)]}'
{
  "log": [
    {
      "commit": "399d0492b38c5d81e4dd2374348b06e0e7aaf083",
      "tree": "9f033b4a9137942d360e951ab9f31f79229383fe",
      "parents": [
        "42a5b5300e3d05ac9a9274479d118958892a9508"
      ],
      "author": {
        "name": "Ahmad Saleem",
        "email": "ahmad.saleem792+github@gmail.com",
        "time": "Sun Aug 09 13:50:45 2026"
      },
      "committer": {
        "name": "Ahmad Saleem",
        "email": "ahmad.saleem792@gmail.com",
        "time": "Sun Aug 09 13:50:45 2026"
      },
      "message": "Resync `css-link-params` from WPT Upstream\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d321392\nrdar://184446435\n\nReviewed by Taher Ali.\n\nUpstream commit: https://github.com/web-platform-tests/wpt/commit/54f8f933629e7c010ae98a246729af01f8abcda5\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-link-params/inheritance.html:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-link-params/link-parameters-computed-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-link-params/link-parameters-computed.html:\n\nCanonical link: https://commits.webkit.org/318860@main\n"
    },
    {
      "commit": "42a5b5300e3d05ac9a9274479d118958892a9508",
      "tree": "d18bf8e197e05c63772332b29e3940c67a7c3996",
      "parents": [
        "8cbbfc9b154d2063cf96f04b40ae7e437fac9241"
      ],
      "author": {
        "name": "Alicia Boya Garcia",
        "email": "aboya@igalia.com",
        "time": "Sun Aug 09 12:48:31 2026"
      },
      "committer": {
        "name": "Enrique Ocaña González",
        "email": "eocanha@igalia.com",
        "time": "Sun Aug 09 12:48:31 2026"
      },
      "message": "[GStreamer][MSE] Avoid spurious seek to 0 when seeking to end\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d320981\n\nReviewed by Xabier Rodriguez-Calvar.\n\nOn a device where a GStreamer seek operation leads to a pipeline async\nstate change, we may enter a flow of internal calls that cause a second\nseek to zero to be executed before the first call has returned. This was\ndetected with Spotify when performing a seek to the asset end (duration)\nright after playback has started from the beginning (position zero).\nThis issue does not happen if the GStreamer seek operation does not\ncause a async pipeline state change.\n\nSee: https://github.com/WebPlatformForEmbedded/WPEWebKit/issues/1645\n\nThis patch avoids automatic playback when the video has ended\n(effectively helping to avoid currentTime accidentally going beyond the\nduration) or when a seek is still happening (avoiding currentTime to\nprogress and change the conditions of the video). ReadyState is\npropagated to the player when seek has completed, helping the\nHTMLMediaElement algorithms to take the right decisions when seek\ncompletes. Finally, code has been added to avoid the position to ever go\nbeyond the duration in order to avoid a degradation of the ReadyState to\nHaveMetadata, except when the duration is zero. This is a special case\nused by MediaPlayerPrivateGStreamer::duration() and\nMediaPlayerPrivateGStreamerMSE::duration() when the duration is\nunknown/unavailable, and we don\u0027t want to mess up with that and cause a\nstream that is just being loaded to trigger unexpected effects.\n\nCo-authored-by: Enrique Ocaña González \u003ceocanha@igalia.com\u003e\n\nTest: media/media-source/media-source-seek-to-end-doesnt-loop.html\n\n* LayoutTests/media/media-source/media-source-seek-to-end-doesnt-loop-expected.txt: Added.\n* LayoutTests/media/media-source/media-source-seek-to-end-doesnt-loop.html: Added.\n* Source/WebCore/html/HTMLMediaElement.cpp:\n(WebCore::HTMLMediaElement::mediaPlayerPlaybackStateChanged): Avoid automatic playback on seek or video end.\n* Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:\n(WebCore::MediaPlayerPrivateGStreamer::playbackPosition const): Never allow the position to go beyond duration, except in the special case when duration is zero.\n* Source/WebCore/platform/graphics/gstreamer/mse/MediaPlayerPrivateGStreamerMSE.cpp:\n(WebCore::MediaPlayerPrivateGStreamerMSE::doSeek): Propagate readyState to player on seek completion.\n(WebCore::MediaPlayerPrivateGStreamerMSE::propagateReadyStateToPlayer): Relaxed the assert so also admit m_isSeeking as a condition to not halt execution.\n\nCanonical link: https://commits.webkit.org/318859@main\n"
    },
    {
      "commit": "8cbbfc9b154d2063cf96f04b40ae7e437fac9241",
      "tree": "438ce95e20aa35abac0b0cc3448ca6b63047c8c5",
      "parents": [
        "9010d6d3bec84492b190049c3e327a803e7ddd65"
      ],
      "author": {
        "name": "Ahmad Saleem",
        "email": "ahmad.saleem792+github@gmail.com",
        "time": "Sun Aug 09 12:33:28 2026"
      },
      "committer": {
        "name": "Ahmad Saleem",
        "email": "ahmad.saleem792@gmail.com",
        "time": "Sun Aug 09 12:33:28 2026"
      },
      "message": "Remove non-standard `percentage` value from `-webkit-line-clamp`\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d298000\nrdar://159808285\n\nReviewed by Alan Baradlay.\n\nThis patch removes non-standard percentage value from `-webkit-line-clamp`,\nwhich is not present in new standard for `line-clamp` plus this was also\ndropped from Blink in 2018 [1] due to lack of usage and it also has quirky\nundefined behavior different from web developer expectations in percentage\ndistribution between lines.\n\n[1] https://chromium.googlesource.com/chromium/src.git/+/7dc2379d58e26905dd77c56617d0baf9972581eb\n\n* Source/WebCore/Sources.txt:\n* Source/WebCore/WebCore.xcodeproj/project.pbxproj:\n* Source/WebCore/css/CSSProperties.json:\n* Source/WebCore/rendering/RenderDeprecatedFlexibleBox.cpp:\n(WebCore::RenderDeprecatedFlexibleBox::hasClampingAndNoFlexing const):\n(WebCore::RenderDeprecatedFlexibleBox::applyLineClamp):\n(WebCore::lineCountFor): Deleted.\n* Source/WebCore/style/values/non-standard/StyleWebKitLineClamp.cpp: Removed.\n* Source/WebCore/style/values/non-standard/StyleWebKitLineClamp.h:\n(WebCore::Style::WebkitLineClamp::WebkitLineClamp): Deleted.\n(WebCore::Style::WebkitLineClamp::isNone const): Deleted.\n(WebCore::Style::WebkitLineClamp::isPercentage const): Deleted.\n(WebCore::Style::WebkitLineClamp::isInteger const): Deleted.\n(WebCore::Style::WebkitLineClamp::tryPercentage const): Deleted.\n(WebCore::Style::WebkitLineClamp::tryInteger const): Deleted.\n(WebCore::Style::WebkitLineClamp::holdsAlternative const): Deleted.\n(WebCore::Style::WebkitLineClamp::switchOn const): Deleted.\n(WebCore::Style::WebkitLineClamp::valueForTextAutosizingHash const): Deleted.\n\n\u003e Tests:\n* LayoutTests/fast/css/webkit-line-clamp-calculated-value-expected.txt:\n* LayoutTests/fast/css/webkit-line-clamp-calculated-value.html:\n* LayoutTests/fast/overflow/line-clamp.html:\n* LayoutTests/platform/mac/fast/overflow/line-clamp-expected.txt:\n* LayoutTests/platform/ios/fast/overflow/line-clamp-expected.txt:\n* LayoutTests/platform/glib/fast/overflow/line-clamp-expected.txt:\n\nCanonical link: https://commits.webkit.org/318858@main\n"
    },
    {
      "commit": "9010d6d3bec84492b190049c3e327a803e7ddd65",
      "tree": "7b793f23908309234f053468ed8641e863727409",
      "parents": [
        "2f72b3d7740d588f216e4fc2e746e963931f0d93"
      ],
      "author": {
        "name": "Nikolas Zimmermann",
        "email": "nzimmermann@igalia.com",
        "time": "Sun Aug 09 12:14:11 2026"
      },
      "committer": {
        "name": "Nikolas Zimmermann",
        "email": "zimmermann@kde.org",
        "time": "Sun Aug 09 12:14:11 2026"
      },
      "message": "[Skia] Re-enable damage in composition feature\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d321378\n\nReviewed by Fujii Hironori.\n\nRe-enable \u0027UseDamagingInformationForCompositing\u0027, since the performance regressions are gone.\nAlso enable \u0027UnifyDamagedRegions\u0027 since it gives a small performance benefit on rpi4 + MotionMark.\n\n* Source/WTF/Scripts/Preferences/UnifiedWebPreferences.yaml:\n\nCanonical link: https://commits.webkit.org/318857@main\n"
    },
    {
      "commit": "2f72b3d7740d588f216e4fc2e746e963931f0d93",
      "tree": "1f83f5311cb5a8efff9afca1932f15d9c82bf709",
      "parents": [
        "ba411cfeaffd5850c6ea32f90a22d5c72ca3443a"
      ],
      "author": {
        "name": "Nikolas Zimmermann",
        "email": "nzimmermann@igalia.com",
        "time": "Sun Aug 09 12:07:08 2026"
      },
      "committer": {
        "name": "Nikolas Zimmermann",
        "email": "zimmermann@kde.org",
        "time": "Sun Aug 09 12:07:08 2026"
      },
      "message": "[Skia] Skip damage restriction when the damage covers the whole draw\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d321377\n\nReviewed by Alejandro G. Castro.\n\nRespecting the damage information in compositing regressed the MotionMark\ncomposition suite by about 20%, and two of its tests by more than 50%.\n\nA draw is restricted to the damage either by splitting it into multiple\nsource-rect-to-destination-rect pieces, which needs a transform that keeps\nrects as rects, or by drawing it under a device-space clip of the damage\nregion. Neither restricts a draw that the damage already covers. A composited\nlayer in the affected tests is much smaller than a damage grid cell, so most\nlayers are covered. Draw those the way they are drawn with damage off.\nThe extra clips add nothing and only stop the batching.\n\nSkia turned a region of more than one rect into a clip path, and the image set\nbatch entries carry no clip quad, so a draw needing a clip also flushed the\nbatch, leaving it an order of magnitude smaller than it is without damage.\nSolid color layers never reach the batch and paid the clip alone, and filters\npaid it again per layer, compositing their intermediate surface back under\nthe clip as well.\n\nFix that and recover the performance losses, while keeping damage\npropagation intact for the cases where it pays off.\n\n* Source/WebCore/platform/graphics/skia/SkiaCompositingLayerImageSetBatch.cpp:\n(WebCore::SkiaCompositingLayerImageSetBatch::addImageSet):\n(WebCore::SkiaCompositingLayerImageSetBatch::addImage):\n* Source/WebCore/platform/graphics/skia/SkiaCompositingLayerImageSetBatch.h:\n(WebCore::SkiaCompositingLayerImageSetBatch::planRestrictedDraw):\n* Source/WebCore/platform/graphics/skia/SkiaDamageRegion.h:\n(WebCore::SkiaDamageRegion::covers const):\n(WebCore::SkiaDamageRegion::restrictDraw const):\n\nCanonical link: https://commits.webkit.org/318856@main\n"
    },
    {
      "commit": "ba411cfeaffd5850c6ea32f90a22d5c72ca3443a",
      "tree": "4823ba12a74108ab9ca5384ced8690288cda81ef",
      "parents": [
        "7b5e7da783f58bd8ee2321ff0a399617f0d2acc8"
      ],
      "author": {
        "name": "Yusuke Suzuki",
        "email": "ysuzuki@apple.com",
        "time": "Sun Aug 09 09:29:06 2026"
      },
      "committer": {
        "name": "Yusuke Suzuki",
        "email": "ysuzuki@apple.com",
        "time": "Sun Aug 09 09:29:06 2026"
      },
      "message": "Unreviewed, speculative fix\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d321390\nrdar://184444637\n\n* Source/WebKit/CMakeLists.txt:\n\nCanonical link: https://commits.webkit.org/318855@main\n"
    },
    {
      "commit": "7b5e7da783f58bd8ee2321ff0a399617f0d2acc8",
      "tree": "ef04151bbdcc9e9835871333078edcb7427f1170",
      "parents": [
        "6850883ce88bda38eec2a026e7b7ab8d044097ea"
      ],
      "author": {
        "name": "Sosuke Suzuki",
        "email": "sosuke@bun.sh",
        "time": "Sun Aug 09 08:51:02 2026"
      },
      "committer": {
        "name": "Sosuke Suzuki",
        "email": "sosuke@bun.com",
        "time": "Sun Aug 09 08:51:02 2026"
      },
      "message": "[YARR] `\\P{...}` on the right side of a v-mode `\u0026\u0026` or `--` becomes a union\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d321252\n\nReviewed by Yusuke Suzuki.\n\nappendInverted() adds the complement of its operand directly to the accumulated\nmatches and ranges without consulting m_setOp, so a pending \u0026\u0026 or -- turns into a union.\n\n    /[\\p{L}\u0026\u0026\\P{Lu}]/v.test(\"A\")        // true, should be false\n    /^[\\q{ab|c|1}\u0026\u0026\\P{L}]$/v.test(\"ab\") // true, should be false\n\nWhen an intersection or subtraction is pending, materialize the complement into a\ntemporary CharacterClass and funnel it through append(), which dispatches on m_setOp\nfor both matches and strings. addSortedInverted()\u0027s adjacent-merge branch targets the\nmember range vectors, but it cannot fire for the temporary since complement pieces\nare always separated by an element of the operand.\n\nTest: JSTests/stress/regexp-v-flag-class-set-op-inverted-property.js\n\n* JSTests/stress/regexp-v-flag-class-set-op-inverted-property.js: Added.\n(shouldBe):\n* Source/JavaScriptCore/yarr/YarrPattern.cpp:\n(JSC::Yarr::CharacterClassConstructor::appendInverted):\n\nCanonical link: https://commits.webkit.org/318854@main\n"
    },
    {
      "commit": "6850883ce88bda38eec2a026e7b7ab8d044097ea",
      "tree": "5c9b44b01c80e4240a398eddbc0a0bfed5b8a150",
      "parents": [
        "c476e1a19df80f83e57e8d577d9baa6cde22d083"
      ],
      "author": {
        "name": "Chris Dumez",
        "email": "cdumez@apple.com",
        "time": "Sun Aug 09 07:18:26 2026"
      },
      "committer": {
        "name": "Chris Dumez",
        "email": "cdumez@apple.com",
        "time": "Sun Aug 09 07:18:26 2026"
      },
      "message": "Clicking an element nested inside a checkbox/radio wrongly activates the ancestor input\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d321247\n\nReviewed by Darin Adler.\n\nWebKit\u0027s legacy-pre-activation behavior (the checkbox/radio toggle that happens before\nevent dispatch) was applied to the first \u003cinput\u003e found anywhere in the event path,\nincluding an ancestor checkbox/radio. Per the DOM specification, legacy-pre-activation\nbehavior must only run on the event\u0027s activation target, which is the innermost node in\nthe event path that has activation behavior. So when an element with its own activation\nbehavior (e.g. a submit/reset \u003cbutton\u003e, an \u003ca\u003e/\u003carea\u003e link, a \u003csummary\u003e, or a\n\u003clabel\u003e\u003cbutton type\u003dbutton\u003e) is nested inside a checkbox/radio, that inner element is the\nactivation target and the ancestor input must not be toggled or activated.\n\nIntroduce a virtual Node::hasActivationBehavior() (matching the spec concept and Blink\u0027s\nHasActivationBehavior), returning true for HTMLInputElement, HTMLButtonElement,\nHTMLLabelElement, and HTMLSummaryElement, and isLink() for HTMLAnchorElement (and\nHTMLAreaElement via inheritance). findInputElementInEventPath() now returns the innermost\nnode with activation behavior, and only when that node is an \u003cinput\u003e; otherwise no legacy\npre-activation behavior runs.\n\nThis fixes 14 subtests in Event-dispatch-single-activation-behavior.html, including the 12\nthat already pass in both Chrome and Firefox. The remaining failures match the ones Chrome\nand/or Firefox also fail.\n\nNo new tests, rebaselined existing WPT test.\n\n* LayoutTests/imported/w3c/web-platform-tests/dom/events/Event-dispatch-single-activation-behavior-expected.txt:\n* Source/WebCore/dom/EventDispatcher.cpp:\n(WebCore::findInputElementInEventPath):\n* Source/WebCore/dom/Node.cpp:\n(WebCore::Node::hasActivationBehavior const):\n* Source/WebCore/dom/Node.h:\n* Source/WebCore/html/HTMLAnchorElement.cpp:\n(WebCore::HTMLAnchorElement::isSystemPreviewLink):\n* Source/WebCore/html/HTMLAnchorElement.h:\n* Source/WebCore/html/HTMLButtonElement.cpp:\n(WebCore::HTMLButtonElement::hasActivationBehavior const):\n* Source/WebCore/html/HTMLButtonElement.h:\n* Source/WebCore/html/HTMLInputElement.cpp:\n(WebCore::HTMLInputElement::hasActivationBehavior const):\n* Source/WebCore/html/HTMLInputElement.h:\n* Source/WebCore/html/HTMLLabelElement.cpp:\n(WebCore::HTMLLabelElement::hasActivationBehavior const):\n* Source/WebCore/html/HTMLLabelElement.h:\n* Source/WebCore/html/HTMLSummaryElement.cpp:\n(WebCore::HTMLSummaryElement::hasActivationBehavior const):\n* Source/WebCore/html/HTMLSummaryElement.h:\n\nCanonical link: https://commits.webkit.org/318853@main\n"
    },
    {
      "commit": "c476e1a19df80f83e57e8d577d9baa6cde22d083",
      "tree": "7c755df8fb5fe5e99ab857bb32266d06d6ec9fab",
      "parents": [
        "5e3ca7af650ecd4aae5d90c5ee663859b405763b"
      ],
      "author": {
        "name": "Fujii Hironori",
        "email": "fujii@igalia.com",
        "time": "Sun Aug 09 04:12:53 2026"
      },
      "committer": {
        "name": "Fujii Hironori",
        "email": "fujii@igalia.com",
        "time": "Sun Aug 09 04:12:53 2026"
      },
      "message": "[GLib] layout test gardening 2026-08-09\n\nUnreviewed.\n\n* LayoutTests/platform/glib/TestExpectations:\n* LayoutTests/platform/gtk/TestExpectations:\n\nCanonical link: https://commits.webkit.org/318852@main\n"
    },
    {
      "commit": "5e3ca7af650ecd4aae5d90c5ee663859b405763b",
      "tree": "548dbe697a5386d324c1a7c114cc8e6d88a9e955",
      "parents": [
        "919642bf433d001fac3d84632615cedb6243be85"
      ],
      "author": {
        "name": "Ahmad Saleem",
        "email": "ahmad.saleem792+github@gmail.com",
        "time": "Sun Aug 09 04:10:25 2026"
      },
      "committer": {
        "name": "Ahmad Saleem",
        "email": "ahmad.saleem792@gmail.com",
        "time": "Sun Aug 09 04:10:25 2026"
      },
      "message": "Sync `html/semantics/scripting-1/the-script-element/module` from WPT Upstream\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d321368\nrdar://184421838\n\nReviewed by Alan Baradlay.\n\nUpstream commit: https://github.com/web-platform-tests/wpt/commit/4c2fd05ed5d0b90a9e1fcdcb35f6671bd461de0d\n\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-script-element/module/WEB_FEATURES.yml:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-script-element/module/dynamic-import/WEB_FEATURES.yml:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-script-element/module/dynamic-import/alpha/WEB_FEATURES.yml:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-script-element/module/dynamic-import/alpha/w3c-import.log:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-script-element/module/dynamic-import/basic-deferred-evaluation.tentative-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-script-element/module/dynamic-import/basic-deferred-evaluation.tentative.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-script-element/module/dynamic-import/beta/w3c-import.log:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-script-element/module/dynamic-import/cyclic-tla-defer-eval.tentative-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-script-element/module/dynamic-import/cyclic-tla-defer-eval.tentative.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-script-element/module/dynamic-import/gamma/w3c-import.log:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-script-element/module/dynamic-import/microtasks/WEB_FEATURES.yml:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-script-element/module/dynamic-import/microtasks/w3c-import.log:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-script-element/module/dynamic-import/resources/cyclic-tla-dep-a.js: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-script-element/module/dynamic-import/resources/cyclic-tla-dep-b.js: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-script-element/module/dynamic-import/resources/module-with-tla-dep.js: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-script-element/module/dynamic-import/resources/side-effect-module.js: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-script-element/module/dynamic-import/resources/tla-module.js: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-script-element/module/dynamic-import/resources/w3c-import.log:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-script-element/module/dynamic-import/scripts/w3c-import.log:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-script-element/module/dynamic-import/tla-deferred-evaluation.tentative-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-script-element/module/dynamic-import/tla-deferred-evaluation.tentative.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-script-element/module/dynamic-import/w3c-import.log:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-script-element/module/import-meta/WEB_FEATURES.yml:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-script-element/module/import-meta/resources/w3c-import.log:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-script-element/module/import-meta/w3c-import.log:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-script-element/module/resources/w3c-import.log:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-script-element/module/top-level-await/WEB_FEATURES.yml:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-script-element/module/top-level-await/w3c-import.log:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-script-element/module/w3c-import.log:\n\nCanonical link: https://commits.webkit.org/318851@main\n"
    },
    {
      "commit": "919642bf433d001fac3d84632615cedb6243be85",
      "tree": "5a7bfabdffad73c256bb127a928c05fe3d26b0fd",
      "parents": [
        "12b2b07ee6d1e90c5d396c3e38f34966f99a02f1"
      ],
      "author": {
        "name": "Fady Farag",
        "email": "com.webkit.iidmsa@gmail.com",
        "time": "Sun Aug 09 03:10:29 2026"
      },
      "committer": {
        "name": "Fady Farag",
        "email": "com.webkit.iidmsa@gmail.com",
        "time": "Sun Aug 09 03:10:29 2026"
      },
      "message": "Introduce an API test for MediaRecorder dropping a frame whenever the writer input reports not ready\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d321373\nrdar://184425255\n\nReviewed by Darin Adler.\n\nThis is a follow-up to 318778@main. This asserts that a frame whose writeFrame()\nreturned NotReady is written by a subsequent writeFrames() retry call.\n\n* Tools/TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:\n* Tools/TestWebKitAPI/Tests/WebCore/cocoa/MediaRecorderPrivateWriterTests.cpp: Added.\n(TestWebKitAPI::makeSampleBlock):\n(TestWebKitAPI::TEST(MediaRecorderPrivateWriter, WritesAllFramesInOrder)):\n(TestWebKitAPI::TEST(MediaRecorderPrivateWriter, NoFrameIsLostWhenWriterIsNotReady)):\n\nCanonical link: https://commits.webkit.org/318850@main\n"
    },
    {
      "commit": "12b2b07ee6d1e90c5d396c3e38f34966f99a02f1",
      "tree": "fc68a8393b3da792717308d79be55073021de171",
      "parents": [
        "75bb1892f1b4d3fd773e008cbf93802f192ca6ca"
      ],
      "author": {
        "name": "Wenson Hsieh",
        "email": "wenson_hsieh@apple.com",
        "time": "Sun Aug 09 02:04:34 2026"
      },
      "committer": {
        "name": "Wenson Hsieh",
        "email": "wenson_hsieh@apple.com",
        "time": "Sun Aug 09 02:04:34 2026"
      },
      "message": "Safari MCP: default text extraction on www.yelp.com contains many hidden SVG elements\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d321371\nrdar://184323683\n\nReviewed by Richard Robinson.\n\nAvoid pathological context window bloat on Yelp, by skipping hidden SVG containers.\n\nTest: fast/text-extraction/debug-text-extraction-svg-sprite-sheet.html\n\n* LayoutTests/fast/text-extraction/debug-text-extraction-svg-sprite-sheet-expected.txt: Added.\n* LayoutTests/fast/text-extraction/debug-text-extraction-svg-sprite-sheet.html: Added.\n* Source/WebCore/page/text-extraction/TextExtraction.cpp:\n(WebCore::TextExtraction::extractItemData):\n\nCanonical link: https://commits.webkit.org/318849@main\n"
    },
    {
      "commit": "75bb1892f1b4d3fd773e008cbf93802f192ca6ca",
      "tree": "cc754a6915836d9744bc0876defc48249bb18472",
      "parents": [
        "b2ec9a4586eec8c6fd9d9871980b6ddc525174d3"
      ],
      "author": {
        "name": "David Kilzer",
        "email": "ddkilzer@apple.com",
        "time": "Sat Aug 08 22:44:45 2026"
      },
      "committer": {
        "name": "David Kilzer",
        "email": "ddkilzer@webkit.org",
        "time": "Sat Aug 08 22:44:45 2026"
      },
      "message": "Stop including \u003cobjc/objc-runtime.h\u003e and forbid it via check-webkit-style\n\u003chttps://bugs.webkit.org/show_bug.cgi?id\u003d321315\u003e\n\u003crdar://184350335\u003e\n\nReviewed by Zak Ridouh and Yusuke Suzuki.\n\nThe legacy `\u003cobjc/objc-runtime.h\u003e` umbrella header is not present in\nthe iOS 27 SDK (it remains in the macOS SDK), so every file that\nimports it fails to compile against that SDK.\n\nImport only the specific `\u003cobjc/...\u003e` headers that each file uses\n(`\u003cobjc/runtime.h\u003e` and/or `\u003cobjc/message.h\u003e` if needed), instead of\nthe umbrella.\n\nAdd an always-on `check-webkit-style` rule that flags any new `#include`\nor `#import` of `\u003cobjc/objc-runtime.h\u003e` and directs authors to the\nindividual headers, so the pattern is not reintroduced.\n\nCovered by a new test in cpp_unittest.py.\n\n* Source/JavaScriptCore/API/JSWrapperMap.h:\n* Source/WebCore/platform/graphics/avfoundation/objc/CDMSessionAVContentKeySession.mm:\n* Source/WebCore/platform/graphics/avfoundation/objc/CDMSessionAVFoundationObjC.mm:\n* Source/WebCore/platform/ios/WebCoreMotionManager.mm:\n* Source/WebKitLegacy/ios/Misc/WebGeolocationCoreLocationProvider.mm:\n* Tools/Scripts/webkitpy/style/checkers/cpp.py:\n(check_include_line):\n* Tools/Scripts/webkitpy/style/checkers/cpp_unittest.py:\n(CppStyleTestBase.perform_language_rules_check):\n(OrderOfIncludesTest.test_check_objc_runtime_header_include): Add.\n\nCanonical link: https://commits.webkit.org/318848@main\n"
    },
    {
      "commit": "b2ec9a4586eec8c6fd9d9871980b6ddc525174d3",
      "tree": "60b0b9664d89d1c0248ee6165399e48344b4d780",
      "parents": [
        "f880bc57ad506aadd0d3fb7872e35752740a99f2"
      ],
      "author": {
        "name": "Yijia Huang",
        "email": "yijia_huang@apple.com",
        "time": "Sat Aug 08 22:31:29 2026"
      },
      "committer": {
        "name": "Yijia Huang",
        "email": "yijia_huang@apple.com",
        "time": "Sat Aug 08 22:31:29 2026"
      },
      "message": "[JSC][Intl] formatToParts must emit the era separator that format() inserts\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d321347\nrdar://184382546\n\nReviewed by Yusuke Suzuki.\n\nICU emits no era name for coptic dates before Anno Martyrum or islamic-* dates\nbefore the Hijra, so both format() overloads synthesize one. format() also\ninserts a separating space before the appended era; formatToParts() did not, so\nconcatenating the parts stopped reproducing format() — 90 of 720 locale and\noption combinations, for example ja-JP coptic {era:\"short\"} formatting\n\"185/5/7 Anno Martyrum\" against joined parts \"185/5/7Anno Martyrum\".\n\nThe separator stays conditional. Where ICU leaves a trailing space in the empty\nera slot, the parts loop already emits it as a literal, so synthesizing one\nunconditionally would double it. jsSingleCharacterString rather than\njsNontrivialString, which asserts a length above one.\n\nOnly the appended-era path is affected; where ICU emits an era field its own\npattern supplies the separator.\n\nAlso correct calendarUsesISOFallbackForExtremeYear\u0027s comment: ±10000 is icu4x\u0027s\nWELL_BEHAVED_ASTRONOMICAL_RANGE, not a claim that ICU is accurate within it —\nICU\u0027s chinese winter-solstice table covers only gregorian 1900-2100.\n\nTest: JSTests/stress/intl-datetimeformat-era-override-parts.js\nCanonical link: https://commits.webkit.org/318847@main\n"
