.com", "time": "Fri Jun 12 22:22:13 2026" }, "message": "Exclude glib from Apple builds\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d317033\nrdar://179518299\n\nReviewed by Ryan Haddad.\n\n* .submitproject-append:\n\nCanonical link: https://commits.webkit.org/315143@main\n" }, { "commit": "c7fe05eb98f63f711766aa2822520c8557a1f404", "tree": "13bdbaaae0a904a155f3dbec36fc34cb3f9e21e0", "parents": [ "d32378b4f5840ea927aaa9ac15f1811fdbb1e8a4" ], "author": { "name": "Kai Tamkun", "email": "k_tamkun@apple.com", "time": "Fri Jun 12 21:52:40 2026" }, "committer": { "name": "Kai Tamkun", "email": "k_tamkun@apple.com", "time": "Fri Jun 12 21:52:40 2026" }, "message": "[JSC] ToBoolean/TypeOfIsUndefined/TypeOfIsFunction/TypeOf/CompareEq def value in DFGClobberize doesn\u0027t depend on node\u0027s origin.semantic\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d311663\nrdar://173924142\n\nReviewed by Marcus Plutowski.\n\nThe semantics of operations like `typeof` are realm-dependent when the input has the\n`MasqueradesAsUndefined` flag set. This patch prevents constant folding of these\nexpressions if they have different realms to preserve the semantics.\n\nAdded regress-173924142.js to ensure that the operations behave as expected even across realms.\n\n* JSTests/stress/regress-173924142.js: Added.\n(assert):\n(otherGlobal.eval.returnMultipleValues):\n(returnMultipleValues):\n(i.returnMultipleValues):\n(otherGlobalMasqueraderAfter.const.property.of.Object.getOwnPropertyNames):\n* Source/JavaScriptCore/dfg/DFGClobberize.h:\n(JSC::DFG::clobberize):\n\nOriginally-landed-as: 305413.657@rapid/safari-7624.2.5.110-branch (882fc55c5e17). rdar://176058724\nCanonical link: https://commits.webkit.org/315142@main\n" }, { "commit": "d32378b4f5840ea927aaa9ac15f1811fdbb1e8a4", "tree": "ded5a34723107243cb343ff7c970e7e46bbe35d2", "parents": [ "98f8025ff153e48d4d98f10eff44cf462b079ce2" ], "author": { "name": "Sihui Liu", "email": "sihui_liu@apple.com", "time": "Fri Jun 12 21:45:37 2026" }, "committer": { "name": "Sihui Liu", "email": "sihui_liu@apple.com", "time": "Fri Jun 12 21:45:37 2026" }, "message": "[Site Isolation] Multiple layout tests are crashing due to assertion failure: frame-\u003epage() \u003d\u003d this\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d316417\nrdar://178830885\n\nReviewed by Charlie Wolfe.\n\nUnder Site Isolation, frames of the same page can be hosted in different processes and frame state updates are async:\nweb process hosting the frame \u003d\u003e UI process \u003d\u003e other web processes hosting the same frame remotely.\nThere is a race where a web process detaches a frame locally before handling an in-flight state update message from\nanother process. For example, the process hosting the parent frame removes an iframe element via JavaScript (e.g.\ndocument.write()), which detaches the frame synchronously — but UIProcess has already forwarded a state update for that\nframe, which arrives after the detach. In this case it is safe to ignore the update, since the frame will be destroyed\nsoon.\n\nReplace ASSERT(frame-\u003epage() \u003d\u003d this) with early returns to handle this race. The exception is\nframeWasRemovedInAnotherProcess, where markAsRemovedInAnotherProcess() must still run unconditionally to prevent a\nspurious DidDestroyFrame from being sent to UIProcess when the frame is later destroyed locally.\n\n* Source/WebKit/WebProcess/WebPage/WebPage.cpp:\n(WebKit::WebPage::didFinishLoadInAnotherProcess):\n(WebKit::WebPage::frameWasRemovedInAnotherProcess):\n(WebKit::WebPage::allFrameTreeSyncDataChangedInAnotherProcess):\n(WebKit::WebPage::createProvisionalFrame):\n(WebKit::WebPage::loadDidCommitInAnotherProcess):\n\nCanonical link: https://commits.webkit.org/315141@main\n" }, { "commit": "98f8025ff153e48d4d98f10eff44cf462b079ce2", "tree": "c17472cd7f68722738ae76ea0e280f290ecdded4", "parents": [ "0ff66663ddfcbc432925828ff2cd0522a22fb5de" ], "author": { "name": "Brandon Stewart", "email": "brandonstewart@apple.com", "time": "Fri Jun 12 21:41:49 2026" }, "committer": { "name": "Brandon Stewart", "email": "brandonstewart@apple.com", "time": "Fri Jun 12 21:41:49 2026" }, "message": "[css-grid] Import css/css-grid WPT tests 2026-06-12\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d316999\nrdar://179498013\n\nReviewed by Alan Baradlay.\n\nRe-import the css/css-grid web-platform-tests suite from upstream. This\nrefreshes 2013 tests (1360 reftests, 624 JS, 29 crash, 29 pixel/manual)\nagainst the latest upstream revision: it adds new subgrid gap and\ntrack-sizing coverage plus a grid-repeat out-of-bounds crash test, and\nmigrates two extra-margin references from XHTML to HTML.\n\nFour newly imported/updated subgridded-to-grid-lanes reftests fail with\nsmall reference image diffs (~1-2%) and are marked ImageOnlyFailure\nunder the existing tracking bug webkit.org/b/316453:\n - gap/column-subgrid-grid-gap-015.html\n - gap/row-subgrid-grid-gap-015.html\n - track-sizing/column-subgrid-extra-margin-005.html\n - track-sizing/row-subgrid-extra-margin-005.html\n\nUpstream commit: https://github.com/web-platform-tests/wpt/commit/d8a8414e5baa2d680a4f57d40fa3aa01dffcf7aa\n\nCanonical link: https://commits.webkit.org/315140@main\n" }, { "commit": "0ff66663ddfcbc432925828ff2cd0522a22fb5de", "tree": "8a77090e35f04dd49cb322f680b35f01ad73203c", "parents": [ "57942aeaf17b188b5a02a73cc2e05d5697a10ba9" ], "author": { "name": "Jean Haberer", "email": "jean.haberer@apple.com", "time": "Fri Jun 12 21:39:32 2026" }, "committer": { "name": "Jean Haberer", "email": "jean.haberer@apple.com", "time": "Fri Jun 12 21:39:32 2026" }, "message": "Increase memory limit for immersive models\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d316994\nrdar://171065710\n\nReviewed by Mike Wyrzykowski.\n\nReload the entity at a higher memory limit when entering immersive\npresentation, and back at the standard limit on exit.\n\n* Source/WebCore/Modules/model-element/HTMLModelElement.cpp:\n* Source/WebCore/Modules/model-element/ModelPlayer.h:\n* Source/WebCore/Modules/model-element/PlaceholderModelPlayer.cpp:\n* Source/WebCore/Modules/model-element/PlaceholderModelPlayer.h:\n* Source/WebCore/Modules/model-element/dummy/DummyModelPlayer.cpp:\n* Source/WebCore/Modules/model-element/dummy/DummyModelPlayer.h:\n* Source/WebKit/WebProcess/Model/ModelProcessModelPlayer.cpp:\n* Source/WebKit/WebProcess/Model/ModelProcessModelPlayer.h:\n* Source/WebKit/WebProcess/Model/WebModelPlayer.h:\n* Source/WebKit/WebProcess/Model/WebModelPlayer.mm:\nPlumb the signal that informs the model process of the initial immersive\npresentation state for the first load of the model.\n\n* Source/WebKit/ModelProcess/ModelConnectionToWebProcess.cpp:\n* Source/WebKit/ModelProcess/ModelConnectionToWebProcess.h:\n* Source/WebKit/ModelProcess/ModelProcess.cpp:\n* Source/WebKit/ModelProcess/ModelProcess.h:\n* Source/WebKit/ModelProcess/ModelProcessCreationParameters.h:\n* Source/WebKit/ModelProcess/ModelProcessCreationParameters.serialization.in:\n* Source/WebKit/ModelProcess/ModelProcessModelPlayerManagerProxy.cpp:\n* Source/WebKit/UIProcess/Model/cocoa/ModelProcessProxyCocoa.mm:\nAdd the debug default for the immersive memory limit.\n\n* Source/WebKit/ModelProcess/cocoa/ModelProcessModelPlayerProxy.h:\n* Source/WebKit/ModelProcess/cocoa/ModelProcessModelPlayerProxy.messages.in:\n* Source/WebKit/ModelProcess/cocoa/ModelProcessModelPlayerProxy.mm:\nAdd the logic that unloads and reloads the entity with the right\nmemory limit if needed.\n\nCanonical link: https://commits.webkit.org/315139@main\n" }, { "commit": "57942aeaf17b188b5a02a73cc2e05d5697a10ba9", "tree": "69632d06c3a8f22217e0d67934cf95699edc6d53", "parents": [ "29b8b63ffbbe6f9d33fb5f474d4029f08b58217e" ], "author": { "name": "Zak Ridouh", "email": "zakr@apple.com", "time": "Fri Jun 12 21:19:14 2026" }, "committer": { "name": "Zak Ridouh", "email": "zakr@apple.com", "time": "Fri Jun 12 21:19:14 2026" }, "message": "[Site Isolation] BlurFocusedElement is broken when the focused element is inside a cross-origin iframe on iOS\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d310061\nrdar://172704039\n\nReviewed by Abrar Rahman Protyasha.\n\nblurFocusedElement() sends the BlurFocusedElement IPC message to\nlegacyMainFrameProcess(), which is the wrong process when the focused\nelement lives in a site-isolated cross-origin iframe.\n\nPass the focused element\u0027s frame identifier through to\nsendToProcessContainingFrame(), matching the pattern already used by\nSetFocusedElementValue, SetFocusedElementSelectedIndex, and\nSetSelectElementIsOpen.\n\n* LayoutTests/http/tests/site-isolation/blur-focused-element-cross-origin-iframe-expected.txt: Added.\n* LayoutTests/http/tests/site-isolation/blur-focused-element-cross-origin-iframe.html: Added.\n* LayoutTests/http/tests/site-isolation/resources/blur-input-iframe.html: Added.\n* Source/WebKit/UIProcess/WebPageProxy.cpp:\n* Source/WebKit/UIProcess/WebPageProxy.h:\n* Source/WebKit/UIProcess/ios/WKContentViewInteraction.mm:\n(-[WKContentView endEditingAndUpdateFocusAppearanceWithReason:]):\n(-[WKContentView focusedFormControlViewDidSubmit:]):\n(-[WKContentView focusedFormControlViewDidCancel:]):\n(-[WKContentView dismissQuickboardViewControllerAndRevealFocusedFormOverlayIfNecessary:]):\n* Source/WebKit/UIProcess/ios/WebPageProxyIOS.mm:\n(WebKit::WebPageProxy::blurFocusedElement):\n\nCanonical link: https://commits.webkit.org/315138@main\n" }, { "commit": "29b8b63ffbbe6f9d33fb5f474d4029f08b58217e", "tree": "5885acaf2f200161dfeba8f039f1954d0c0e7649", "parents": [ "0ea898a2ff9f4b6605ffaf93891267858f1b5e71" ], "author": { "name": "Zak Ridouh", "email": "zakr@apple.com", "time": "Fri Jun 12 21:14:16 2026" }, "committer": { "name": "Zak Ridouh", "email": "zakr@apple.com", "time": "Fri Jun 12 21:14:16 2026" }, "message": "[Site Isolation] Remove now passing page-cache tests from Test Expectations\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d316937\nrdar://179405847\n\nReviewed by Alex Christensen.\n\nThese back/forward-cache tests now pass under site isolation; remove their\nstale [ Failure ] entries from the mac and iOS site-isolation expectations.\n\n* LayoutTests/platform/ios-site-isolation/TestExpectations:\n* LayoutTests/platform/mac-site-isolation/TestExpectations:\n\nCanonical link: https://commits.webkit.org/315137@main\n" }, { "commit": "0ea898a2ff9f4b6605ffaf93891267858f1b5e71", "tree": "06e25f22e48c11d5c9770780c4790b8e900f05b8", "parents": [ "b0c4b5139e34076a28ee6d9b59ba5cf0871e22a4" ], "author": { "name": "Yulun Wu", "email": "yulun_wu@apple.com", "time": "Fri Jun 12 20:56:31 2026" }, "committer": { "name": "Yulun Wu", "email": "yulun_wu@apple.com", "time": "Fri Jun 12 20:56:31 2026" }, "message": "[GFC] Grid items ignore row-gap/column-gap\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d316923\n\u003crdar://179385621\u003e\n\nReviewed by Sammy Gill.\n\nThis PR fixes two off by one errors that caused grid items to be mispositioned\nand/or oversized with row/column gap set.