    },
    {
      "commit": "f880bc57ad506aadd0d3fb7872e35752740a99f2",
      "tree": "79b6d9559a7cc747969f6ff71fc07c28c0a85854",
      "parents": [
        "dfc0426a5fa1908fbca70f290e6ea2d9cdff7c14"
      ],
      "author": {
        "name": "Geoffrey Garen",
        "email": "ggaren@apple.com",
        "time": "Sat Aug 08 20:05:11 2026"
      },
      "committer": {
        "name": "Geoffrey Garen",
        "email": "ggaren@apple.com",
        "time": "Sat Aug 08 20:05:11 2026"
      },
      "message": "RefCountedWithInlineWeakPtr is undef in GCC 15\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d321243\nrdar://184290928\n\nReviewed by Ryosuke Niwa.\n\nThis patch moves the refcount bits in RefCountedWithInlineWeakPtr\u003cT\u003e into a\nseparately declared type that is adjacent to T, instead of a base class of T.\n\nTechnically, it is undef to read bits out of T after ~T(), and GCC 15 is\naggressive about this. Separating the types works around this restriction.\n\nThe allocation and data layout should remain the exact same in practice.\n\nCanonical link: https://commits.webkit.org/318846@main\n"
    },
    {
      "commit": "dfc0426a5fa1908fbca70f290e6ea2d9cdff7c14",
      "tree": "f66a2143f947bc0cdc010922f3fefbf7c64cfdc9",
      "parents": [
        "c4357d1dbdecfa5938c08bf8e4e7d33fbac6ab03"
      ],
      "author": {
        "name": "Lily Spiniolas",
        "email": "lily_spiniolas@apple.com",
        "time": "Sat Aug 08 18:54:46 2026"
      },
      "committer": {
        "name": "Lily Spiniolas",
        "email": "lily_spiniolas@apple.com",
        "time": "Sat Aug 08 18:54:46 2026"
      },
      "message": "[Unified PDF] PDF HUD should show toggle for accessibility filters\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d320864\nrdar://183607542\n\nReviewed by Abrar Rahman Protyasha.\n\nIf a PDF is loaded with PDF accessibility filters enabled, add an item\nto the PDF HUD to toggle the filter on and off. If no accessibility filter\nis enabled/present, no toggle is added.\n\nWhen the toggle is activated (or if the filter itself is disabled for PDFs\nas a whole) the PDF is now completely redrawn using the new rendering settings\nin order to reflect the correct state.\n\n* Source/WebKit/CMakeLists.txt:\n* Source/WebKit/DerivedSources-input.xcfilelist:\n* Source/WebKit/DerivedSources.make:\n* Source/WebKit/Scripts/webkit/messages.py:\n(headers_for_type):\n* Source/WebKit/Shared/PDFAccessibilityDisplayModeState.h: Copied from Source/WebKit/UIProcess/PDF/WKPDFHUDView.h.\n* Source/WebKit/Shared/PDFAccessibilityDisplayModeState.serialization.in: Added.\n* Source/WebKit/UIProcess/PDF/WKAlternatePDFHUDView.swift:\n(ControlsModel.isVisible):\n(ControlsModel.accessibilityDisplayModeState):\n(Controls.body):\n(WKAlternatePDFHUDView.setAccessibilityDisplayModeState(_:)):\n(Controls.isVisible): Deleted.\n* Source/WebKit/UIProcess/PDF/WKDefaultPDFHUDView.swift:\n(WKDefaultPDFHUDView.accessibilityDisplayModeButton):\n(WKDefaultPDFHUDView.setAccessibilityDisplayModeState(_:)):\n(WKDefaultPDFHUDView._performAction(forControl:)):\n(WKDefaultPDFHUDView.hitTest(_:)):\n(WKDefaultPDFHUDView.toggleAccessibilityDisplayModeAction):\n* Source/WebKit/UIProcess/PDF/WKPDFHUDView.h:\n* Source/WebKit/UIProcess/PageClient.h:\n* Source/WebKit/UIProcess/WebPageProxy.cpp:\n* Source/WebKit/UIProcess/WebPageProxy.h:\n* Source/WebKit/UIProcess/WebPageProxy.messages.in:\n* Source/WebKit/UIProcess/mac/PageClientImplMac.h:\n* Source/WebKit/UIProcess/mac/PageClientImplMac.mm:\n(WebKit::PageClientImpl::updatePDFHUDAccessibilityDisplayMode):\n* Source/WebKit/UIProcess/mac/WebPageProxyMac.mm:\n(WebKit::WebPageProxy::updatePDFHUDAccessibilityDisplayMode):\n(WebKit::WebPageProxy::pdfToggleAccessibilityDisplayMode):\n* Source/WebKit/UIProcess/mac/WebViewImpl.h:\n* Source/WebKit/UIProcess/mac/WebViewImpl.mm:\n(WebKit::platformAccessibilityDisplayModeState):\n(WebKit::WebViewImpl::createPDFHUD):\n(WebKit::WebViewImpl::updatePDFHUDLocation):\n(WebKit::WebViewImpl::updatePDFHUDAccessibilityDisplayMode):\n* Source/WebKit/WebKit.xcodeproj/project.pbxproj:\n* Source/WebKit/WebProcess/Plugins/PDF/PDFPluginBase.h:\n(WebKit::PDFPluginBase::toggleAccessibilityDisplayMode):\n* Source/WebKit/WebProcess/Plugins/PDF/PDFPluginBase.mm:\n(WebKit::PDFPluginBase::accessibilityDisplayModeState const):\n* Source/WebKit/WebProcess/Plugins/PDF/UnifiedPDF/AsyncPDFRenderer.h:\n* Source/WebKit/WebProcess/Plugins/PDF/UnifiedPDF/AsyncPDFRenderer.mm:\n(WebKit::AsyncPDFRenderer::invalidateAllRenderedContent):\n* Source/WebKit/WebProcess/Plugins/PDF/UnifiedPDF/PDFDiscretePresentationController.h:\n* Source/WebKit/WebProcess/Plugins/PDF/UnifiedPDF/PDFDiscretePresentationController.mm:\n(WebKit::PDFDiscretePresentationController::updateLayersForAccessibilityDisplayModeChange):\n(WebKit::PDFDiscretePresentationController::updateForAccessibilityDisplayModeChange): Deleted.\n* Source/WebKit/WebProcess/Plugins/PDF/UnifiedPDF/PDFPresentationController.h:\n* Source/WebKit/WebProcess/Plugins/PDF/UnifiedPDF/PDFPresentationController.mm:\n(WebKit::PDFPresentationController::updateForAccessibilityDisplayModeChange):\n(WebKit::PDFPresentationController::invalidateRenderedContentForAccessibilityDisplayModeChange): Deleted.\n* Source/WebKit/WebProcess/Plugins/PDF/UnifiedPDF/PDFScrollingPresentationController.h:\n* Source/WebKit/WebProcess/Plugins/PDF/UnifiedPDF/PDFScrollingPresentationController.mm:\n(WebKit::PDFScrollingPresentationController::updateLayersForAccessibilityDisplayModeChange):\n(WebKit::PDFScrollingPresentationController::updateForAccessibilityDisplayModeChange): Deleted.\n* Source/WebKit/WebProcess/Plugins/PDF/UnifiedPDF/UnifiedPDFPlugin.h:\n* Source/WebKit/WebProcess/Plugins/PDF/UnifiedPDF/UnifiedPDFPlugin.mm:\n(WebKit::UnifiedPDFPlugin::defaultAccessibilityDisplayModeStateForCurrentSettings const):\n(WebKit::pdfPluginBackgroundColor):\n(WebKit::UnifiedPDFPlugin::UnifiedPDFPlugin):\n(WebKit::UnifiedPDFPlugin::didChangeSettings):\n(WebKit::UnifiedPDFPlugin::setAccessibilityDisplayModeState):\n(WebKit::UnifiedPDFPlugin::pluginBackgroundColor const):\n(WebKit::UnifiedPDFPlugin::updateHUDAccessibilityDisplayMode):\n(WebKit::UnifiedPDFPlugin::toggleAccessibilityDisplayMode):\n* Source/WebKit/WebProcess/WebPage/WebPage.h:\n* Source/WebKit/WebProcess/WebPage/WebPage.messages.in:\n* Source/WebKit/WebProcess/WebPage/mac/WebPageMac.mm:\n(WebKit::WebPage::togglePDFAccessibilityDisplayMode):\n(WebKit::WebPage::createPDFHUD):\n(WebKit::WebPage::updatePDFHUDAccessibilityDisplayMode):\n\nCanonical link: https://commits.webkit.org/318845@main\n"
    },
    {
      "commit": "c4357d1dbdecfa5938c08bf8e4e7d33fbac6ab03",
      "tree": "1f2f2ef512ba45643cdfdac5d5d606d18892632e",
      "parents": [
        "72928a517633537696c0e6a9f14ed0114791cb46"
      ],
      "author": {
        "name": "Yusuke Suzuki",
        "email": "ysuzuki@apple.com",
        "time": "Sat Aug 08 18:09:15 2026"
      },
      "committer": {
        "name": "Yusuke Suzuki",
        "email": "ysuzuki@apple.com",
        "time": "Sat Aug 08 18:09:15 2026"
      },
      "message": "Release Mach port rights\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d321354\nrdar://184386480\n\nReviewed by Mark Lam.\n\nSeveral code sites are leaking mach port rights incorrectly.\n\n1. mach_thread_self() retains Mach port rights. Let\u0027s just use\n   pthread_mach_thread_np(pthread_self()), which does not need to retain\n   it.\n2. catch_mach_exception_raise_state_identity_protected receives the task\n   ID token. When routine succeeds, we need to release the ownership.\n3. ResourceUsageThread leaked a mach_thread_self(). Adopt it into a\n   MachSendRight instead.\n\n* Source/WTF/wtf/threads/Signals.cpp:\n(WTF::hashThreadState):\n* Source/WebCore/page/cocoa/ResourceUsageThreadCocoa.mm:\n(WebCore::ResourceUsageThread::platformCollectCPUData):\n* Source/WebKit/webpushd/webpushtool/WebPushToolConnection.mm:\n(WebPushTool::maybeConnectToService):\n(WebPushTool::Connection::connectToService):\n\nCanonical link: https://commits.webkit.org/318844@main\n"
    },
    {
      "commit": "72928a517633537696c0e6a9f14ed0114791cb46",
      "tree": "194f23526fe9446e00958ed1c2590f918a9a3091",
      "parents": [
        "e10f76756319604596dad0ab29f5676732c18846"
      ],
      "author": {
        "name": "Yusuke Suzuki",
        "email": "ysuzuki@apple.com",
        "time": "Sat Aug 08 17:18:04 2026"
      },
      "committer": {
        "name": "Yusuke Suzuki",
        "email": "ysuzuki@apple.com",
        "time": "Sat Aug 08 17:18:04 2026"
      },
      "message": "[JSC] Reserve 0-slot cached memory base and size even when a module declares no memory\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d321355\nrdar://184387395\n\nReviewed by Mark Lam.\n\nWe need to zero clear all cachedMemoryBaseSizePairs initially.\nAlso we must need to call updateCachedMemoryBaseSizePair(0) when\nupdating memory0.\n\n* Source/JavaScriptCore/wasm/js/JSWebAssemblyInstance.cpp:\n(JSC::JSWebAssemblyInstance::JSWebAssemblyInstance):\n* Source/JavaScriptCore/wasm/js/JSWebAssemblyInstance.h:\n\nCanonical link: https://commits.webkit.org/318843@main\n"
    },
    {
      "commit": "e10f76756319604596dad0ab29f5676732c18846",
      "tree": "45e9cf62aa14b3e2faf3e2623afacfa4a91bffaf",
      "parents": [
        "96aa8e88d20db54a6cadd26a9dc0b36646820776"
      ],
      "author": {
        "name": "Kristian Monsen",
        "email": "k_monsen@apple.com",
        "time": "Sat Aug 08 15:02:23 2026"
      },
      "committer": {
        "name": "Kristian Monsen",
        "email": "k_monsen@apple.com",
        "time": "Sat Aug 08 15:02:23 2026"
      },
      "message": "[GFC] Convert percentages in grid-auto-rows/grid-auto-columns to auto when computing intrinsic grid container size\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d321353\nrdar://184019251\n\nReviewed by Sammy Gill.\n\nThe crash happens because rowSizesForFirstIterationColumnSizing (GridLayout.cpp:391-423) assumes every row track\u0027s percentage sizing function has already been converted to auto\nbefore it runs. Its own comment says as much, and the ASSERT at line 399 documents that assumption directly: \"The formatting context should have transformed this track size to\nauto.\" When a row track is still a raw Percentage at that point, the function unconditionally dereferences the optional gridContainerInnerInlineSize, which is only empty in exactly\nthis situation.\n\nThat assumption was correctly upheld for grid-template-columns and grid-template-rows. The helper gridTemplateListWithPercentagesConvertedToAuto was already applied to both, in\nboth computeIntrinsicWidths and layout. But it was silently not upheld for grid-auto-columns and grid-auto-rows, which were passed through to GridDefinition untouched. Since\nimplicit tracks are sized from grid-auto-rows and grid-auto-columns (generateImplicitTrackSizingFunctions, GridLayout.cpp:346), any grid whose rows are entirely implicit, including\nthe common case of an empty explicit grid as in the crash testcase, could carry a raw percentage all the way into rowSizesForFirstIterationColumnSizing, with the container\u0027s\ninline size still indefinite because the code is in the middle of computing that container\u0027s own intrinsic width. The precondition the code was written to depend on simply never\nheld for this input.\n\nThe fix closes that gap by applying the exact same percentage-to-auto conversion to grid-auto-columns and grid-auto-rows that already existed for the template lists, in the same\ntwo call sites and under the same conditions. In layout, the conversion is gated on inlineAxisDependsOnTracks and blockAxisDependsOnTracks. In computeIntrinsicWidths, it is applied\nunconditionally, since intrinsic sizing is always against an indefinite constraint. Once grid-auto-rows: 0% is converted to auto before reaching GridLayout,\nrowSizesForFirstIterationColumnSizing takes the Auto branch at line 412 instead of the Percentage branch, and that branch returns LayoutUnit::max() without touching\ngridContainerInnerInlineSize at all.\n\nThe ASSERT\u0027s precondition is now actually satisfied, so the fix is not \"handle the null case defensively,\" which would just convert a clean crash into silently wrong track sizing.\nIt is \"make sure the data reaching this code matches what the code was always written to assume.\" That is also exactly what the CSS Grid spec requires: percentage track sizes must\nresolve as auto whenever the axis they depend on is indefinite, and that rule applies equally to grid-template-* and grid-auto-*, not just the former.\n\nTest: fast/css-grid-layout/grid-auto-rows-percentage-intrinsic-width-crash.html\n\n* LayoutTests/fast/css-grid-layout/grid-auto-rows-percentage-intrinsic-width-crash-expected.txt: Added.\n* LayoutTests/fast/css-grid-layout/grid-auto-rows-percentage-intrinsic-width-crash.html: Added.\n* Source/WebCore/layout/formattingContexts/grid/GridFormattingContext.cpp:\n(WebCore::Layout::gridAutoTrackSizesWithPercentagesConvertedToAuto):\n(WebCore::Layout::GridFormattingContext::layout):\n(WebCore::Layout::GridFormattingContext::computeIntrinsicWidths):\n\nCanonical link: https://commits.webkit.org/318842@main\n"
    },
    {
      "commit": "96aa8e88d20db54a6cadd26a9dc0b36646820776",
      "tree": "d42178a8b93a192c634e1c0b20f24acf0b379446",
      "parents": [
        "bb345ab09ac5b38035ec69ee7f96396adae11e7e"
      ],
      "author": {
        "name": "Fujii Hironori",
        "email": "fujii@igalia.com",
        "time": "Sat Aug 08 14:09:36 2026"
      },
      "committer": {
        "name": "Fujii Hironori",
        "email": "fujii@igalia.com",
        "time": "Sat Aug 08 14:09:36 2026"
      },
      "message": "[GLib] layout test gardening\n\nUnreviewed.\n\n* LayoutTests/TestExpectations:\n* LayoutTests/platform/glib/TestExpectations:\n* LayoutTests/platform/gtk/TestExpectations:\n* LayoutTests/platform/wpe/TestExpectations:\n\nCanonical link: https://commits.webkit.org/318841@main\n"
    },
    {
      "commit": "bb345ab09ac5b38035ec69ee7f96396adae11e7e",
      "tree": "513bdb0f154a29c5ea3bb3b4ce4c814534cedeaa",
      "parents": [
        "445ef5ac4f91f6af821e2211bb4f507d7c66a390"
      ],
      "author": {
        "name": "Marcus Plutowski",
        "email": "marcus_plutowski@apple.com",
        "time": "Sat Aug 08 09:50:02 2026"
      },
      "committer": {
        "name": "Marcus Plutowski",
        "email": "marcus_plutowski@apple.com",
        "time": "Sat Aug 08 09:50:02 2026"
      },
      "message": "Drop cached SequesteredMalloc arena granules on memory-pressure notification\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d320593\nrdar://181858046\n\nReviewed by Keith Miller.\n\nBy default, each compiler thread caches a single granule to minimize the\nlatency of their next compiler job. This means the memory is never\ndecommitted, which adds persistent memory pressure even through\nsubsequent memory-pressure notifications.\nThis patch makes two changes:\n  - Before caching a granule, each compiler thread checks whether the\n    system is currently under memory pressure; if so, it doesn\u0027t cache\n  - When memory pressure is encountered, we iterate all arenas and drop\n    the first granule of all idle compiler threads\nThe latter condition requires a new lock to avoid a thread starting up\nwhile the scavenger (or etc.) is midway through removing their granule.\nThis is worthwhile because the alternative would be waiting until the\ncompiler thread runs again, which could be some time due to the\nsometimes-bursty nature of compilation jobs.\n\nNo new tests since this is an implementation detail.\n\n* Source/WTF/wtf/FastMalloc.cpp:\n(WTF::releaseFastMallocFreeMemory):\n* Source/WTF/wtf/SequesteredAllocator.h:\n* Source/WTF/wtf/SequesteredImmortalHeap.cpp:\n(WTF::SequesteredImmortalHeap::shouldReduceRetention const):\n(WTF::SequesteredImmortalHeap::scavengeImpl):\n(WTF::SequesteredImmortalHeap::reclaimIdleSlots):\n(WTF::SequesteredImmortalHeap::reclaimIdleGranulesOnce):\n* Source/WTF/wtf/SequesteredImmortalHeap.h:\n\nCanonical link: https://commits.webkit.org/318840@main\n"
    },
    {
      "commit": "445ef5ac4f91f6af821e2211bb4f507d7c66a390",
      "tree": "55ad71cdaaaccdffd35b3023f80f747bbf08bf1d",
      "parents": [
        "334a2610faa0e991b018c571a7cc0c0325f5d1a6"
      ],
      "author": {
        "name": "Yoel Hawa",
        "email": "yoel@apple.com",
        "time": "Sat Aug 08 07:33:43 2026"
      },
      "committer": {
        "name": "Yoel Hawa",
        "email": "yoel@apple.com",
        "time": "Sat Aug 08 07:33:43 2026"
      },
      "message": "Add animation forwarding to child models in spatial portals\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d321050\nrdar://182292543\n\nReviewed by Mike Wyrzykowski and Etienne Segonzac.\n\nA \u003cmodel\u003e child of a spatial portal has no ModelPlayer of its own, so\nits animation attributes and playback accessors went nowhere. Route them\nthrough the portal\u0027s player, which addresses each child by\nNodeIdentifier, and track playback state per node in both the Web and\nModel processes, so the first model loaded no longer reports playback\nfor the whole portal.\n\nTests: spatial-css/spatial-portal-animation-currenttime.html\n       spatial-css/spatial-portal-animation-dynamic.html\n       spatial-css/spatial-portal-animation-independent.html\n       spatial-css/spatial-portal-model-animations.html\n\n* LayoutTests/spatial-css/resources/spatial-portal-utils.js:\n(async waitFor):\n* LayoutTests/spatial-css/spatial-portal-animation-currenttime-expected.txt: Added.\n* LayoutTests/spatial-css/spatial-portal-animation-currenttime.html: Added.\n* LayoutTests/spatial-css/spatial-portal-animation-dynamic-expected.txt: Added.\n* LayoutTests/spatial-css/spatial-portal-animation-dynamic.html: Added.\n* LayoutTests/spatial-css/spatial-portal-animation-independent-expected.txt: Added.\n* LayoutTests/spatial-css/spatial-portal-animation-independent.html: Added.\n* LayoutTests/spatial-css/spatial-portal-model-animations-expected.txt: Added.\n* LayoutTests/spatial-css/spatial-portal-model-animations.html: Added.\nCover autoplay and loop reaching a child, seeking a child,\nsiblings playing, pausing and looping independently of one another, and\na re-added child not reusing the playback state it had before.\n\n* Source/WebCore/Modules/model-element/HTMLModelElement.cpp:\n(WebCore::HTMLModelElement::createModelPlayer):\n(WebCore::HTMLModelElement::modelPlayerForAnimation const):\n(WebCore::HTMLModelElement::applyInitialAnimationState):\n(WebCore::HTMLModelElement::setPlaybackRate):\n(WebCore::HTMLModelElement::duration const):\n(WebCore::HTMLModelElement::paused const):\n(WebCore::HTMLModelElement::setPaused):\n(WebCore::HTMLModelElement::updateAutoplay):\n(WebCore::HTMLModelElement::updateLoop):\n(WebCore::HTMLModelElement::currentTime const):\n(WebCore::HTMLModelElement::setCurrentTime):\n* Source/WebCore/Modules/model-element/HTMLModelElement.h:\nReach the portal\u0027s player when the element has none of its own. The\nattributes a standalone \u003cmodel\u003e pushes in createModelPlayer() move to\napplyInitialAnimationState(), so the portal\u0027s load path can push the\nsame ones on the child\u0027s behalf.\n\n* Source/WebCore/Modules/model-element/SpatialPortalController.cpp:\n(WebCore::SpatialPortalController::ensureModelPlayer):\n(WebCore::SpatialPortalController::loadChildModelIfReady):\n(WebCore::SpatialPortalController::unregisterChildModel):\nReach the player of the portal this element is registered with when it\nhas none of its own. The attributes a standalone \u003cmodel\u003e pushes in\ncreateModelPlayer() move to applyInitialAnimationState(), so the\nportal\u0027s load path can push the same ones on the child\u0027s behalf.\n\n* Source/WebKit/WebProcess/Model/ModelProcessModelPlayer.cpp:\n(WebKit::ModelProcessModelPlayer::ensureAnimationState):\n(WebKit::ModelProcessModelPlayer::animationStateIfExists):\n(WebKit::ModelProcessModelPlayer::animationStateIfExists const):\n(WebKit::ModelProcessModelPlayer::load):\n(WebKit::ModelProcessModelPlayer::unload):\n(WebKit::ModelProcessModelPlayer::reload):\n(WebKit::ModelProcessModelPlayer::didFailLoading):\n(WebKit::ModelProcessModelPlayer::didUpdateAnimationPlaybackState):\n(WebKit::ModelProcessModelPlayer::currentAnimationState const):\n(WebKit::ModelProcessModelPlayer::setAutoplay):\n(WebKit::ModelProcessModelPlayer::setLoop):\n(WebKit::ModelProcessModelPlayer::setPlaybackRate):\n(WebKit::ModelProcessModelPlayer::duration const):\n(WebKit::ModelProcessModelPlayer::paused const):\n(WebKit::ModelProcessModelPlayer::currentTime const):\n(WebKit::ModelProcessModelPlayer::setCurrentTime):\n(WebKit::ModelProcessModelPlayer::didFailLoading):\n* Source/WebKit/WebProcess/Model/ModelProcessModelPlayer.h:\nKey animation state by NodeIdentifier rather than holding one set of\nvalues per player. A playback report for a node the player does not\ntrack is dropped instead of inventing state that would then be\nreported to script, and a failed load drops the node\u0027s state, since the\nmodel process drops its own entry for it.\n\n* Source/WebKit/ModelProcess/cocoa/ModelProcessModelPlayerProxy.h:\n* Source/WebKit/ModelProcess/cocoa/ModelProcessModelPlayerProxy.mm:\n(-[WKModelProcessModelPlayerProxyObjCAdapter entityAnimationPlaybackStateDidUpdate:]):\n(WebKit::ModelProcessModelPlayerProxy::entityForNode const):\n(WebKit::ModelProcessModelPlayerProxy::loadModel):\n(WebKit::ModelProcessModelPlayerProxy::reloadModel):\n(WebKit::ModelProcessModelPlayerProxy::load):\n(WebKit::ModelProcessModelPlayerProxy::didFinishLoading):\n(WebKit::ModelProcessModelPlayerProxy::setUpLoadedEntity):\n(WebKit::ModelProcessModelPlayerProxy::unloadModel):\n(WebKit::ModelProcessModelPlayerProxy::animationPlaybackStateDidUpdate):\n(WebKit::ModelProcessModelPlayerProxy::setAutoplay):\n(WebKit::ModelProcessModelPlayerProxy::setLoop):\n(WebKit::ModelProcessModelPlayerProxy::setPlaybackRate):\n(WebKit::ModelProcessModelPlayerProxy::duration const):\n(WebKit::ModelProcessModelPlayerProxy::paused const):\n(WebKit::ModelProcessModelPlayerProxy::setPaused):\n(WebKit::ModelProcessModelPlayerProxy::currentTime const):\n(WebKit::ModelProcessModelPlayerProxy::setCurrentTime):\n(WebKit::ModelProcessModelPlayerProxy::teardownEntity):\n(WebKit::ModelProcessModelPlayerProxy::captureStateForReload):\n(WebKit::ModelProcessModelPlayerProxy::computeTransform):\n(WebKit::ModelProcessModelPlayerProxy::updateTransform):\n(WebKit::ModelProcessModelPlayerProxy::updateOpacity):\n(WebKit::ModelProcessModelPlayerProxy::didFailLoading):\n(WebKit::ModelProcessModelPlayerProxy::reportingModelScale const):\n(WebKit::ModelProcessModelPlayerProxy::findTrackedModelForLoader):\n(WebKit::ModelProcessModelPlayerProxy::findTrackedModelForEntity):\n(WebKit::ModelProcessModelPlayerProxy::ensureTrackedModel):\n(WebKit::ModelProcessModelPlayerProxy::trackedModel):\n(WebKit::ModelProcessModelPlayerProxy::trackedModel const):\n(WebKit::ModelProcessModelPlayerProxy::cancelAllLoaders):\n(WebKit::ModelProcessModelPlayerProxy::sizeDidChange):\n(WebKit::ModelProcessModelPlayerProxy::ensureImmersivePresentation):\n(WebKit::ModelProcessModelPlayerProxy::exitImmersivePresentation):\n(WebKit::ModelProcessModelPlayerProxy::findHostedEntityForLoader): Deleted.\nHold autoplay, loop, playback rate and the state to restore on each\ntracked model, and set the playback delegate on every entity so a\nsibling reports its own state rather than the first model\u0027s. An\naccessor for a node whose entity has not loaded now reports failure\nrather than answering from a nil entity, so play() before load rejects.\nteardownEntity() keeps its map entries, since captureStateForReload()\nhas just recorded playback state in them.\n\nCanonical link: https://commits.webkit.org/318839@main\n"
    },
    {
      "commit": "334a2610faa0e991b018c571a7cc0c0325f5d1a6",
      "tree": "dbaff7d833321eacd80e7622d957e9766525f5d3",
      "parents": [
        "f1111014c1d28387fcb7dbdd673e69e6ffcc2004"
      ],
      "author": {
        "name": "Richard Robinson",
        "email": "richard_robinson2@apple.com",
        "time": "Sat Aug 08 05:14:55 2026"
      },
      "committer": {
        "name": "Richard Robinson",
        "email": "richard_robinson2@apple.com",
        "time": "Sat Aug 08 05:14:55 2026"
      },
      "message": "[AppKit Gestures] NSWindows are left behind after each test when running several tests sequentially\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d321356\nrdar://184388647\n\nReviewed by Abrar Rahman Protyasha.\n\nRemove the window during test teardown.\n\n* Tools/TestWebKitAPI/Tests/WebKit/WebPage/AppKit Gesture Tests/AppKitGesturesTestsSupport.swift:\n* Tools/TestWebKitAPI/Tests/WebKit/WebPage/AppKit Gesture Tests/BasicAppKitGesturesTests.swift:\n* Tools/TestWebKitAPI/Tests/WebKit/WebPage/AppKit Gesture Tests/DoubleClickGesturesTests.swift:\n* Tools/TestWebKitAPI/Tests/WebKit/WebPage/AppKit Gesture Tests/EmbeddedAppKitGesturesTests.swift:\n\nCanonical link: https://commits.webkit.org/318838@main\n"
    },
    {
      "commit": "f1111014c1d28387fcb7dbdd673e69e6ffcc2004",
      "tree": "f1102cb4e3ab1ffe8ca782194bc3a5be0fb94154",
      "parents": [
        "37cfccb3c6c9ae9cc09b9d9908c190286ac2e858"
      ],
      "author": {
        "name": "Abrar Rahman Protyasha",
        "email": "a_protyasha@apple.com",
        "time": "Sat Aug 08 04:49:43 2026"
      },
      "committer": {
        "name": "Abrar Rahman Protyasha",
        "email": "a_protyasha@apple.com",
        "time": "Sat Aug 08 04:49:43 2026"
      },
      "message": "Embedded PDFs do not re-fit when the plugin frame is resized\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d321241\nrdar://160319744\n\nReviewed by Richard Robinson and Megan Gardner.\n\nThe PDF plugin computes (and pins to) a scale from the frame\u0027s width\nafter the first layout, so a main frame PDF maintains user zoom across\nwindow resizes. However, since subframe PDFs follow this same logic,\nthey are never re-fit when the _plugin frame_ itself is resized.\n\nThis is most notable with Site Isolation enabled since a cross origin\n\u003ciframe src\u003dpdf\u003e will often do its first layout pass with a provisional\nframe (that is window sized) and then proceed to keep that bad scale\nwhen the real size does eventually arrive (asynchronously). However, we\nsee the same issue when we modify the width attribute of any embedded\nPDF div.\n\nTo fix this issue, we make subframe PDFs recompute its document layout\nscale (and initialScale()) whenever its frame is resized, until of\ncourse user zoom is applied and auto-resizing is disabled\nunconditionally anyway.\n\nTest: TestWebKitAPI.UnifiedPDF.EmbeddedPDFFitsToFrame\n\n* Source/WebKit/WebProcess/Plugins/PDF/UnifiedPDF/UnifiedPDFPlugin.mm:\n(WebKit::UnifiedPDFPlugin::geometryDidChange):\n(WebKit::UnifiedPDFPlugin::updateLayout):\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/UnifiedPDFTests.mm:\n(TestWebKitAPI::EmbeddedPDFFitsToFrame::embedElement const):\n(TestWebKitAPI::EmbeddedPDFFitsToFrame::crossOrigin const):\n(TestWebKitAPI::EmbeddedPDFFitsToFrame::siteIsolationEnabled const):\n(TestWebKitAPI::EmbeddedPDFFitsToFrame::siteIsolationSharedProcessEnabled const):\n(TestWebKitAPI::EmbeddedPDFFitsToFrame::testNameGenerator):\n(TestWebKitAPI::TEST_P):\n\nCanonical link: https://commits.webkit.org/318837@main\n"
    },
    {
      "commit": "37cfccb3c6c9ae9cc09b9d9908c190286ac2e858",
      "tree": "5f749622026767e27788e1b39dd007c21631e0ff",
      "parents": [
        "b1bfab65c61e36f4daccb86aee42f7ff31e45dc6"
      ],
      "author": {
        "name": "Kristian Monsen",
        "email": "k_monsen@apple.com",
        "time": "Sat Aug 08 04:00:37 2026"
      },
      "committer": {
        "name": "Kristian Monsen",
        "email": "k_monsen@apple.com",
        "time": "Sat Aug 08 04:00:37 2026"
      },
      "message": "Fix crash from double-consuming the pending exception in DeferredPromise::reject() during Navigation reload()/navigate() error handling\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d321250\nrdar://183911429\n\nReviewed by Rupin Mittal.\n\nNavigation::createErrorResult() rejects both the committed and finished promises with the same Exception. When that exception carries ExceptionCode::ExistingExceptionError — the\nsentinel meaning \"the real JS exception is already sitting on the VM\u0027s exception scope\" — DeferredPromise::reject() pulled the value straight off scope.exception() and called\nscope.clearException() as a side effect. That works for the first reject() call, but clears the exception before the second call runs, so it finds nothing there: an assert in\ndebug/ASan builds, a null-pointer read of Exception::m_value in release builds — either way, a crash on every reload()/navigate() whose state argument throws during\nstructured-clone.\n\nThe fix reuses the exceptionObject out-parameter that\u0027s already threaded through both reject() calls (the same parameter the plain-ExceptionCode branch a few lines below already\nuses to build the DOMException once and share it across calls). On the first call, if exceptionObject is still empty, it extracts the value from the exception scope, clears it, and\ncaches the result in exceptionObject; on the second call, exceptionObject is already populated, so it skips touching the exception scope entirely and just rejects with the cached\nvalue. This matches the pattern already used elsewhere in Navigation.cpp (rejectFinishedPromise, which precomputes a DOMException once and passes it to both promise rejections),\nand it satisfies the spec requirement that committed and finished reject with the identical error value — which a \"swallow and fall back to a generic error\" fix would not have.\n\nTests: navigation-api/navigation-navigate-state-clone-exception-crash.html\n       navigation-api/navigation-reload-state-clone-exception-crash.html\n\n* LayoutTests/navigation-api/navigation-navigate-state-clone-exception-crash-expected.txt: Added.\n* LayoutTests/navigation-api/navigation-navigate-state-clone-exception-crash.html: Added.\n* LayoutTests/navigation-api/navigation-reload-state-clone-exception-crash-expected.txt: Added.\n* LayoutTests/navigation-api/navigation-reload-state-clone-exception-crash.html: Added.\n* Source/WebCore/bindings/js/JSDOMPromiseDeferred.cpp:\n(WebCore::DeferredPromise::reject):\n\nCanonical link: https://commits.webkit.org/318836@main\n"
    },
    {
      "commit": "b1bfab65c61e36f4daccb86aee42f7ff31e45dc6",
      "tree": "898243ef2d1ad27bba964aead7c17219a4842dda",
      "parents": [
        "aa8167a2feb9a49f5380353389324102f2a63462"
      ],
      "author": {
        "name": "Yusuke Suzuki",
        "email": "ysuzuki@apple.com",
        "time": "Sat Aug 08 03:45:04 2026"
      },
      "committer": {
        "name": "Yusuke Suzuki",
        "email": "ysuzuki@apple.com",
        "time": "Sat Aug 08 03:45:04 2026"
      },
      "message": "Unreviewed, use WASM_FAIL_IF_HELPER_FAILS\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d321348\nrdar://184382576\n\n* JSTests/wasm/stress/const-expr-i32-wrap.js:\n(assert.eq):\n* JSTests/wasm/stress/data-segment-offset-2gb.js:\n* JSTests/wasm/stress/exception-trace-stack.js:\n* JSTests/wasm/stress/instance-anchor.js:\n(main):\n* Source/JavaScriptCore/wasm/WasmFunctionParser.h:\n(JSC::Wasm::FunctionParser\u003cContext\u003e::load):\n(JSC::Wasm::FunctionParser\u003cContext\u003e::store):\n(JSC::Wasm::FunctionParser\u003cContext\u003e::atomicLoad):\n(JSC::Wasm::FunctionParser\u003cContext\u003e::atomicStore):\n(JSC::Wasm::FunctionParser\u003cContext\u003e::atomicBinaryRMW):\n(JSC::Wasm::FunctionParser\u003cContext\u003e::atomicCompareExchange):\n(JSC::Wasm::FunctionParser\u003cContext\u003e::atomicWait):\n(JSC::Wasm::FunctionParser\u003cContext\u003e::atomicNotify):\n(JSC::Wasm::FunctionParser\u003cContext\u003e::simd):\n(JSC::Wasm::FunctionParser\u003cContext\u003e::parseUnreachableExpression):\n\nCanonical link: https://commits.webkit.org/318835@main\n"
    },
    {
      "commit": "aa8167a2feb9a49f5380353389324102f2a63462",
      "tree": "371298e43e360ed521aa7d6b38a2d178824ee247",
      "parents": [
        "1d2141761faac89e4a85fc49cf2f9fc3fb15c145"
      ],
      "author": {
        "name": "Yusuke Suzuki",
        "email": "ysuzuki@apple.com",
        "time": "Sat Aug 08 03:43:15 2026"
      },
      "committer": {
        "name": "Yusuke Suzuki",
        "email": "ysuzuki@apple.com",
        "time": "Sat Aug 08 03:43:15 2026"
      },
      "message": "[JSC] Table64 size should be checked when creating / growing, not parsing\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d321338\nrdar://184367247\n\nReviewed by Yijia Huang.\n\nClamping the table size at parsing time will cause incorrect table size\nreporting. The correct behavior is (1) parsing should accept, it is just\ndeclaration and then (2) creating a table actually should reject it.\nThis patch fixes this issue.\n\nTest: JSTests/wasm/stress/table-oversized-initial-reflection.js\n\n* JSTests/wasm/stress/table-oversized-initial-reflection.js: Added.\n(leb):\n(section):\n(importedTable):\n(exportedTable):\n(checkMinimum):\n(true.assert.throws.new.WebAssembly.Instance.new.WebAssembly.Module.importedTable):\n* Source/JavaScriptCore/wasm/WasmBBQJIT.cpp:\n(JSC::Wasm::BBQJITImpl::BBQJIT::addCallIndirect):\n* Source/JavaScriptCore/wasm/WasmFormat.h:\n(JSC::Wasm::TableInformation::TableInformation):\n(JSC::Wasm::TableInformation::initial const):\n* Source/JavaScriptCore/wasm/WasmOMGIRGenerator.cpp:\n(JSC::Wasm::OMGIRGenerator::addCallIndirect):\n* Source/JavaScriptCore/wasm/WasmSectionParser.cpp:\n(JSC::Wasm::SectionParser::parseTableHelper):\n* Source/JavaScriptCore/wasm/WasmTable.cpp:\n(JSC::Wasm::Table::tryCreate):\n* Source/JavaScriptCore/wasm/WasmTable.h:\n* Source/JavaScriptCore/wasm/js/WebAssemblyModuleRecord.cpp:\n(JSC::WebAssemblyModuleRecord::initializeImports):\n\nCanonical link: https://commits.webkit.org/318834@main\n"
    },
    {
      "commit": "1d2141761faac89e4a85fc49cf2f9fc3fb15c145",
      "tree": "2a2b735585329f0c3e1129eb536159f53d0c404c",
      "parents": [
        "23cf2c3d79dbe10e0270ae53fbc8350e18a56def"
      ],
      "author": {
        "name": "Brian Weinstein",
        "email": "bweinstein@apple.com",
        "time": "Sat Aug 08 03:06:52 2026"
      },
      "committer": {
        "name": "Brian Weinstein",
        "email": "bweinstein@apple.com",
        "time": "Sat Aug 08 03:06:52 2026"
      },
      "message": "Web Extensions: Add support for the offscreen API\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d321216\nWork towards: rdar://184269255\n\nReviewed by Kiara Rose and Timothy Hatcher.\n\nThis PR adds the start of support for the Web Extensions offscreen API, described in:\nhttps://developer.chrome.com/docs/extensions/reference/api/offscreen\n\nThe API is currently compiled off, and once it is compiled on, will be in testable mode to start.\n\nThis PR doesn\u0027t actually implement the API functionality, it just puts us into a position to do so. We now support:\n- The `offscreen` permission gating access to `browser.offscreen`.\n- Argument validation for `browser.offscreen.createDocument`.\n- Web Process -\u003e UI process communication for the `browser.offscreen` APIs.\n- Tests for presence of the APIs and argument validation for `browser.offscreen.createDocument`.\n\nFuture PRs will implement actually creating and loading a web view in the UI process, and implementing the other\nAPIs.\n\nTest: Tools/TestWebKitAPI/Tests/WebKit/WKWebView/WKWebExtensionAPIOffscreen.mm\n\n* Source/WTF/Scripts/Preferences/UnifiedWebPreferences.yaml:\n* Source/WTF/wtf/PlatformEnableCocoa.h:\n* Source/WebKit/DerivedSources-input.xcfilelist:\n* Source/WebKit/DerivedSources-output.xcfilelist:\n* Source/WebKit/DerivedSources.make:\n* Source/WebKit/Shared/Extensions/WebExtensionOffscreenDocumentParameters.h: Copied from Source/WebKit/Shared/Extensions/WebExtensionPermission.h.\n* Source/WebKit/Shared/Extensions/WebExtensionOffscreenDocumentParameters.serialization.in: Added.\n* Source/WebKit/Shared/Extensions/WebExtensionPermission.cpp:\n(WebKit::WebExtensionPermission::offscreen):\n* Source/WebKit/Shared/Extensions/WebExtensionPermission.h:\n* Source/WebKit/SourcesCocoa.txt:\n* Source/WebKit/UIProcess/Extensions/Cocoa/API/WebExtensionContextAPIOffscreenCocoa.mm: Copied from Source/WebKit/Shared/Extensions/WebExtensionPermission.h.\n(WebKit::WebExtensionContext::isOffscreenMessageAllowed):\n(WebKit::WebExtensionContext::offscreenCreateDocument):\n(WebKit::WebExtensionContext::offscreenCloseDocument):\n(WebKit::WebExtensionContext::offscreenHasDocument):\n* Source/WebKit/UIProcess/Extensions/WebExtension.cpp:\n(WebKit::WebExtension::supportedPermissions):\n* Source/WebKit/UIProcess/Extensions/WebExtensionContext.h:\n* Source/WebKit/UIProcess/Extensions/WebExtensionContext.messages.in:\n* Source/WebKit/WebKit.xcodeproj/project.pbxproj:\n* Source/WebKit/WebProcess/Extensions/API/Cocoa/WebExtensionAPINamespaceCocoa.mm:\n(WebKit::WebExtensionAPINamespace::offscreen):\n* Source/WebKit/WebProcess/Extensions/API/Cocoa/WebExtensionAPIOffscreenCocoa.mm: Added.\n(WebKit::WebExtensionAPIOffscreen::createDocument):\n(WebKit::WebExtensionAPIOffscreen::closeDocument):\n(WebKit::WebExtensionAPIOffscreen::hasDocument):\n* Source/WebKit/WebProcess/Extensions/API/WebExtensionAPIKeys.h:\n* Source/WebKit/WebProcess/Extensions/API/WebExtensionAPINamespace.h:\n* Source/WebKit/WebProcess/Extensions/API/WebExtensionAPIOffscreen.h: Copied from Source/WebKit/Shared/Extensions/WebExtensionPermission.h.\n* Source/WebKit/WebProcess/Extensions/Interfaces/WebExtensionAPINamespace.idl:\n* Source/WebKit/WebProcess/Extensions/Interfaces/WebExtensionAPIOffscreen.idl: Copied from Source/WebKit/Shared/Extensions/WebExtensionPermission.h.\n* Tools/TestWebKitAPI/SourcesCocoa.txt:\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/WKWebExtensionAPIOffscreen.mm: Added.\n(TestWebKitAPI::WKWebExtensionAPIOffscreen::WKWebExtensionAPIOffscreen):\n(TestWebKitAPI::WKWebExtensionAPIOffscreen::getManagerFor):\n(TestWebKitAPI::TEST_F(WKWebExtensionAPIOffscreen, APISUnavailableWhenManifestDoesNotRequest)):\n(TestWebKitAPI::TEST_F(WKWebExtensionAPIOffscreen, OffscreenAPIAvailableWhenManifestRequests)):\n(TestWebKitAPI::TEST_F(WKWebExtensionAPIOffscreen, OffscreenCreateDocumentArgumentValidation)):\n\nCanonical link: https://commits.webkit.org/318833@main\n"
    },
    {
      "commit": "23cf2c3d79dbe10e0270ae53fbc8350e18a56def",
      "tree": "b4d052fba73cc77aa636285cc22df38f0f867134",
      "parents": [
        "3e351c7849f30e38846e49f2ed1c5e94d9a59d29"
      ],
      "author": {
        "name": "David Kilzer",
        "email": "ddkilzer@apple.com",
        "time": "Sat Aug 08 03:04:48 2026"
      },
      "committer": {
        "name": "David Kilzer",
        "email": "ddkilzer@webkit.org",
        "time": "Sat Aug 08 03:04:48 2026"
      },
      "message": "LibWebRTCAudioModule.h should not be a private header\n\u003chttps://bugs.webkit.org/show_bug.cgi?id\u003d321345\u003e\n\u003crdar://184380932\u003e\n\nUnreviewed build fix.\n\nMake `LibWebRTCAudioModule.h` project-internal and forward-declare it in\nthe installed `AudioMediaStreamTrackRenderer.h` so the installed\n`WebCore_Private` module no longer requires a libwebrtc header that is\nnot part of WebCore\u0027s installed surface.\n\nNo new tests since this change is not directly testable.\n\n* Source/WebCore/WebCore.xcodeproj/project.pbxproj:\n* Source/WebCore/platform/mediastream/AudioMediaStreamTrackRenderer.cpp:\n(WebCore::AudioMediaStreamTrackRenderer::~AudioMediaStreamTrackRenderer): Add.\n* Source/WebCore/platform/mediastream/AudioMediaStreamTrackRenderer.h:\n\nCanonical link: https://commits.webkit.org/318832@main\n"
    },
    {
      "commit": "3e351c7849f30e38846e49f2ed1c5e94d9a59d29",
      "tree": "d6d0e0769c97a7a0d1fe5d25f0f90f0d0e755573",
      "parents": [
        "707048fdabb7f80ccb5222e342ca5a4257eb1dd2"
      ],
      "author": {
        "name": "Yusuke Suzuki",
        "email": "ysuzuki@apple.com",
        "time": "Sat Aug 08 02:54:03 2026"
      },
      "committer": {
        "name": "Yusuke Suzuki",
        "email": "ysuzuki@apple.com",
        "time": "Sat Aug 08 02:54:03 2026"
      },
      "message": "[JSC] SerializedScriptValue is not carrying memory64 flag\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d321332\nrdar://184365775\n\nReviewed by Yijia Huang.\n\nMemory64 Wasm Memory was not correctly propagating memory64 flag. And\nSerializedScriptValue is incorrectly accessing addressType() of non\nattached memory, this is not correct. This patch fixes it.\n\nTests: JSTests/wasm/stress/memory64-shared-broadcast-address-type.js\n       js/dom/webassembly-memory-shared-zero-maximum-clone.html\n\n* JSTests/wasm/stress/memory64-shared-broadcast-address-type.js: Added.\n(const.agentSource.agent.receiveBroadcast):\n(broadcastAndCollect):\n* LayoutTests/js/dom/webassembly-memory-shared-zero-maximum-clone-expected.txt: Added.\n* LayoutTests/js/dom/webassembly-memory-shared-zero-maximum-clone.html: Added.\n* Source/JavaScriptCore/jsc.cpp:\n(JSC_DEFINE_HOST_FUNCTION):\n* Source/WebCore/bindings/js/SerializedScriptValue.cpp:\n(WebCore::CloneSerializer::dumpDerivedTerminal):\n(WebCore::CloneDeserializer::readDerivedTerminal):\n(WebCore::SerializedScriptValue::computeMemoryCost const):\n\nCanonical link: https://commits.webkit.org/318831@main\n"
    },
    {
      "commit": "707048fdabb7f80ccb5222e342ca5a4257eb1dd2",
      "tree": "d8d116e17f98eba4b6ed6940685a6abc43f612d7",
      "parents": [
        "e07ecf4c4a07c61d5c331dfe900266ee50785cdf"
      ],
      "author": {
        "name": "Yusuke Suzuki",
        "email": "ysuzuki@apple.com",
        "time": "Sat Aug 08 02:46:52 2026"
      },
      "committer": {
        "name": "Yusuke Suzuki",
        "email": "ysuzuki@apple.com",
        "time": "Sat Aug 08 02:46:52 2026"
      },
      "message": "[JSC] WebAssembly.Memory.prototype.type() needs to report current size\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d321329\nrdar://184364939\n\nReviewed by Yijia Huang.\n\nWebAssembly.Memory.prototype.type()\u0027s minimum size is mem_type\u0027s\nminimum limit[2], which is the current size of the memory, not initially\ndeclared size.\n\n[1]: https://webassembly.github.io/js-types/js-api/index.html#dom-memory-type\n[2]: https://webassembly.github.io/spec/core/appendix/embedding.html#embed-mem-type\n\nTest: JSTests/wasm/stress/memory-type-reflects-current-size.js\n\n* JSTests/wasm/stress/memory-type-reflects-current-size.js: Added.\n(check):\n(string_appeared_here.await.instantiate.module.memory):\n(string_appeared_here.memory.grow):\n(maximum.numOrBig):\n* Source/JavaScriptCore/wasm/js/JSWebAssemblyMemory.cpp:\n(JSC::JSWebAssemblyMemory::type):\n\nCanonical link: https://commits.webkit.org/318830@main\n"
    },
    {
      "commit": "e07ecf4c4a07c61d5c331dfe900266ee50785cdf",
      "tree": "3bf1887893c50e27256cda182d340c3ccd0f28eb",
      "parents": [
        "1194eb4af51484664a505a72567f290cf6763a28"
      ],
      "author": {
        "name": "Yijia Huang",
        "email": "yijia_huang@apple.com",
        "time": "Sat Aug 08 02:40:56 2026"
      },
      "committer": {
        "name": "Yijia Huang",
        "email": "yijia_huang@apple.com",
        "time": "Sat Aug 08 02:40:56 2026"
      },
      "message": "[JSC][Temporal] Replace the four monthCode search walks with one primitive\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d321313\nrdar://184352721\n\nReviewed by Yusuke Suzuki.\n\nsetCalendarToMonthCode walked the months of a calendar year twice, once for\nHebrew and once for everything else, and resolveMonthCodeToOrdinal and\nnonISOCalendarDateToISO each walked once more: four loops in three functions.\nsearchYearForMonthCode does it once and reports where it stopped and why,\nleaving each caller its own constrain rule and its own answer to give. The\nconstrain rule is the part that genuinely differed: Hebrew M05L (Adar I)\nconstrains forward to M06, every other calendar backward.\n\nNo behaviour change. Hebrew\u0027s forward constrain is now guarded on the overshoot\nstop it applies to — M05L is the only monthCode that can be absent from a Hebrew\nyear — so a walk that leaves the year rewinds like every other calendar.\n\ncalendarYear now reaches ICU through withCalendarSetToDate and readICUField like\nthe rest of the accessor family.\n\nparseUTCOffset and parseTimeSpec take SubMinutePrecision instead of a bool,\nnaming the UTCOffset[SubMinutePrecision] grammar parameter, and TimeZoneRecord\nbecomes ISOStringTimeZoneParseRecord after the record it implements.\n\nCanonical link: https://commits.webkit.org/318829@main\n"
    },
    {
      "commit": "1194eb4af51484664a505a72567f290cf6763a28",
      "tree": "66ea3bdc12b4e5354107bde2f17d0f6e7eb36e39",
      "parents": [
        "c110cc1814093427588f3c7c421aed4587087ff2"
      ],
      "author": {
        "name": "Kate Lee",
        "email": "klee@igalia.com",
        "time": "Sat Aug 08 02:26:05 2026"
      },
      "committer": {
        "name": "Fujii Hironori",
        "email": "fujii@igalia.com",
        "time": "Sat Aug 08 02:26:05 2026"
      },
      "message": "[GTK][WPE] Gardening of tests - 2026-08-07\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d321286\n\nUnreviewed gardening.\n\n* LayoutTests/platform/glib/TestExpectations:\n* LayoutTests/platform/gtk/TestExpectations:\n* LayoutTests/platform/wpe/TestExpectations:\n\nCanonical link: https://commits.webkit.org/318828@main\n"
    },
    {
      "commit": "c110cc1814093427588f3c7c421aed4587087ff2",
      "tree": "48c2f4df871be08c7d5c56273d6c844aaf783173",
      "parents": [
        "2e8a96a8c5857b071f073feea215c90803f22520"
      ],
      "author": {
        "name": "Chris Dumez",
        "email": "cdumez@apple.com",
        "time": "Sat Aug 08 02:00:14 2026"
      },
      "committer": {
        "name": "Chris Dumez",
        "email": "cdumez@apple.com",
        "time": "Sat Aug 08 02:00:14 2026"
      },
      "message": "Label default action incorrectly triggers when clicked interactive content removes itself\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d321257\n\nReviewed by Ryosuke Niwa.\n\nWhen a \u003clabel\u003e contains interactive content (e.g. a \u003cbutton\u003e), the label\u0027s\nactivation behavior must do nothing for clicks targeting that interactive\ncontent, per https://html.spec.whatwg.org/#the-label-element.\n\nHTMLLabelElement::isEventTargetedAtInteractiveDescendants determined this by\nwalking the live composed tree from the event target up to the label. But the\nevent path is computed once, up front, at dispatch time, so the label still\ndefault-handles the click even if the interactive content removes itself from\nthe tree while handling that same click. In that case the target is no longer\na descendant of the label, the isShadowIncludingInclusiveAncestorOf() guard\nbailed early returning false, and the label went on to activate its control.\n\nOnly reject a target that is still connected but outside the label. A\ndisconnected target means interactive content removed itself mid-dispatch; its\nown subtree and ancestor chain remain intact, so the interactive-content walk\nbelow still detects it and correctly does nothing.\n\nNo new tests, rebaselined existing WPT test. This test was already passing\nin both Chrome and Firefox.\n\n* LayoutTests/imported/w3c/web-platform-tests/dom/events/label-default-action-expected.txt:\n* Source/WebCore/html/HTMLLabelElement.cpp:\n(WebCore::HTMLLabelElement::isEventTargetedAtInteractiveDescendants const):\n\nCanonical link: https://commits.webkit.org/318827@main\n"
    },
    {
      "commit": "2e8a96a8c5857b071f073feea215c90803f22520",
      "tree": "b0744156b1b4c7ed4d8c29d468b84db56ca4d0c3",
      "parents": [
        "b1b0566f244ebf72f8cdd87ea3e9de08b768eff8"
      ],
      "author": {
        "name": "Yusuke Suzuki",
        "email": "ysuzuki@apple.com",
        "time": "Sat Aug 08 01:10:32 2026"
      },
      "committer": {
        "name": "Yusuke Suzuki",
        "email": "ysuzuki@apple.com",
        "time": "Sat Aug 08 01:10:32 2026"
      },
      "message": "[JSC] Fix Wasm memory64 memarg offset parsing\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d321328\nrdar://184364662\n\nReviewed by Yijia Huang.\n\nRegardless of memory64 / memory32, memarg offset is u64. This patch\nfixes that by introducing `parseMemoryOffset`. We decode VarUInt64, and\nthen do range check for memory32 case. IPInt side is already using\nVarUInt decoding so it does not need a change. Also we fix several Call,\nTable related offset scanning in parseUnreachableExpression.\n\nTests: JSTests/wasm/stress/memarg-offset-u64-encoding.js\n       JSTests/wasm/stress/unreachable-immediates-validation.js\n\n* JSTests/wasm/stress/memarg-offset-u64-encoding.js: Added.\n(leb):\n(paddedLeb):\n(section):\n(moduleBytes):\n(assertValid):\n* JSTests/wasm/stress/unreachable-immediates-validation.js: Added.\n(leb):\n(section):\n(moduleBytes):\n* Source/JavaScriptCore/wasm/WasmFunctionParser.h:\n(JSC::Wasm::FunctionParser\u003cContext\u003e::load):\n(JSC::Wasm::FunctionParser\u003cContext\u003e::store):\n(JSC::Wasm::FunctionParser\u003cContext\u003e::atomicLoad):\n(JSC::Wasm::FunctionParser\u003cContext\u003e::atomicStore):\n(JSC::Wasm::FunctionParser\u003cContext\u003e::atomicBinaryRMW):\n(JSC::Wasm::FunctionParser\u003cContext\u003e::atomicCompareExchange):\n(JSC::Wasm::FunctionParser\u003cContext\u003e::atomicWait):\n(JSC::Wasm::FunctionParser\u003cContext\u003e::atomicNotify):\n(JSC::Wasm::FunctionParser\u003cContext\u003e::simd):\n(JSC::Wasm::FunctionParser\u003cContext\u003e::parseMemoryOffset):\n(JSC::Wasm::FunctionParser\u003cContext\u003e::parseUnreachableExpression):\n\nCanonical link: https://commits.webkit.org/318826@main\n"
    },
    {
      "commit": "b1b0566f244ebf72f8cdd87ea3e9de08b768eff8",
      "tree": "2f388e3a0a8a671bb4a349d58e08a2f1c84b2366",
      "parents": [
        "9f82586af24ce000cbf76a2b2aa22ea58c34f414"
      ],
      "author": {
        "name": "Yusuke Suzuki",
        "email": "ysuzuki@apple.com",
        "time": "Fri Aug 07 23:50:07 2026"
      },
      "committer": {
        "name": "Yusuke Suzuki",
        "email": "ysuzuki@apple.com",
        "time": "Fri Aug 07 23:50:07 2026"
      },
      "message": "[JSC] Wasm table.copy should not use index to check identity\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d321316\nrdar://184355393\n\nReviewed by Yijia Huang.\n\nYou can set the same tables in different table index. So you cannot\ncheck the table identity by table index. We should check the actual\ntable\u0027s pointer.\n\nTest: JSTests/wasm/stress/table-copy-aliased-import.js\n\n* JSTests/wasm/stress/table-copy-aliased-import.js: Added.\n(reset):\n(contents):\n(test):\n(string_appeared_here.const.instance.await.instantiate.wat):\n* Source/JavaScriptCore/wasm/js/JSWebAssemblyInstance.cpp:\n(JSC::JSWebAssemblyInstance::tableCopy):\n\nCanonical link: https://commits.webkit.org/318825@main\n"
    },
    {
      "commit": "9f82586af24ce000cbf76a2b2aa22ea58c34f414",
      "tree": "4d3fafa82374f4eba1892a818f678ce6df5beacc",
      "parents": [
        "c2a26696cc420b4c9c925cdf6b1a2afa122dc9a8"
      ],
      "author": {
        "name": "Richard Robinson",
        "email": "richard_robinson2@apple.com",
        "time": "Fri Aug 07 23:47:02 2026"
      },
      "committer": {
        "name": "Richard Robinson",
        "email": "richard_robinson2@apple.com",
        "time": "Fri Aug 07 23:47:02 2026"
      },
      "message": "Remove `using WTF::Task` since it conflicts with Swift\u0027s Task\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d321212\nrdar://184270073\n\nReviewed by Aditya Keerthi.\n\nUse of `Task` in Swift is much more common than uses of `WTF::Task` which is only used in a single\nfile. Therefore, remove the `using` declaration and just use the namespaced name, since that\u0027s what\nnamespaces are for anyways.\n\nTests: Tools/TestWebKitAPI/Tests/WebKit/WebPage/AppKit Gesture Tests/AppKitGesturesTestsSupport.swift\n       Tools/TestWebKitAPI/Tests/WebKit/WebPage/AppKit Gesture Tests/BasicAppKitGesturesTests.swift\n       Tools/TestWebKitAPI/Tests/WebKit/WebPage/AppKit Gesture Tests/DoubleClickGesturesTests.swift\n       Tools/TestWebKitAPI/Tests/WebKit/WebPage/AppKit Gesture Tests/EmbeddedAppKitGesturesTests.swift\n       Tools/TestWebKitAPI/Tests/WebKit/WebPage/SendInspectorMessage.swift\n       Tools/TestWebKitAPI/Tests/WebKit/WebPage/URLSchemeHandlerTests.swift\n       Tools/TestWebKitAPI/Tests/WebKit/WebPage/WebPageNavigationTests.swift\n       Tools/TestWebKitAPI/Tests/WebKit/WebPage/WebViewTests.swift\n\n* Source/WTF/wtf/CoroutineUtilities.h:\n* Source/WebKit/Platform/IPC/HandleMessage.h:\n(IPC::callMemberFunctionCoroutine):\n(IPC::callMemberFunctionCoroutineVoid):\n* Tools/TestWebKitAPI/Tests/WebKit/WebPage/AppKit Gesture Tests/AppKitGesturesTestsSupport.swift:\n* Tools/TestWebKitAPI/Tests/WebKit/WebPage/AppKit Gesture Tests/BasicAppKitGesturesTests.swift:\n* Tools/TestWebKitAPI/Tests/WebKit/WebPage/AppKit Gesture Tests/DoubleClickGesturesTests.swift:\n* Tools/TestWebKitAPI/Tests/WebKit/WebPage/AppKit Gesture Tests/EmbeddedAppKitGesturesTests.swift:\n* Tools/TestWebKitAPI/Tests/WebKit/WebPage/SendInspectorMessage.swift:\n* Tools/TestWebKitAPI/Tests/WebKit/WebPage/URLSchemeHandlerTests.swift:\n* Tools/TestWebKitAPI/Tests/WebKit/WebPage/WebPageNavigationTests.swift:\n* Tools/TestWebKitAPI/Tests/WebKit/WebPage/WebViewTests.swift:\n\nCanonical link: https://commits.webkit.org/318824@main\n"
    },
    {
      "commit": "c2a26696cc420b4c9c925cdf6b1a2afa122dc9a8",