\n\ncomputeGridLinePosition accumulates grid track sizes and grid gaps up to line X\nand should include X gutters, not x-1 gutters.\n\ngridAreaDimensionSize from grid lines start to end was incorrectly counting\nspan (end - start) gutters when it should be counting span - 1 gutters.\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-grid/alignment/grid-gutters-explicit-placement-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-grid/alignment/grid-gutters-explicit-placement.html: Added.\n* Source/WebCore/layout/formattingContexts/grid/GridLayoutUtils.cpp:\n(WebCore::Layout::GridLayoutUtils::computeGridLinePosition):\n(WebCore::Layout::GridLayoutUtils::gridAreaDimensionSize):\n\nCanonical link: https://commits.webkit.org/315136@main\n" }, { "commit": "b0c4b5139e34076a28ee6d9b59ba5cf0871e22a4", "tree": "e6ff337c0238706ac686eff71231ff43aa96a193", "parents": [ "23df7d03b8f7f9bbff942638be9b54f2631266fb" ], "author": { "name": "Keith Miller", "email": "keith_miller@apple.com", "time": "Fri Jun 12 20:51:20 2026" }, "committer": { "name": "Keith Miller", "email": "keith_miller@apple.com", "time": "Fri Jun 12 20:51:20 2026" }, "message": "[CMake] LowLevelInterpreterLib shouldn\u0027t serialize with the rest of JSC\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d316869\nrdar://179296313\n\nReviewed by Geoffrey Garen.\n\nEvery JavaScriptCore translation unit was waiting for LLIntAssembly.h\ngeneration before it could begin compiling, even though only\nLowLevelInterpreter.cpp uses the header.\n\nThe serialization came from two CMake behaviors combining:\n\n1. LLIntAssembly.h was listed as a source of LowLevelInterpreterLib,\n which put it into the target\u0027s compile-ordering phony.\n2. Consuming the target as $\u003cTARGET_OBJECTS:...\u003e propagated that\n phony as an order-only dependency to JavaScriptCore\u0027s compile-\n ordering phony, which all of its unified sources transitively\n depend on.\n\nInstead of adding LowLevelInterpreterLib as a SOURCE link against the\nobject file as a PRIVATE_LIBRARY by name. LowLevelInterpreter.cpp.o\nstill has a direct file-level dependency on LLIntAssembly.h, but no\npropagation reaches JavaScriptCore, so unified sources can compile in\nparallel with offlineasm.\n\nCanonical link: https://commits.webkit.org/315135@main\n" }, { "commit": "23df7d03b8f7f9bbff942638be9b54f2631266fb", "tree": "720a17b82a82f56ad11b4974b36fb32f6e2b7424", "parents": [ "c329236d6f8eb05d72d0aa0d262fbac2b4cb602d" ], "author": { "name": "Sammy Gill", "email": "sammy.gill@apple.com", "time": "Fri Jun 12 20:43:05 2026" }, "committer": { "name": "Sammy Gill", "email": "sgill26@apple.com", "time": "Fri Jun 12 20:43:05 2026" }, "message": "amazon.design: bottom of navigation menu is clipped on devices with certain viewports\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d306649\nrdar://169307770\n\nReviewed by Brent Fulgham.\n\nOn certain types of iOS devices, particularly Pro Max phones,\nthe bottom portion of the navigation menu gets obscured by Safari\u0027s navigation\ntoolbar. The page\u0027s navigation bar content is a flex item with margin-top:\nauto inside a flexbox that has a height based off 100vh. It seems likes\nthere are some offests that are subtracted from the 100vh in an attempt\nto make sure the content is placed correctly since the auto top margin\npushes the content to the bottom.\n\nHowever, it does not seem like this is enough since on the aforementioned\ndevices the bottom of the \"Amazon Log In,\" text ends up getting hidden by\nSafari\u0027s toolbar. The reason is does not seem to reproduce on Pro devices\nis because those devices have a narrower viewport and second line is\ncreated after the log in text. This line is created because there is a\nSVG that appears after the text that does not fit on the line. That\npushes the \"Amazon Log In,\" text a bit up and what ends up happening is\nthe SVG ends up getting clicked. In fact, if you set the viewport\ndimensions to the same dimensions as a Pro device on other browsers you\nend up getting the same layout. However, it does not become visible\nuntil you hover over the text so for the purposes of this targeted fix\nit is probably ok.\n\nTo fix this we can apply a quirk that forces the flexbox that contains\nthe navigation bar content to use 100dvh, which takes into\nconvisderation the space taken up by Safari\u0027s navigation bar, instead of\n100vh.\n\nCanonical link: https://commits.webkit.org/315134@main\n" }, { "commit": "c329236d6f8eb05d72d0aa0d262fbac2b4cb602d", "tree": "a1cbaf1de1a67a1fbcc5f05772d986b18d7d3cbd", "parents": [ "eb36fe1d6447d973bb1d112b745f74a0bb000a83" ], "author": { "name": "Ahmad Saleem", "email": "ahmad.saleem792+github@gmail.com", "time": "Fri Jun 12 20:31:52 2026" }, "committer": { "name": "Ahmad Saleem", "email": "ahmad.saleem792@gmail.com", "time": "Fri Jun 12 20:31:52 2026" }, "message": "SVGFEConvolveMatrixElement should reject invalid order attribute values\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d304107\nrdar://166438611\n\nReviewed by Taher Ali.\n\nThis patch aligns WebKit with Gecko / Firefox and Blink / Chromium.\n\nWhen the order attribute is set to an invalid value (e.g., negative numbers\nor zero), the orderX and orderY SVG DOM getters return the initial value of 3\nper WPT, rather than the invalid parsed value. But the filter must still fail\nto render — otherwise an invalid order combined with a matching kernelMatrix\nlength would paint as if valid (e.g. order\u003d\"-3\" with a 9-element kernelMatrix\nwould otherwise succeed as order\u003d\"3\").\n\nTo satisfy both requirements, track the invalid state via a new\nm_hasInvalidOrderAttribute flag, set when parsing produces a value \u003c 1 and\ncleared on a valid update. The DOM getters still report 3, while\ncreateFilterEffect checks the flag and returns an empty IntSize so filter\ncreation fails.\n\nNote: when a CSS filter reference fails, HTML elements still paint without\nthe filter (only SVG elements are suppressed via hasFailedFilterForSVG).\nThat discrepancy is pre-existing and out of scope for this patch.\n\n* Source/WebCore/svg/SVGFEConvolveMatrixElement.cpp:\n(WebCore::SVGFEConvolveMatrixElement::attributeChanged):\n(WebCore::SVGFEConvolveMatrixElement::createFilterEffect const):\n* Source/WebCore/svg/SVGFEConvolveMatrixElement.h:\n* LayoutTests/imported/w3c/web-platform-tests/svg/types/scripted/SVGAnimatedInteger-expected.txt: Progression\n\nCanonical link: https://commits.webkit.org/315133@main\n" }, { "commit": "eb36fe1d6447d973bb1d112b745f74a0bb000a83", "tree": "65bd02bd0432b57f6f6fa6eb262542da466da518", "parents": [ "af4ee67f24a3659185165c90ab8915826e65daf9" ], "author": { "name": "Marta Darbinyan", "email": "darbinyan@apple.com", "time": "Fri Jun 12 20:30:59 2026" }, "committer": { "name": "Marta Darbinyan", "email": "darbinyan@apple.com", "time": "Fri Jun 12 20:30:59 2026" }, "message": "Unreviewed, reverting 315121@main (844ebfeb1d99)\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d317025\nrdar://179511043\n\nBroke iOS builds on main\n\nReverted change:\n\n Delegated Apple Pay: Move HAVE_PASSKIT_DELEGATED_REQUEST to WebKit\n https://bugs.webkit.org/show_bug.cgi?id\u003d315564\n rdar://165837621\n 315121@main (844ebfeb1d99)\n\nCanonical link: https://commits.webkit.org/315132@main\n" }, { "commit": "af4ee67f24a3659185165c90ab8915826e65daf9", "tree": "ebab5a94e0d7a97b6be5efddb034c15f2514db2a", "parents": [ "54ff85f6c8e4ffbb9264630bb107c8fafe4086be" ], "author": { "name": "Marta Darbinyan", "email": "darbinyan@apple.com", "time": "Fri Jun 12 20:26:24 2026" }, "committer": { "name": "Marta Darbinyan", "email": "darbinyan@apple.com", "time": "Fri Jun 12 20:26:24 2026" }, "message": "[Gardening]: REGRESSION(315022@main): [iOS macOS] imported/w3c/web-platform-tests/largest-contentful-paint/multiple-redirects-TAO.html is a flaky failure\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d317017\nrdar://179508696\n\nUnreviewed test gardening\n\n* LayoutTests/TestExpectations:\n\nCanonical link: https://commits.webkit.org/315131@main\n" }, { "commit": "54ff85f6c8e4ffbb9264630bb107c8fafe4086be", "tree": "9daf2dcf1bfd740592929392c9bf09c628a7284e", "parents": [ "a6f42da10166a940ded9fdaa2018012470362516" ], "author": { "name": "Alejandro G. Castro", "email": "alex@igalia.com", "time": "Fri Jun 12 20:24:36 2026" }, "committer": { "name": "Alejandro G. Castro", "email": "alex@igalia.com", "time": "Fri Jun 12 20:24:36 2026" }, "message": "[WPE][arm64] Gardening of layout tests\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d317023\n\nUnreviewed test gardening.\n\nReport and mark new expected failures and flaky tests on the\nWPE arm64 release bot.\n\n* LayoutTests/platform/glib/TestExpectations:\n* LayoutTests/platform/wpe/TestExpectations:\n\nCanonical link: https://commits.webkit.org/315130@main\n" }, { "commit": "a6f42da10166a940ded9fdaa2018012470362516", "tree": "56747f5de194b01aeb6f764b35f1948d47814774", "parents": [ "ba459bae8fa7fff9852a9017e3735ec9dc20844a" ], "author": { "name": "Vassili Bykov", "email": "v_bykov@apple.com", "time": "Fri Jun 12 20:22:18 2026" }, "committer": { "name": "Vassili Bykov", "email": "v_bykov@apple.com", "time": "Fri Jun 12 20:22:18 2026" }, "message": "[JSC] BBQJIT tail call shuffle should detect overlapping stack slots\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d312288\nrdar://174490087\n\nReviewed by Dan Hecht.\n\nBecause in a tail call the caller and the callee frames overlap, BBQJIT::emitTailCall()\nuses emitShuffle() to orchestrate the copying of call arguments into their destination\nlocations in such a way that if a caller temp resides in the callee argument space and is\nitself passed as an argument, it is not clobbered before it\u0027s been moved to its final\nlocation.\n\nThe move hazard detection in emitShuffleMove() compares stack locations by offset only\n(via Location::operator\u003d\u003d). The core assumption here is that source and destination values\nwith different base addresses never overlap, so a write to a destination address A never\nclobbers a source value at address B.\n\nThis assumption does not always hold. Caller temps (source values) are always 16-byte\naligned regardless of value type. Callee arguments (destination values) are packed\ncontiguously. If an i64 argument at address B is followed by a v128 argument, the v128\nargument occupies the address range [B+8, B+24). This range overlaps two temp slots with\nranges [B, B+16) and [B+16, B+32). Because hazard detection currently only considers the\nbase address, this overlap will go unnoticed and the shuffle may write the v128 argument\nbefore the values in the overlapping source slots have been moved.\n\nThis patch adds Location::overlaps() method which considers actual ranges for Stack and\nStackArgument locations. The method replaces Location::operator\u003d\u003d() for hazard detection.\n\nThe new method is also used in destination uniqueness assertion in emitShuffle.