      "tree": "b28ba3f8a7cecf26ef5bff80046545f0b720bef6",
      "parents": [
        "e0a4c3f6764a4b74c23660affaef01c30c8afd73"
      ],
      "author": {
        "name": "Kiet Ho",
        "email": "kiet.ho@apple.com",
        "time": "Fri Aug 07 23:19:08 2026"
      },
      "committer": {
        "name": "Kiet Ho",
        "email": "kiet.ho@apple.com",
        "time": "Fri Aug 07 23:19:08 2026"
      },
      "message": "[css-anchor-position] Refactor how position-anchor: none and normal work\nrdar://183590606\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d320625\n\nReviewed by Antti Koivisto.\n\nposition-anchor: none makes an element not have a default anchor, while\nposition-anchor: normal gives it a default anchor (the implicit anchor)\nif it uses position-area.\n\nA natural place to implement this is AnchorPositionEvaluator::defaultAnchorName,\nwhich determines the name of the default anchor name. Instead, the current code\ndoesn\u0027t touch defaultAnchorName at all - elements that should not have a default\nanchor are still given the implicit anchor as the default anchor. Then, in\nfindAnchorForAnchorFunctionAndAttemptResolution, we reject resolving the implicit\nanchor if the element shouldn\u0027t have a default anchor.\n\nThis patch moves the implementation to defaultAnchorName - it now returns std::nullopt\nif the element doesn\u0027t have a default anchor. Its callers got fixed up to deal with\nit returning std::nullopt.\n\nRefactoring, tested by existing test suite.\n\n* Source/WebCore/style/AnchorPositionEvaluator.cpp:\n(WebCore::Style::AnchorPositionEvaluator::findAnchorForAnchorFunctionAndAttemptResolution):\n(WebCore::Style::findAnchorsForAnchorPositionedElement):\n(WebCore::Style::AnchorPositionEvaluator::updateAnchorPositioningStatesAfterInterleavedLayout):\n(WebCore::Style::AnchorPositionEvaluator::updateAnchorPositionedStateForDefaultAnchorAndPositionVisibility):\n(WebCore::Style::AnchorPositionEvaluator::defaultAnchorName):\n(WebCore::Style::AnchorPositionEvaluator::defaultAnchorForBox):\n* Source/WebCore/style/AnchorPositionEvaluator.h:\n\nCanonical link: https://commits.webkit.org/318823@main\n"
    },
    {
      "commit": "e0a4c3f6764a4b74c23660affaef01c30c8afd73",
      "tree": "86ee7a4ce5a75cc1b30ab4b4d135904ae128605f",
      "parents": [
        "c7ed9fcf795770aaef1c237379693dbfc4b205c3"
      ],
      "author": {
        "name": "Gerald Squelart",
        "email": "g_squelart@apple.com",
        "time": "Fri Aug 07 23:05:38 2026"
      },
      "committer": {
        "name": "Gerald Squelart",
        "email": "g_squelart@apple.com",
        "time": "Fri Aug 07 23:05:38 2026"
      },
      "message": "Accelerated convertImagePixels for PixelFormat::RGBA16F\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d321147\nrdar://158267620\n\nReviewed by Mike Wyrzykowski.\n\nRemove the long-winded and unaccelerated float16 conversion functions.\nInstead, add float16 support through the accelerated path.\n\nNote: There is no need for unaccelerated float16 functions at this time,\nsince PixelFormat::RGBA16F is only available on platforms where\naccelerated CG functions exist and should be used.\n\n* Source/WebCore/platform/graphics/PixelBufferConversion.cpp:\n(WebCore::makeVImageCGImageFormat):\n(WebCore::convertImagePixelsAccelerated):\n(WebCore::copyImagePixels):\n(WebCore::isSupportedConversionFormat):\n(WebCore::hasEnoughBytesForConversion):\n(WebCore::convertImagePixels):\n(WebCore::readFloat16): Deleted.\n(WebCore::writeFloat16): Deleted.\n(WebCore::convertImagePixelsFromFloat16ToFloat16): Deleted.\n(WebCore::convertImagePixelsFromFloat16): Deleted.\n(WebCore::convertImagePixelsToFloat16): Deleted.\n* Tools/TestWebKitAPI/Tests/WebCore/PixelBufferConversionTests.cpp:\n(TestWebKitAPI::byteVectorFromFloat16s):\n(TestWebKitAPI::float16sFromByteVector):\n(TestWebKitAPI::convertFloat16s):\n(TestWebKitAPI::expectFloat16sNear):\n(TestWebKitAPI::TEST(PixelBufferConversionTests, convertImagePixelsFloat16Identical)):\n(TestWebKitAPI::TEST(PixelBufferConversionTests, convertImagePixelsFloat16AlphaOnly)):\n(TestWebKitAPI::TEST(PixelBufferConversionTests, convertImagePixelsFloat16ColorSpaceConversion)):\n(TestWebKitAPI::TEST(PixelBufferConversionTests, convertImagePixelsFloat16ToAndFromByte)):\n(TestWebKitAPI::TEST(PixelBufferConversionTests, convertImagePixelsFloat16PaddedRows)):\n\nCanonical link: https://commits.webkit.org/318822@main\n"
    },
    {
      "commit": "c7ed9fcf795770aaef1c237379693dbfc4b205c3",
      "tree": "f8d648c7ec2ecfda8357276b4b5fec8bbd7f7712",
      "parents": [
        "7b1a9ea70e83ee49ddab02a1d2b1ad1ddbdd425f"
      ],
      "author": {
        "name": "Yusuke Suzuki",
        "email": "ysuzuki@apple.com",
        "time": "Fri Aug 07 22:59:14 2026"
      },
      "committer": {
        "name": "Yusuke Suzuki",
        "email": "ysuzuki@apple.com",
        "time": "Fri Aug 07 22:59:14 2026"
      },
      "message": "[JSC] Propagate uint64_t index until we do bound-check for TypedArray\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d321317\nrdar://184355743\n\nReviewed by Yijia Huang.\n\nIt is 32bit only issue. We should propagate uint64_t index until we do\nbound check, after that, we can use size_t. In 64bit, it does not matter\nsince sizeof(uint64_t) \u003d\u003d sizeof(size_t).\n\nTest: JSTests/stress/typedarray-put-out-of-range-canonical-numeric-index.js\n\n* JSTests/stress/typedarray-put-out-of-range-canonical-numeric-index.js: Added.\n(shouldBe):\n* Source/JavaScriptCore/runtime/JSGenericTypedArrayView.h:\n* Source/JavaScriptCore/runtime/JSGenericTypedArrayViewInlines.h:\n(JSC::JSGenericTypedArrayView\u003cAdaptor\u003e::defineOwnProperty):\n(JSC::JSGenericTypedArrayView\u003cAdaptor\u003e::setIndex):\n\nCanonical link: https://commits.webkit.org/318821@main\n"
    },
    {
      "commit": "7b1a9ea70e83ee49ddab02a1d2b1ad1ddbdd425f",
      "tree": "83ea1f14331684d9374337e714ed5a866d5ada00",
      "parents": [
        "18a9a4ac61884fe28c374d84757469e20161bd95"
      ],
      "author": {
        "name": "Zak Ridouh",
        "email": "zakr@apple.com",
        "time": "Fri Aug 07 22:30:47 2026"
      },
      "committer": {
        "name": "Zak Ridouh",
        "email": "zakr@apple.com",
        "time": "Fri Aug 07 22:30:47 2026"
      },
      "message": "[Site Isolation] Remove dead process-qualified media identifier plumbing\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d321126\nrdar://184160039\n\nReviewed by Charlie Wolfe.\n\nThe UI process now pairs a bare WebCore::MediaPlayerClientIdentifier from IPC with\nthe process identity of the sending IPC::Connection, so nothing constructs or sends a\nprocess-qualified media identifier anymore. Delete the two pieces of machinery that\nserved only those senders:\n\n- processQualify(), whose last callers were removed when the media manager messages\n  and the layer-tree / text-recognition messages were converted.\n- The WebKit::PlaybackSessionContextIdentifier serialization alias, whose generated\n  coder is now unused and which needlessly advertised the type to\n  IPC.serializedTypeInfo.\n\nWebKit::PlaybackSessionContextIdentifier itself stays. It remains load-bearing as\nUI-process-internal state — it is how the UI process distinguishes same-numbered\nmedia elements in different processes. The end state is the point: the UI process\nconstructs this type and never receives it.\n\nNo change in behaviour; pure dead-code removal.\n\n* Source/WebKit/Shared/PlaybackSessionContextIdentifier.h:\n(WebKit::processQualify): Deleted.\n* Source/WebKit/Shared/ProcessQualified.serialization.in:\n\nCanonical link: https://commits.webkit.org/318820@main\n"
    },
    {
      "commit": "18a9a4ac61884fe28c374d84757469e20161bd95",
      "tree": "3e68edf3cb21754c1f3e0b90fd4dab946d641f87",
      "parents": [
        "99f7faef3a01564a0d2a47bb44302c3ab5be28bb"
      ],
      "author": {
        "name": "Nikolas Zimmermann",
        "email": "nzimmermann@igalia.com",
        "time": "Fri Aug 07 22:22:10 2026"
      },
      "committer": {
        "name": "Nikolas Zimmermann",
        "email": "zimmermann@kde.org",
        "time": "Fri Aug 07 22:22:10 2026"
      },
      "message": "[WPE][cross-toolchain-helper] webkitdevci builds fail on hosts with glibc 2.43 (e.g. Ubuntu 26.04 SDK)\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d321337\n\nReviewed by Carlos Alberto Lopez Perez.\n\nThe do_package task dies while copying a recipe\u0027s image directory:\n\n    tar: ./usr/share: Cannot mkdir: Function not implemented\n\npseudo 1.9.3, the revision pinned by poky scarthgap 5.0.18, wraps openat2()\nwith an unconditional ENOSYS and hopes that callers fall back to an older\nsyscall. GNU tar linked against glibc 2.43 calls openat2() and reports the\nerror instead of falling back, so every do_package fails. tar is currently\nthe only entry in tmp/hosttools that references openat2.\n\nUpstream pseudo implements the openat2() wrapper since 1.9.9, so bump the\npseudo recipe to upstream master until poky ships a new enough revision.\n\n* Tools/yocto/meta-openembedded_and_meta-webkit.patch:\n\nCanonical link: https://commits.webkit.org/318819@main\n"
    },
    {
      "commit": "99f7faef3a01564a0d2a47bb44302c3ab5be28bb",
      "tree": "84975c8fcc2e1a8a8066b682ffff8d748ee0493c",
      "parents": [
        "6050a91d396cdfc1200117dbe456ea291e64860c"
      ],
      "author": {
        "name": "Nikolas Zimmermann",
        "email": "nzimmermann@igalia.com",
        "time": "Fri Aug 07 22:08:10 2026"
      },
      "committer": {
        "name": "Nikolas Zimmermann",
        "email": "zimmermann@kde.org",
        "time": "Fri Aug 07 22:08:10 2026"
      },
      "message": "[LBSE] Update baseline + TestExpectations\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d321335\n\nUnreviewed gardening.\n\nRemove an iOS specific baseline that\u0027s no longer needed (matches the generic one),\nplus update TestExepctations for two more passing LBSE tests.\n\n* LayoutTests/platform/ios/svg/repaint/mask-object-bounding-box-transformed-expected.txt: Removed.\n* LayoutTests/platform/mac-tahoe-wk2-lbse-text/TestExpectations:\n\nCanonical link: https://commits.webkit.org/318818@main\n"
    },
    {
      "commit": "6050a91d396cdfc1200117dbe456ea291e64860c",
      "tree": "1abc0ed0c52c665e7378880da2e35769fbe838d7",
      "parents": [
        "49d0165dc35c18492fe0b1ac841f86ec583a7bc0"
      ],
      "author": {
        "name": "Nikolas Zimmermann",
        "email": "nzimmermann@igalia.com",
        "time": "Fri Aug 07 21:58:22 2026"
      },
      "committer": {
        "name": "Nikolas Zimmermann",
        "email": "zimmermann@kde.org",
        "time": "Fri Aug 07 21:58:22 2026"
      },
      "message": "[LBSE] Fix remaining mask issues\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d321215\n\nReviewed by Simon Fraser.\n\nRenderSVGResourceMasker cancelled \u0027adjustedPaintOffset\u0027 against\nobjectBoundingBox() instead of nominalSVGLayoutLocation(), displacing the mask\nof any target whose children carry transforms. It also ignored the mask region\ngiven by x/y/width/height, so mask content reaching past it was not cut off and\na mask covering nothing left its target fully visible. Confining the image also\nmakes painting clip to that region, and a rectangular clip is not antialiased,\nso a fractional region rounds the outermost row and column of the mask away.\nRound it _outwards_ to the whole pixels the image is rasterized over.\n\nTwo problems concerned the cached mask image: nothing dropped it on layout, so\na resized viewport went on masking with an image rasterized for the percentage\nlengths of the old one. It was also allocated through ImageBuffer::create()\nrather than through the context, which in the GPU process leaves the context\nwithout a handle to it, so every paint has to upload the mask again...\n\nFinally, SVGMaskElement::calculateMaskContentRepaintRect() skipped mask\nchildren with \u0027visibility: hidden\u0027, whose descendants can turn visibility back\non.\n\nThe fixes combined, fix all remaining issues with SVG masks in LBSE.\n\n* LayoutTests/platform/mac-tahoe-wk2-lbse-text/TestExpectations:\n* LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/dynamic-updates/SVGMaskElement-dom-height-attr-expected.png: Added.\n* LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/dynamic-updates/SVGMaskElement-dom-maskContentUnits-attr-expected.png: Added.\n* LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/dynamic-updates/SVGMaskElement-dom-maskUnits-attr-expected.png: Added.\n* LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/dynamic-updates/SVGMaskElement-dom-width-attr-expected.png: Added.\n* LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/dynamic-updates/SVGMaskElement-dom-x-attr-expected.png: Added.\n* LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/dynamic-updates/SVGMaskElement-dom-y-attr-expected.png: Added.\n* LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/dynamic-updates/SVGMaskElement-svgdom-height-prop-expected.png: Added.\n* LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/dynamic-updates/SVGMaskElement-svgdom-maskContentUnits-prop-expected.png: Added.\n* LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/dynamic-updates/SVGMaskElement-svgdom-maskUnits-prop-expected.png: Added.\n* LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/dynamic-updates/SVGMaskElement-svgdom-width-prop-expected.png: Added.\n* LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/dynamic-updates/SVGMaskElement-svgdom-x-prop-expected.png: Added.\n* LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/dynamic-updates/SVGMaskElement-svgdom-y-prop-expected.png: Added.\n* LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/repaint/mask-clip-target-transform-expected.png: Added.\n* Source/WebCore/rendering/svg/RenderSVGResourceMasker.cpp:\n(WebCore::createImageBuffer):\n(WebCore::RenderSVGResourceMasker::applyMask):\n(WebCore::RenderSVGResourceMasker::maskBoundsInLocalCoordinates):\n(WebCore::RenderSVGResourceMasker::resourceBoundingBox):\n* Source/WebCore/rendering/svg/RenderSVGResourceMasker.h:\n* Source/WebCore/svg/SVGMaskElement.cpp:\n(WebCore::SVGMaskElement::calculateMaskContentRepaintRect):\n\nCanonical link: https://commits.webkit.org/318817@main\n"
    },
    {
      "commit": "49d0165dc35c18492fe0b1ac841f86ec583a7bc0",
      "tree": "bc79d0d0fb00f4d569eb050d07dd80bae6c0f7fb",
      "parents": [
        "87958571e8999a561412d8bdffd67dca08733f39"
      ],
      "author": {
        "name": "Nikolas Zimmermann",
        "email": "nzimmermann@igalia.com",
        "time": "Fri Aug 07 21:35:21 2026"
      },
      "committer": {
        "name": "Nikolas Zimmermann",
        "email": "zimmermann@kde.org",
        "time": "Fri Aug 07 21:35:21 2026"
      },
      "message": "[LBSE] Masked SVG content is cut off at the edges of the transparency layer bound\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d321289\n\nReviewed by Simon Fraser.\n\nRenderSVGResourceMasker sizes and draws its mask image over\nenclosingIntRect(absoluteTransform.mapRect(decoratedBounds)), the enclosing\ninteger rect of the mask content bounds in device space. Perform the clip for\nthe transparency layer in the same way, otherwise the edge pixels of the masked\ncontent are lost. SVG content below the SVG root is not snapped to device\npixels and its bound is in the local coordinate system that the CTM scales, so\ndo the rounding in the context\u0027s device space. The same applies to a clipper\napplied as a mask.\n\nThe bound was wrong for SVG in a second way. An SVG renderer that is a box\n(\u003ctext\u003e, \u003cforeignObject\u003e) used the CSS mask clip rect, which comes from the\nborder box and leaves out the SVG content that spills outside it. The visual\noverflow rect already covers the mask resource, so use that instead.\n\n* LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/W3C-SVG-1.1/masking-mask-01-b-expected.png:\n* LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/W3C-SVG-1.1/masking-path-01-b-expected.png:\n* LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/absolute-sized-content-with-resources-expected.png:\n* LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/grayscale-gradient-mask-2-expected.png:\n* LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/grayscale-gradient-mask-expected.png:\n* LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/transforms/text-with-mask-with-svg-transform-expected.png:\n* LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/zoom/page/zoom-mask-with-percentages-expected.png:\n* Source/WebCore/rendering/RenderLayer.cpp:\n(WebCore::clipRectForTransparencyLayer):\n(WebCore::RenderLayer::beginTransparencyLayers):\n(WebCore::RenderLayer::calculateClipRects const):\n\nCanonical link: https://commits.webkit.org/318816@main\n"
    },
    {
      "commit": "87958571e8999a561412d8bdffd67dca08733f39",
      "tree": "36c393de326788ca75ad78a813368b5ebf3b4d2f",
      "parents": [
        "d5bec83d776b775bc1a9a3e3af39faf551dd9f27"
      ],
      "author": {
        "name": "Sam Weinig",
        "email": "sam@webkit.org",
        "time": "Fri Aug 07 21:21:37 2026"
      },
      "committer": {
        "name": "Sam Weinig",
        "email": "sam@webkit.org",
        "time": "Fri Aug 07 21:21:37 2026"
      },
      "message": "Restrict length values passed via script for the WebAnimation rangeStart/rangeEnd attributes to computationally independent values\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d321003\n\nReviewed by Darin Adler.\n\nRestrict length values passed via script for the WebAnimation rangeStart/rangeEnd attributes\nto computationally independent values.\n\nThis was resolved on by the CSSWG in https://github.com/w3c/csswg-drafts/issues/13853.\n\nTest: imported/w3c/web-platform-tests/web-animations/interfaces/Animation/animation-range-invalid.html\n* LayoutTests/imported/w3c/web-platform-tests/scroll-animations/scroll-timelines/scroll-timeline-range-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/scroll-animations/scroll-timelines/scroll-timeline-range-with-zoom.html:\n* LayoutTests/imported/w3c/web-platform-tests/scroll-animations/scroll-timelines/scroll-timeline-range.html:\n* LayoutTests/imported/w3c/web-platform-tests/scroll-animations/view-timelines/view-timeline-range.html:\n* LayoutTests/imported/w3c/web-platform-tests/web-animations/interfaces/Animation/animation-range-invalid-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/web-animations/interfaces/Animation/animation-range-invalid.html: Added.\n* Source/WebCore/WebCore.xcodeproj/project.pbxproj:\n* Source/WebCore/animation/CSSAnimation.cpp:\n* Source/WebCore/animation/CSSAnimation.h:\n* Source/WebCore/animation/TimelineRangeValue.cpp:\n* Source/WebCore/animation/TimelineRangeValue.h:\n* Source/WebCore/animation/WebAnimation.cpp:\n* Source/WebCore/animation/WebAnimation.h:\n* Source/WebCore/animation/WebAnimation.idl:\n* Source/WebCore/css/calc/CSSCalcTree+ComputedStyleDependencies.cpp:\n* Source/WebCore/css/calc/CSSCalcTree+ComputedStyleDependencies.h:\n* Source/WebCore/css/parser/CSSPropertyParserConsumer+Timeline.cpp:\n* Source/WebCore/css/parser/CSSPropertyParserConsumer+Timeline.h:\n* Source/WebCore/css/typedom/numeric/CSSMathValue.cpp:\n* Source/WebCore/css/typedom/numeric/CSSMathValue.h:\n* Source/WebCore/dom/Element.cpp:\n* Source/WebCore/style/calc/StyleCalculationTree+Conversion.cpp:\n* Source/WebCore/style/values/animations/StyleSingleAnimationRange.h:\n* Source/WebCore/style/values/primitives/StyleLengthResolution.cpp:\n* Source/WebCore/style/values/primitives/StyleLengthResolution.h:\n\nCanonical link: https://commits.webkit.org/318815@main\n"
    },
    {
      "commit": "d5bec83d776b775bc1a9a3e3af39faf551dd9f27",
      "tree": "427ed7fd6e7709a1327db5d75735edfcdb6a1a50",
      "parents": [
        "039dce84d4e0eda9e1e6b3a58964d50731e8e581"
      ],
      "author": {
        "name": "Marta Darbinyan",
        "email": "darbinyan@apple.com",
        "time": "Fri Aug 07 20:54:30 2026"
      },
      "committer": {
        "name": "Marta Darbinyan",
        "email": "darbinyan@apple.com",
        "time": "Fri Aug 07 20:54:30 2026"
      },
      "message": "[Gardening]: [macOS] imported/w3c/web-platform-tests/webrtc/RTCRtpReceiver-getSynchronizationSources.https.html is flaky failure\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d321312\nrdar://184351245\n\nUnreviewed test gardening\n\n* LayoutTests/platform/mac-wk2/TestExpectations:\n\nCanonical link: https://commits.webkit.org/318814@main\n"
    },
    {
      "commit": "039dce84d4e0eda9e1e6b3a58964d50731e8e581",
      "tree": "6b3007e1ac9b87e6fa8c8cb1fcc7ef3d8ea9e366",
      "parents": [
        "b29eae826faaf0aff766c3a64a48b514fb0efb76"
      ],
      "author": {
        "name": "Yusuke Suzuki",
        "email": "ysuzuki@apple.com",
        "time": "Fri Aug 07 20:53:52 2026"
      },
      "committer": {
        "name": "Yusuke Suzuki",
        "email": "ysuzuki@apple.com",
        "time": "Fri Aug 07 20:53:52 2026"
      },
      "message": "Unreviewed, fix weird formatting\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d321321\nrdar://184361372\n\n* Source/JavaScriptCore/bytecode/CheckPrivateBrandStatus.cpp:\n(JSC::CheckPrivateBrandStatus::computeForBaseline):\n(JSC::CheckPrivateBrandStatus::computeFor):\n* Source/JavaScriptCore/bytecode/CheckPrivateBrandStatus.h:\n* Source/JavaScriptCore/bytecode/DeleteByStatus.cpp:\n(JSC::DeleteByStatus::computeForBaseline):\n(JSC::DeleteByStatus::computeFor):\n* Source/JavaScriptCore/bytecode/DeleteByStatus.h:\n* Source/JavaScriptCore/bytecode/GetByStatus.cpp:\n(JSC::GetByStatus::computeFor):\n* Source/JavaScriptCore/bytecode/InByStatus.cpp:\n(JSC::InByStatus::computeFor):\n* Source/JavaScriptCore/bytecode/InstanceOfStatus.cpp:\n(JSC::InstanceOfStatus::computeFor):\n(JSC::InstanceOfStatus::computeForPropertyInlineCache):\n* Source/JavaScriptCore/bytecode/InstanceOfStatus.h:\n* Source/JavaScriptCore/bytecode/PutByStatus.cpp:\n(JSC::PutByStatus::computeFor):\n(JSC::PutByStatus::computeForPropertyInlineCache):\n* Source/JavaScriptCore/bytecode/PutByStatus.h:\n* Source/JavaScriptCore/bytecode/SetPrivateBrandStatus.cpp:\n(JSC::SetPrivateBrandStatus::computeForBaseline):\n(JSC::SetPrivateBrandStatus::computeFor):\n* Source/JavaScriptCore/bytecode/SetPrivateBrandStatus.h:\n\nCanonical link: https://commits.webkit.org/318813@main\n"
    },
    {
      "commit": "b29eae826faaf0aff766c3a64a48b514fb0efb76",
      "tree": "31cc52b23122b90c7ac0031f53158e400cb82df4",
      "parents": [
        "acf8a9bd09120f8b9dd8974c16cc499047fd8d56"
      ],
      "author": {
        "name": "Patrick Griffis",
        "email": "pgriffis@igalia.com",
        "time": "Fri Aug 07 20:51:46 2026"
      },
      "committer": {
        "name": "Patrick Griffis",
        "email": "pgriffis@igalia.com",
        "time": "Fri Aug 07 20:51:46 2026"
      },
      "message": "[GLib] Fix webkit_favicon_database_get_page_icons() lookups\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d321310\n\nReviewed by Adrian Perez de Castro.\n\nThis fixes two bugs:\n\nThe commit introducing this feature used AllowDatabaseWrite::No which meant the\nin-memory cache worked but loading it would fail. The database contains a timestamp\nof when icons were last used, so it must be writable, otherwise every icon is\nconsidered not recently used and ignored.\n\nThe purpose of this API was to return multiple sizes for the same URL, however\nthe schema was `pageURL (url UNIQUE ..., iconID ...)` which meant there could\nonly be one entry per URL. Change this to `UNIQUE (url, iconID)` so the combination\nmust be unique.\n\nTest: Tools/TestWebKitAPI/Tests/WebKit/WKWebView/glib/TestWebKitFaviconDatabase.cpp\n\n* Source/WebKit/UIProcess/API/glib/IconDatabase.cpp:\n(WebKit::IconDatabase::createTablesIfNeeded):\n* Source/WebKit/UIProcess/API/glib/WebKitFaviconDatabase.cpp:\n(webkit_favicon_database_get_page_icons):\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/glib/TestWebKitFaviconDatabase.cpp:\n(testFaviconDatabaseGetPageIcons):\n\nCanonical link: https://commits.webkit.org/318812@main\n"
    },
    {
      "commit": "acf8a9bd09120f8b9dd8974c16cc499047fd8d56",
      "tree": "ec516492b166bd67ceba12905c4ef1bcd6e98ce6",
      "parents": [
        "65b1821f100eb623205ecb3f59b961307f97dca8"
      ],
      "author": {
        "name": "Abrar Rahman Protyasha",
        "email": "a_protyasha@apple.com",
        "time": "Fri Aug 07 20:47:34 2026"
      },
      "committer": {
        "name": "Abrar Rahman Protyasha",
        "email": "a_protyasha@apple.com",
        "time": "Fri Aug 07 20:47:34 2026"
      },
      "message": "[SwiftBrowser] URL field does not reflect the committed URL after navigation\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d321267\nrdar://184318736\n\nReviewed by Pascoe and Richard Robinson.\n\nSwiftBrowser consumed the async navigation sequence but it only printed\neach event and did not invoke didReceiveNavigationEvent(). This is the\nmethod responsible  for syncinc displayedURL against page.url after a\nnavigation is committed. As such, the field kept whatever text was\nsubmitted, and did not reflect the final URL the page committed to.\n\nThis bug manifested itself in a stale address bar for navigations that\nproduced a known-host HTTPS upgrade (such as apple.com).\n\nTo fix this, we simply route navigation events through the correct\nhandler. We also include the event\u0027s URL in the logging to make\nnavigation state easier to follow.\n\nA couple of drive-by fixes:\n1. Mark the pre-existing \"Exported PDF to …\" log as privacy: .sensitive\n   for consistency.\n2. Drop the now redundant addingProtocolIfNecessary() adjustment in\n   navigateToSubmittedURL(). The userTypedString: init already applies\n   scheme inference and the field is now drive entirely by page.url.\n\n* Tools/SwiftBrowser/Source/ViewModel/BrowserViewModel.swift:\n(BrowserViewModel.didReceiveNavigationEvent(_:)):\n(BrowserViewModel.navigateToSubmittedURL):\n(BrowserViewModel.didExportPDF(_:any:)):\n* Tools/SwiftBrowser/Source/Views/ContentView.swift:\n(ContentView.body):\n\nCanonical link: https://commits.webkit.org/318811@main\n"
    },
    {
      "commit": "65b1821f100eb623205ecb3f59b961307f97dca8",
      "tree": "8d1da3c95b1ea51b3cef4c297326f9e0b8f66195",
      "parents": [
        "7618e8ee7881185820b1b2cedb953a7a8a7e19a7"
      ],
      "author": {
        "name": "Ryosuke Niwa",
        "email": "rniwa@webkit.org",
        "time": "Fri Aug 07 20:15:51 2026"
      },
      "committer": {
        "name": "Ryosuke Niwa",
        "email": "rniwa@webkit.org",
        "time": "Fri Aug 07 20:15:51 2026"
      },
      "message": "Remove incorrect NODELETE annotations from Source/WebCore/css\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d320518\n\nReviewed by Geoffrey Garen.\n\nRemoved NODELETE annotations from a bunch of functions in Source/WebCore/css.\n\n* Source/WebCore/SaferCPPExpectations/NoDeleteCheckerExpectations:\n* Source/WebCore/css/CSSComputedStyleDeclaration.h:\n* Source/WebCore/css/CSSPropertyInitialValues.cpp:\n(WebCore::isNumber):\n* Source/WebCore/css/DOMMatrixReadOnly.h:\n* Source/WebCore/css/SelectorChecker.cpp:\n(WebCore::localContextForParent):\n* Source/WebCore/css/StyleSheetList.h:\n* Source/WebCore/css/parser/CSSPropertyParserConsumer+String.h:\n* Source/WebCore/css/values/color/CSSKeywordColor.cpp:\n(WebCore::CSS::isDeprecatedSystemColorKeyword):\n\nCanonical link: https://commits.webkit.org/318810@main\n"