\n\nTest: JSTests/wasm/stress/tail-call-v128-ref-stack-overlap.js\n\nOriginally-landed-as: 305413.670@safari-7624-branch (73c288dd8c72). rdar://176058891\nCanonical link: https://commits.webkit.org/315129@main\n" }, { "commit": "ba459bae8fa7fff9852a9017e3735ec9dc20844a", "tree": "a37d241e1c971ee61c1294a80e52b8e3461fe49e", "parents": [ "8963f8f945165a7ed67bf6a21e26def2e2f6877d" ], "author": { "name": "Yusuke Suzuki", "email": "ysuzuki@apple.com", "time": "Fri Jun 12 19:51:13 2026" }, "committer": { "name": "Yusuke Suzuki", "email": "ysuzuki@apple.com", "time": "Fri Jun 12 19:51:13 2026" }, "message": "[JSC] Remove ucal_clone by reorganize ucal code\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d316970\nrdar://179440479\n\nReviewed by Yijia Huang.\n\nLet\u0027s change the scope of withCalendar / withTimeZone so that we do not\nneed to call ucal_clone, which is significantly slower. Also we\nintroduce TinyLRUCache to Calendar cache too.\n\n* Source/JavaScriptCore/runtime/temporal/core/CalendarICUBridge.cpp:\n(JSC::TemporalCore::CalendarLRUCachePolicy::isKeyNull):\n(JSC::TemporalCore::CalendarLRUCachePolicy::createValueForNullKey):\n(JSC::TemporalCore::CalendarLRUCachePolicy::createValueForKey):\n(JSC::TemporalCore::CalendarLRUCachePolicy::createKeyForStorage):\n(JSC::TemporalCore::calendarCacheEntry):\n(JSC::TemporalCore::withCalendar):\n(JSC::TemporalCore::surpassesMonths):\n(JSC::TemporalCore::calendarDateUntil):\n* Source/JavaScriptCore/runtime/temporal/core/TimeZoneICUBridge.cpp:\n\nCanonical link: https://commits.webkit.org/315128@main\n" }, { "commit": "8963f8f945165a7ed67bf6a21e26def2e2f6877d", "tree": "2cf982c4adc1eb2283ce6804829ecfbbc5e099a7", "parents": [ "4b8ee8d96bd1911587fb97c01779b7116d960ea3" ], "author": { "name": "Alejandro G. Castro", "email": "alex@igalia.com", "time": "Fri Jun 12 19:50:24 2026" }, "committer": { "name": "Alejandro G. Castro", "email": "alex@igalia.com", "time": "Fri Jun 12 19:50:24 2026" }, "message": "[GTK][WPE] Gardening of tests\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d317012\n\nUnreviewed test gardening.\n\nReport and mark new expected failures and flaky tests on the\nGTK and WPE x86_64 release bots.\n\n* LayoutTests/platform/glib/TestExpectations:\n* LayoutTests/platform/gtk/TestExpectations:\n\nCanonical link: https://commits.webkit.org/315127@main\n" }, { "commit": "4b8ee8d96bd1911587fb97c01779b7116d960ea3", "tree": "54456167726df49ec23a9e10cbfa4faa127ef0d9", "parents": [ "74720ee2b7df6a33982136654d14bc3cd4236ab7" ], "author": { "name": "Yusuke Suzuki", "email": "ysuzuki@apple.com", "time": "Fri Jun 12 19:49:10 2026" }, "committer": { "name": "Yusuke Suzuki", "email": "ysuzuki@apple.com", "time": "Fri Jun 12 19:49:10 2026" }, "message": "[JSC] Use runtime check for fast path for Spread\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d316957\nrdar://179423267\n\nReviewed by Yijia Huang.\n\nCurrently DFG / FTL Spread only take fast path when AbstractValue is\nproven Array with specific shape. But this is a bit too conservative,\nlet\u0027s have runtime check with original Array structures so that we can\nstill take the fast path even when it is not proven.\n\n* Source/JavaScriptCore/dfg/DFGGraph.cpp:\n(JSC::DFG::Graph::canDoFastSpreadWithStructureCheck):\n* Source/JavaScriptCore/dfg/DFGGraph.h:\n* Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:\n* Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:\n(JSC::FTL::DFG::LowerDFGToB3::compileSpread):\n\nCanonical link: https://commits.webkit.org/315126@main\n" }, { "commit": "74720ee2b7df6a33982136654d14bc3cd4236ab7", "tree": "31e8eac8f3580612ba87562be31f7c116817667e", "parents": [ "ccfb13ac522147b6c2b8b7ab290a47344467fbde" ], "author": { "name": "Basuke Suzuki", "email": "basuke@apple.com", "time": "Fri Jun 12 19:25:15 2026" }, "committer": { "name": "Basuke Suzuki", "email": "basuke@apple.com", "time": "Fri Jun 12 19:25:15 2026" }, "message": "[Site Isolation] Iframe pushState misroutes history.back() under UseUIProcessForBackForwardItemLoading\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d316881\nrdar://179304807\n\nReviewed by Charlie Wolfe and Sihui Liu.\n\nHistoryController::pushState built the topItem from frame-\u003erootFrame(), so the\nIPC payload\u0027s frameID identified the rootFrame even when an iframe initiated\nthe navigation. Under UseUIProcessForBackForwardItemLoading (auto-enabled with\nSiteIsolation), UIProcess routes history.back() by currentItem-\u003enavigatedFrameID()\nand so navigated the main frame to its own URL — back() became a no-op and the\niframe stayed at the latest pushed entry.\n\nBuild the tree from the navigating frame, matching what regular iframe\nnavigations already do via WebLocalFrameLoaderClient::createHistoryItemTree.\nThe IPC payload\u0027s root frameID then identifies the iframe directly, and\nWebBackForwardList::completeFrameStateForNavigation handles grafting the\niframe-rooted FrameState onto the main tree as it does for any other\nsub-frame navigation.\n\nTools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolation.mm:\nIframePushStateBackForwardRoutesToIframe.\n\n* Source/WebCore/loader/HistoryController.cpp:\n(WebCore::HistoryController::pushState):\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolation.mm:\n\nCanonical link: https://commits.webkit.org/315125@main\n" }, { "commit": "ccfb13ac522147b6c2b8b7ab290a47344467fbde", "tree": "fa7b07effd0346cd45f16bfa0d5fe5551482ae32", "parents": [ "7a6f5e3b706a471ce7a4c9e85bc27973886178dc" ], "author": { "name": "Geoffrey Garen", "email": "ggaren@apple.com", "time": "Fri Jun 12 19:02:46 2026" }, "committer": { "name": "Geoffrey Garen", "email": "ggaren@apple.com", "time": "Fri Jun 12 19:02:46 2026" }, "message": "Null dereference beneath speechSynthesis.speak\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d311761\nrdar://173393491\n\nReviewed by Sihui Liu.\n\nWe have a fuzzer test case that sometimes reproduces a null deref on this path.\n\nTest: fast/speechsynthesis/speech-synthesis-speak-fuzzer-crash.html\n\n* LayoutTests/fast/speechsynthesis/speech-synthesis-speak-fuzzer-crash-expected.txt: Added.\n* LayoutTests/fast/speechsynthesis/speech-synthesis-speak-fuzzer-crash.html: Added.\n* Source/WebCore/platform/cocoa/PlatformSpeechSynthesizerCocoa.mm:\n(-[WebSpeechSynthesisWrapper speakUtterance:]):\n(-[WebSpeechSynthesisWrapper speechSynthesizer:didStartSpeechUtterance:]):\n(-[WebSpeechSynthesisWrapper speechSynthesizer:didFinishSpeechUtterance:]):\n(-[WebSpeechSynthesisWrapper speechSynthesizer:didPauseSpeechUtterance:]):\n(-[WebSpeechSynthesisWrapper speechSynthesizer:didContinueSpeechUtterance:]):\n(-[WebSpeechSynthesisWrapper speechSynthesizer:didCancelSpeechUtterance:]):\n(-[WebSpeechSynthesisWrapper speechSynthesizer:willSpeakRangeOfSpeechString:utterance:]):\n\nOriginally-landed-as: 305413.635@rapid/safari-7624.2.5.110-branch (834f01c6724e). rdar://176059232\nCanonical link: https://commits.webkit.org/315124@main\n" }, { "commit": "7a6f5e3b706a471ce7a4c9e85bc27973886178dc", "tree": "b7f52bf3d74a5755be724be43338c000241ec8b0", "parents": [ "9681e24c3b287eab1f380c38ed7488db874d66fa" ], "author": { "name": "Charlie Wolfe", "email": "charliew@apple.com", "time": "Fri Jun 12 19:00:13 2026" }, "committer": { "name": "Charlie Wolfe", "email": "charliew@apple.com", "time": "Fri Jun 12 19:00:13 2026" }, "message": "encodeAsCBOR() emplaces the versions array twice and reads it after move\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d316974\nrdar://179451130\n\nReviewed by Pascoe.\n\nThe versions array was inserted under CBORValue(1) and then again under\nkCtapAuthenticatorGetInfoVersionsKey (which is also 1). Since it\u0027s the same key it is a no-op\ninsert. Keep the single emplace using the named constant.\n\n* Source/WebCore/Modules/webauthn/fido/AuthenticatorGetInfoResponse.cpp:\n(fido::encodeAsCBOR):\n\nCanonical link: https://commits.webkit.org/315123@main\n" }, { "commit": "9681e24c3b287eab1f380c38ed7488db874d66fa", "tree": "f6854b8b288b622567c216cd083d3c8535469dca", "parents": [ "844ebfeb1d997360dad9aebd280811b3ec4dd2f8" ], "author": { "name": "Rupin Mittal", "email": "rupin@apple.com", "time": "Fri Jun 12 18:48:59 2026" }, "committer": { "name": "Rupin Mittal", "email": "rupin@apple.com", "time": "Fri Jun 12 18:48:59 2026" }, "message": "[Site Isolation] Make UserGestureIndicator not require the mainFrameDocument\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d316924\nrdar://179386506\n\nReviewed by Aditya Keerthi.\n\nAfter 314903@main, logUserInteractionWithReducedTimeResolution() is capable of\nworking with a non-mainFrame document. So we amend UserGestureIndicator to not\nneed to pass in the mainFrameDocument.\n\nIt\u0027s not possible to add a new test for this. UserGestureIndicator only calls\nlogUserInteractionWithReducedTimeResolution() when the ProcessInteractionStyle\npassed in is ProcessInteractionStyle::Immediate. This only happens for mouse\nand touch events (see EventHandler::handleMousePressEvent and handleTouchEvent)\nwhich are always processed in the main frame first. This means that for those\nevents, the user interaction is already attributed to the main frame\u0027s origin.\nThis scenario is covered by existing tests which still pass after this change\nwith and without site isolation (user-interaction-in-cross-origin-sub-frame.html).\n\nEven though we can\u0027t add a new test, it still makes sense to ensure that\nUserGestureIndicator isn\u0027t dependent on accessing the mainFrameDocument.\n\n* Source/WebCore/dom/UserGestureIndicator.cpp:\n(WebCore::UserGestureIndicator::UserGestureIndicator):\n\nCanonical link: https://commits.webkit.org/315122@main\n" }, { "commit": "844ebfeb1d997360dad9aebd280811b3ec4dd2f8", "tree": "7db3cf1dc775bfe36a99e45dc359c81481de7b9e", "parents": [ "d93e2231de6506d017dd13bc0fe3c02367c9bd98" ], "author": { "name": "David Stockley", "email": "stockley@apple.com", "time": "Fri Jun 12 18:47:18 2026" }, "committer": { "name": "Abrar Rahman Protyasha", "email": "a_protyasha@apple.com", "time": "Fri Jun 12 18:47:18 2026" }, "message": "Delegated Apple Pay: Move HAVE_PASSKIT_DELEGATED_REQUEST to WebKit\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d315564\nrdar://165837621\n\nReviewed by Abrar Rahman Protyasha.\n\nGiven Delegated Apple Pay launched in iOS 26.4, this PR adds the relevant PlatformHave\nmacros to the open source codebase.\n\nNo new tests are required, existing tests surrounding Delegated Apple Pay will suffice.\n\n* Source/WTF/wtf/PlatformHave.h:\n\nCanonical link: https://commits.webkit.org/315121@main\n" }, { "commit": "d93e2231de6506d017dd13bc0fe3c02367c9bd98", "tree": "d444afab350835e7a7ae44022113ca85f9341c2d", "parents": [ "461dbf7066ba0e0c9cfe92b9792da613be101df4" ], "author": { "name": "Elliott Williams", "email": "emw@apple.com", "time": "Fri Jun 12 18:45:24 2026" }, "committer": { "name": "Elliott Williams", "email": "emw@apple.com", "time": "Fri Jun 12 18:45:24 2026" }, "message": "Fix broken measure-build-perf patch\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d317002\nrdar://179502229\n\nUnreviewed CI fix. The `webkit-swift-interface` patch no longer applies;\nfix it.