    },
    {
      "commit": "7618e8ee7881185820b1b2cedb953a7a8a7e19a7",
      "tree": "bb0bc74a53916532884a1e0a5d615f6fc25d1ae5",
      "parents": [
        "9ef04dabf52d7432a3e7ab13f44f9d8b4bd933a0"
      ],
      "author": {
        "name": "Yusuke Suzuki",
        "email": "ysuzuki@apple.com",
        "time": "Fri Aug 07 20:10:45 2026"
      },
      "committer": {
        "name": "Yusuke Suzuki",
        "email": "ysuzuki@apple.com",
        "time": "Fri Aug 07 20:10:45 2026"
      },
      "message": "Unreviewed, fix stale test\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d321319\nrdar://184357942\n\n* JSTests/stress/iterator-prototype-join.js:\n(3.values.join.toString):\n(sameValue):\n\nCanonical link: https://commits.webkit.org/318809@main\n"
    },
    {
      "commit": "9ef04dabf52d7432a3e7ab13f44f9d8b4bd933a0",
      "tree": "2f4626cc46ae2c0f9569e7c2ef39b8bdacd7b18d",
      "parents": [
        "0496fa627ebfc60e411c0a52009387ca10b4e584"
      ],
      "author": {
        "name": "Yusuke Suzuki",
        "email": "ysuzuki@apple.com",
        "time": "Fri Aug 07 20:01:24 2026"
      },
      "committer": {
        "name": "Yusuke Suzuki",
        "email": "ysuzuki@apple.com",
        "time": "Fri Aug 07 20:01:24 2026"
      },
      "message": "[JSC] Intl.Locale\u0027s collections should be sorted\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d321273\nrdar://184322384\n\nReviewed by Yijia Huang.\n\nIntl.Locale\u0027s returned arrays should be sorted according to the spec[1].\n\n[1]: https://tc39.es/proposal-intl-locale-info/#sec-collations-of-locale\n\n* JSTests/stress/intl-locale-info.js:\n(shouldBe):\n* JSTests/test262/expectations.yaml:\n* Source/JavaScriptCore/runtime/IntlLocale.cpp:\n(JSC::IntlLocale::collations):\n(JSC::IntlLocale::timeZones):\n\nCanonical link: https://commits.webkit.org/318808@main\n"
    },
    {
      "commit": "0496fa627ebfc60e411c0a52009387ca10b4e584",
      "tree": "92c75c8d6c9dec3bda89779e674d86edb4f54875",
      "parents": [
        "7417386b7da17bdb83f5c8f90aafb25234967e66"
      ],
      "author": {
        "name": "Patrick Griffis",
        "email": "pgriffis@igalia.com",
        "time": "Fri Aug 07 19:40:57 2026"
      },
      "committer": {
        "name": "Patrick Griffis",
        "email": "pgriffis@igalia.com",
        "time": "Fri Aug 07 19:40:57 2026"
      },
      "message": "[WPE] Add WebView::run-color-chooser API\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d321190\n\nReviewed by Carlos Garcia Campos and Adrian Perez de Castro.\n\nThis exposes roughly the same API as GTK, just with WebKitColor,\nand shares as much internally as possible.\n\nTest: Tools/TestWebKitAPI/Tests/WebKit/WKWebView/glib/TestUIClient.cpp\n\n* Source/WTF/Scripts/Preferences/UnifiedWebPreferences.yaml:\n* Source/WebKit/PlatformGTK.cmake:\n* Source/WebKit/PlatformWPE.cmake:\n* Source/WebKit/SourcesGTK.txt:\n* Source/WebKit/SourcesWPE.txt:\n* Source/WebKit/UIProcess/API/glib/WebKitAutocleanups.h.in:\n* Source/WebKit/UIProcess/API/glib/WebKitColorChooserRequest.cpp: Renamed from Source/WebKit/UIProcess/API/gtk/WebKitColorChooserRequest.cpp.\n(webkitColorChooserRequestSelectedColorChanged):\n(webkitColorChooserRequestGetProperty):\n(webkitColorChooserRequestSetProperty):\n(webkit_color_chooser_request_class_init):\n(webkit_color_chooser_request_set_rgba):\n(webkit_color_chooser_request_get_element_rectangle):\n(webkit_color_chooser_request_set_color):\n(webkit_color_chooser_request_get_color):\n(webkit_color_chooser_request_cancel):\n(webkitColorChooserRequestCreate):\n* Source/WebKit/UIProcess/API/glib/WebKitColorChooserRequest.h.in: Renamed from Source/WebKit/UIProcess/API/gtk/WebKitColorChooserRequest.h.in.\n* Source/WebKit/UIProcess/API/glib/WebKitColorChooserRequestPrivate.h: Renamed from Source/WebKit/UIProcess/API/gtk/WebKitColorChooserRequestPrivate.h.\n* Source/WebKit/UIProcess/API/glib/WebKitWebView.cpp:\n(WebKitWebViewClient::runColorChooser):\n(webkit_web_view_class_init):\n(webkitWebViewEmitRunColorChooser):\n* Source/WebKit/UIProcess/API/glib/WebKitWebView.h.in:\n* Source/WebKit/UIProcess/API/glib/WebKitWebViewPrivate.h:\n* Source/WebKit/UIProcess/API/glib/webkit.h.in:\n* Source/WebKit/UIProcess/API/gtk/WebKitColorChooser.cpp:\n(WebKit::WebKitColorChooser::showColorPicker):\n(WebKit::WebKitColorChooser::colorChooserRequestRGBAChanged): Deleted.\n* Source/WebKit/UIProcess/API/gtk/WebKitColorChooser.h:\n* Source/WebKit/UIProcess/API/gtk/WebKitColorChooserRequest.h.in: Removed.\n* Source/WebKit/UIProcess/API/gtk/WebKitWebViewGtk.cpp:\n(createRunColorChooserSignal):\n* Source/WebKit/UIProcess/API/wpe/PageClientImpl.cpp:\n(WebKit::PageClientImpl::createColorPicker):\n* Source/WebKit/UIProcess/API/wpe/WebKitColorChooser.cpp: Copied from Source/WebKit/UIProcess/API/gtk/WebKitColorChooser.cpp.\n(WebKit::WebKitColorChooser::create):\n(WebKit::WebKitColorChooser::WebKitColorChooser):\n(WebKit::WebKitColorChooser::~WebKitColorChooser):\n(WebKit::WebKitColorChooser::endPicker):\n(WebKit::WebKitColorChooser::colorChooserRequestFinished):\n(WebKit::WebKitColorChooser::showColorPicker):\n* Source/WebKit/UIProcess/API/wpe/WebKitColorChooser.h: Copied from Source/WebKit/UIProcess/API/gtk/WebKitColorChooser.h.\n* Source/WebKit/UIProcess/API/wpe/WebKitWebViewClient.h:\n* Source/WebKit/UIProcess/API/wpe/WebKitWebViewWPE.cpp:\n(createRunColorChooserSignal):\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/glib/TestUIClient.cpp:\n(assertColorIsEqual):\n(cancelColorChooserRequestOnColorChanged):\n(testWebViewColorChooserRequest):\n(beforeAll):\n\nCanonical link: https://commits.webkit.org/318807@main\n"
    },
    {
      "commit": "7417386b7da17bdb83f5c8f90aafb25234967e66",
      "tree": "254f214689c92610b3c3f99a873109aacea678d0",
      "parents": [
        "3c2f9abf7173b999417f7b09c02f4c91fb43615f"
      ],
      "author": {
        "name": "Yusuke Suzuki",
        "email": "ysuzuki@apple.com",
        "time": "Fri Aug 07 19:20:53 2026"
      },
      "committer": {
        "name": "Yusuke Suzuki",
        "email": "ysuzuki@apple.com",
        "time": "Fri Aug 07 19:20:53 2026"
      },
      "message": "[JSC] Align Iterator#join to the latest spec\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d321270\nrdar://184321382\n\nReviewed by Yijia Huang.\n\nAlign Iterator#join implementation more to the spec.\n\n1. even if undefined/null element exists, we still need to append a\n   separator. This fixes a test262 failure.\n2. For efficiency, use JSRopeString::RopeBuilder.\n\n* JSTests/test262/expectations.yaml:\n* Source/JavaScriptCore/runtime/JSIteratorPrototype.cpp:\n(JSC::JSC_DEFINE_HOST_FUNCTION):\n\nCanonical link: https://commits.webkit.org/318806@main\n"
    },
    {
      "commit": "3c2f9abf7173b999417f7b09c02f4c91fb43615f",
      "tree": "4612b1d5e55aa0629addab70df8fbfbc9f2a7d0f",
      "parents": [
        "da21559d05d5532252c21c93a62a2631f3192351"
      ],
      "author": {
        "name": "Chris Dumez",
        "email": "cdumez@apple.com",
        "time": "Fri Aug 07 19:04:58 2026"
      },
      "committer": {
        "name": "Chris Dumez",
        "email": "cdumez@apple.com",
        "time": "Fri Aug 07 19:04:58 2026"
      },
      "message": "scrollend event is not fired when wheel-scrolling a subframe\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d321265\n\nReviewed by Darin Adler.\n\nA subframe (and any scrollable area without an asynchronous scrolling node)\nis wheel-scrolled synchronously on the main thread, driven by ScrollAnimator\u0027s\nScrollingEffectsController. When such a scroll ends, the controller calls\nScrollingEffectsControllerClient::didStopWheelEventScroll(), but ScrollAnimator\nnever overrode it, so the empty base implementation ran and ScrollableArea::\nscrollDidEnd() was never called. As a result no scrollend event was dispatched\nfor main-thread wheel scrolls, even though the scroll (and scroll events) worked\ncorrectly.\n\nAreas with an async scrolling node were unaffected because their scrollend is\ndriven by the scrolling tree delegate (ScrollingTreeScrollingNodeDelegateMac),\nwhich does implement didStopWheelEventScroll(). Programmatic/animated scrolls\nwere also fine because ScrollAnimator already overrides didStopAnimatedScroll()\nto call scrollDidEnd().\n\nFix this by overriding didStopWheelEventScroll() in ScrollAnimator to call\nscrollDidEnd(), mirroring didStopAnimatedScroll(). This covers both gesture-phase\nwheel ends and discrete mouse-wheel scrolls (via the scrollend timer). It cannot\ndouble-fire: scrollDidEnd() is guarded by isAwaitingScrollend() and only runs\nwhen a scroll actually occurred, and async-scrolled areas use a separate\nScrollingEffectsController instance.\n\nThis makes the imported WPT test scroll-cross-origin-iframes.html pass, which\npreviously timed out waiting for a scrollend handshake from the iframes.\n\nNo new tests, rebaselined existing WPT test that was previously timing out\nin WebKit. This test is passing in both Chrome and Firefox already.\n\n* LayoutTests/imported/w3c/web-platform-tests/dom/events/scrolling/scroll-cross-origin-iframes-expected.txt:\n* LayoutTests/platform/mac-site-isolation/TestExpectations:\n* Source/WebCore/platform/ScrollAnimator.cpp:\n(WebCore::ScrollAnimator::didStopWheelEventScroll):\n* Source/WebCore/platform/ScrollAnimator.h:\n\nCanonical link: https://commits.webkit.org/318805@main\n"
    },
    {
      "commit": "da21559d05d5532252c21c93a62a2631f3192351",
      "tree": "38e2e72723ffefa575c2851cdc9f2ffbebc6b235",
      "parents": [
        "9f9cfc195a4378ec860ec5618dcad658843acc07"
      ],
      "author": {
        "name": "David Kilzer",
        "email": "ddkilzer@apple.com",
        "time": "Fri Aug 07 18:48:18 2026"
      },
      "committer": {
        "name": "David Kilzer",
        "email": "ddkilzer@webkit.org",
        "time": "Fri Aug 07 18:48:18 2026"
      },
      "message": "[ASan] Generate a crash log when a process is killed for a failed IPC message check\n\u003chttps://bugs.webkit.org/show_bug.cgi?id\u003d321120\u003e\n\u003crdar://184153814\u003e\n\nReviewed by Mike Wyrzykowski, Zak Ridouh, and Charlie Wolfe.\n\nWhen an incoming IPC message fails a MESSAGE_CHECK, the receiving\nprocess asks for the process that sent it to be terminated.  On macOS\nthat termination is a plain SIGKILL sent through\n`xpc_connection_kill()`, which carries no `os_reason`, so the kernel\nwrites no crash report for the killed process.  run-webkit-tests marks\nthe process crashed but finds no crash log to attach and reports \"No\ncrash log found\".\n\nOn ASan builds, terminate such a process with `terminate_with_reason()`\nin the `OS_REASON_WEBKIT` namespace instead, so the kernel emits a\ncrash report attributed to the killed process.  Encode the failing\n`IPC::MessageName` above the low reason-code byte so the report\u0027s\ntermination reason names which message check failed.  Only\nmessage-check and watchdog terminations report this way; ordinary\ninvalidation and client-requested terminations keep the report-less\n`xpc_connection_kill()`.\n\nThe kill is always issued by the UI process.  When a GPU, Networking,\nor Model process is the one that detects the invalid message, forward\nthe failing message name to the UI process through the\n`TerminateWebProcess` message so that termination occurs the same\nway.\n\nNo new tests since this change is not directly testable.\n\n* Source/WebKit/Scripts/webkit/messages.py:\n- Add `IPC::MessageName` to the `headers_for_type()` special-cases dict\n  so message receivers that take an `IPC::MessageName` parameter include\n  `\"MessageNames.h\"` rather than the derived (non-existent)\n  `\"MessageName.h\"`.\n* Source/WebKit/Scripts/webkit/parser_unittest.py:\n(_expected_model_test_with_superclass):\n- Add the new TestMessageWithMessageName message so the expected model\n  matches the TestWithSuperclass.messages.in fixture.\n* Source/WebKit/Scripts/webkit/tests/MessageArgumentDescriptions.cpp:\n* Source/WebKit/Scripts/webkit/tests/MessageNames.cpp:\n* Source/WebKit/Scripts/webkit/tests/MessageNames.h:\n* Source/WebKit/Scripts/webkit/tests/TestWithSuperclass.messages.in:\n(TestWithSuperclass::TestMessageWithMessageName): Add.\n* Source/WebKit/Scripts/webkit/tests/TestWithSuperclassMessageReceiver.cpp:\n* Source/WebKit/Scripts/webkit/tests/TestWithSuperclassMessages.h:\n* Source/WebKit/GPUProcess/GPUConnectionToWebProcess.cpp:\n(WebKit::GPUConnectionToWebProcess::didReceiveInvalidMessage):\n(WebKit::GPUConnectionToWebProcess::terminateWebProcess):\n* Source/WebKit/GPUProcess/GPUConnectionToWebProcess.h:\n(WebKit::GPUConnectionToWebProcess::terminateWebProcess):\n* Source/WebKit/GPUProcess/GPUProcess.cpp:\n(WebKit::GPUProcess::terminateWebProcess):\n* Source/WebKit/GPUProcess/GPUProcess.h:\n(WebKit::GPUProcess::terminateWebProcess):\n* Source/WebKit/GPUProcess/graphics/RemoteGraphicsContextGL.cpp:\n(WebKit::RemoteGraphicsContextGL::didReceiveInvalidMessage):\n* Source/WebKit/GPUProcess/graphics/RemoteRenderingBackend.cpp:\n(WebKit::RemoteRenderingBackend::didReceiveInvalidMessage):\n* Source/WebKit/GPUProcess/graphics/WebGPU/RemoteGPU.cpp:\n(WebKit::RemoteGPU::didReceiveInvalidMessage):\n* Source/WebKit/ModelProcess/ModelConnectionToWebProcess.cpp:\n(WebKit::ModelConnectionToWebProcess::didReceiveInvalidMessage):\n* Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.cpp:\n(WebKit::NetworkConnectionToWebProcess::didReceiveInvalidMessage):\n* Source/WebKit/Platform/IPC/Connection.h:\n(IPC::Connection::kill):\n* Source/WebKit/Platform/IPC/cocoa/ConnectionCocoa.mm:\n(IPC::Connection::kill):\n* Source/WebKit/Platform/cocoa/XPCUtilities.h:\n(WebKit::ReasonCode):\n(WebKit::terminateWithReason):\n* Source/WebKit/Platform/cocoa/XPCUtilities.mm:\n(WebKit::terminateWithReason):\n* Source/WebKit/UIProcess/AuxiliaryProcessProxy.cpp:\n(WebKit::AuxiliaryProcessProxy::terminate):\n* Source/WebKit/UIProcess/AuxiliaryProcessProxy.h:\n(WebKit::AuxiliaryProcessProxy::terminate):\n* Source/WebKit/UIProcess/GPU/GPUProcessProxy.cpp:\n(WebKit::GPUProcessProxy::didReceiveInvalidMessage):\n(WebKit::GPUProcessProxy::terminateWebProcess):\n* Source/WebKit/UIProcess/GPU/GPUProcessProxy.h:\n(WebKit::GPUProcessProxy::terminateWebProcess):\n* Source/WebKit/UIProcess/GPU/GPUProcessProxy.messages.in:\n* Source/WebKit/UIProcess/Model/ModelProcessProxy.cpp:\n(WebKit::ModelProcessProxy::terminateWebProcess):\n(WebKit::ModelProcessProxy::didReceiveInvalidMessage):\n* Source/WebKit/UIProcess/Model/ModelProcessProxy.h:\n(WebKit::ModelProcessProxy::terminateWebProcess):\n* Source/WebKit/UIProcess/Model/ModelProcessProxy.messages.in:\n* Source/WebKit/UIProcess/Network/NetworkProcessProxy.cpp:\n(WebKit::NetworkProcessProxy::terminate):\n(WebKit::NetworkProcessProxy::didReceiveInvalidMessage):\n(WebKit::NetworkProcessProxy::terminateWebProcess):\n* Source/WebKit/UIProcess/Network/NetworkProcessProxy.h:\n(WebKit::NetworkProcessProxy::terminate):\n(WebKit::NetworkProcessProxy::terminateWebProcess):\n* Source/WebKit/UIProcess/Network/NetworkProcessProxy.messages.in:\n* Source/WebKit/UIProcess/WebProcessProxy.cpp:\n(WebKit::WebProcessProxy::didReceiveInvalidMessage):\n(WebKit::WebProcessProxy::requestTermination):\n* Source/WebKit/UIProcess/WebProcessProxy.h:\n(WebKit::WebProcessProxy::requestTermination):\n\nCanonical link: https://commits.webkit.org/318804@main\n"
    },
    {
      "commit": "9f9cfc195a4378ec860ec5618dcad658843acc07",
      "tree": "7ff33d14399bf085376e2fa45432fc4b4af7ca99",
      "parents": [
        "547e1555ce4d3fc9a0b016c2cc6cd84c29fe03ce"
      ],
      "author": {
        "name": "Ryan Haddad",
        "email": "ryanhaddad@apple.com",
        "time": "Fri Aug 07 18:40:14 2026"
      },
      "committer": {
        "name": "Ryan Haddad",
        "email": "ryanhaddad@apple.com",
        "time": "Fri Aug 07 18:40:14 2026"
      },
      "message": "[Build] Support public builds on the macOS 27 SDK\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d321195\nrdar://problem/184255666\n\nReviewed by Abrar Rahman Protyasha.\n\nAdd the sparse SDK additions directory for the macOS 27 SDK, copied from macOS Tahoe.\n\nHAVE_NSREFRESHCONTROLLER turns on at a macOS 27 deployment target, so\nWKWebView+RefreshControl.swift is compiled for the first time in an open source build. It\nconforms WKWebView to AppKit\u0027s NSRefreshControlHosting, which AppKit declares only as\n@_spi(RefreshControl) in Swift, so it is absent from the public SDK. Add a handwritten\nAppKit_SPI module for it, following the pattern used for SwiftUI in 300040@main.\n\nThe Objective-C protocol of the same name in AppKitSPI.h cannot serve the conformance, since it\nreaches Swift only as the internally-imported WebKit_Internal. It is still required by\nWebKit-Swift-Generated.h, so both declarations have to stay.\n\nBecause the import must be public, AppKit_SPI appears in WebKit\u0027s Swift interface, so Swift\ntargets importing WebKit need it on SWIFT_INCLUDE_PATHS.\n\n* Source/WebKit/Configurations/BaseTarget.xcconfig:\n* Source/WebKit/Platform/spi/Cocoa/AppKit_SPI.swiftinterface: Added.\n* Source/WebKit/Platform/spi/mac/AppKitSPI.h:\n* Source/WebKit/UIProcess/API/Cocoa/WKWebView+RefreshControl.swift:\n* Tools/SwiftBrowser/Configurations/Base.xcconfig:\n* Tools/TestWebKitAPI/Configurations/Base.xcconfig:\n* WebKitLibraries/SDKs/macosx27.0-additions.sdk/SDKSettings.plist: Added.\n* WebKitLibraries/SDKs/macosx27.0-additions.sdk/SymlinkedHeaders-output.xcfilelist: Added.\n* WebKitLibraries/SDKs/macosx27.0-additions.sdk/SymlinkedHeaders.xcfilelist: Added.\n\nCo-Authored-By: Elliott Williams \u003cemw@apple.com\u003e\nCanonical link: https://commits.webkit.org/318803@main\n"
    },
    {
      "commit": "547e1555ce4d3fc9a0b016c2cc6cd84c29fe03ce",
      "tree": "195dc477a0d69db3f8f5a39807d111426cf8fc9f",
      "parents": [
        "76df1b96aaae623fa8b9ac96d3d6ac86ea99e6cb"
      ],
      "author": {
        "name": "Yusuke Suzuki",
        "email": "ysuzuki@apple.com",
        "time": "Fri Aug 07 18:36:57 2026"
      },
      "committer": {
        "name": "Yusuke Suzuki",
        "email": "ysuzuki@apple.com",
        "time": "Fri Aug 07 18:36:57 2026"
      },
      "message": "[JSC] Align Iterator#chunk / Iterator#windows to the latest spec\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d321272\nrdar://184321801\n\nReviewed by Yijia Huang.\n\nIterator#chunk / Iterator#windows handles input chunk-size / window-size\ndifferently. This patch fixes them to align them to the latest spec.\n\n* JSTests/stress/iterator-prototype-chunks.js:\n(const.invalidChunkSize.of.invalidChunkSizes.shouldThrow):\n(Iterator.prototype.chunks.call):\n(validIter.chunks.const.validIter):\n(validIter.chunks):\n(const.closable.get next):\n(const.closable.return):\n(shouldThrow):\n(assert.const.closable.get next):\n(assert.const.closable.get return):\n(assert):\n* JSTests/stress/iterator-prototype-windows.js:\n(const.invalidWindowSize.of.invalidWindowSizes.shouldThrow):\n(Iterator.prototype.windows.call):\n(validIter.windows.const.validIter):\n(validIter.windows):\n(const.invalidUndersized.of.invalidUndersizedValues.shouldThrow):\n(validIter.windows.const.closable.get next):\n(assert.const.closable.get next):\n(assert.const.closable.get return):\n(assert):\n(shouldThrow.const.validIter): Deleted.\n* JSTests/test262/expectations.yaml:\n* Source/JavaScriptCore/builtins/JSIteratorPrototype.js:\n(chunks.generator):\n(chunks):\n(windows.generator):\n(windows):\n\nCanonical link: https://commits.webkit.org/318802@main\n"
    },
    {
      "commit": "76df1b96aaae623fa8b9ac96d3d6ac86ea99e6cb",
      "tree": "1ac2fb9d51181303d10c08c4b7d02b4f086a0ed1",
      "parents": [
        "bbab514b1010b4a0eddd2ed5c479747a0511108d"
      ],
      "author": {
        "name": "Chris Dumez",
        "email": "cdumez@apple.com",
        "time": "Fri Aug 07 18:36:20 2026"
      },
      "committer": {
        "name": "Chris Dumez",
        "email": "cdumez@apple.com",
        "time": "Fri Aug 07 18:36:20 2026"
      },
      "message": "Rename SVGPathSegList to SVGPath to reflect its actual role\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d321248\n\nReviewed by Darin Adler.\n\nFollow-up to the SVGPathSegList/SVGPathSeg* DOM interface removal. That patch\nkept the old class names to minimize churn, but SVGPathSegList is no longer a\nlist of segments -- it is just the owner of the SVGPathByteStream backing the\n\"d\" attribute. This renames it (and the property glue) to match its role, and\nrenames the header that now holds only enum SVGPathSegType.\n\nThe renames are:\n    SVGPathSegList                  -\u003e SVGPath\n    SVGPathSegList.h                -\u003e SVGPath.h\n    SVGAnimatedPathSegList          -\u003e SVGAnimatedPath\n    SVGAnimatedPathSegListAccessor  -\u003e SVGAnimatedPathAccessor\n    SVGAnimatedPathSegListAnimator  -\u003e SVGAnimatedPathAnimator\n    SVGAnimationPathSegListFunction -\u003e SVGAnimationPathFunction\n    SVGAnimatorType::PathSegList    -\u003e SVGAnimatorType::Path\n    SVGPathElement::m_pathSegList   -\u003e SVGPathElement::m_path\n    PathSegListCache                -\u003e PathCache\n    SVGPathSeg.h                    -\u003e SVGPathSegType.h (enum SVGPathSegType unchanged)\n\nNo behavior change.\n\n* Source/WebCore/WebCore.xcodeproj/project.pbxproj:\n* Source/WebCore/svg/SVGPath.h: Renamed from Source/WebCore/svg/SVGPathSegList.h.\n* Source/WebCore/svg/SVGPathBlender.cpp:\n* Source/WebCore/svg/SVGPathByteStreamBuilder.cpp:\n* Source/WebCore/svg/SVGPathElement.cpp:\n(WebCore::PathCache::singleton):\n(WebCore::PathCache::get const):\n(WebCore::PathCache::add):\n(WebCore::PathCache::clear):\n(WebCore::SVGPathElement::SVGPathElement):\n(WebCore::SVGPathElement::attributeChanged):\n(WebCore::SVGPathElement::clearCache):\n(WebCore::SVGPathElement::pathByteStream const):\n(WebCore::SVGPathElement::path const):\n(WebCore::SVGPathElement::collectDPresentationalHint):\n(WebCore::PathSegListCache::singleton): Deleted.\n(WebCore::PathSegListCache::get const): Deleted.\n(WebCore::PathSegListCache::add): Deleted.\n(WebCore::PathSegListCache::clear): Deleted.\n* Source/WebCore/svg/SVGPathElement.h:\n* Source/WebCore/svg/SVGPathParser.h:\n* Source/WebCore/svg/SVGPathSegType.h: Renamed from Source/WebCore/svg/SVGPathSeg.h.\n* Source/WebCore/svg/SVGPathSource.h:\n* Source/WebCore/svg/SVGTZoneImpls.cpp:\n* Source/WebCore/svg/properties/SVGAnimatedPropertyAccessorImpl.h:\n* Source/WebCore/svg/properties/SVGAnimatedPropertyAnimatorImpl.h:\n(isType):\n* Source/WebCore/svg/properties/SVGAnimatedPropertyImpl.h:\n(WebCore::SVGAnimatedPath::create):\n(WebCore::SVGAnimatedPathSegList::create): Deleted.\n(WebCore::SVGAnimatedPathSegList::currentPathByteStream): Deleted.\n(WebCore::SVGAnimatedPathSegList::currentPath): Deleted.\n(WebCore::SVGAnimatedPathSegList::approximateMemoryCost const): Deleted.\n* Source/WebCore/svg/properties/SVGAnimationAdditiveValueFunctionImpl.h:\n(WebCore::SVGAnimationPathSegListFunction::animate): Deleted.\n* Source/WebCore/svg/properties/SVGAttributeAnimator.h:\n* Source/WebCore/svg/properties/SVGPropertyOwnerRegistry.h:\n(WebCore::SVGPropertyOwnerRegistry::registerProperty):\n\nCanonical link: https://commits.webkit.org/318801@main\n"
    },
    {
      "commit": "bbab514b1010b4a0eddd2ed5c479747a0511108d",
      "tree": "95a1571794d7d9a63eb376f54a26b02c999c22ca",
      "parents": [
        "186929fd217c12e69cbb3e31cb40b90760b0f799"
      ],
      "author": {
        "name": "Dan Hecht",
        "email": "dan.hecht@apple.com",
        "time": "Fri Aug 07 18:25:50 2026"
      },
      "committer": {
        "name": "Dan Hecht",
        "email": "dan.hecht@apple.com",
        "time": "Fri Aug 07 18:25:50 2026"
      },
      "message": "[JSC] LazyJSValue::emit leaks a StringImpl reference when finalization is skipped\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d321221\nrdar://184272837\n\nReviewed by Yusuke Suzuki.\n\nemit() manually refs a NewStringImpl\u0027s StringImpl and relies on the main-thread\nfinalization task to deref it, but several paths skip that task. When JIT\nexecutable memory runs out after code generation, both DFG and FTL bail on\nLinkBuffer::didFailToAllocate(), so the link task never runs and the finalization\ntask it would have registered never exists. Separately,\nrunMainThreadFinalizationTasks() runs inside JITFinalizer::finalize(), which\nPlan::finalize() only reaches past its isStillValidCodeBlock() check, so a\ncompilation that links successfully and is then invalidated leaks as well. A plan\ncancelled after code generation would leak the same way, which today only the\nplacement of safepoints prevents.\n\nHold the reference in a RefPtr instead, so it is released whether the task runs\nor not.\n\n* Source/JavaScriptCore/dfg/DFGLazyJSValue.cpp:\n(JSC::DFG::EscapedLazyJSValue::EscapedLazyJSValue):\n(JSC::DFG::LazyJSValue::emit const):\n\nCanonical link: https://commits.webkit.org/318800@main\n"
    },
    {
      "commit": "186929fd217c12e69cbb3e31cb40b90760b0f799",
      "tree": "974f518795c3c5ef6845384499598fff6d70481b",
      "parents": [
        "b86307c97d1abc50ea819a0d102be09f3b04a73e"
      ],
      "author": {
        "name": "Mike Wyrzykowski",
        "email": "mwyrzykowski@apple.com",
        "time": "Fri Aug 07 18:20:15 2026"
      },
      "committer": {
        "name": "Mike Wyrzykowski",
        "email": "mwyrzykowski@apple.com",
        "time": "Fri Aug 07 18:20:15 2026"
      },