\n\n* Tools/Scripts/measure-build-time:\n(IncrementalBuild6):\n\nCanonical link: https://commits.webkit.org/315120@main\n" }, { "commit": "461dbf7066ba0e0c9cfe92b9792da613be101df4", "tree": "6a8fa866f4f1072603885240e2011a4d3313681e", "parents": [ "66c073b22627b409d20b0ac96237df6ac89eb6c1" ], "author": { "name": "Charlie Wolfe", "email": "charliew@apple.com", "time": "Fri Jun 12 18:42:04 2026" }, "committer": { "name": "Charlie Wolfe", "email": "charliew@apple.com", "time": "Fri Jun 12 18:42:04 2026" }, "message": "AuthenticatorAssertionResponse::m_synchronizable is left uninitialized\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d316975\nrdar://179451483\n\nReviewed by Pascoe.\n\nm_synchronizable had no in-class initializer and neither constructor set it, so it held an\nindeterminate value. LocalAuthenticator only calls setSynchronizable() conditionally, so on the path\nwhere the keychain group is null and the attributes lack kSecAttrSynchronizable the garbage value\nwas read into authDataFlags(). Default-initialize it to false.\n\n* Source/WebCore/Modules/webauthn/AuthenticatorAssertionResponse.h:\n\nCanonical link: https://commits.webkit.org/315119@main\n" }, { "commit": "66c073b22627b409d20b0ac96237df6ac89eb6c1", "tree": "80d8a8be81dedbadacbca0bc3726adf665d9a93b", "parents": [ "21e15196b456f1a14ad17bd28f84736c7278e0fb" ], "author": { "name": "David Stockley", "email": "stockley@apple.com", "time": "Fri Jun 12 18:40:18 2026" }, "committer": { "name": "Abrar Rahman Protyasha", "email": "a_protyasha@apple.com", "time": "Fri Jun 12 18:40:18 2026" }, "message": "Delegated Apple Pay: Remove bincompat staging code from WebKit\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d315562\nrdar://165836164\n\nReviewed by Abrar Rahman Protyasha.\n\nWhen rolling out support for Delegated Apple Pay, temporary staging SPI and a\nrespondsToSelector check was added to ensure the build process didn\u0027t break. Now that\nthe delegated payments API is public in the iOS 26.4 SDK, this SPI and selector check can\nnow be removed.\n\nNo new tests are required, existing tests surrounding Delegated Apple Pay will suffice.\n\n* Source/WebCore/PAL/pal/spi/cocoa/PassKitSPI.h:\n* Source/WebKit/Configurations/AllowedSPI.toml:\n* Source/WebKit/Shared/ApplePay/cocoa/WebPaymentCoordinatorProxyCocoa.mm:\n(WebKit::WebPaymentCoordinatorProxy::platformPaymentRequest):\n\nCanonical link: https://commits.webkit.org/315118@main\n" }, { "commit": "21e15196b456f1a14ad17bd28f84736c7278e0fb", "tree": "8b4a3b9dbaa40f1a62c9d7607470f11003e02a40", "parents": [ "4e561e6e24860adba388f722794bb9bd9bc11f2c" ], "author": { "name": "Charlie Wolfe", "email": "charliew@apple.com", "time": "Fri Jun 12 18:36:42 2026" }, "committer": { "name": "Charlie Wolfe", "email": "charliew@apple.com", "time": "Fri Jun 12 18:36:42 2026" }, "message": "Fix typo in IDBIndex getAll* exception messages\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d316979\nrdar://179452761\n\nReviewed by Aditya Keerthi.\n\n* Source/WebCore/Modules/indexeddb/IDBIndex.cpp:\n(WebCore::IDBIndex::doGetAllShared):\n\nCanonical link: https://commits.webkit.org/315117@main\n" }, { "commit": "4e561e6e24860adba388f722794bb9bd9bc11f2c", "tree": "a02f0759cf89dafe92bfb7734ade449da3c35911", "parents": [ "2f073190fecd8722c04b080dd747a9aaeeda5584" ], "author": { "name": "Pascoe", "email": "pascoe@apple.com", "time": "Fri Jun 12 17:59:50 2026" }, "committer": { "name": "Pascoe", "email": "pascoe@apple.com", "time": "Fri Jun 12 17:59:50 2026" }, "message": "[WebAuthn] Fix crash during requestPIN\nrdar://179212159\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d316911\n\nReviewed by Abrar Rahman Protyasha, Richard Robinson, and Aditya Keerthi.\n\nCall completionHandler(nullString()) on early-return paths in requestPin() and\nrequestNewPin() instead of letting the CompletionHandler be destroyed uncalled.\nThe caller already handles a null pin gracefully.\n\n* Source/WebKit/UIProcess/WebAuthentication/AuthenticatorManager.cpp:\n(WebKit::AuthenticatorManager::requestPin):\n(WebKit::AuthenticatorManager::requestNewPin):\n\nCanonical link: https://commits.webkit.org/315116@main\n" }, { "commit": "2f073190fecd8722c04b080dd747a9aaeeda5584", "tree": "6a65190c25923f79eaa61bd48a9d5a3bc1a959b6", "parents": [ "3b350434b86d1d50ddca79cbcd057aa3cf7f106a" ], "author": { "name": "Said Abou-Hallawa", "email": "said@apple.com", "time": "Fri Jun 12 17:32:45 2026" }, "committer": { "name": "Said Abou-Hallawa", "email": "sabouhallawa@apple.com", "time": "Fri Jun 12 17:32:45 2026" }, "message": "Before creating a remote AVF image decoder, the mime-type should be checked if it is supported\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d311953\nrdar://172058208\n\nReviewed by Jer Noble.\n\nRemoteImageDecoderAVFProxy::createDecoder() should MESSAGE_CHECK() whether the\nmime-type is supported or not before calling create(). GPU process should not\ntrust WebProcess for this check and should terminate itself.\n\n* Source/WebCore/platform/graphics/avfoundation/objc/ImageDecoderAVFObjC.mm:\n(WebCore::ImageDecoderAVFObjC::create):\n* Source/WebKit/GPUProcess/media/RemoteImageDecoderAVFProxy.cpp:\n(WebKit::RemoteImageDecoderAVFProxy::createDecoder):\n* Source/WebKit/WebProcess/GPU/media/RemoteImageDecoderAVFManager.cpp:\n(WebKit::RemoteImageDecoderAVFManager::createImageDecoder):\n\nOriginally-landed-as: 305413.655@rapid/safari-7624.2.5.110-branch (2669cd39c908). rdar://176059127\nCanonical link: https://commits.webkit.org/315115@main\n" }, { "commit": "3b350434b86d1d50ddca79cbcd057aa3cf7f106a", "tree": "23b696ac6f86f164c08756ed48aeb610abcf61fb", "parents": [ "6350c54363c185145ff0457d6d8d5c1f299bbddd" ], "author": { "name": "Rupin Mittal", "email": "rupin@apple.com", "time": "Fri Jun 12 17:24:44 2026" }, "committer": { "name": "Rupin Mittal", "email": "rupin@apple.com", "time": "Fri Jun 12 17:24:44 2026" }, "message": "[Site Isolation] 2x resourceLoadStatistics/omit-document-referrer* tests are failing\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d316971\nrdar://179440666\n\nReviewed by Alex Christensen.\n\nThese tests check that if advancedPrivacyProtectionsEnabled\u003dtrue, then\ndocument.referrer is omitted in third-party iframes. With site isolation on,\nthe tests fail because the referrer is not omitted.\n\nDocument::referrerForBindings() returns the referrer instead of omitting it\nwhen it cannot access the main frame document, which is what happens with site\nisolation enabled. We make the decision to omit the referrer if the\nAdvancedPrivacyProtections::BaselineProtections flag is on. Currently, this flag\nis only set on the main frame\u0027s DocumentLoader (we need the main frame\u0027s document\nto access this).\n\nWe fix this issue by ensuring that the flag is set on the DocumentLoader of a\nthird-party iframe as well. We do this by setting the flag on the LoadParameters\nthat are sent to WebPage::loadRequest() in continueNavigationInNewProcess so that\nthey eventually make it to the DocumentLoader. Document::referrerForBindings()\ncan then check the flag on the current Document\u0027s loader.\n\n* LayoutTests/platform/ios-site-isolation/TestExpectations:\n* LayoutTests/platform/mac-site-isolation/TestExpectations:\n* Source/WebCore/dom/Document.cpp:\n(WebCore::Document::referrerForBindings):\n* Source/WebKit/UIProcess/WebPageProxy.cpp:\n(WebKit::WebPageProxy::continueNavigationInNewProcess):\n\nCanonical link: https://commits.webkit.org/315114@main\n" }, { "commit": "6350c54363c185145ff0457d6d8d5c1f299bbddd", "tree": "92d7d3f2fbe4554747b7301ad3d7877060a05c87", "parents": [ "346f097d212d209cefa65e2f02d74f29def23865" ], "author": { "name": "Keith Miller", "email": "keith_miller@apple.com", "time": "Fri Jun 12 17:15:45 2026" }, "committer": { "name": "Keith Miller", "email": "keith_miller@apple.com", "time": "Fri Jun 12 17:15:45 2026" }, "message": "[CMake] codesign JavaScriptCore binary products\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d316946\nrdar://179410684\n\nReviewed by Geoffrey Garen and Yusuke Suzuki.\n\nThe binaries produced by the CMake build with the Apple internal\nSDK are not signed and don\u0027t have any entitlements. This causes\nJSC to not JIT and other fun things. This causes a bunch of JSC\ntests to fail.\n\nI added a WEBKIT_PROCESS_ENTITLEMENTS function so we can add\ncodesigning for subsequent build products in the future from the\nsame shared function.\n\nCanonical link: https://commits.webkit.org/315113@main\n" }, { "commit": "346f097d212d209cefa65e2f02d74f29def23865", "tree": "0f41f67148466e59058f175ad41897a52d1d8213", "parents": [ "cc25c9e277138fd967f2367ace6eec9499968317" ], "author": { "name": "Marta Darbinyan", "email": "darbinyan@apple.com", "time": "Fri Jun 12 16:56:04 2026" }, "committer": { "name": "Marta Darbinyan", "email": "darbinyan@apple.com", "time": "Fri Jun 12 16:56:04 2026" }, "message": "[Gardening]: [iOS] ASSERTION FAILED: m_creationThreadID \u003d\u003d currentThreadID() in TestWebKitAPI.CopyHTML.SanitizationPreservesCharacterSetInSelectedText\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d316931\nrdar://179401567\n\nUnreviewed test gardening\n\n* TestExpectations/apitests:\n\nCanonical link: https://commits.webkit.org/315112@main\n" }, { "commit": "cc25c9e277138fd967f2367ace6eec9499968317", "tree": "f623e8293f35225bf43549c17733e3dece4e28c0", "parents": [ "b549e94395ec3526c10d8e3abd0b418d036fb923" ], "author": { "name": "Chris Dumez", "email": "cdumez@apple.com", "time": "Fri Jun 12 16:52:07 2026" }, "committer": { "name": "Darin Adler", "email": "darin@apple.com", "time": "Fri Jun 12 16:52:07 2026" }, "message": "Fix some uninitialized data members in WebCore/html\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d316959\n\nReviewed by Rupin Mittal and Darin Adler.\n\n* Source/WebCore/html/HTMLMediaElement.h:\n* Source/WebCore/html/LazyLoadFrameObserver.h:\n* Source/WebCore/html/track/TrackBase.h:\n\nCanonical link: https://commits.webkit.org/315111@main\n" }, { "commit": "b549e94395ec3526c10d8e3abd0b418d036fb923", "tree": "097d12def286225d9bce304bdac3bfc0264a7bd3", "parents": [ "6cc340adc68dbe2b5baa0f77d638731fc577746a" ], "author": { "name": "lilly", "email": "173393835+codedbycupidity@users.noreply.github.com", "time": "Fri Jun 12 16:47:57 2026" }, "committer": { "name": "Simon Fraser", "email": "simon.fraser@apple.com", "time": "Fri Jun 12 16:47:57 2026" }, "message": "Implement CSS corner-shape logical and physical side shorthands\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d316835\nrdar://179277008\n\nReviewed by Simon Fraser.