      "message": "Performance seems slower with attached shader in Safari\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d320866\nrdar://183571775\n\nReviewed by Dan Glastonbury.\n\nA WebGPU canvas whose per-frame GPU work cannot finish within a single\ndisplay VSync, e.g., a complex shader, kept requesting presentation at 60Hz,\nso frames backed up and were displayed unevenly, making the animation look choppy.\n\nInstead measure the presented frame\u0027s GPU cost in the GPU process. WebGPUFramePacer\nconsumes those costs and picks the highest sustainable rate, so a single spike does\nnot change the rate. GPUCanvasContextCocoa drives the pacer and registers\nwith the page so the page\u0027s rendering update rate is clamped to the\nslowest requesting canvas.\n\nTest: Tools/TestWebKitAPI/Tests/WebCore/WebGPUFramePacer.cpp\n\n* Source/WebCore/Modules/WebGPU/GPUCompositorIntegration.h:\n(WebCore::GPUCompositorIntegration::lastFrameGPUCost const):\n* Source/WebCore/Modules/WebGPU/Implementation/WebGPUCompositorIntegrationImpl.cpp:\n(WebCore::WebGPU::CompositorIntegrationImpl::lastFrameGPUCost const):\n* Source/WebCore/Modules/WebGPU/Implementation/WebGPUCompositorIntegrationImpl.h:\n* Source/WebCore/Modules/WebGPU/Implementation/WebGPUPresentationContextImpl.cpp:\n(WebCore::WebGPU::PresentationContextImpl::lastFrameGPUCost const):\n* Source/WebCore/Modules/WebGPU/Implementation/WebGPUPresentationContextImpl.h:\n* Source/WebCore/Modules/WebGPU/InternalAPI/WebGPUCompositorIntegration.h:\n(WebCore::WebGPU::CompositorIntegration::lastFrameGPUCost const):\n* Source/WebCore/Sources.txt:\n* Source/WebCore/WebCore.xcodeproj/project.pbxproj:\n* Source/WebCore/html/canvas/CanvasRenderingContext.h:\n(WebCore::CanvasRenderingContext::preferredRenderingUpdateFramesPerSecond const):\n* Source/WebCore/html/canvas/GPUCanvasContextCocoa.h:\n* Source/WebCore/html/canvas/GPUCanvasContextCocoa.mm:\n(WebCore::GPUCanvasContextCocoa::surfaceBufferToImageBuffer):\n(WebCore::GPUCanvasContextCocoa::unconfigure):\n(WebCore::GPUCanvasContextCocoa::prepareForDisplay):\n(WebCore::GPUCanvasContextCocoa::page const):\n(WebCore::GPUCanvasContextCocoa::updateFramePacing):\n(WebCore::GPUCanvasContextCocoa::preferredRenderingUpdateFramesPerSecond const):\n* Source/WebCore/page/Page.cpp:\n(WebCore::Page::preferredRenderingUpdateFramesPerSecond const):\n(WebCore::Page::addGPUCanvasRequestingRenderingUpdatePacing):\n(WebCore::Page::removeGPUCanvasRequestingRenderingUpdatePacing):\n* Source/WebCore/page/Page.h:\n* Source/WebCore/platform/graphics/WebGPUFramePacer.cpp: Added.\n(WebCore::WebGPUFramePacer::setDisplayNominalFramesPerSecond):\n(WebCore::WebGPUFramePacer::rebuildDivisorLadder):\n(WebCore::WebGPUFramePacer::reset):\n(WebCore::WebGPUFramePacer::recordFrame):\n(WebCore::WebGPUFramePacer::runController):\n(WebCore::WebGPUFramePacer::preferredFramesPerSecond const):\n* Source/WebCore/platform/graphics/WebGPUFramePacer.h: Added.\n* Source/WebGPU/WGSL/Metal/MetalFunctionWriter.cpp:\n(WGSL::Metal::FunctionDefinitionWriter::visit):\n* Source/WebGPU/WebGPU/CommandBuffer.mm:\n(WebGPU::CommandBuffer::makeInvalidDueToCommit):\n* Source/WebGPU/WebGPU/CommandEncoder.h:\n* Source/WebGPU/WebGPU/CommandEncoder.mm:\n(WebGPU::CommandEncoder::recordGPUExecutionWindowOnCanvasTextures const):\n* Source/WebGPU/WebGPU/PresentationContext.h:\n(WebGPU::PresentationContext::lastFrameGPUCost const):\n* Source/WebGPU/WebGPU/PresentationContext.mm:\n(wgpuSurfaceGetLastFrameGPUCostSeconds):\n* Source/WebGPU/WebGPU/PresentationContextIOSurface.h:\n* Source/WebGPU/WebGPU/PresentationContextIOSurface.mm:\n* Source/WebGPU/WebGPU/Texture.h:\n(WebGPU::Texture::WTF_GUARDED_BY_LOCK):\n* Source/WebGPU/WebGPU/Texture.mm:\n(WebGPU::Texture::recordGPUExecutionWindow const):\n(WebGPU::Texture::gpuFrameCost const):\n(WebGPU::Texture::resetGPUFrameCost const):\n(WebGPU::Texture::setCommandEncoder const):\n* Source/WebGPU/WebGPU/TextureView.mm:\n(WebGPU::TextureView::setCommandEncoder const):\n* Source/WebGPU/WebGPU/WebGPUExt.h:\n* Source/WebKit/GPUProcess/graphics/WebGPU/RemoteCompositorIntegration.cpp:\n(WebKit::RemoteCompositorIntegration::prepareForDisplay):\n* Source/WebKit/GPUProcess/graphics/WebGPU/RemoteCompositorIntegration.h:\n* Source/WebKit/GPUProcess/graphics/WebGPU/RemoteCompositorIntegration.messages.in:\n* Source/WebKit/WebProcess/GPU/graphics/WebGPU/RemoteCompositorIntegrationProxy.cpp:\n(WebKit::WebGPU::RemoteCompositorIntegrationProxy::prepareForDisplay):\n* Source/WebKit/WebProcess/GPU/graphics/WebGPU/RemoteCompositorIntegrationProxy.h:\n* Tools/TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:\n* Tools/TestWebKitAPI/Tests/WebCore/WebGPUFramePacer.cpp: Added.\n(TestWebKitAPI::feedFrames):\n(TestWebKitAPI::TEST(WebGPUFramePacer, NoRateBeforeWarmUp)):\n(TestWebKitAPI::TEST(WebGPUFramePacer, FullRefreshContentIsNotPaced)):\n(TestWebKitAPI::TEST(WebGPUFramePacer, ConvergesTo20For45msFrames)):\n(TestWebKitAPI::TEST(WebGPUFramePacer, ConvergesTo12For83msFrames)):\n(TestWebKitAPI::TEST(WebGPUFramePacer, ConvergedRateIsStable)):\n(TestWebKitAPI::TEST(WebGPUFramePacer, SingleSpikeDoesNotStepDown)):\n(TestWebKitAPI::TEST(WebGPUFramePacer, SustainedOverloadStepsDown)):\n(TestWebKitAPI::TEST(WebGPUFramePacer, IdleCanvasStopsPacing)):\n(TestWebKitAPI::TEST(WebGPUFramePacer, DivisorLadderFollows120HzDisplay)):\n(TestWebKitAPI::TEST(WebGPUFramePacer, ClosedLoopDoesNotRatchet)):\n(TestWebKitAPI::TEST(WebGPUFramePacer, RecoversWhenWorkloadEases)):\n\nCanonical link: https://commits.webkit.org/318799@main\n"
    },
    {
      "commit": "b86307c97d1abc50ea819a0d102be09f3b04a73e",
      "tree": "3ab63236dc84f91622f32c2f164aadcff506eeb5",
      "parents": [
        "35cfc0baa7e78315ea8453fd3239765ab652968f"
      ],
      "author": {
        "name": "Ahmad Saleem",
        "email": "ahmad.saleem792+github@gmail.com",
        "time": "Fri Aug 07 18:06:39 2026"
      },
      "committer": {
        "name": "Ahmad Saleem",
        "email": "ahmad.saleem792@gmail.com",
        "time": "Fri Aug 07 18:06:39 2026"
      },
      "message": "REGRESSION(283572@main): Canvas ctx.font keywords larger and smaller scale by 1.02 instead of ~1.2\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d321261\nrdar://184312611\n\nReviewed by Sam Weinig.\n\nThe relative-size keywords may be resolved either through the absolute size keyword mapping table or\nby a simple ratio, and of the latter the specification says \"The specific ratio is unspecified, but\nshould be around 1.2-1.5\" [1].\n\nCanvas used 1.02, which is not in that range, so `ctx.font \u003d \"larger sans-serif\"` on a canvas whose\nfont-size is 20px produced 20.4px rather than 24px, making both keywords very nearly no-ops. CSS\nresolution is unaffected and uses 1.2 (BuilderCustom::largerFontSize).\n\nThe value was a transcription typo. 283572@main moved this logic into StyleResolveForFontRaw.cpp\nwhile replacing eager evaluation of calc() in the font consumers, and turned `parentSize * 1.2f` into\n`parentSize * 1.02f` in a change that was otherwise a pure refactor. 1.02f appears nowhere else in\nthe tree.\n\nThe new test asserts the two things the specification actually constrains rather than hard coding\nWebKit\u0027s ratio: that the ratio falls in the 1.2-1.5 range, and that canvas agrees with CSS resolution\nfor the same parent font-size.\n\n[1] https://drafts.csswg.org/css-fonts-4/#typedef-relative-size\n\nTest: fast/canvas/canvas-font-size-larger-smaller.html\n\n* LayoutTests/fast/canvas/canvas-font-size-larger-smaller-expected.txt: Added.\n* LayoutTests/fast/canvas/canvas-font-size-larger-smaller.html: Added.\n* Source/WebCore/style/StyleResolveForFont.cpp:\n(WebCore::Style::fontSizeFromUnresolvedFontSize):\n\nCanonical link: https://commits.webkit.org/318798@main\n"
    },
    {
      "commit": "35cfc0baa7e78315ea8453fd3239765ab652968f",
      "tree": "a88a10dfcdfc0296412b3a202279ac46e268832b",
      "parents": [
        "f5b7a0e8ef5d9a43f004d4c9db666408be234302"
      ],
      "author": {
        "name": "Charlie Wolfe",
        "email": "charliew@apple.com",
        "time": "Fri Aug 07 18:04:24 2026"
      },
      "committer": {
        "name": "Charlie Wolfe",
        "email": "charliew@apple.com",
        "time": "Fri Aug 07 18:04:24 2026"
      },
      "message": "Plug-in byte-range requests are blocked by connect-src instead of being governed by object-src\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d321145\nrdar://184258237\n\nReviewed by Ryan Reno.\n\nNetscapePlugInStreamLoader left ResourceLoaderOptions::destination at its default value of the empty\nstring, so the CSP check for a plug-in stream fell back to connect-src. Per CSP3 §6.1.9 the loads an\nobject or embed element makes for its content are governed by object-src. Previously a page with\n\"object-src \u0027self\u0027; connect-src \u0027none\u0027\" had its PDF blocked partway through incremental loading even\nthough object-src allowed it.\n\nPlumb a FetchOptions::Destination through schedulePluginStreamLoad() to NetscapePlugInStreamLoader,\nand have PluginView report Embed or Object based on its plug-in element\u0027s tag name so the stream is\nmatched against object-src.\n\nhttps://www.w3.org/TR/CSP3/#directive-object-src\n\nTest: imported/w3c/web-platform-tests/content-security-policy/object-src/object-src-pdf-byte-range-allowed.html\n\n* LayoutTests/imported/w3c/web-platform-tests/content-security-policy/object-src/object-src-pdf-byte-range-allowed-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/content-security-policy/object-src/object-src-pdf-byte-range-allowed.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/content-security-policy/support/incremental-pdf.py: Added.\n(main):\n* LayoutTests/imported/w3c/web-platform-tests/content-security-policy/support/linearized.pdf: Added.\n* Source/WebCore/loader/NetscapePlugInStreamLoader.cpp:\n(WebCore::plugInStreamLoaderOptions):\n(WebCore::NetscapePlugInStreamLoader::NetscapePlugInStreamLoader):\n(WebCore::NetscapePlugInStreamLoader::create):\n* Source/WebCore/loader/NetscapePlugInStreamLoader.h:\n* Source/WebKit/WebProcess/Network/WebLoaderStrategy.cpp:\n(WebKit::WebLoaderStrategy::schedulePluginStreamLoad):\n* Source/WebKit/WebProcess/Network/WebLoaderStrategy.h:\n* Source/WebKit/WebProcess/Plugins/PDF/PDFPluginBase.mm:\n(WebKit::PDFPluginBase::startByteRangeRequest):\n* Source/WebKit/WebProcess/Plugins/PluginView.cpp:\n(WebKit::PluginView::Stream::start):\n(WebKit::PluginView::fetchDestination const):\n* Source/WebKit/WebProcess/Plugins/PluginView.h:\n* Source/WebKitLegacy/WebCoreSupport/WebResourceLoadScheduler.cpp:\n(WebResourceLoadScheduler::schedulePluginStreamLoad):\n* Source/WebKitLegacy/WebCoreSupport/WebResourceLoadScheduler.h:\n\nCanonical link: https://commits.webkit.org/318797@main\n"
    },
    {
      "commit": "f5b7a0e8ef5d9a43f004d4c9db666408be234302",
      "tree": "263ec783b18233963cf09e21369f273224e17634",
      "parents": [
        "ff7f28a16185100b3c1911bc1a95c9d34fa9477b"
      ],
      "author": {
        "name": "Ben Nham",
        "email": "nham@apple.com",
        "time": "Fri Aug 07 18:01:11 2026"
      },
      "committer": {
        "name": "Ben Nham",
        "email": "nham@apple.com",
        "time": "Fri Aug 07 18:01:11 2026"
      },
      "message": "Site-isolated iframe processes keep a page load assertion after a cross-site navigation\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d320790\nrdar://183676310\n\nReviewed by Per Arne Vollan.\n\nWe are seeing that remote frame processes are running too long after a main frame navigation due to\nthe remote frame processes holding a page load activity through a navigation (m_networkActivity in\nWebProcessActivityState).\n\nThe reason for this is that when a PSON occurs, we try to move the page load activities from the old\nWebProcesses pre-swap to the new WebProcesses post-swap via NavigationState::didSwapWebProcesses()\n\u003d\u003e WebPageProxy::takeNetworkActivity().\n\nThis works for the main frame because WebPageProxy\u0027s m_mainFrameProcessActivityState stays the same\nthrough the navigation.\n\nIt doesn\u0027t work for remote frames because a PSON will generally cause a BrowsingContextGroup\nswitch. So by the time WebPageProxy::takeNetworkActivity() runs, its BCG points to a new set of\nRemotePageProxy objects. WebPageProxy has no way of reaching back to the old BCG pre-swap, so it\nalso can\u0027t reach the pre-swap RemotePageProxy objects. So the page load activities associated with\nthose old RemotePageProxy objects keep running until the RemotePageProxy dies.\n\nThis becomes a problem when multi-process back/forward cache is enabled, because that can keep a\nRemotePageProxy object alive for a long time (as long as it\u0027s in cache). Previously, this wasn\u0027t\nreally an issue because RemotePageProxy objects would die soon after the PSON.\n\nMy first attempt at fixing this (318458@main) was extremely simple: I just reset m_networkActivity\ninside WebProcessActivityState::reset. However, while this works to fix this bug, it caused a large\nPLT regression through another convoluted chain of events:\n\n1. The network activity might be the last activity for the process, causing it to suspend.\n2. WebProcess::prepareToSuspend runs and thinks the process isn\u0027t in the process cache, so it dumps\nall caches (see 289156@main).\n3. We then shortly thereafter put this process in the process cache with cold caches, which leads to\na PLT regression.\n\nSo this is my second attempt at fixing the issue. Instead of preemptively dropping the network\nactivity in WebProcessActivityState::reset, we now drop the network activity when the\nRemotePageProxy enters the b/f cache (in SuspendedPageProxy::startSuspension).\n\nThis really should be cleaned up at some point, but I can\u0027t see a cleaner way of doing this without\na major refactor.\n\nTest: Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolation.mm\n\n* Source/WebKit/UIProcess/API/Cocoa/WKWebViewPrivateForTesting.h:\n* Source/WebKit/UIProcess/API/Cocoa/WKWebViewTesting.mm:\n(+[WKWebView _suspendedRemotePageNetworkActivityCountForTesting]):\n* Source/WebKit/UIProcess/RemotePageProxy.cpp:\n(WebKit::RemotePageProxy::processDidTerminate):\n* Source/WebKit/UIProcess/SuspendedPageProxy.cpp:\n(WebKit::SuspendedPageProxy::remotePagesWithNetworkActivityCountForTesting):\n(WebKit::SuspendedPageProxy::startSuspension):\n(WebKit::SuspendedPageProxy::dropNetworkActivityOnRemotePages):\n* Source/WebKit/UIProcess/SuspendedPageProxy.h:\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolation.mm:\n(TestWebKitAPI::(SiteIsolation, SharedProcessDropsPageLoadActivityAfterCrossSiteNavigation)):\n\nCanonical link: https://commits.webkit.org/318796@main\n"
    },
    {
      "commit": "ff7f28a16185100b3c1911bc1a95c9d34fa9477b",
      "tree": "9a20415b5353f1523c76d1ca492062405217ee34",
      "parents": [
        "af624adbb3bc34102a4e7f99703c9d1350e8fc66"
      ],
      "author": {
        "name": "Issac Roy",
        "email": "issacroy05@gmail.com",
        "time": "Fri Aug 07 17:59:05 2026"
      },
      "committer": {
        "name": "Ryan Haddad",
        "email": "ryanhaddad@apple.com",
        "time": "Fri Aug 07 17:59:05 2026"
      },
      "message": "Give Issac Roy committer status\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d321213\nrdar://184270445\n\nReviewed by Ryan Haddad.\n\nGive me committer status.\n\n* metadata/contributors.json:\n\nCanonical link: https://commits.webkit.org/318795@main\n"
    },
    {
      "commit": "af624adbb3bc34102a4e7f99703c9d1350e8fc66",
      "tree": "df636ff26e6df5971238c81b82a1ed5de786392c",
      "parents": [
        "71c68f4b3b35d98548525c85b7d740a8c83613db"
      ],
      "author": {
        "name": "Devin Rousso",
        "email": "hi@devinrousso.com",
        "time": "Fri Aug 07 17:46:12 2026"
      },
      "committer": {
        "name": "Devin Rousso",
        "email": "hi@devinrousso.com",
        "time": "Fri Aug 07 17:46:12 2026"
      },
      "message": "Web Inspector: Canvas: distinguish configured WebGPU `\u003ccanvas\u003e` from CSS canvas client nodes\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d321150\n\nReviewed by Mike Wyrzykowski.\n\n* Source/JavaScriptCore/inspector/protocol/Canvas.json:\n* Source/WebCore/inspector/InspectorCanvas.h:\n* Source/WebCore/inspector/InspectorCanvas.cpp:\n(WebCore::InspectorCanvas::canvasElements const): Renamed from `canvasElement`.\n(WebCore::InspectorCanvas::cssCanvasClientNodes const): Renamed from `clientNodes`.\n(WebCore::InspectorCanvas::buildObjectForCanvas):\n* Source/WebCore/inspector/agents/page/PageCanvasAgent.h:\n* Source/WebCore/inspector/agents/page/PageCanvasAgent.cpp:\n(WebCore::PageCanvasAgent::requestNodes): Renamed from `requestNode`.\n(WebCore::PageCanvasAgent::requestCSSCanvasClientNodes): Renamed from `requestClientNodes`.\n(WebCore::PageCanvasAgent::frameNavigated):\n(WebCore::PageCanvasAgent::didChangeCSSCanvasClientNodes):\n(WebCore::PageCanvasAgent::didChangeGPUDeviceClientNodes):\n(WebCore::PageCanvasAgent::buildObjectForCanvas): Deleted.\n(WebCore::PageCanvasAgent::nodeIdForCanvas): Deleted.\n(WebCore::PageCanvasAgent::dispatchNodesChanged): Added.\n(WebCore::PageCanvasAgent::dispatchCSSCanvasClientNodesChanged): Renamed from `dispatchClientNodesChanged`.\n(WebCore::PageCanvasAgent::dispatchCSSCanvasNamesChanged): Added.\n* Source/WebCore/inspector/agents/worker/WorkerCanvasAgent.h:\n* Source/WebCore/inspector/agents/worker/WorkerCanvasAgent.cpp:\n(WebCore::WorkerCanvasAgent::requestNodes): Renamed from `requestNode`.\n(WebCore::WorkerCanvasAgent::requestCSSCanvasClientNodes): Renamed from `requestClientNodes`.\nReturn every `HTMLCanvasElement` configured with a `GPUDevice` from `Canvas.requestNodes`, while `Canvas.requestCSSCanvasClientNodes` only returns nodes that consume CSS canvas images.\nPush DOM nodes via `Canvas.nodesChanged` instead of including it in the initial `Canvas`.\n\n* Source/WebInspectorUI/UserInterface/Protocol/CanvasObserver.js:\n(WI.CanvasObserver.prototype.nodesChanged): Added.\n(WI.CanvasObserver.prototype.cssCanvasClientNodesChanged):\n(WI.CanvasObserver.prototype.cssCanvasNamesChanged): Added.\n(WI.CanvasObserver.prototype.clientNodesChanged):\n* Source/WebInspectorUI/UserInterface/Controllers/CanvasManager.js:\n(WI.CanvasManager.prototype.nodesChanged): Renamed from `clientNodesChanged`.\n(WI.CanvasManager.prototype.cssCanvasClientNodesChanged): Added.\n(WI.CanvasManager.prototype.cssCanvasNamesChanged): Added.\n* Source/WebInspectorUI/UserInterface/Models/Canvas.js:\n(WI.Canvas.prototype.constructor):\n(WI.Canvas.fromPayload):\n(WI.Canvas.prototype.get displayName):\n(WI.Canvas.prototype.requestNodes): Renamed from `requestNode`.\n(WI.Canvas.prototype.requestCSSCanvasClientNodes): Renamed from `requestClientNodes`.\n(WI.Canvas.prototype.highlight): Added.\n(WI.Canvas.prototype.saveIdentityToCookie):\n(WI.Canvas.prototype.nodesChanged): Renamed from `clientNodesChanged`.\n(WI.Canvas.prototype.cssCanvasClientNodesChanged): Added.\n(WI.Canvas.prototype.cssCanvasNamesChanged): Added.\n(WI.Canvas.Event):\nUpdate CSS canvas names only from `Canvas.cssCanvasNamesChanged`.\nCentralize hover highlighting logic instead of repeating it in a few places.\n\n* Source/WebInspectorUI/UserInterface/Views/CanvasContentView.js:\n(WI.CanvasContentView.prototype.constructor):\n(WI.CanvasContentView.prototype.attached):\n(WI.CanvasContentView.prototype.detached):\n(WI.CanvasContentView.prototype._populateCanvasElementButtonContextMenu):\n(WI.CanvasContentView.prototype._updateCanvasNode):\n* Source/WebInspectorUI/UserInterface/Views/CanvasDetailsSidebarPanel.js:\n(WI.CanvasDetailsSidebarPanel.prototype.constructor):\n(WI.CanvasDetailsSidebarPanel.prototype.set canvas):\n(WI.CanvasDetailsSidebarPanel.prototype.initialLayout):\n(WI.CanvasDetailsSidebarPanel.prototype._refreshSourceSection):\n(WI.CanvasDetailsSidebarPanel.prototype._refreshClientsSection):\n(WI.CanvasDetailsSidebarPanel.prototype._handleNodesChanged): Added.\n(WI.CanvasDetailsSidebarPanel.prototype._handleCSSCanvasClientNodesChanged): Renamed from `_handleClientNodesChanged`.\n(WI.CanvasDetailsSidebarPanel.prototype._handleCSSCanvasNamesChanged): Added.\n* Source/WebInspectorUI/UserInterface/Views/CanvasOverviewContentView.js:\n(WI.CanvasOverviewContentView.prototype._contentViewMouseEnter):\n* Source/WebInspectorUI/UserInterface/Views/CanvasTreeElement.js:\n(WI.CanvasTreeElement.prototype._handleMouseOver):\nDisplay every configured node in the \"Source\" section.\nRefresh the \"Source\" and \"Client\" sections from their corresponding events.\n\n* LayoutTests/inspector/canvas/requestNode.html:\n* LayoutTests/inspector/canvas/requestNode-expected.txt:\n* LayoutTests/inspector/canvas/requestClientNodes.html:\n* LayoutTests/inspector/canvas/requestClientNodes-expected.txt:\n* LayoutTests/inspector/canvas/requestClientNodes-css.html:\n* LayoutTests/inspector/canvas/requestClientNodes-css-expected.txt:\n* LayoutTests/inspector/canvas/requestClientNodes-webgpu.html:\n* LayoutTests/inspector/canvas/requestClientNodes-webgpu-expected.txt:\n* LayoutTests/inspector/canvas/worker-webgpu.html:\n* LayoutTests/inspector/canvas/worker-webgpu-expected.txt:\n\nCanonical link: https://commits.webkit.org/318794@main\n"
    },
    {
      "commit": "71c68f4b3b35d98548525c85b7d740a8c83613db",
      "tree": "a2845efd8eadcd5b42437eeb47dd55aea72314ed",
      "parents": [
        "428fd736695d230e39867fdfb6a0fc7b1dc29d68"
      ],
      "author": {
        "name": "Vassili Bykov",
        "email": "v_bykov@apple.com",
        "time": "Fri Aug 07 17:31:02 2026"
      },
      "committer": {
        "name": "Vassili Bykov",
        "email": "v_bykov@apple.com",
        "time": "Fri Aug 07 17:31:02 2026"
      },
      "message": "[JSC] Retire Lexer::lexExpectIdentifier()\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d321188\nrdar://184247644\n\nReviewed by Yusuke Suzuki.\n\nLexer::lexExpectIdentifier() is intended as the fast path for quickly parsing an\nidentifier. It was introduced a long time ago. In the meantime, the baseline\nLexer::parseIdentifier() has been vectorized and now performs better than\nlexExpectIdentifier() with its character-by-character scanning and 4 conditionals.\nRemoving lexExpectIdentifier() simplifies and shrinks hot code and improves performance.\n\nCovered by existing tests.\n\n* Source/JavaScriptCore/parser/Lexer.h:\n(JSC::Lexer\u003cT\u003e::lexExpectIdentifier): Deleted.\n* Source/JavaScriptCore/parser/Parser.cpp:\n(JSC::Parser\u003cLexerType\u003e::parseProperty):\n(JSC::Parser\u003cLexerType\u003e::parseMemberExpression):\n* Source/JavaScriptCore/parser/Parser.h:\n\nCanonical link: https://commits.webkit.org/318793@main\n"
    },
    {
      "commit": "428fd736695d230e39867fdfb6a0fc7b1dc29d68",
      "tree": "fb9322e17bc91e2f00c6a2e45975edb2cfaf2784",
      "parents": [
        "062e3932bff008ef3a6c1069e561b372ad534547"
      ],
      "author": {
        "name": "Alan Baradlay",
        "email": "zalan@apple.com",
        "time": "Fri Aug 07 17:21:19 2026"
      },
      "committer": {
        "name": "Alan Baradlay",
        "email": "zalan@apple.com",
        "time": "Fri Aug 07 17:21:19 2026"
      },
      "message": "[block-in-inline] A block level box\u0027s margin after is counted twice when only that box needs layout\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d321236\n\nReviewed by Antti Koivisto.\n\nlayoutSimpleBlockContentInInline() is the fast-path taken when a container with inline children needs\nlayout only because one of its block level boxes does. It walks the block level boxes, lays each one out,\nand takes the MarginInfo the last one leaves behind. The lines are not laid out at all.\n\nThat is fine while the block level box is the only in-flow content, since its margins are then the\ncontainer\u0027s own. A line next to the box changes that: the line consumes the adjacent margin as its own\nspacing, so nothing is left to collapse with the container. Normal line layout accounts for this in\nLineBuilder::layoutInlineContent (see updateMarginStateIfNeeded), which does two things once a line places\ncontentful inline content - it resets the margin values, and it leaves the before side of the block. The\nshortcut lays out no lines, so it has to do both itself as the walk passes contentful inline content.\n\n    \u003cdiv\u003e\u003cspan\u003e\u003cdiv style\u003d\"margin-bottom: 16px\"\u003eblock\u003c/div\u003e\u003c/span\u003eline after\u003c/div\u003e\n\nreports a 16px margin after on the container once something inside the block changes and this path runs:\nthe margin is still in MarginInfo when the caller hands it to handleAfterSideOfBlock(), so it is counted a\nsecond time.\n\n    \u003cdiv\u003eline before\u003cspan\u003e\u003cdiv style\u003d\"margin-top: 16px\"\u003eblock\u003c/div\u003e\u003c/span\u003e\u003c/div\u003e\n\nreports a 16px margin before for the same reason. Resetting the margin values is not enough here, because\ncanCollapseWithMarginBefore() reads m_atBeforeSideOfBlock rather than the values, so collapseMargins()\nstill promotes the block\u0027s own margin before into the container\u0027s collapsed margin before and the container\nis then repositioned by its parent.\n\n* Source/WebCore/rendering/RenderBlockFlow.cpp:\n(WebCore::RenderBlockFlow::layoutSimpleBlockContentInInline):\n* LayoutTests/imported/w3c/web-platform-tests/css/CSS2/normal-flow/block-in-inline-margin-after-relayout.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/CSS2/normal-flow/block-in-inline-margin-after-relayout-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/CSS2/normal-flow/block-in-inline-margin-before-relayout.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/CSS2/normal-flow/block-in-inline-margin-before-relayout-expected.txt: Added.\n\nCanonical link: https://commits.webkit.org/318792@main\n"
    },
    {
      "commit": "062e3932bff008ef3a6c1069e561b372ad534547",
      "tree": "8c8ae4498c52833903ca768db5bdb7760cf4cf06",
      "parents": [
        "6815dd9b127c2197d355f3bd4427b37ed9be2cde"
      ],
      "author": {
        "name": "Patrick Griffis",
        "email": "pgriffis@igalia.com",
        "time": "Fri Aug 07 17:19:58 2026"
      },
      "committer": {
        "name": "Patrick Griffis",
        "email": "pgriffis@igalia.com",
        "time": "Fri Aug 07 17:19:58 2026"
      },
      "message": "[WPE] Expose WebKitClipboardPermissionRequest API\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d321204\n\nReviewed by Carlos Garcia Campos and Adrian Perez de Castro.\n\nBasically all of it was cross-port, it just wasn\u0027t hooked up and exposed.\n\nTest: Tools/TestWebKitAPI/Tests/WebKit/WKWebView/glib/TestUIClient.cpp\n\n* Source/WebKit/PlatformWPE.cmake:\n* Source/WebKit/SourcesWPE.txt:\n* Source/WebKit/UIProcess/API/glib/WebKitAutocleanups.h.in:\n* Source/WebKit/UIProcess/API/glib/WebKitClipboardPermissionRequest.cpp:\n* Source/WebKit/UIProcess/API/glib/WebKitClipboardPermissionRequest.h.in:\n* Source/WebKit/UIProcess/API/glib/WebKitWebView.cpp:\n(WebKitWebViewClient::requestClipboardPermission):\n* Source/WebKit/UIProcess/API/glib/webkit.h.in:\n* Source/WebKit/UIProcess/API/wpe/PageClientImpl.cpp:\n(WebKit::PageClientImpl::requestDOMPasteAccess):\n* Source/WebKit/UIProcess/API/wpe/WebKitWebViewClient.h:\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/glib/TestUIClient.cpp:\n(testWebViewClipboardPermissionRequest):\n(beforeAll):\n\nCanonical link: https://commits.webkit.org/318791@main\n"
    },
    {
      "commit": "6815dd9b127c2197d355f3bd4427b37ed9be2cde",
      "tree": "1cdb0edfcce92362474fc9efa4cc89e7a01c94ce",
      "parents": [
        "eb46d8c72c1f3ca11fe79ebeb31bf546bda2daba"
      ],
      "author": {
        "name": "Ari Young",
        "email": "ari_young@apple.com",
        "time": "Fri Aug 07 17:19:16 2026"
      },
      "committer": {
        "name": "Timothy Hatcher",
        "email": "timothy@apple.com",
        "time": "Fri Aug 07 17:19:16 2026"
      },