\n\nAdds the 8 missing CSS corner-shape side shorthands, 4 physical (corner-top-shape,\ncorner-right-shape, corner-bottom-shape, corner-left-shape) and 4 logical\n(corner-block-start-shape, corner-block-end-shape, corner-inline-start-shape,\ncorner-inline-end-shape), to CSSProperties.json using the existing CoalescingPair\nshorthand pattern, which handles 1–2 value expansion\n\nPasses existing WPT tests\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-borders/corner-shape/corner-shape-computed-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-borders/corner-shape/corner-shape-valid-expected.txt:\n* Source/WebCore/css/CSSProperties.json:\n* Source/WebCore/css/ShorthandSerializer.cpp:\n(WebCore::ShorthandSerializer::serialize):\n\nCanonical link: https://commits.webkit.org/315110@main\n" }, { "commit": "6cc340adc68dbe2b5baa0f77d638731fc577746a", "tree": "54fd9d0af8823c0f03bb40ac7eb42eff650b4539", "parents": [ "719a73b464bfaf60a7e3c2c716ce5045f4ae838e" ], "author": { "name": "Kai Tamkun", "email": "k_tamkun@apple.com", "time": "Fri Jun 12 16:41:50 2026" }, "committer": { "name": "Kai Tamkun", "email": "k_tamkun@apple.com", "time": "Fri Jun 12 16:41:50 2026" }, "message": "Importing modules from a document with no base URL causes null deref\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d316862\nrdar://179143870\n\nReviewed by Yusuke Suzuki.\n\nThis replaces an assertion that the base URL is valid when dynamically importing a module\nfrom ScriptModuleLoader with an actual validation.\n\nTest: js/dom/modules/import-from-javascript-url-new-window.html\n\n* LayoutTests/js/dom/modules/import-from-javascript-url-new-window-expected.txt: Added.\n* LayoutTests/js/dom/modules/import-from-javascript-url-new-window.html: Added.\n* Source/WebCore/bindings/js/ScriptModuleLoader.cpp:\n(WebCore::ScriptModuleLoader::importModule):\n\nCanonical link: https://commits.webkit.org/315109@main\n" }, { "commit": "719a73b464bfaf60a7e3c2c716ce5045f4ae838e", "tree": "60f8d41507a865d63bb25b02a83f9839e8f9187e", "parents": [ "f9f215d168b0a6bbb3d24ea061cce1a211f498f4" ], "author": { "name": "Brandon Stewart", "email": "brandonstewart@apple.com", "time": "Fri Jun 12 16:27:31 2026" }, "committer": { "name": "Brandon Stewart", "email": "brandonstewart@apple.com", "time": "Fri Jun 12 16:27:31 2026" }, "message": "[Site Isolation] Emit live Page.frameNavigated/frameDetached from cross-origin processes\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d316664\nrdar://179117260\n\nReviewed by BJ Burg.\n\nUnder Site Isolation a cross-origin frame commits in its own WebContent process, so\nthe per-page InspectorPageAgent (which lives in the main frame\u0027s process) never sees\nit. The UIProcess ProxyingPageAgent aggregates frame state across processes, but it\nreceived no frame lifecycle events from non-main processes, so dynamically added or\nremoved cross-origin iframes were invisible to it.\n\nRe-enable the dispatch of frameNavigated/frameDetached to the cross-process\nPageAgentProxy (registered in the enabledPageProxy slot of each participating\nprocess\u0027s InstrumentingAgents). PageAgentProxy forwards them over IPC to the\nUIProcess ProxyingPageAgent. Late-joining processes are already instrumented via\nWebPageInspectorController::didCreateFrame, and the frame\u0027s InstrumentingAgents\nfalls back to the page\u0027s, where the proxy is registered -- so no additional\ninstrumentation plumbing is needed.\n\nThis dispatch was reverted previously because it crashed. The crash was a\nuse-after-free: WebInspectorBackend::disablePageInstrumentation() destroyed the\nPageAgentProxy without clearing it from the page\u0027s InstrumentingAgents enabledPageProxy\nslot, so the next frame commit in that process dereferenced a freed pointer. Fix by\ndisabling (which clears the slot) before destroying.\n\n* Source/WebCore/inspector/InspectorInstrumentation.cpp:\n(WebCore::InspectorInstrumentation::frameDetachedFromParentImpl):\n(WebCore::InspectorInstrumentation::didCommitLoadImpl):\nDispatch to enabledPageProxy() alongside enabledPageAgent(). Include\nPageAgentInstrumentation.h for the now-required complete type.\n\n* Source/WebKit/WebProcess/Inspector/WebInspectorBackend.cpp:\n(WebKit::WebInspectorBackend::disablePageInstrumentation):\nCall PageAgentProxy::disable() (clears the enabledPageProxy slot) before destroying\nit, fixing the dangling-pointer crash.\n\n* Source/WebKit/WebProcess/Inspector/PageAgentProxy.cpp:\n(WebKit::PageAgentProxy::frameNavigated):\n(WebKit::PageAgentProxy::frameDetached):\nGuard against a null parentProcessConnection() rather than dereferencing it.\n\n* Source/JavaScriptCore/inspector/protocol/Page.json:\nRemove frameDetached\u0027s targetTypes:[\"page\"] restriction so it is available on the\n\"web-page\" multiplexing target (matching frameNavigated), where the ProxyingPageAgent\ndispatches it. Without this the frontend rejected it as an unspecified method.\n\n* Source/WebInspectorUI/UserInterface/Controllers/DOMDebuggerManager.js:\n(WI.DOMDebuggerManager.prototype._mainFrameDidChange):\nGuard against a transiently-null mainFrame while frame events from multiple Site\nIsolation processes are reconciled. Full cross-process merge is the live-UI follow-up.\n\nCanonical link: https://commits.webkit.org/315108@main\n" }, { "commit": "f9f215d168b0a6bbb3d24ea061cce1a211f498f4", "tree": "ea343e799b09beb51a00c5143bba58f0fc592069", "parents": [ "f03a38dfc461b3d9a0d119c7ed67796bb281daae" ], "author": { "name": "Wenson Hsieh", "email": "wenson_hsieh@apple.com", "time": "Fri Jun 12 16:19:33 2026" }, "committer": { "name": "Wenson Hsieh", "email": "wenson_hsieh@apple.com", "time": "Fri Jun 12 16:19:33 2026" }, "message": "Improve text extraction interaction summaries when inserting text\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d316963\nrdar://179428861\n\nReviewed by Lily Spiniolas.\n\nInstead of always returning a canned result (\"Inserted text by simulating paste with plain text\"),\nleverage element interaction descriptions to surface additional context about the element that was\njust interacted with.\n\nTest: Tools/TestWebKitAPI/Tests/WebKit/WKWebView/TextExtractionTests.mm\n\n* Source/WebCore/page/text-extraction/TextExtraction.cpp:\n(WebCore::TextExtraction::textDescription):\n\nMove these methods further up the file (this code is otherwise unchanged).\n\n(WebCore::TextExtraction::focusAndInsertText):\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/TextExtractionTests.mm:\n(TestWebKitAPI::TEST(TextExtractionTests, InteractionResultSummary)):\n\nCanonical link: https://commits.webkit.org/315107@main\n" }, { "commit": "f03a38dfc461b3d9a0d119c7ed67796bb281daae", "tree": "a493e0b9e2db91157e9b0fa24e91fc3e33b460e4", "parents": [ "97721ca8c2a59ef7b9b3ad7bcf3b489fb767d34b" ], "author": { "name": "Chris Dumez", "email": "cdumez@apple.com", "time": "Fri Jun 12 15:59:22 2026" }, "committer": { "name": "Chris Dumez", "email": "cdumez@apple.com", "time": "Fri Jun 12 15:59:22 2026" }, "message": "REGRESSION(309877@main): window.event not restored when a window.onerror handler throws\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d316968\n\nReviewed by Anne van Kesteren.\n\nJSErrorHandler::handleEvent saves the window\u0027s current event, sets it to the\nerror event for the duration of the onerror call, and is supposed to restore it\nafterwards. 309877@main refactored this function into a lambda that returns\nearly when the handler throws (if (exception) return exception;), placing the\nsetCurrentEvent(savedEvent) restore on the success path only. As a result, when\na window.onerror handler throws, window.event is left pointing at the error\nevent instead of being restored to the previously current event.\n\nRestore window.event with a makeScopeExit right after it is saved, so it runs on\nboth the normal and throwing paths, mirroring JSEventListener::handleEvent (which\nhas always done this and was not changed by 309877@main).\n\nTest: imported/w3c/web-platform-tests/dom/events/window-event-restored-after-throwing-onerror.html\n\n* LayoutTests/imported/w3c/web-platform-tests/dom/events/window-event-restored-after-throwing-onerror-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/dom/events/window-event-restored-after-throwing-onerror.html: Added.\n* Source/WebCore/bindings/js/JSErrorHandler.cpp:\n(WebCore::JSErrorHandler::handleEvent):\n\nCanonical link: https://commits.webkit.org/315106@main\n" }, { "commit": "97721ca8c2a59ef7b9b3ad7bcf3b489fb767d34b", "tree": "7c22e02c938c5720c006ee50e3438d2c3d0ea45f", "parents": [ "3e38165dc47083cb5628f943e6d718b5dfd0828c" ], "author": { "name": "Chris Dumez", "email": "cdumez@apple.com", "time": "Fri Jun 12 15:47:54 2026" }, "committer": { "name": "Chris Dumez", "email": "cdumez@apple.com", "time": "Fri Jun 12 15:47:54 2026" }, "message": "JSCustomElementInterface fails to visit m_connectedMoveCallback during GC\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d316965\n\nReviewed by Anne van Kesteren.\n\nJSCustomElementInterface stores each custom element reaction callback as a\nJSC::Weak\u003cJSObject\u003e with no custom WeakHandleOwner, so the visitor.append()\ncalls in visitJSFunctionsInGCThread() are the only thing keeping those\nfunctions alive across a garbage collection. That function appended every\ncallback except m_connectedMoveCallback, which was added later (in the\nconnectedMoveCallback() implementation) without updating the visit list.\n\nAs a result, once the only other reference to the connectedMoveCallback\nfunction is dropped (e.g. the method is deleted off the constructor\u0027s\nprototype), the function can be collected while its custom element definition\nis still live and registered. After collection hasConnectedMoveCallback()\nreturns false, so a subsequent moveBefore() enqueues the\ndisconnected/connected reactions instead of connectedMove, silently changing\nobservable behavior.\n\nFix this by visiting m_connectedMoveCallback alongside the other callbacks,\nin member-declaration order.\n\nTest: fast/custom-elements/connectedMoveCallback-survives-gc.html\n\n* LayoutTests/fast/custom-elements/connectedMoveCallback-survives-gc-expected.txt: Added.\n* LayoutTests/fast/custom-elements/connectedMoveCallback-survives-gc.html: Added.\n* Source/WebCore/bindings/js/JSCustomElementInterface.cpp:\n(WebCore::JSCustomElementInterface::visitJSFunctionsInGCThread const):\n\nCanonical link: https://commits.webkit.org/315105@main\n" }, { "commit": "3e38165dc47083cb5628f943e6d718b5dfd0828c", "tree": "c61633edc9c177b9febcf4f7799740cd2225d26d", "parents": [ "06d7373045cefd2ef7022e719365cbfcbf23d114" ], "author": { "name": "Carlos Alberto Lopez Perez", "email": "clopez@igalia.com", "time": "Fri Jun 12 15:43:53 2026" }, "committer": { "name": "Carlos Alberto Lopez Perez", "email": "clopez@igalia.com", "time": "Fri Jun 12 15:43:53 2026" }, "message": "[WPE][cross-toolchain-helper] For the optional chromium build, do not set CHROMIUM_EXTRA_ARGS\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d315999\n\nReviewed by Nikolas Zimmermann.\n\nThe flags we were passing to Chromium are not longer valid as those switches got renamed,\nthis resulted in Chromium not enabling hardware acceleration (about://gpu).