      "message": "Web Extensions sidebar is rendered per-tab instead of per-window, even in the absence of tab-specific sidebars\nrdar://182752551\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d321128\n\nReviewed by Timothy Hatcher.\n\nThe sidebar pane was rendered per tab rather than per window: every tab was given its own\nsidebar object and its own WKWebView, even when the extension had set nothing specific to that\ntab. Switching between such tabs tore down one sidebar and built an identical one instead of\nleaving the window\u0027s sidebar in place, and changes made at the window (or global) tier were not\nreflected on the tabs that inherited them.\n\nMake each window own a single sidebar whose WKWebView is shared by every tab that sets no panel\nof its own; a tab gets its own sidebar and web view only while it overrides its own panel path.\nsidebarForTab: hands back that shared object for every non-overriding tab, so the browser can\ncompare successive results by identity to decide whether the displayed sidebar must change on a\ntab switch. A tab sidebar is discarded once it stops overriding anything, and the browser is told\nto drop it through the new didInvalidateSidebar: delegate method.\n\nTest: Tools/TestWebKitAPI/Tests/WebKit/WKWebView/WKWebExtensionAPISidebar.mm\n\n* Source/WebKit/UIProcess/API/Cocoa/WKWebExtensionContext.mm:\n(-[WKWebExtensionContext sidebarForTab:]):\n    Resolve through the shared per-window sidebar rather than creating a tab-specific one.\n* Source/WebKit/UIProcess/API/Cocoa/WKWebExtensionContextPrivate.h:\n* Source/WebKit/UIProcess/API/Cocoa/WKWebExtensionControllerDelegatePrivate.h:\n* Source/WebKit/UIProcess/API/Cocoa/_WKWebExtensionSidebar.h:\n* Source/WebKit/UIProcess/API/Cocoa/_WKWebExtensionSidebar.mm:\n(-[_WKWebExtensionSidebar title]):\n(-[_WKWebExtensionSidebar viewController]):\n(-[_WKWebExtensionSidebar webView]):\n(-[_WKWebExtensionSidebar willOpenSidebarFromUserInteraction:]):\n(-[_WKWebExtensionSidebar associatedWindow]):\n    The sidebar\u0027s window, or its tab\u0027s window for a tab-specific sidebar.\n(-[_WKWebExtensionSidebar willOpenSidebar]): Deleted.\n* Source/WebKit/UIProcess/Extensions/Cocoa/API/WebExtensionContextAPISidebarCocoa.mm:\n(WebKit::WebExtensionContext::notifyDelegateOfSidebarUpdate):\n(WebKit::WebExtensionContext::notifyDelegateOfSidebarInvalidation):\n(WebKit::WebExtensionContext::sidebarOpen):\n    Resolve the tab directly; creating a sidebar here would defeat per-window sharing.\n(WebKit::WebExtensionContext::sidebarClose):\n(WebKit::WebExtensionContext::sidebarIsOpen):\n(WebKit::WebExtensionContext::sidebarToggle):\n    Reject when no panel is set.\n(WebKit::WebExtensionContext::sidebarSetTitle):\n(WebKit::WebExtensionContext::sidebarGetOptions):\n    Use the non-creating resolver so a query never materializes a tab sidebar.\n(WebKit::WebExtensionContext::sidebarSetOptions):\n    Apply path and enablement together so one call notifies the browser at most once.\n* Source/WebKit/UIProcess/Extensions/Cocoa/WebExtensionContextCocoa.mm:\n(WebKit::WebExtensionContext::unload):\n    Clear the sidebar maps, which were never cleared, leaking sidebars and web views across reloads.\n(WebKit::WebExtensionContext::getCurrentTab const):\n(WebKit::WebExtensionContext::didMoveTab):\n(WebKit::WebExtensionContext::performAction):\n(WebKit::WebExtensionContext::sidebarForTab):\n(WebKit::WebExtensionContext::addSidebarPage):\n(WebKit::WebExtensionContext::discardSidebarIfUnmodified):\n    Drop a tab sidebar which overrides nothing, unlink it, and notify the delegate it is invalidated.\n* Source/WebKit/UIProcess/Extensions/Cocoa/WebExtensionSidebarCocoa.mm:\n(-[_WKWebExtensionSidebarWebViewDelegate webView:decidePolicyForNavigationAction:decisionHandler:]):\n(WebKit::WebExtensionSidebar::hasOverriddenProperties const):\n(WebKit::WebExtensionSidebar::parent const):\n    Create the window sidebar when resolving a tab\u0027s parent, so it inherits from its window rather\n    than falling through to the global sidebar.\n(WebKit::WebExtensionSidebar::propertiesDidChange):\n    Report this sidebar to the delegate as well as its children, so a parent-tier change reaches\n    the tabs that inherit it.\n(WebKit::WebExtensionSidebar::setIconsDictionary):\n    Notify when an icon override is cleared, not only when one is set.\n(WebKit::WebExtensionSidebar::setOptions):\n    Replaces setSidebarPath/setEnabled: mutate both, tear down a demoted tab\u0027s web view, reload the\n    shared web views, and notify at most once.\n(WebKit::WebExtensionSidebar::willOpenSidebar):\n    Grant activeTab only for a user-initiated open, so an extension cannot grant itself the\n    permission by changing a tab\u0027s sidebar.\n(WebKit::WebExtensionSidebar::willCloseSidebar):\n(WebKit::WebExtensionSidebar::didReceiveUserInteraction):\n(WebKit::WebExtensionSidebar::viewController):\n(WebKit::WebExtensionSidebar::webView):\n(WebKit::WebExtensionSidebar::parentPropertiesWereUpdated):\n(WebKit::WebExtensionSidebar::notifyChildrenOfPropertyUpdate):\n(WebKit::WebExtensionSidebar::notifyDelegateOfPropertyUpdate):\n(WebKit::WebExtensionSidebar::reloadDescendantWebViews):\n(WebKit::WebExtensionSidebar::setEnabled): Deleted.\n(WebKit::WebExtensionSidebar::setSidebarPath): Deleted.\n* Source/WebKit/UIProcess/Extensions/WebExtensionContext.h:\n* Source/WebKit/UIProcess/Extensions/WebExtensionSidebar.h:\n* Source/WebKit/WebProcess/Extensions/API/Cocoa/WebExtensionAPISidePanelCocoa.mm:\n(WebKit::WebExtensionAPISidePanel::setOptions):\n    Reject a call that sets neither path nor enabled, and forward each only when the caller supplied it.\n(WebKit::deserializeSidebarParameters): Deleted.\n* Tools/TestWebKitAPI/Helpers/cocoa/TestWebExtensionsDelegate.h:\n* Tools/TestWebKitAPI/Helpers/cocoa/TestWebExtensionsDelegate.mm:\n(-[TestWebExtensionsDelegate _webExtensionController:didInvalidateSidebar:forExtensionContext:]):\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/WKWebExtensionAPISidebar.mm:\n(TestWebKitAPI::TEST_F(WKWebExtensionAPISidebar, SidebarActionOpenSucceedsWithUserGesture)):\n(TestWebKitAPI::TEST_F(WKWebExtensionAPISidebar, SidebarActionCloseSucceedsWithUserGesture)):\n(TestWebKitAPI::TEST_F(WKWebExtensionAPISidebar, SidePanelOpenForTabSucceedsWithUserGesture)):\n(TestWebKitAPI::TEST_F(WKWebExtensionAPISidebar, SidePanelOpenForWindowSucceedsWithUserGesture)):\n    These four now assert associatedWindow rather than associatedTab, since a tab that overrides\n    nothing is shown its window\u0027s sidebar.\n(TestWebKitAPI::TEST_F(WKWebExtensionAPISidebar, TabsWithoutOverridesShareTheirWindowSidebar)):\n(TestWebKitAPI::TEST_F(WKWebExtensionAPISidebar, DidInvalidateSidebarFiresWhenLastOverrideCleared)):\n(TestWebKitAPI::TEST_F(WKWebExtensionAPISidebar, WillOpenSidebarWithoutUserInteractionDoesNotStartUserGesture)):\n(TestWebKitAPI::TEST_F(WKWebExtensionAPISidebar, SidePanelSetOptionsRequiresPathOrEnabled)):\n(TestWebKitAPI::TEST_F(WKWebExtensionAPISidebar, TabPanelOverrideSwapsWebViewAndRestoresIt)):\n(TestWebKitAPI::TEST_F(WKWebExtensionAPISidebar, WindowPanelChangeReloadsSharedWebViewInPlace)):\n(TestWebKitAPI::TEST_F(WKWebExtensionAPISidebar, ParentTitleChangeNotifiesInheritingTabSidebar)):\n(TestWebKitAPI::TEST_F(WKWebExtensionAPISidebar, SetOptionsNotifiesDelegateAtMostOnce)):\n(TestWebKitAPI::TEST_F(WKWebExtensionAPISidebar, TabSidebarRelinksToNewWindowOnMove)):\n\nCanonical link: https://commits.webkit.org/318790@main\n"
    },
    {
      "commit": "eb46d8c72c1f3ca11fe79ebeb31bf546bda2daba",
      "tree": "f44732085c6f3052451c1c9320eaa9e860f9ff72",
      "parents": [
        "d3ad5982fcec45b7ccadcd2df37cf917e74a6f9a"
      ],
      "author": {
        "name": "Per Arne Vollan",
        "email": "pvollan@apple.com",
        "time": "Fri Aug 07 16:54:01 2026"
      },
      "committer": {
        "name": "Per Arne Vollan",
        "email": "pvollan@apple.com",
        "time": "Fri Aug 07 16:54:01 2026"
      },
      "message": "Dynamically created cross-site iframe gets stuck on about:blank after a back/forward reload\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d320761\nrdar://184248998\n\nReviewed by Sihui Liu.\n\nWhen useUIProcessForBackForwardItemLoading is enabled, WebPageProxy::\nframeStateForBackForwardChildFrame resolves a child frame\u0027s history\nentry by frame identifier, falling back to matching by sibling\nposition when the identifier isn\u0027t found (e.g. after session restore\nor cross-site child-frame recreation). This position-based fallback\ndidn\u0027t verify that the entry at that position actually corresponded\nto the same frame: a frame created fresh by script during a back/\nforward-classified reload (e.g. a third-party iframe inserted by an\ninline \u003cscript\u003e before the page\u0027s load event) could match, by pure\nposition, a stale entry left behind by an earlier, differently-named\niframe that occupied the same child slot. The new frame was then\nmisrouted into loading that stale entry\u0027s URL and got stuck instead\nof loading its own.\n\nThis is fixed by checking the frame name before falling back to\nposition.\n\nTest: Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolation.mm\n(TestWebKitAPI::TEST(SiteIsolation, GoBackReloadsDynamicallyCreated-\nCrossSiteIframe))\n\n* Source/WebKit/Shared/WebBackForwardListFrameItem.cpp:\n(WebKit::WebBackForwardListFrameItem::childItemForFrameName):\n* Source/WebKit/Shared/WebBackForwardListFrameItem.h:\n* Source/WebKit/UIProcess/WebBackForwardList.cpp:\n(WebKit::WebBackForwardList::findFrameStateInItem):\n* Source/WebKit/UIProcess/WebBackForwardList.h:\n* Source/WebKit/UIProcess/WebBackForwardList.swift:\n* Source/WebKit/UIProcess/WebPageProxy.cpp:\n(WebKit::WebPageProxy::frameStateForBackForwardChildFrame):\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolation.mm:\n(TestWebKitAPI::TEST(SiteIsolation, GoBackReloadsDynamicallyCreatedCrossSiteIframe)):\n\nCanonical link: https://commits.webkit.org/318789@main\n"
    },
    {
      "commit": "d3ad5982fcec45b7ccadcd2df37cf917e74a6f9a",
      "tree": "c66f0a15c22eaa143dfbcb09c15bc06468890639",
      "parents": [
        "a06f835dc421f966f73b2bb02dcf778aae2513c4"
      ],
      "author": {
        "name": "Justin Michaud",
        "email": "jmichaud@igalia.com",
        "time": "Fri Aug 07 16:46:21 2026"
      },
      "committer": {
        "name": "Justin Michaud",
        "email": "jmichaud@igalia.com",
        "time": "Fri Aug 07 16:46:21 2026"
      },
      "message": "Fix TestWTF on arm64 linux\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d320929\n\nReviewed by Yusuke Suzuki.\n\nFixes some minor bugs when trying to run these tests on my machine:\n\n1) Timezones\n2) chars are unsigned on arm64 linux\n3) Flush WTF loggers like surrounding tests\n\nCanonical link: https://commits.webkit.org/318788@main\n"
    },
    {
      "commit": "a06f835dc421f966f73b2bb02dcf778aae2513c4",
      "tree": "12bd452dc9c1a090c8bfdb89220cffc345cc4b10",
      "parents": [
        "e5dca40404776fba8994f658918fd4a1eaaf0f5a"
      ],
      "author": {
        "name": "Aakash Jain",
        "email": "aakash_jain@apple.com",
        "time": "Fri Aug 07 16:43:19 2026"
      },
      "committer": {
        "name": "Aakash Jain",
        "email": "aakash_jain@apple.com",
        "time": "Fri Aug 07 16:43:19 2026"
      },
      "message": "Fail early when buildmaster configuration is incomplete\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d321296\nrdar://184338133\n\nReviewed by Ryan Haddad.\n\nRead GITHUB_HOOK_SECRET into a local and stop the master at configuration load\nwhen it is not set, instead of passing an empty value through to buildbot. The\nchange hook handler is only constructed once the first request arrives, so a\nmissing secret would otherwise go unnoticed until then.\n\n* Tools/CISupport/build-webkit-org-webserver/master.cfg:\n* Tools/CISupport/ews-build-webserver/master.cfg:\n\nCanonical link: https://commits.webkit.org/318787@main\n"
    },
    {
      "commit": "e5dca40404776fba8994f658918fd4a1eaaf0f5a",
      "tree": "f88d5499bb9cff6a86172f9453bc0451f634b84a",
      "parents": [
        "399973c04a04c5fbd4519c6b51f28a54b1acf59a"
      ],
      "author": {
        "name": "Marta Darbinyan",
        "email": "darbinyan@apple.com",
        "time": "Fri Aug 07 16:40:49 2026"
      },
      "committer": {
        "name": "Marta Darbinyan",
        "email": "darbinyan@apple.com",
        "time": "Fri Aug 07 16:40:49 2026"
      },
      "message": "[Gardening]: REGRESSION(318767@main): [macOS Release] imported/w3c/web-platform-tests/wasm/serialization/memory/window-success.tentative.https.html is a flaky crash\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d321298\nrdar://184338230\n\nUnreviewed test Gardening\n\nSkipping the crashing tests in Release.\n\n* LayoutTests/platform/mac-wk2/TestExpectations:\n\nCanonical link: https://commits.webkit.org/318786@main\n"
    },
    {
      "commit": "399973c04a04c5fbd4519c6b51f28a54b1acf59a",
      "tree": "0fae8639a06aa48430ab80d0b2894f54c7dfaa8d",
      "parents": [
        "2c2c1af3574308929fecb71bc1897b8f6b04dc2e"
      ],
      "author": {
        "name": "Yijia Huang",
        "email": "yijia_huang@apple.com",
        "time": "Fri Aug 07 16:19:59 2026"
      },
      "committer": {
        "name": "Yijia Huang",
        "email": "yijia_huang@apple.com",
        "time": "Fri Aug 07 16:19:59 2026"
      },
      "message": "[JSC][Temporal] Implement ISODateToFields and CalendarMergeFields as the spec\u0027s own operations\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d321189\nrdar://184247766\n\nReviewed by Yusuke Suzuki.\n\nAdd isoDateToFields and calendarMergeFields, plus the CalendarFieldKeysPresent,\nCalendarFieldKeysToIgnore and NonISOFieldKeysToIgnore operations they rest on.\nEvery .with() entry point previously hand-fused those steps with its own\nfield-priority rules, PlainMonthDay\u0027s in 44 lines, and the MergeMode enum they\nneeded is gone. differenceYearMonth\u0027s two hand-rolled copies of\nISODateToFields(~year-month~) are converted too.\n\nCalendarFieldKeysToIgnore is what makes a year-only change correct on a\nlunisolar calendar: month and monthCode encode one field, so setting either must\ndiscard the other. Carrying the ordinal across a year change picks the wrong\nmonth once a leap month precedes it — chinese M05 is ordinal 5 in 2018, 6 in\n2020.\n\nThis also fixes PlainYearMonth.prototype.add/subtract shifting the month by a\nconstant -2 for \"buddhist\", \"roc\" and \"japanese\" when the receiver\u0027s ISO year\nwas in roughly 1..1582, confirmed pre-existing by A/B against a pre-conversion\nbuild. Root cause never established.\n\nAdd calendarDayOfWeek, calendarWeekOfYear and calendarYearOfWeek so all fifteen\nCalendarISOToDate fields reach the getters through one accessor family; the\nspec\u0027s \"undefined for calendars with no well-defined week calendar system\" rule\nwas re-derived at six getter sites and is now one std::optional. Remove the\neight forwarders this leaves unreferenced.\n\nInline TemporalPlainTime::with into its prototype, and restore\nZonedDateTime.prototype.with to spec step order: steps 9, 10-16 and 18 ran after\n19-22, so ISODateToFields could throw only after the options getters had run.\n\nTests: JSTests/stress/temporal-calendar-merge-fields-with.js\n       JSTests/stress/temporal-isodatetofields-call-sites.js\n       Source/JavaScriptCore/API/tests/TemporalCoreTest.cpp\n\nCanonical link: https://commits.webkit.org/318785@main\n"
    },
    {
      "commit": "2c2c1af3574308929fecb71bc1897b8f6b04dc2e",
      "tree": "f76d94b8106ec7d112ae943366fe53b3ac3e24a7",
      "parents": [
        "411d06d64c29c07e5f685564bab966a45c56caa8"
      ],
      "author": {
        "name": "Yusuke Suzuki",
        "email": "ysuzuki@apple.com",
        "time": "Fri Aug 07 16:17:07 2026"
      },
      "committer": {
        "name": "Yusuke Suzuki",
        "email": "ysuzuki@apple.com",
        "time": "Fri Aug 07 16:17:07 2026"
      },
      "message": "[JSC] Overhaul ArrayBuffer \u0026 Wasm::Memory sizing with memory64\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d321182\nrdar://184241045\n\nReviewed by Yijia Huang.\n\nCurrently memory64 crashes when growing a shared buffer more than 4GB.\nWe have an inconsistency in our current implementation in terms of\nsize. ArrayBuffer\u0027s maximum size is right now 4GB, but Wasm::Memory\u0027s\nmaximum reserved size is 2^37-1 pages, which is way more than the\nactually usable memory (8PB).\n\nThis patch overhauls the design and the limit of ArrayBuffer / Wasm::Memory\nsizing.\n\n1. Now ArrayBuffer max size is bumped from 4GB to 16GB, aligning to V8\u0027s\n   number. Also this 16GB is aligned to the spec\u0027s limit size[1].\n   \"The maximum size of a 64-bit memory is 262,144 pages (16 GiB).\"\n   Because of our LARGE_TYPED_ARRAYS work, size of ArrayBuffer can be\n   larger than 4GB already, so changing this is not hard. On 32bit\n   environment, no threshold change is done.\n2. We introduce a limit for memory32 and memory64 based on the spec[1].\n   4GB for memory32 and 16GB for memory64.\n3. We also found that some of WebCore side is truncating size of\n   ArrayBuffer to `unsinged` (32bit) while it can be 64bit size before\n   this change. They are semantically incorrect but it is fine (just\n   only handling small sized part), but anyway, fixing them.\n4. Also avoid calling GC while taking a lock of BufferMemoryHandle.\n5. This also revealed many of WebGL issues too, where it is not using\n   `unsinged long long` while spec requires so. This patch fixes them\n   too as they started becoming failures after ArrayBuffer can get\n   larger size than 32bit.\n\nThree web-visible behavior changes fall out of this:\n\n1. A memory64 may now declare a maximum of at most 262144 pages, down from\n   PageCount\u0027s own 2^37-1. A module declaring more used to compile and\n   instantiate at its initial size and now fails WebAssembly.Module(), which\n   matches V8\u0027s kV8MaxWasmMemory64Pages. JSTests/wasm/v8/memory64.js\u0027s two\n   tests for this are re-enabled.\n2. A memory\u0027s buffer reports the maximum this platform could actually grow it\n   to, rather than the one the address type permits declaring, so that a resize\n   within maxByteLength never fails deterministically. The two differ wherever\n   the Primitive address space budget is the tighter bound.\n3. RTCPeerConnection.generateCertificate() reads publicExponent as the big\n   endian WebCrypto BigInteger it is, rather than little endian, and accepts\n   arbitrary leading zero padding. WebSocket.send() now fails the connection\n   for a binary payload too large to frame instead of dropping it or crashing.\n\n[1]: https://www.w3.org/TR/wasm-js-api-2/#limits\n\nTests: JSTests/stress/array-buffer-slice-larger-than-4gb.js\n       JSTests/wasm/stress/memory64-grow-past-4gb.js\n       JSTests/wasm/stress/memory64-maximum-limits.js\n       webrtc/generate-certificate-public-exponent.html\n\n* JSTests/stress/array-buffer-slice-larger-than-4gb.js: Added.\n(shouldBe):\n* JSTests/stress/shared-array-buffer-large-maxbytelength.js:\n(catch):\n* JSTests/stress/typedarray-canonical-numeric-index-string-past-max-array-index.js: Added.\n(shouldBe):\n(const.key.of.keys.array.key.valueOf):\n* JSTests/stress/typedarray-index-past-max-array-index.js: Added.\n(shouldBe):\n(catch):\n(array.undefined.String):\n* JSTests/wasm/js-api/memory-toResizableBuffer.js:\n(assertTrue):\n* JSTests/wasm/js-api/memory64-js-api-errors.js:\n(assert.throws):\n* JSTests/wasm/js-api/memory64-js-api.js:\n(assert.throws):\n* JSTests/wasm/stress/memory64-grow-past-4gb.js: Added.\n(catch):\n(true.try.mem.await.instantiate.module.memory):\n(true.catch):\n(true.canHostPastFourGiB.catch):\n(assert.throws.grow):\n* JSTests/wasm/stress/memory64-maximum-limits.js: Added.\n(true.try.mem.await.instantiate.module.memory):\n(true.catch):\n* JSTests/wasm/stress/memory64-oversized-limits.js:\n(moduleBytesWithMemoryLimits):\n* JSTests/wasm/v8/memory64.js:\n(BasicMemory64Tests):\n(TestBulkMemoryOperations): Deleted.\n* LayoutTests/fast/canvas/webgl/array-unit-tests.html:\n* LayoutTests/fast/canvas/webgl/webgl-array-invalid-ranges.html:\n* LayoutTests/fast/canvas/webgl/webgl2-array-buffer-view-offset-past-32-bits-expected.txt: Added.\n* LayoutTests/fast/canvas/webgl/webgl2-array-buffer-view-offset-past-32-bits.html: Added.\n* LayoutTests/http/tests/websocket/tests/hybi/bufferedAmount-past-32-bits-after-close-expected.txt: Added.\n* LayoutTests/http/tests/websocket/tests/hybi/bufferedAmount-past-32-bits-after-close.html: Added.\n* LayoutTests/webrtc/generate-certificate-public-exponent-expected.txt: Added.\n* LayoutTests/webrtc/generate-certificate-public-exponent.html: Added.\n* Source/JavaScriptCore/runtime/ArrayBuffer.cpp:\n(JSC::tryAllocateResizableMemory):\n(JSC::ArrayBuffer::resize):\n(JSC::SharedArrayBufferContents::grow):\n(JSC::SharedArrayBufferContents::tryGrow):\n* Source/JavaScriptCore/runtime/ArrayBuffer.h:\n* Source/JavaScriptCore/runtime/BufferMemoryHandle.cpp:\n(JSC::BufferMemoryHandle::fastMappedBytes):\n* Source/JavaScriptCore/runtime/BufferMemoryHandle.h:\n* Source/JavaScriptCore/runtime/JSArrayBufferPrototype.cpp:\n(JSC::arrayBufferSlice):\n* Source/JavaScriptCore/runtime/JSGenericTypedArrayViewInlines.h:\n(JSC::JSGenericTypedArrayView\u003cAdaptor\u003e::getOwnPropertySlot):\n(JSC::JSGenericTypedArrayView\u003cAdaptor\u003e::put):\n(JSC::JSGenericTypedArrayView\u003cAdaptor\u003e::defineOwnProperty):\n(JSC::JSGenericTypedArrayView\u003cAdaptor\u003e::deleteProperty):\n* Source/JavaScriptCore/runtime/PageCount.h:\n* Source/JavaScriptCore/runtime/PropertyName.h:\n(JSC::isCanonicalNumericIndexString):\n* Source/JavaScriptCore/wasm/WasmAddressType.cpp:\n* Source/JavaScriptCore/wasm/WasmAddressType.h:\n(JSC::Wasm::AddressType::AddressType):\n(JSC::Wasm::AddressType::is64Bit const):\n* Source/JavaScriptCore/wasm/WasmLimits.h:\n(JSC::Wasm::maxDeclarablePages):\n(JSC::Wasm::maxBufferByteLength):\n(JSC::Wasm::static_assert):\n* Source/JavaScriptCore/wasm/WasmMemory.cpp:\n(JSC::Wasm::maxAllocatableBytes):\n(JSC::Wasm::Memory::tryCreate):\n(JSC::Wasm::Memory::growShared):\n(JSC::Wasm::Memory::grow):\n* Source/JavaScriptCore/wasm/WasmMemory.h:\n* Source/JavaScriptCore/wasm/WasmSectionParser.cpp:\n(JSC::Wasm::SectionParser::parseMemoryHelper):\n* Source/JavaScriptCore/wasm/js/JSWebAssemblyMemory.cpp:\n(JSC::JSWebAssemblyMemory::associateArrayBuffer):\n* Source/JavaScriptCore/wasm/js/WebAssemblyMemoryConstructor.cpp:\n(JSC::WebAssemblyMemoryConstructor::createMemoryFromDescriptor):\n* Source/WebCore/Modules/mediastream/RTCPeerConnection.cpp:\n(WebCore::certificateTypeFromAlgorithmIdentifier):\n* Source/WebCore/Modules/websockets/ThreadableWebSocketChannel.h:\n* Source/WebCore/Modules/websockets/ThreadableWebSocketChannelClientWrapper.cpp:\n(WebCore::ThreadableWebSocketChannelClientWrapper::didUpdateBufferedAmount):\n(WebCore::ThreadableWebSocketChannelClientWrapper::didClose):\n* Source/WebCore/Modules/websockets/ThreadableWebSocketChannelClientWrapper.h:\n* Source/WebCore/Modules/websockets/WebSocket.cpp:\n(WebCore::saturateAdd):\n(WebCore::isFramablePayloadSize):\n(WebCore::WebSocket::send):\n(WebCore::WebSocket::bufferedAmount const):\n(WebCore::WebSocket::didUpdateBufferedAmount):\n(WebCore::WebSocket::didClose):\n* Source/WebCore/Modules/websockets/WebSocket.h:\n* Source/WebCore/Modules/websockets/WebSocket.idl:\n* Source/WebCore/Modules/websockets/WebSocketChannelClient.h:\n* Source/WebCore/Modules/websockets/WorkerThreadableWebSocketChannel.cpp:\n(WebCore::WorkerThreadableWebSocketChannel::send):\n(WebCore::WorkerThreadableWebSocketChannel::Peer::didUpdateBufferedAmount):\n(WebCore::WorkerThreadableWebSocketChannel::Peer::didClose):\n(WebCore::WorkerThreadableWebSocketChannel::Bridge::send):\n* Source/WebCore/Modules/websockets/WorkerThreadableWebSocketChannel.h:\n* Source/WebCore/css/FontFace.cpp:\n(WebCore::FontFace::create):\n* Source/WebCore/fileapi/NetworkSendQueue.cpp:\n(WebCore::NetworkSendQueue::enqueue):\n* Source/WebCore/fileapi/NetworkSendQueue.h:\n* Source/WebCore/html/canvas/WebGL2RenderingContext.cpp:\n(WebCore::WebGL2RenderingContext::arrayBufferViewSliceFactory):\n(WebCore::WebGL2RenderingContext::sliceArrayBufferView):\n(WebCore::WebGL2RenderingContext::bufferData):\n(WebCore::WebGL2RenderingContext::bufferSubData):\n(WebCore::WebGL2RenderingContext::getBufferSubData):\n(WebCore::WebGL2RenderingContext::texImage2D):\n(WebCore::WebGL2RenderingContext::texImage3D):\n(WebCore::WebGL2RenderingContext::texSubImage2D):\n(WebCore::WebGL2RenderingContext::texSubImage3D):\n(WebCore::WebGL2RenderingContext::compressedTexImage2D):\n(WebCore::WebGL2RenderingContext::compressedTexImage3D):\n(WebCore::WebGL2RenderingContext::compressedTexSubImage2D):\n(WebCore::WebGL2RenderingContext::compressedTexSubImage3D):\n(WebCore::WebGL2RenderingContext::uniform1uiv):\n(WebCore::WebGL2RenderingContext::uniform2uiv):\n(WebCore::WebGL2RenderingContext::uniform3uiv):\n(WebCore::WebGL2RenderingContext::uniform4uiv):\n(WebCore::WebGL2RenderingContext::uniformMatrix2x3fv):\n(WebCore::WebGL2RenderingContext::uniformMatrix3x2fv):\n(WebCore::WebGL2RenderingContext::uniformMatrix2x4fv):\n(WebCore::WebGL2RenderingContext::uniformMatrix4x2fv):\n(WebCore::WebGL2RenderingContext::uniformMatrix3x4fv):\n(WebCore::WebGL2RenderingContext::uniformMatrix4x3fv):\n(WebCore::WebGL2RenderingContext::vertexAttribI4iv):\n(WebCore::WebGL2RenderingContext::vertexAttribI4uiv):\n(WebCore::WebGL2RenderingContext::clearBufferiv):\n(WebCore::WebGL2RenderingContext::clearBufferuiv):\n(WebCore::WebGL2RenderingContext::clearBufferfv):\n(WebCore::WebGL2RenderingContext::validateClearBuffer):\n(WebCore::WebGL2RenderingContext::uniform1fv):\n(WebCore::WebGL2RenderingContext::uniform2fv):\n(WebCore::WebGL2RenderingContext::uniform3fv):\n(WebCore::WebGL2RenderingContext::uniform4fv):\n(WebCore::WebGL2RenderingContext::uniform1iv):\n(WebCore::WebGL2RenderingContext::uniform2iv):\n(WebCore::WebGL2RenderingContext::uniform3iv):\n(WebCore::WebGL2RenderingContext::uniform4iv):\n(WebCore::WebGL2RenderingContext::uniformMatrix2fv):\n(WebCore::WebGL2RenderingContext::uniformMatrix3fv):\n(WebCore::WebGL2RenderingContext::uniformMatrix4fv):\n(WebCore::WebGL2RenderingContext::readPixels):\n* Source/WebCore/html/canvas/WebGL2RenderingContext.h:\n* Source/WebCore/html/canvas/WebGL2RenderingContext.idl:\n* Source/WebCore/html/canvas/WebGLMultiDraw.cpp:\n(WebCore::WebGLMultiDraw::validateOffset):\n* Source/WebCore/html/canvas/WebGLMultiDraw.h:\n* Source/WebCore/html/canvas/WebGLMultiDrawInstancedBaseVertexBaseInstance.cpp:\n(WebCore::WebGLMultiDrawInstancedBaseVertexBaseInstance::validateOffset):\n* Source/WebCore/html/canvas/WebGLMultiDrawInstancedBaseVertexBaseInstance.h:\n* Source/WebCore/html/canvas/WebGLRenderingContextBase.cpp:\n(WebCore::WebGLRenderingContextBase::texImageArrayBufferViewHelper):\n(WebCore::WebGLRenderingContextBase::validateTexFuncData):\n(WebCore::WebGLRenderingContextBase::validateUniformMatrixParameters):\n(WebCore::WebGLRenderingContextBase::vertexAttribfvImpl):\n* Source/WebCore/html/canvas/WebGLRenderingContextBase.h:\n(WebCore::WebGLRenderingContextBase::TypedList::length const):\n(WebCore::WebGLRenderingContextBase::validateUniformParameters):\n* Source/WebCore/platform/graphics/iso/ISOBox.cpp:\n(WebCore::isWalkableView):\n(WebCore::ISOBox::peekBox):\n(WebCore::ISOBox::parse):\n* Source/WebKit/WebProcess/Network/WebSocketChannel.cpp:\n(WebKit::WebSocketChannel::send):\n* Source/WebKit/WebProcess/Network/WebSocketChannel.h:\n* Source/WebKitLegacy/WebCoreSupport/WebSocketChannel.cpp:\n(WebCore::WebSocketChannel::send):\n* Source/WebKitLegacy/WebCoreSupport/WebSocketChannel.h:\n* Source/bmalloc/bmalloc/Gigacage.h:\n\nCanonical link: https://commits.webkit.org/318784@main\n"