\n\nLeave the value empty so the recipe defaults to the right values, which are defined via\nPACKAGECONFIG options, and on the current version will resolve to:\n\n\"--use-angle\u003dgles-egl \\\n --ozone-platform-hint\u003dwayland \\\n --ozone-platform\u003dwayland\n --enable-features\u003dAcceleratedVideoDecoder,AcceleratedVideoDecodeLinuxGL,AcceleratedVideoDecodeLinuxZeroCopyGL\"\n\n* Tools/yocto/image_extras/chromium.conf:\n\nCanonical link: https://commits.webkit.org/315104@main\n" }, { "commit": "06d7373045cefd2ef7022e719365cbfcbf23d114", "tree": "72fbe040d9835cf0248fc6edaeda3319128cd9a4", "parents": [ "2387eef3bad24a2fea2ba5f9943e38d446a07983" ], "author": { "name": "Carlos Alberto Lopez Perez", "email": "clopez@igalia.com", "time": "Fri Jun 12 15:42:12 2026" }, "committer": { "name": "Carlos Alberto Lopez Perez", "email": "clopez@igalia.com", "time": "Fri Jun 12 15:42:12 2026" }, "message": "[WPE][cross-toolchain-helper] Allow detached tmux/screen sessions, set logind KillUserProcesses\u003dno\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d316989\n\nReviewed by Nikolas Zimmermann.\n\nConfigure the image with KillUserProcesses\u003dno for logind, so it is possible\nto run detached screen or tmux sessions in the background. This is a general\nuseful thing for development and matches the behaviour expected on login\nsessions from most desktop distributions.\n\n* Tools/yocto/meta-openembedded_and_meta-webkit.patch:\n\nCanonical link: https://commits.webkit.org/315103@main\n" }, { "commit": "2387eef3bad24a2fea2ba5f9943e38d446a07983", "tree": "542a22443602c76ade2fd03b432fcbfaf0b9186b", "parents": [ "42b3ecc4724deceda84578093f57f6fd842abf6e" ], "author": { "name": "Tyler Wilcock", "email": "tyler_w@apple.com", "time": "Fri Jun 12 15:32:42 2026" }, "committer": { "name": "Tyler Wilcock", "email": "tyler_w@apple.com", "time": "Fri Jun 12 15:32:42 2026" }, "message": "AX: An anchor element that has a click handler but no href should still be considered a link\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d316929\nrdar://179398579\n\nReviewed by Chris Fleizach.\n\nAs a markup repair, Chrome and Firefox expose an \u003ca\u003e with a click handler but\nno href as a link. WebKit did not: Element::isLink() is only true for anchors\nwith an href, so a hrefless anchor with an onclick handler fell through role\ndetermination to the generic Inline role and was ignored by the accessibility tree.\n\nWith this commit, we implement this markup repair.\n\n* LayoutTests/accessibility/anchor-with-click-handler-is-link-expected.txt: Added.\n* LayoutTests/accessibility/anchor-with-click-handler-is-link.html: Added.\n* Source/WebCore/accessibility/AXObjectCache.cpp:\n(WebCore::isClickEvent):\n(WebCore::AXObjectCache::onEventListenerAdded):\n(WebCore::AXObjectCache::onEventListenerRemoved):\n(WebCore::AXObjectCache::handleClickHandlerChanged):\n(WebCore::AXObjectCache::handleAttributeChange):\n* Source/WebCore/accessibility/AXObjectCache.h:\n* Source/WebCore/accessibility/AccessibilityNodeObject.cpp:\n(WebCore::AccessibilityNodeObject::determineAccessibilityRoleFromNode const):\n\nCanonical link: https://commits.webkit.org/315102@main\n" }, { "commit": "42b3ecc4724deceda84578093f57f6fd842abf6e", "tree": "3e0a070826d6642a5a1477aec92f759022e1be8b", "parents": [ "7176d03868861a90728104e83d928b33a37b117a" ], "author": { "name": "Tyler Wilcock", "email": "tyler_w@apple.com", "time": "Fri Jun 12 15:11:03 2026" }, "committer": { "name": "Tyler Wilcock", "email": "tyler_w@apple.com", "time": "Fri Jun 12 15:11:03 2026" }, "message": "AX: AXTextOperations skip text input fields when isolated tree is enabled\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d316961\nrdar://179428392\n\nReviewed by Chris Fleizach.\n\nWith isolated tree mode enabled, AXTextOperations (e.g. replace) skip\ntext inputs. The cause is in AXObjectCache::textMarkerDataForVisiblePosition.\nWhen shouldCreateAXThreadCompatibleMarkers() is true, it builds a TextMarkerData\nwith the `ignored` field set from object-\u0026gt;isIgnored(). An \u0026lt;input\u0026gt;\u0026apos;s inner\nuser-agent-shadow text is an AX-ignored object, so its marker was flagged ignored\u003dtrue.\nWhen that marker range was later converted back to a SimpleRange on the main thread,\ncharacterOffsetForTextMarkerData / objectForTextMarkerData return null for an\nignored marker, so the range was dropped and never operated on.\n\nThe main reason this bug occurred is because TextMarkerData\u0026apos;s `ignored`\nfield did not actually map to the canonical notion of accessibility-is-ignored.\nBased on how the live tree actually sets and uses it, the intent is to\ndenote whether the marker is within a secure field. The bug is fixed\nby hardcoding `ignored` to false for anything that\u0026apos;s not a secure field.\n\nTo keep the name from inviting the same mistake again, this commit renames\nthe field from `ignored` to `isRedacted`.\n\nThis progresses test accessibility/mac/text-operation/text-operation-replace-across-multiple-fields.html\nin isolated tree mode.\n\n* LayoutTests/accessibility-isolated-tree/TestExpectations:\n* Source/WebCore/accessibility/AXObjectCache.cpp:\n(WebCore::AXObjectCache::characterOffsetForTextMarkerData):\n(WebCore::AXObjectCache::textMarkerDataForCharacterOffset):\n(WebCore::AXObjectCache::textMarkerDataForNextCharacterOffset):\n(WebCore::AXObjectCache::textMarkerDataForPreviousCharacterOffset):\n(WebCore::AXObjectCache::objectForTextMarkerData):\n(WebCore::AXObjectCache::textMarkerDataForVisiblePosition):\n* Source/WebCore/accessibility/AXTextMarker.cpp:\n(WebCore::TextMarkerData::TextMarkerData):\n(WebCore::AXTextMarker::operator CharacterOffset const):\n(WebCore::AXTextMarker::description const):\n* Source/WebCore/accessibility/AXTextMarker.h:\n(WebCore::TextMarkerData::TextMarkerData):\n(WebCore::AXTextMarker::isRedacted const):\n(WebCore::AXTextMarker::isIgnored const): Deleted.\n* Source/WebCore/accessibility/ios/WebAccessibilityObjectWrapperIOS.mm:\n(+[WebAccessibilityTextMarker textMarkerWithCharacterOffset:cache:]):\n(-[WebAccessibilityTextMarker isIgnored]):\n* Source/WebCore/accessibility/mac/AXObjectCacheMac.mm:\n(WebCore::textMarkerForCharacterOffset):\n\nCanonical link: https://commits.webkit.org/315101@main\n" }, { "commit": "7176d03868861a90728104e83d928b33a37b117a", "tree": "4fe871ff9bb7de0fb2a05537686ccd1a8d702f22", "parents": [ "b29dbe2549487a275f32363f8d00b8f1771e3f2d" ], "author": { "name": "Jean Haberer", "email": "jean.haberer@apple.com", "time": "Fri Jun 12 15:05:12 2026" }, "committer": { "name": "Jean Haberer", "email": "jean.haberer@apple.com", "time": "Fri Jun 12 15:05:12 2026" }, "message": "Remove Spatial Backdrop developer preview in favor of the Immersive API\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d316910\nrdar://160271766\n\nReviewed by Etienne Segonzac.\n\nRemove the whole Spatial Backdrop Developer preview.\nDevelopers can now use the new Immersive API, which is out of\ndeveloper preview to provide spatial backdrop.\n\nAdd a console error if we detect an old spatial-backdrop link tag.\n\n* Source/WTF/Scripts/Preferences/UnifiedWebPreferences.yaml:\n* Source/WTF/wtf/PlatformEnableCocoa.h:\n* Source/WebCore/Headers.cmake:\n* Source/WebCore/Sources.txt:\n* Source/WebCore/WebCore.xcodeproj/project.pbxproj:\n* Source/WebCore/dom/Document.cpp:\n* Source/WebCore/dom/Document.h:\n* Source/WebCore/dom/SpatialBackdropSource.cpp: Removed.\n* Source/WebCore/dom/SpatialBackdropSource.h: Removed.\n* Source/WebCore/html/HTMLLinkElement.cpp:\n* Source/WebCore/html/HTMLLinkElement.h:\n* Source/WebCore/html/HTMLLinkElement.idl:\n* Source/WebCore/html/LinkRelAttribute.cpp:\n* Source/WebCore/html/LinkRelAttribute.h:\n* Source/WebCore/page/ChromeClient.h:\n* Source/WebCore/page/Page.cpp:\n* Source/WebCore/page/Page.h:\n* Source/WebKit/Shared/API/Cocoa/WebKitPrivate.h:\n* Source/WebKit/Shared/WebCoreArgumentCoders.serialization.in:\n* Source/WebKit/SourcesCocoa.txt:\n* Source/WebKit/UIProcess/API/Cocoa/WKWebView.mm:\n* Source/WebKit/UIProcess/API/Cocoa/WKWebViewInternal.h:\n* Source/WebKit/UIProcess/API/Cocoa/WKWebViewPrivate.h:\n* Source/WebKit/UIProcess/API/Cocoa/_WKSpatialBackdropSource.h: Removed.\n* Source/WebKit/UIProcess/API/Cocoa/_WKSpatialBackdropSource.mm: Removed.\n* Source/WebKit/UIProcess/API/Cocoa/_WKSpatialBackdropSourceInternal.h: Removed.\n* Source/WebKit/UIProcess/Cocoa/PageClientImplCocoa.h:\n* Source/WebKit/UIProcess/Cocoa/PageClientImplCocoa.mm:\n* Source/WebKit/UIProcess/PageClient.h:\n* Source/WebKit/UIProcess/WebPageProxy.cpp:\n* Source/WebKit/UIProcess/WebPageProxy.h:\n* Source/WebKit/UIProcess/WebPageProxy.messages.in:\n* Source/WebKit/UIProcess/WebPageProxyInternals.h:\n* Source/WebKit/WebKit.xcodeproj/project.pbxproj:\n* Source/WebKit/WebProcess/WebCoreSupport/WebChromeClient.cpp:\n* Source/WebKit/WebProcess/WebCoreSupport/WebChromeClient.h:\n* Source/WebKit/WebProcess/WebPage/WebPage.cpp:\n* Source/WebKit/WebProcess/WebPage/WebPage.h:\n\nCanonical link: https://commits.webkit.org/315100@main\n" }, { "commit": "b29dbe2549487a275f32363f8d00b8f1771e3f2d", "tree": "e1d9a5fba404c51c23e41b55e63275ce0b58af5a", "parents": [ "7aacc6579a0267ca6db554536c3fff0d406686c5" ], "author": { "name": "Dan Hecht", "email": "dan.hecht@apple.com", "time": "Fri Jun 12 14:58:26 2026" }, "committer": { "name": "Dan Hecht", "email": "dan.hecht@apple.com", "time": "Fri Jun 12 14:58:26 2026" }, "message": "[JSC] Remove OMGIRGenerator::RootBlock\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d316956\nrdar://179420996\n\nReviewed by Yusuke Suzuki.\n\nThe root block level usesSIMD tracking is a relic of how the code used\nto work but it\u0027s no longer used. So let\u0027s just remove RootBlock and\nsome related code.\n\n* Source/JavaScriptCore/wasm/WasmOMGIRGenerator.cpp:\n(JSC::Wasm::OMGIRGenerator::OMGIRGenerator):\n(JSC::Wasm::OMGIRGenerator::insertEntrySwitch):\n(JSC::Wasm::OMGIRGenerator::addLoop):\n(JSC::Wasm::OMGIRGenerator::emitCatchImpl):\n(JSC::Wasm::OMGIRGenerator::emitCatchTableImpl):\n(JSC::Wasm::OMGIRGenerator::emitInlineDirectCall):\n(JSC::Wasm::OMGIRGenerator::usesSIMD): Deleted.\n\nCanonical link: https://commits.webkit.org/315099@main\n" }, { "commit": "7aacc6579a0267ca6db554536c3fff0d406686c5", "tree": "45171ba2d60bd84b6e049f73adab5c910b828f2a", "parents": [ "5a62df176e3b50f969cef1d86afff9c007a0f2f1" ], "author": { "name": "Ryosuke Niwa", "email": "rniwa@webkit.org", "time": "Fri Jun 12 14:53:57 2026" }, "committer": { "name": "Ryosuke Niwa", "email": "rniwa@webkit.org", "time": "Fri Jun 12 14:53:57 2026" }, "message": "Use-after-free in Element::dispatchBlurEvent\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d312365\nrdar://174646151\n\nReviewed by Rupin Mittal, Chris Dumez, and Anne van Kesteren.\n\nDeployed more smart pointers to fix the bug.\n\nTest: fast/events/blur-window-with-focus-in-shadow-tree-crash.html\n\n* LayoutTests/fast/events/blur-window-with-focus-in-shadow-tree-crash-expected.txt: Added.\n* LayoutTests/fast/events/blur-window-with-focus-in-shadow-tree-crash.html: Added.\n* Source/WebCore/page/FocusController.cpp:\n(WebCore::dispatchEventsOnWindowAndFocusedElement):\n\nOriginally-landed-as: 305413.673@safari-7624-branch (f045966f731c). rdar://176058798\nCanonical link: https://commits.webkit.org/315098@main\n" }, { "commit": "5a62df176e3b50f969cef1d86afff9c007a0f2f1", "tree": "1c5dab2c7ee352cfed7c79aa474dac0327cccdf1", "parents": [ "5ccb692f3e65ac32d6d6b83796dd8c9ca0bf1e1b" ], "author": { "name": "Tyler Wilcock", "email": "tyler_w@apple.com", "time": "Fri Jun 12 14:46:30 2026" }, "committer": { "name": "Tyler Wilcock", "email": "tyler_w@apple.com", "time": "Fri Jun 12 14:46:30 2026" }, "message": "AX: VoiceOver does not expose aria-actions custom actions when the action target is accessibility-ignored\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d316854\nrdar://179286650\n\nReviewed by Dominic Mazzoni.\n\nWhen an element with aria-actions points at action targets that are themselves\naccessibility-ignored, VoiceOver exposed no custom actions for the source element,\neven though the relation itself was built and synced correctly.\n\nThis happened whenever the action target was ignored. As an optimization, we cache\nonly a limited set of properties for nodes that are ignored, unless they are\n\"unconnected\" nodes (not in the exposed tree) that are part of a relation.\n\nHowever, we failed to add the ignored object into AXIsolatedTree::m_unconnectedNodes\nuntil after the oject had already been created, defeating the behavior of caching all\nproperties for objects in relations. Because we didn\u0027t cache all properties for these\nobjects, they computed an empty accname, and thus were not allowed to be exposed as actions.\n\nThis fix is simple: add to m_unconnectedNodes before creating the isolated object.\n\n* LayoutTests/accessibility/aria-actions-ignored-target-expected.txt: Added.\n* LayoutTests/accessibility/aria-actions-ignored-target.html: Added.\n* Source/WebCore/accessibility/isolatedtree/AXIsolatedTree.cpp:\n(WebCore::AXIsolatedTree::addUnconnectedNode):\n\nCanonical link: https://commits.webkit.org/315097@main\n" }, { "commit": "5ccb692f3e65ac32d6d6b83796dd8c9ca0bf1e1b", "tree": "df90e4dd5127863ac731e6465e91415c2e89222d", "parents": [ "7143ace56abb865760f080d2e558497d06be20e5" ], "author": { "name": "Patrick Griffis", "email": "pgriffis@igalia.com", "time": "Fri Jun 12 14:43:51 2026" }, "committer": { "name": "Patrick Griffis", "email": "pgriffis@igalia.com", "time": "Fri Jun 12 14:43:51 2026" }, "message": "[WPE] Implement a fallback popup menu\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d310383\n\nReviewed by Carlos Garcia Campos.\n\nWhen using WPE, depending on the backend, it may not have the capability\nof creating a popup menu. In this case we fallback to WebKit rendering\nits own.\n\nThe fallback popup supports all of the styling WebKit supports.\nIt tries to mimic a native OS popup in behavior where possible.\n\n* Source/WebCore/Sources.txt:\n* Source/WebCore/WebCore.xcodeproj/project.pbxproj:\n* Source/WebCore/css/CSSPseudoSelectors.json:\n* Source/WebCore/css/html.css:\n(select::-internal-fallback-popup-menu):\n(select::-internal-fallback-popup-menu-item,):\n(select::-internal-fallback-popup-menu-item-selected):\n(select::-internal-fallback-popup-menu-item:hover,):\n(select::-internal-fallback-popup-menu-group-label):\n(select::-internal-fallback-popup-menu-separator):\n* Source/WebCore/html/FallbackPopupMenu.cpp: Added.\n(WebCore::applyFontCascade):\n(WebCore::applyItemStyle):\n(WebCore::applyMenuStyle):\n(WebCore::FallbackPopupMenu::FallbackPopupMenu):\n(WebCore::FallbackPopupMenu::~FallbackPopupMenu):\n(WebCore::FallbackPopupMenu::show):\n(WebCore::FallbackPopupMenu::hide):\n(WebCore::FallbackPopupMenu::updateFromElement):\n(WebCore::FallbackPopupMenu::updateFromElementTimerFired):\n(WebCore::FallbackPopupMenu::disconnectClient):\n(WebCore::FallbackPopupMenu::itemClicked):\n(WebCore::FallbackPopupMenu::maybeClose):\n(WebCore::FallbackPopupMenu::buildPopupTree):\n(WebCore::FallbackPopupMenu::deletePopupTree):\n* Source/WebCore/html/FallbackPopupMenu.h: Added.\n(WebCore::FallbackPopupMenu::create):\n* Source/WebCore/html/HTMLSelectElement.cpp:\n(WebCore::HTMLSelectElement::menuListDefaultEventHandler):\n* Source/WebCore/html/HTMLSelectElement.h:\n* Source/WebCore/html/LazyLoadVideoObserver.h:\n* Source/WebCore/platform/PopupMenuClient.h:\n(WebCore::PopupMenuClient::showFallbackPopupMenu):\n* Source/WebCore/rendering/svg/RenderSVGText.cpp:\n* Source/WebKit/UIProcess/API/wpe/WebKitPopupMenu.cpp:\n(WebKit::WebKitPopupMenu::showPopupMenu):\n* Source/WebKit/UIProcess/WebPageProxy.cpp:\n* Source/WebKit/UIProcess/WebPageProxyInternals.h:\n* Source/WebKit/UIProcess/WebPopupMenuProxy.h:\n* Source/WebKit/WebProcess/WebCoreSupport/WebChromeClient.cpp:\n(WebKit::WebChromeClient::createPopupMenu const):\n* Source/WebKit/WebProcess/WebCoreSupport/WebPopupMenu.h:\n* Source/WebKit/WebProcess/WebPage/WebPage.cpp:\n(WebKit::WebPage::failedToShowPopupMenu):\n* Source/WebKit/WebProcess/WebPage/WebPage.h:\n* Source/WebKit/WebProcess/WebPage/WebPage.messages.in:\n\nCanonical link: https://commits.webkit.org/315096@main\n" }, { "commit": "7143ace56abb865760f080d2e558497d06be20e5", "tree": "c57877b2840b92497585b632de59d40f7e5cf889", "parents": [ "a58677958ef8fc58e910606655c7b06191d788dd" ], "author": { "name": "Darryl Parkinson", "email": "d_parkinson@apple.com", "time": "Fri Jun 12 14:33:57 2026" }, "committer": { "name": "Darryl Parkinson", "email": "d_parkinson@apple.com", "time": "Fri Jun 12 14:33:57 2026" }, "message": "Gate AddOriginAccessAllowListEntry IPC behind AllowTestOnlyIPC\nrdar://171243270\n\nReviewed by Charlie Wolfe and Ryosuke Niwa.\n\nOrigin access allowlist IPC messages on NetworkConnectionToWebProcess\nmodify a process-global allowlist with no validation, allowing a\ncompromised WebContent process to bypass CORS for all connections.\n\nThese messages are only used by TestRunner SPI. Gate them behind\nEnabledBy\u003dAllowTestOnlyIPC so they are rejected unless the test-only\nflag is set.\n\nTest: Tools/TestWebKitAPI/Tests/WebKitCocoa/IPCTestingAPI.mm\n\n* Source/WTF/Scripts/Preferences/UnifiedWebPreferences.yaml:\n* Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.messages.in:\n* Tools/TestWebKitAPI/Tests/WebKitCocoa/IPCTestingAPI.mm:\n(AddOriginAccessAllowListEntryRequiresTestOnlyIPC)):\n(AddOriginAccessAllowListEntryAllowedWithTestOnlyIPC)):\n* Tools/WebKitTestRunner/TestController.cpp:\n(WTR::TestController::resetPreferencesToConsistentValues):\n* Tools/WebKitTestRunner/TestOptions.cpp:\n(WTR::TestOptions::defaults):\n(WTR::TestOptions::keyTypeMapping):\n* Tools/WebKitTestRunner/TestOptions.h:\n(WTR::TestOptions::allowTestOnlyOriginAccessAllowListIPC const):\n\nOriginally-landed-as: 305413.421@rapid/safari-7624.2.5.110-branch (44da09d437d9). rdar://176067091\nCanonical link: https://commits.webkit.org/315095@main\n" }, { "commit": "a58677958ef8fc58e910606655c7b06191d788dd", "tree": "dc5b21157fbca1d55b2d6cc446da02f4610a31dc", "parents": [ "71eb21b1186a755c8de2c0ef9e7f743ac20f0406" ], "author": { "name": "Taher Ali", "email": "taher_ali@apple.com", "time": "Fri Jun 12 14:22:37 2026" }, "committer": { "name": "Taher Ali", "email": "taher_ali@apple.com", "time": "Fri Jun 12 14:22:37 2026" }, "message": "Animated GIF freezes when presentation attributes are changed on SVG image referenced by use element\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d314093\nrdar://179414226\n\nReviewed by Said Abou-Hallawa.\n\nWhen an SVG \u003cimage\u003e element displaying an animated GIF is referenced by a\n\u003cuse\u003e element, rapidly changing a presentation attribute like opacity causes\nthe animation to freeze.\n\nEach setAttribute call triggers invalidateInstances(), which rebuilds the\n\u003cuse\u003e shadow tree. The clone\u0027s renderer destruction calls\nRenderImageResource::willBeDestroyed(), which unconditionally calls\nstopAnimation() on the shared BitmapImage. Since the animation timer is\nkilled faster than the frame duration, it never fires to advance frames.\n\nThe previous landing of this fix (313531@main) used CachedImage::isVisibleInViewport()\nto decide whether to stop the animation, but it was reverted because it caused a\nMotionMark performance regression and a crash.\n\nThis version instead introduces CachedImage::numberOfRendererClients(), which\nwalks the client list and counts only renderer clients.\n\nTest: svg/custom/use-animated-image-opacity-change.html\n\n* LayoutTests/fast/images/stopped-animation-deleted-image.html:\n* LayoutTests/svg/custom/resources/animated-gif-for-use-test.gif: Added.\n* LayoutTests/svg/custom/use-animated-image-opacity-change-expected.txt: Added.\n* LayoutTests/svg/custom/use-animated-image-opacity-change.html: Added.\n* Source/WebCore/loader/cache/CachedImage.cpp:\n(WebCore::CachedImage::hasRendererClients const):\n* Source/WebCore/loader/cache/CachedImage.h:\n* Source/WebCore/loader/cache/CachedImageClient.h:\n(WebCore::CachedImageClient::isRendererClient const):\n* Source/WebCore/rendering/RenderImageResource.cpp:\n(WebCore::RenderImageResource::willBeDestroyed):\n* Source/WebCore/rendering/RenderObject.h:\n\nCanonical link: https://commits.webkit.org/315094@main\n" }, { "commit": "71eb21b1186a755c8de2c0ef9e7f743ac20f0406", "tree": "f65de57fad77760852c768c793d94f8e5723448e", "parents": [ "a8884b8e05e683e3e5022a2034cc4ff5bf98ccc1" ], "author": { "name": "Aakash Jain", "email": "aakash_jain@apple.com", "time": "Fri Jun 12 13:56:31 2026" }, "committer": { "name": "Aakash Jain", "email": "aakash_jain@apple.com", "time": "Fri Jun 12 13:56:31 2026" }, "message": "[ews] Improve logging for S3 upload in case of failure\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d316988\nrdar://179476116\n\nUnreviewed minor fix.\n\n* Tools/Scripts/upload-file-to-url:\n\nCanonical link: https://commits.webkit.org/315093@main\n" }, { "commit": "a8884b8e05e683e3e5022a2034cc4ff5bf98ccc1", "tree": "226405b9f43538af949226b839173179264bacc7", "parents": [ "cf16656cdaabfbd898f3c3542a7ad9c95fbbd25c" ], "author": { "name": "Claudio Saavedra", "email": "csaavedra@igalia.com", "time": "Fri Jun 12 13:45:36 2026" }, "committer": { "name": "Claudio Saavedra", "email": "csaavedra@igalia.com", "time": "Fri Jun 12 13:45:36 2026" }, "message": "Non-unified build fixes for June 12th, 2026\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d316987\n\nUnreviewed build fixes.\n\n* Source/WebCore/accessibility/AccessibilityScrollView.cpp:\n* Source/WebCore/editing/InsertNestedListCommand.cpp:\n* Source/WebCore/editing/ModifySelectionListLevel.cpp:\n* Source/WebCore/editing/RemoveFormatCommand.cpp:\n* Source/WebCore/editing/SimplifyMarkupCommand.cpp:\n* Source/WebCore/html/HTMLMeterElement.cpp:\n* Source/WebCore/inspector/agents/frame/FrameDOMAgent.cpp:\n* Source/WebCore/style/computed/StyleComputedStyleProperties+GettersCustom.cpp:\n* Source/WebCore/style/values/images/StyleObjectViewBox.cpp:\n* Source/WebCore/workers/shared/SharedWorkerScriptLoader.cpp:\n\nCanonical link: https://commits.webkit.org/315092@main\n" }, { "commit": "cf16656cdaabfbd898f3c3542a7ad9c95fbbd25c", "tree": "959d31921dce3638f60718abc17143244edff452", "parents": [ "41ce48e2d2b7bc97b9a3754ddfc32a8a69f90019" ], "author": { "name": "Adrian Perez de Castro", "email": "aperez@igalia.com", "time": "Fri Jun 12 13:28:30 2026" }, "committer": { "name": "Adrian Perez de Castro", "email": "aperez@igalia.com", "time": "Fri Jun 12 13:28:30 2026" }, "message": "[GTK][WPE] Expose search inputs as WEBKIT_INPUT_PURPOSE_SEARCH\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d316942\n\nReviewed by Carlos Garcia Campos.\n\nExpose the internal WebCore::InputMode::Search / HTMLInputElement::isSearchField()\nas WEBKIT_INPUT_PURPOSE_SEARCH in the public API for the GTK and WPE ports, and as\nWPE_INPUT_PURPOSE_SEARCH in WPEPlatform.\n\nIn the case of the GTK port the WEBKIT_INPUT_PURPOSE_SEARCH value is folded into\nGTK_INPUT_PURPOSE_FREE_FORM because the toolkit does not provide an equivalent.\nApplications can still use the WebKitInputPurpose value, though.\n\n* Source/WebKit/Shared/glib/InputMethodState.cpp:\n(WebKit::InputMethodState::setPurposeOrHintForInputMode):\n(WebKit::InputMethodState::setPurposeForInputElement):\n* Source/WebKit/Shared/glib/InputMethodState.h:\n* Source/WebKit/Shared/glib/InputMethodState.serialization.in:\n* Source/WebKit/UIProcess/API/glib/InputMethodFilter.cpp:\n(WebKit::toWebKitPurpose):\n* Source/WebKit/UIProcess/API/glib/WebKitInputMethodContext.h.in:\n* Source/WebKit/UIProcess/API/gtk/WebKitInputMethodContextImplGtk.cpp:\n(toGtkInputPurpose):\n* Source/WebKit/UIProcess/API/wpe/WebKitInputMethodContextImplWPE.cpp:\n(toWPEInputPurpose):\n* Source/WebKit/WPEPlatform/wpe/WPEInputMethodContext.h:\n* Tools/TestWebKitAPI/Tests/WebKit/WKPage/glib/TestInputMethodContext.cpp:\n(testWebKitInputMethodContextContentType):\n\nCanonical link: https://commits.webkit.org/315091@main\n" }, { "commit": "41ce48e2d2b7bc97b9a3754ddfc32a8a69f90019", "tree": "ce8bd21680385722e0d1ec6272ada71b30ee0bd2", "parents": [ "5756012375b90fd63a73eeee8295d88c739bd350" ], "author": { "name": "Carlos Garcia Campos", "email": "cgarcia@igalia.com", "time": "Fri Jun 12 13:01:39 2026" }, "committer": { "name": "Carlos Garcia Campos", "email": "cgarcia@igalia.com", "time": "Fri Jun 12 13:01:39 2026" }, "message": "Unreviewed. Fix the build\n\nAdd missing include.\n\n* Source/WebCore/Modules/mediacapabilities/MediaCapabilities.cpp:\n\nCanonical link: https://commits.webkit.org/315090@main\n" }, { "commit": "5756012375b90fd63a73eeee8295d88c739bd350", "tree": "9e5ab382f7147b7932d2d78b574fe43463f8c841", "parents": [ "083f263204a7f4fa1168ce116eaf30cd8c1868b2" ], "author": { "name": "Przemyslaw Gorszkowski", "email": "pgorszkowski@igalia.com", "time": "Fri Jun 12 12:37:11 2026" }, "committer": { "name": "Przemyslaw Gorszkowski", "email": "pgorszkowski@igalia.com", "time": "Fri Jun 12 12:37:11 2026" }, "message": "[GStreamer] Video element with canvas captureStream source should not use holepunch rendering\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d316297\n\nReviewed by Philippe Normand.\n\nIntroduce a dedicated Canvas device type in CaptureDevice::DeviceType\nto distinguish CanvasCaptureMediaStreamTrack sources from Camera sources.\nUpdate all switch statements and type checks across the mediastream stack to\nhandle Canvas as a video type.\nDisable GStreamer hole-punch rendering for canvas-captured streams since they\nrender via a different path.\n\nNo new tests.\n\nThere is: ManualTests/mediastream/mediastream-canvas-to-video.html, which can\nbe used to test this change. It should behave in the same way with:\nWEBKIT_GST_HOLE_PUNCH_QUIRK\u003dfake and without it.\n\n* Source/WebCore/Modules/mediastream/CanvasCaptureMediaStreamTrack.cpp:\n(WebCore::CanvasCaptureMediaStreamTrack::Source::Source):\n* Source/WebCore/Modules/mediastream/CanvasCaptureMediaStreamTrack.h:\n* Source/WebCore/Modules/mediastream/MediaDeviceInfo.cpp:\n(WebCore::toMediaDeviceInfoKind):\n* Source/WebCore/Modules/mediastream/MediaStreamTrack.cpp:\n(WebCore::MediaStreamTrack::captureState):\n* Source/WebCore/dom/Document.cpp:\n(WebCore::updateCaptureSourceToPageMutedState):\n* Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:\n(WebCore::MediaPlayerPrivateGStreamer::isHolePunchRenderingEnabled const):\n* Source/WebCore/platform/mediastream/CaptureDevice.h:\n* Source/WebCore/platform/mediastream/RealtimeMediaSource.cpp:\n(WebCore::toSourceType):\n* Source/WebCore/platform/mediastream/gstreamer/GStreamerCaptureDeviceManager.cpp:\n(WebCore::GStreamerCaptureDeviceManager::refreshCaptureDevices):\n* Source/WebCore/platform/mock/MockRealtimeMediaSourceCenter.cpp:\n\nCanonical link: https://commits.webkit.org/315089@main\n" }, { "commit": "083f263204a7f4fa1168ce116eaf30cd8c1868b2", "tree": "57b6ef05f73b5ca46840d3bd81b66f0cd2faff07", "parents": [ "3919bd62ec83c09518a8000ff29870a613d22e5b" ], "author": { "name": "Przemyslaw Gorszkowski", "email": "pgorszkowski@igalia.com", "time": "Fri Jun 12 12:04:33 2026" }, "committer": { "name": "Przemyslaw Gorszkowski", "email": "pgorszkowski@igalia.com", "time": "Fri Jun 12 12:04:33 2026" }, "message": "navigator.mediaCapabilities wrapper should not become GC-collectable before its navigator object\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d315684\n\nReviewed by Ryosuke Niwa.\n\nnavigator.mediaCapabilities wrapper should not become GC-collectable before its navigator object.\nThe MediaCapabilities interface is annotated [SameObject] in the spec:\nhttps://www.w3.org/TR/media-capabilities/#idl-index\nIt means that navigator.mediaCapabilities must return the same object on every access.\n\nSee: https://github.com/WebPlatformForEmbedded/WPEWebKit/pull/1678\n\nOriginal author: Andrzej Surdej (https://github.com/asurdej-comcast)\n\nUpdated existing LayoutTest with mediaCapabilities case.\n\n* LayoutTests/fast/dom/navigator-property-gc-after-frame-detach-expected.txt:\n* LayoutTests/fast/dom/navigator-property-gc-after-frame-detach.html:\n* Source/WebCore/Modules/mediacapabilities/MediaCapabilities.cpp:\n(WebCore::MediaCapabilities::MediaCapabilities):\n(WebCore::MediaCapabilities::navigator):\n* Source/WebCore/Modules/mediacapabilities/MediaCapabilities.h:\n(WebCore::MediaCapabilities::create):\n* Source/WebCore/Modules/mediacapabilities/MediaCapabilities.idl:\n* Source/WebCore/Modules/mediacapabilities/NavigatorMediaCapabilities.cpp:\n(WebCore::NavigatorMediaCapabilities::NavigatorMediaCapabilities):\n(WebCore::NavigatorMediaCapabilities::from):\n* Source/WebCore/Modules/mediacapabilities/NavigatorMediaCapabilities.h:\n* Source/WebCore/Modules/mediacapabilities/WorkerNavigatorMediaCapabilities.cpp:\n(WebCore::WorkerNavigatorMediaCapabilities::WorkerNavigatorMediaCapabilities):\n(WebCore::WorkerNavigatorMediaCapabilities::from):\n* Source/WebCore/Modules/mediacapabilities/WorkerNavigatorMediaCapabilities.h:\n\nCanonical link: https://commits.webkit.org/315088@main\n" }, { "commit": "3919bd62ec83c09518a8000ff29870a613d22e5b", "tree": "bf62d1fef96b4cf0b2f275435b5d918ca8c19350", "parents": [ "7abc2361027ff0b9cd4f8d6c284f9ef89205eb5a" ], "author": { "name": "Chris Dumez", "email": "cdumez@apple.com", "time": "Fri Jun 12 11:27:55 2026" }, "committer": { "name": "Chris Dumez", "email": "cdumez@apple.com", "time": "Fri Jun 12 11:27:55 2026" }, "message": "ScreenTime data removal uses an unanchored host suffix match, deleting unrelated sites\u0027 data\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d316884\n\nReviewed by Abrar Rahman Protyasha.\n\nScreenTimeWebsiteDataSupport::removeScreenTimeData() built a set of host\nstrings from the origins to remove, then for every URL in the ScreenTime\nhistory deleted it when [[url host] hasSuffix:domainString]. A bare\nhasSuffix: check has no label boundary, so removing ScreenTime data for\n\"apple.com\" also matched and deleted history for \"notapple.com\",\n\"myapple.com\", \"evilapple.com\", etc. — any host that happens to end with\nthe literal suffix.\n\nWebsiteDataRecord::hostIsInDomain() already implements the correct\nsemantics: a suffix match additionally requires either an exact match or\nthat the character preceding the suffix is \u0027.\u0027. Add an NSString-based\nequivalent and use it in place of the bare hasSuffix: check, so that\n\"apple.com\" matches \"apple.com\" and \"www.apple.com\" but not \"notapple.com\".\n\nThe comparison is kept in NSString space because the\nfetchAllHistoryWithCompletionHandler completion block may run off the\nmain thread, where WTF::String ref-counting is not thread-safe. Also\n break out of the inner loop once a URL matches (avoiding a redundant\ndeleteHistoryForURL: for the same URL), and skip empty hosts when\nbuilding the match set.\n\nTest: ScreenTime.RemoveDataDoesNotMatchUnanchoredHostSuffix\n\n* Source/WebKit/UIProcess/WebsiteData/Cocoa/ScreenTimeWebsiteDataSupport.mm:\n(WebKit::ScreenTimeWebsiteDataSupport::hostIsInDomain):\n(WebKit::ScreenTimeWebsiteDataSupport::removeScreenTimeData):\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/ScreenTime.mm:\n(TEST(ScreenTime, RemoveDataDoesNotMatchUnanchoredHostSuffix)):\n\nCanonical link: https://commits.webkit.org/315087@main\n" }, { "commit": "7abc2361027ff0b9cd4f8d6c284f9ef89205eb5a", "tree": "2b7588912533d086f067fa4234cebd49d780c49f", "parents": [ "6a4f65a5bcc38e610c91fe957a47f5463242c70b" ], "author": { "name": "Nikolas Zimmermann", "email": "nzimmermann@igalia.com", "time": "Fri Jun 12 11:24:01 2026" }, "committer": { "name": "Nikolas Zimmermann", "email": "zimmermann@kde.org", "time": "Fri Jun 12 11:24:01 2026" }, "message": "[CMake] Glob all Source/cmake/*.cmake files when deciding to remove CMakeCache.txt\n\nReviewed by Carlos Alberto Lopez Perez.\n\nshouldRemoveCMakeCache() only checked a hand-picked subset of cmake files\n(the port Options file, OptionsCommon and WebKitCompilerFlags) against the\ncache mtime, so edits to other configuration files that influence the\ngenerated cache -- WebKitFeatures, VersioningUtils, did not trigger an\nautomatic reconfigure.\n\nReplace the enumerated checks (and the redundant Windows-only OptionsWin\nspecial case) with a glob over Source/cmake/*.cmake, so every current and\nfuture module is covered automatically.\n\n* Tools/Scripts/webkitdirs.pm:\n(shouldRemoveCMakeCache):\n\nCanonical link: https://commits.webkit.org/315086@main\n" }, { "commit": "6a4f65a5bcc38e610c91fe957a47f5463242c70b", "tree": "51e784d6f3e3d18b0ccd364fa00759c8f1625b0e", "parents": [ "834967406989dc98e038dc03a810f085db79738a" ], "author": { "name": "Philippe Normand", "email": "philn@igalia.com", "time": "Fri Jun 12 11:02:52 2026" }, "committer": { "name": "Philippe Normand", "email": "philn@igalia.com", "time": "Fri Jun 12 11:02:52 2026" }, "message": "[GStreamer] Migrate MediaStream source element to PadProbeHandle\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d316551\n\nReviewed by Xabier Rodriguez-Calvar.\n\nRefactoring migrating from gst_pad_add_probe to PadProbeHandle.\n\n* Source/WebCore/platform/mediastream/gstreamer/GStreamerMediaStreamSource.cpp:\n(webkitMediaStreamSrcAddTrack):\n(webkitMediaStreamSrcPadProbeCb): Deleted.\n\nCanonical link: https://commits.webkit.org/315085@main\n" } ], "next": "834967406989dc98e038dc03a810f085db79738a" }