    },
    {
      "commit": "411d06d64c29c07e5f685564bab966a45c56caa8",
      "tree": "ff01a219751c02695122fc0589e38b283a432a8a",
      "parents": [
        "0848b3fb1bb07d7db687e1a6a60fcbe5f333e9b6"
      ],
      "author": {
        "name": "Alan Baradlay",
        "email": "zalan@apple.com",
        "time": "Fri Aug 07 15:56:38 2026"
      },
      "committer": {
        "name": "Alan Baradlay",
        "email": "zalan@apple.com",
        "time": "Fri Aug 07 15:56:38 2026"
      },
      "message": "[anon-block-removal] Fix editing/selection/end-of-document.html\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d321205\n\nReviewed by Antti Koivisto.\n\npreviousLinePosition() and nextLinePosition() step to the adjacent line box and put the caret on it. They\nalready skip lines that are not lines of text to land on - zero height ones, and ones with no leaf box -\nand fall back to a candidate search that walks the tree for the real position instead.\n\nA line holding a block level box belongs in that same category. The caret does not go on that line, it\ngoes on a line inside the block, which is what the candidate search finds. Accepting the line instead\nresolves the position through the block level box: closestBoxForHorizontalPosition() returns it,\neditingIgnoresContent() is true for it, and the caret ends up in front of the whole block. In\nend-of-document.html moving the caret backward by line from the end of the document lands it at the very\nstart instead of on the previous line.\n\n* Source/WebCore/editing/VisibleUnits.cpp:\n(WebCore::previousLinePosition):\n(WebCore::nextLinePosition):\n\nCanonical link: https://commits.webkit.org/318783@main\n"
    },
    {
      "commit": "0848b3fb1bb07d7db687e1a6a60fcbe5f333e9b6",
      "tree": "d29886457f6984df69b7999460061a4f00a64ed7",
      "parents": [
        "db5ab4766a6212b3b8da3fc4a491f50b1ef8095c"
      ],
      "author": {
        "name": "Alan Baradlay",
        "email": "zalan@apple.com",
        "time": "Fri Aug 07 15:54:29 2026"
      },
      "committer": {
        "name": "Alan Baradlay",
        "email": "zalan@apple.com",
        "time": "Fri Aug 07 15:54:29 2026"
      },
      "message": "[block-in-inline] A block whose content is a table is treated as self-collapsing\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d321198\n\nReviewed by Antti Koivisto.\n\nLineLayout::isSelfCollapsingContent() looks for the block level box on a line so it can ask whether that\nbox is self-collapsing. It iterates the line\u0027s display boxes with\n\n    for (auto index \u003d line.firstBoxIndex(); index \u003c line.lastBoxIndex(); ++index)\n\nbut lastBoxIndex() is firstBoxIndex() + boxCount() - 1, an inclusive index, so the last box on the line is\nnever examined. A block level box on a line is typically the last box on it, in which case the look-up\nreturns nullptr and the \"renderBox \u0026\u0026 !renderBox-\u003eisSelfCollapsingBlock()\" test is skipped altogether.\n\n* Source/WebCore/layout/integration/inline/LayoutIntegrationLineLayout.cpp:\n(WebCore::LayoutIntegration::LineLayout::isSelfCollapsingContent const):\n* LayoutTests/imported/w3c/web-platform-tests/css/CSS2/normal-flow/block-with-table-content-is-not-self-collapsing.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/CSS2/normal-flow/block-with-table-content-is-not-self-collapsing-expected.txt: Added.\n\nCanonical link: https://commits.webkit.org/318782@main\n"
    },
    {
      "commit": "db5ab4766a6212b3b8da3fc4a491f50b1ef8095c",
      "tree": "9d3191e3c39b73ec9ac4f5f8200d3bb9951bfe3a",
      "parents": [
        "f641af0b8e472dd959f5e0763e18a68072bfca6e"
      ],
      "author": {
        "name": "Sihui Liu",
        "email": "sihui_liu@apple.com",
        "time": "Fri Aug 07 15:42:26 2026"
      },
      "committer": {
        "name": "Sihui Liu",
        "email": "sihui_liu@apple.com",
        "time": "Fri Aug 07 15:42:26 2026"
      },
      "message": "Network cache traversal decodes every record in full just to read its URL\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d321234\nrdar://184280149\n\nReviewed by Chris Dumez.\n\nCache::traverse decoded every visited record into an Entry before handing it to its client, and every client that\ntraverses only needs the response URL, to match the record against an origin or a registrable domain. Decoding an\nEntry deserializes the whole ResourceResponse, so each record costs a full HTTP header map rebuild plus a SecTrust\ndeserialization, which DER-decodes and hashes the response\u0027s certificate chain, and this could be costly.\n\nTo reduce the cost, this patch adds Entry::decodeStorageRecordResponseURL, which only decodes URL from response and\nstops there -- the Entry::encodeAsStorageRecord writes the response first, and Coder\u003cWebCore::ResourceResponse\u003e writes\nm_isNull followed by m_url, so the URL is at the start of the record header and is decoded early.\n\nAlso, this patch adds assertion in decodeStorageRecord to ensure the decode URL is the same as Entry::response().url(),\nso that reordering the coder\u0027s fields cannot silently turn the fast path into reading some other field as a URL.\n\nCache::traverse is replaced with Cache::traverseRecords, which hands out the undecoded Storage::Record and lets the\nclient decide what it needs, and convert the four clients that only need an origin.\n\nOne behavior difference: a record that failed to decode was previously skipped inside Cache::traverse, whichever field\nfailed. Now only a record whose URL cannot be decoded is skipped, so a record with a readable URL but a corrupt later\nfield becomes deletable, which seems more useful than keeping it around forever.\n\nThe new test WKWebsiteDataStore.RemoveDiskCacheDataForOrigin covers both directions of Cache::deleteData, that the\nrequested origin\u0027s entries are gone, and that another origin\u0027s entries are left alone.\n\n* Source/WebKit/NetworkProcess/NetworkProcess.cpp:\n(WebKit::NetworkProcess::deleteWebsiteDataForOrigin):\n* Source/WebKit/NetworkProcess/cache/NetworkCache.cpp:\n(WebKit::NetworkCache::Cache::traverseRecords):\n(WebKit::NetworkCache::Cache::fetchData):\n(WebKit::NetworkCache::Cache::deleteData):\n(WebKit::NetworkCache::Cache::deleteDataForRegistrableDomains):\n(WebKit::NetworkCache::Cache::traverse): Deleted.\n* Source/WebKit/NetworkProcess/cache/NetworkCache.h:\n* Source/WebKit/NetworkProcess/cache/NetworkCacheEntry.cpp:\n(WebKit::NetworkCache::Entry::decodeStorageRecord):\n(WebKit::NetworkCache::Entry::decodeStorageRecordResponseURL):\n* Source/WebKit/NetworkProcess/cache/NetworkCacheEntry.h:\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/WebsiteDataStoreCustomPaths.mm:\n(TEST(WKWebsiteDataStore, RemoveDiskCacheDataForOrigin)):\n\nCanonical link: https://commits.webkit.org/318781@main\n"
    },
    {
      "commit": "f641af0b8e472dd959f5e0763e18a68072bfca6e",
      "tree": "9d0a7d6936052298731a4c439d472775f6f8dbeb",
      "parents": [
        "9334b44ff7ef9b546018ba0417e9f0f0cfaddc22"
      ],
      "author": {
        "name": "Keith Miller",
        "email": "keith_miller@apple.com",
        "time": "Fri Aug 07 15:26:50 2026"
      },
      "committer": {
        "name": "Keith Miller",
        "email": "keith_miller@apple.com",
        "time": "Fri Aug 07 15:26:50 2026"
      },
      "message": "Add missing writeBarrier to Array.unshift\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d321217\nrdar://183142160\n\nReviewed by Yusuke Suzuki.\n\nIn 313475@main we added support for Array.p.unshift in the DFG based on\nArray.push. Unlike Array.push, when relocating elements they may become\ninvisible to the GC. Since we inline the case where there is exactly\none element being prepended to the array and we don\u0027t know what the\ncontents of the array are we always have to writeBarrier the array.\n\nTest: JSTests/stress/array-unshift-moved-cell-barrier.js\nCanonical link: https://commits.webkit.org/318780@main\n"
    },
    {
      "commit": "9334b44ff7ef9b546018ba0417e9f0f0cfaddc22",
      "tree": "76e72c103acc3a8a4f538e7d39d82ccc733d64c2",
      "parents": [
        "2c529b89097add1b320d3db123d7fa9ef8456329"
      ],
      "author": {
        "name": "Antti Koivisto",
        "email": "antti@apple.com",
        "time": "Fri Aug 07 15:16:00 2026"
      },
      "committer": {
        "name": "Antti Koivisto",
        "email": "koivisto@iki.fi",
        "time": "Fri Aug 07 15:16:00 2026"
      },
      "message": "[Custom Highlight] ::highlight() pseudo-elements should inherit from the parent element\u0027s highlight.\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d320716\nrdar://183702060\n\nReviewed by Alan Baradlay.\n\nImplement per-property highlight cascade per\n\nhttps://drafts.csswg.org/css-pseudo-4/#highlight-cascade\n\n\"When any supported property is not given a value by the cascade, or given a value of inherit or unset,\nits specified value is determined by inheritance from the corresponding highlight pseudo-element of its\noriginating element’s parent element. This occurs regardless of whether that property is an inherited property.\"\n\nThis requires adding highlight specific inheritance paths to style builder.\n\nTest: imported/w3c/web-platform-tests/css/css-pseudo/highlight-cascade/highlight-cascade-parent-style-change.html\n\n* LayoutTests/TestExpectations:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-pseudo/highlight-cascade/highlight-cascade-007-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-pseudo/highlight-cascade/highlight-cascade-parent-style-change-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-pseudo/highlight-cascade/highlight-cascade-parent-style-change.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-pseudo/highlight-cascade/highlight-cascade-shadow-boundary-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-pseudo/highlight-cascade/highlight-cascade-shadow-boundary.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-pseudo/highlight-cascade/highlight-currentcolor-computed-inheritance-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-pseudo/highlight-cascade/highlight-pseudos-inheritance-computed-001-expected.txt:\n* Source/WebCore/css/CSSProperties.json:\n* Source/WebCore/css/CSSProperty.h:\n* Source/WebCore/css/query/ContainerQueryFeatures.cpp:\n(WebCore::CQ::Features::StyleFeatureSchema::evaluateRange const):\n\nDesignated initializers for BuilderContext, so that adding a member doesn\u0027t silently shift\nthe arguments. Same for ResolutionContext in StyleTreeResolver.cpp below.\n\n* Source/WebCore/css/scripts/process-css-properties.py:\n(StylePropertyCodeGenProperties):\n(StylePropertyCodeGenProperties.from_json):\n(applies_to_highlight_pseudo_elements):\n(inherits_in_highlight_pseudo_elements):\n(GenerateCSSPropertyNames):\n* Source/WebCore/css/scripts/test/TestCSSProperties.json:\n* Source/WebCore/css/scripts/test/TestCSSPropertiesResults/CSSPropertyNames.gperf:\n* Source/WebCore/css/scripts/test/TestCSSPropertiesResults/StyleBuilderGenerated.cpp:\n(WebCore::Style::BuilderFunctions::applyHighlightInheritTestColorPropertyWithVisitedLinkSupport):\n(WebCore::Style::BuilderFunctions::applyHighlightInheritTestRenderStyleHasExplicitlySetPolicyAllAuthorOrigin):\n(WebCore::Style::BuilderGenerated::applyHighlightInheritAllProperties):\n(WebCore::Style::BuilderGenerated::applyHighlightProperty):\n\nNew applies-to-highlight-pseudo-elements codegen property. It generates the allowlist\npredicate and an applyHighlightInherit\u003cProperty\u003e() reading the parent highlight style\ninstead of the parent style. Its \"yes-without-inheritance\" value is for fill and stroke,\nwhich stay allowed but keep inheriting from the originating element: the applicable\nproperty list has \u0027fill-color\u0027 and \u0027stroke-color\u0027, which we don\u0027t support, rather than\nthe SVG paint properties.\n\nstyle-builder-custom takes HighlightInitial, HighlightInherit and HighlightValue for the\nproperties that need more than reading a value out of the parent highlight style.\n\n* Source/WebCore/rendering/style/RenderStyleConstants.h:\n\nA highlight pseudo-element exists whenever it exists for the parent element, since it\ninherits from it even with no rules of its own. The bits get propagated to the children\nso that the early return in RenderElement::resolvePseudoElementStyle() keeps working\nwithout gating out descendants that match nothing themselves.\n\n* Source/WebCore/style/MatchedDeclarationsCache.cpp:\n(WebCore::Style::MatchedDeclarationsCache::isCacheable):\n\nThe parent highlight style is not part of the cache key, and copyNonInheritedFrom() on a\nhit would drop the inherited background-color and text-decoration values.\n\n* Source/WebCore/style/PropertyAllowlist.cpp:\n(WebCore::Style::isValidHighlightStyleProperty):\n\nThe allowlist is generated now. Custom properties are not in the applicable property list\nbut are allowed, since they can be substituted into the properties that are.\n\n* Source/WebCore/style/StyleBuilder.cpp:\n(WebCore::Style::Builder::applyHighlightInheritance):\n(WebCore::Style::Builder::applyProperty):\n* Source/WebCore/style/StyleBuilder.h:\n\nA highlight style applies every property through applyHighlightProperty(), which uses the\nhighlight version of a function where there is one and otherwise falls back to\napplyProperty(), so the normal path has no highlight code in it.\n\nunset inherits instead of resolving to the initial value, which is what makes the\nnon-inherited properties like background-color participate.\n\n* Source/WebCore/style/StyleBuilderCustom.h:\n(WebCore::Style::BuilderCustom::applyHighlightInitialColor):\n(WebCore::Style::BuilderCustom::applyHighlightValueColor):\n(WebCore::Style::BuilderCustom::applyHighlightInheritColor):\n\ncurrentcolor in a highlight pseudo-element is the originating element\u0027s color, so the\nchain inherits the keyword rather than the color it resolved to. These are the only\nfunctions that write the bit for it.\n\n* Source/WebCore/style/StyleBuilderGenerated.h:\n* Source/WebCore/style/StyleBuilderState.h:\n* Source/WebCore/style/StyleBuilderStateInlines.h:\n(WebCore::Style::BuilderState::isBuildingHighlightStyle const):\n\nparentHighlightStyle() returns a pointer, since it is null at the start of the chain,\nwhere the inherited value is the initial value except for color.\n\n* Source/WebCore/style/StyleResolver.cpp:\n(WebCore::Style::Resolver::State::State):\n(WebCore::Style::Resolver::State::parentHighlightStyle const):\n(WebCore::Style::Resolver::builderContext const):\n(WebCore::Style::Resolver::unadjustedStyleForElement):\n(WebCore::Style::parentHighlightStyleIgnoringPendingUpdate):\n(WebCore::Style::Resolver::styleForPseudoElement):\n(WebCore::Style::Resolver::applyMatchedProperties):\n* Source/WebCore/style/StyleResolver.h:\n\nThe chain is resolved one level per style, each cached in the ancestor\u0027s style, and\nfollows the flat tree like the rest of inheritance, so it continues past a shadow\nboundary to the host. A highlight pseudo-element with no rules of its own now gets a\nstyle too, so that it can pass the inherited values on to its descendants.\n\nThe parent highlight style comes in with the ResolutionContext, because highlight styles\nare also re-resolved during tree resolution, where the parent\u0027s existing computed style\nis the one being replaced. The lazy paths still walk up to find it, which is correct\nthere since nothing is being resolved.\n\n* Source/WebCore/style/StyleTreeResolver.cpp:\n(WebCore::Style::TreeResolver::makeResolutionContext):\n(WebCore::Style::TreeResolver::makeResolutionContextForPseudoElement):\n(WebCore::Style::TreeResolver::makeResolutionContextForInheritedFirstLine):\n(WebCore::Style::TreeResolver::resolveAgainInDifferentContext):\n(WebCore::Style::TreeResolver::applyCascadeAfterAnimation):\n* Source/WebCore/style/computed/StyleComputedStyleBase+GettersInlines.h:\n(WebCore::Style::ComputedStyleBase::colorIsCurrentColorForHighlight const):\n(WebCore::Style::ComputedStyleBase::highlightPseudoElementTypes const):\n* Source/WebCore/style/computed/StyleComputedStyleBase+SettersInlines.h:\n(WebCore::Style::ComputedStyleBase::setColorIsCurrentColorForHighlight):\n* Source/WebCore/style/computed/StyleComputedStyleBase.h:\n* Source/WebCore/style/computed/data/StyleInheritedData.cpp:\n(WebCore::Style::InheritedData::InheritedData):\n(WebCore::Style::InheritedData::fastPathInheritedEqual const):\n(WebCore::Style::InheritedData::fastPathInheritFrom):\n(WebCore::Style::InheritedData::dumpDifferences const):\n* Source/WebCore/style/computed/data/StyleInheritedData.h:\n\nThe bit lives with the color it describes, so it travels with inheritFrom() and the fast\npath without any handling of its own.\n\n* Tools/Scripts/webkitpy/style/checkers/jsonchecker.py:\n(JSONCSSPropertiesChecker.check_codegen_properties):\n\nCanonical link: https://commits.webkit.org/318779@main\n"
    },
    {
      "commit": "2c529b89097add1b320d3db123d7fa9ef8456329",
      "tree": "5a3a5bece2ad91f6d872631a700c2ff51174aae7",
      "parents": [
        "a0c9c2ff2d1bb0fefd187e4540738c05000c4626"
      ],
      "author": {
        "name": "Fady Farag",
        "email": "com.webkit.iidmsa@gmail.com",
        "time": "Fri Aug 07 13:33:17 2026"
      },
      "committer": {
        "name": "Fady Farag",
        "email": "com.webkit.iidmsa@gmail.com",
        "time": "Fri Aug 07 13:33:17 2026"
      },
      "message": "MediaRecorder drops a frame whenever the writer input reports not ready\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d321218\nrdar://184271782\n\nReviewed by Darin Adler.\n\nPreviously, MediaRecorderPrivateWriter::writeFrames() removed the sample\nfrom m_pendingFrames before calling writeFrame(). That caused the sample\nto be destroyed instead of retried when writeFrame() returned NotReady,\ncontradicting the adjacent comment and discarding one frame. This removes\nthe sample from the deque if and only if writeFrame() returned Success,\nwhich is the intended behavior.\n\n* Source/WebCore/platform/mediarecorder/MediaRecorderPrivateWriter.cpp:\n(WebCore::MediaRecorderPrivateWriter::writeFrames):\n\nCanonical link: https://commits.webkit.org/318778@main\n"
    },
    {
      "commit": "a0c9c2ff2d1bb0fefd187e4540738c05000c4626",
      "tree": "a58946b7766126a43f9799d95907831f76a65a6d",
      "parents": [
        "4cdafb42e29d0fd7e0c21da6808c131d68c4bba2"
      ],
      "author": {
        "name": "Fujii Hironori",
        "email": "fujii@igalia.com",
        "time": "Fri Aug 07 12:57:01 2026"
      },
      "committer": {
        "name": "Fujii Hironori",
        "email": "fujii@igalia.com",
        "time": "Fri Aug 07 12:57:01 2026"
      },
      "message": "CryptoAlgorithmX25519ParamsInit.h: Fix typo \"version 2,1\"\n\nUnreviewed. Fixed a typo of LGPL version 2.1 that censused a license tool.\n\n* Source/WebCore/crypto/parameters/CryptoAlgorithmX25519ParamsInit.h:\n\nCanonical link: https://commits.webkit.org/318777@main\n"
    },
    {
      "commit": "4cdafb42e29d0fd7e0c21da6808c131d68c4bba2",
      "tree": "a5a303e59eba8dedd42c697a7a27721419c6e022",
      "parents": [
        "a1678ffa5ff18d2173b0f871d794ba57b34d7efd"
      ],
      "author": {
        "name": "Jean-Yves Avenard",
        "email": "jya@apple.com",
        "time": "Fri Aug 07 11:42:08 2026"
      },
      "committer": {
        "name": "Jean-Yves Avenard",
        "email": "jean-yves.avenard@apple.com",
        "time": "Fri Aug 07 11:42:08 2026"
      },
      "message": "[site-isolation] http/tests/webrtc/audioSessionInFrames.html is a permanent failure\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d321166\nrdar://184204754\n\nReviewed by Eric Carlson.\n\nThis test exposed four separate issues.\n\n1) navigator.audioSession.type read \"auto\" in a cross-site iframe: a WebContent process\n    joining an existing page never received the top document\u0027s DocumentSyncData. The\n    broadcast on change only reached processes that already hosted the page, and\n    RemotePageParameters carried the main document URL but no sync data, so the iframe\u0027s\n    Page kept a default-constructed DocumentSyncData. 100% failure whenever the iframe was\n    site-isolated into its own process.\n\n2) navigator.audioSession.state read \"inactive\" there: the DOM audio session state was not\n    page-scoped, so a passive iframe process consulted its own RemoteAudioSession, which\n    never activated. RemoteAudioSessionConfiguration::isActive was that process\u0027s own\n    activation request, and the GPU process only pushed ConfigurationChanged for mute,\n    buffer size and sample rate. Also 100% failure once 1) was fixed.\n\n3) getUserMedia resolved once the audio session category had been applied but before the\n    activation completed, so JS reading state right after the await could see \"inactive\" in\n    any configuration. 45% failure without site isolation.\n\n4) The test only started listening for the frame\u0027s message after waiting for the frame to load.\n    With the frame in another process, the message and the load notification travelled as separate\n    IPCs, so a message that arrived first was dropped and the test waited forever. 8% of runs,\n    reported as a timeout.\n\nDocumentSyncData is now sent in the remote page creation parameters and adopted by pages\nthat do not host the local main frame, and the audio session state joins it as a\nsynchronized, page-scoped value that remote-frame processes read and dispatch statechange\nfrom. For 3), audioCaptureSourceStateChanged() returns GenericPromise::all() of the\ncategory and the activation, so waiters (the getUserMedia promise, the track mute/unmute\nevents) see a session that is both categorised and active; activation is still requested\nsynchronously, so callers that do not wait keep observing AudioSession::isActive()\nimmediately, as 318537@main requires.\nThe test now starts listening for the message before it creates the frame.\n\n* LayoutTests/http/tests/webrtc/audioSessionInFrames.html: Listen for the frame\u0027s message\nbefore creating the frame.\n* LayoutTests/platform/ios-site-isolation/TestExpectations: Unskip the now-passing test.\n* LayoutTests/platform/mac-site-isolation/TestExpectations: Ditto.\n* Source/WebCore/Modules/audiosession/DOMAudioSession.cpp:\n(WebCore::DOMAudioSession::state const): Use the effective state.\n(WebCore::DOMAudioSession::currentState const): Read the synchronized state when the page\nhas no local main frame, otherwise compute it and publish it from the top document.\n(WebCore::DOMAudioSession::topDocumentAudioSessionStateChanged): Schedule a statechange\nevent for a state computed in another process.\n(WebCore::DOMAudioSession::scheduleStateChangeEvent): Capture the effective state.\n* Source/WebCore/Modules/audiosession/DOMAudioSession.h:\n* Source/WebCore/Modules/audiosession/NavigatorAudioSession.cpp:\n(WebCore::NavigatorAudioSession::audioSessionIfExists): Added; does not provision the\nsupplement.\n* Source/WebCore/Modules/audiosession/NavigatorAudioSession.h:\n* Source/WebCore/dom/Document.cpp:\n(WebCore::Document::populateDocumentSyncDataForNewlyConstructedDocument): Handle the new\ndata type.\n* Source/WebCore/page/DocumentSyncData.in: Add AudioSessionState.\n* Source/WebCore/page/Page.cpp:\n(WebCore::Page::setAudioSessionState): Store and broadcast the page\u0027s audio session state.\n(WebCore::Page::audioSessionState const):\n(WebCore::Page::updateTopDocumentSyncData): Notify existing DOMAudioSession objects when\nthe synchronized state changes.\n* Source/WebCore/page/Page.h:\n* Source/WebCore/platform/audio/MediaSessionManagerInterface.cpp:\n(WebCore::MediaSessionManagerInterface::audioCaptureSourceStateChanged): Return a promise\ncovering both the category and the activation; keep requesting activation synchronously.\n* Source/WebKit/Shared/WebCoreArgumentCodersMedia.serialization.in: Declare\nDOMAudioSessionState for IPC.\n* Source/WebKit/Shared/WebPageCreationParameters.h:\n* Source/WebKit/Shared/WebPageCreationParameters.serialization.in: Carry the top document\u0027s\nDocumentSyncData in RemotePageParameters.\n* Source/WebKit/UIProcess/ProvisionalPageProxy.cpp:\n(WebKit::ProvisionalPageProxy::initializeWebPage): Send fresh sync data; the provisional\npage commits a new top document.\n* Source/WebKit/UIProcess/RemotePageProxy.cpp:\n(WebKit::RemotePageProxy::injectPageIntoNewProcess): Send the current sync data.\n(WebKit::RemotePageProxy::setDrawingArea): Ditto.\n* Source/WebKit/UIProcess/WebPageProxy.cpp:\n(WebKit::WebPageProxy::topDocumentSyncData const): Added.\n* Source/WebKit/UIProcess/WebPageProxy.h:\n* Source/WebKit/WebProcess/WebPage/WebPage.cpp:\n(WebKit::m_allowsImmersiveEnvironments):\n* Tools/TestWebKitAPI/Resources/getUserMedia.html: Wait for the getUserMedia promise to resolved before calling stop().\n* Tools/TestWebKitAPI/SourcesCocoa.txt: Added missing file so API test gets compiled.\n\nCanonical link: https://commits.webkit.org/318776@main\n"
    },
    {
      "commit": "a1678ffa5ff18d2173b0f871d794ba57b34d7efd",
      "tree": "e156675fcd6f6baf3698ef2d673c4917fc6019bb",
      "parents": [
        "2bed988b197be9756a5112e82085920c99b8da96"
      ],
      "author": {
        "name": "Karl Dubost",
        "email": "karlcow@apple.com",
        "time": "Fri Aug 07 10:47:19 2026"
      },
      "committer": {
        "name": "Karl Dubost",
        "email": "karlcow@apple.com",
        "time": "Fri Aug 07 10:47:19 2026"
      },
      "message": "REGRESSION(311768@main): :focus-visible incorrectly shown after focus() inside a focused ancestor\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d321157\nrdar://181570771\n\nReviewed by Abrar Rahman Protyasha.\n\nButtons are not mouse-focusable on macOS/iOS, so a workaround records\nthat the last focus trigger was a click. 311768@main stopped that\nworkaround from running when the clicked button sits inside an ancestor\nthat can take focus, such as a \u003cdialog\u003e. Usually the ancestor is focused\ninstead and the click is recorded there, but not when it is already\nfocused. Nothing recorded the click, so the programmatic focus() that\nfollowed showed :focus-visible.\n\nmusic.apple.com opens its now-playing player as a \u003cdialog\u003e. Dismissing\nit left a red focus ring on the mini player.\n\nWalk the ancestors only up to the element that will be focused, instead\nof skipping the workaround whenever there is one.\n\nTests: fast/selectors/focus-visible-script-focus-after-dialog-dismiss.html\n       fast/selectors/focus-visible-script-focus-inside-focused-ancestor.html\n\n* LayoutTests/fast/selectors/focus-visible-script-focus-after-dialog-dismiss-expected.txt: Added.\n* LayoutTests/fast/selectors/focus-visible-script-focus-after-dialog-dismiss.html: Added.\n* LayoutTests/fast/selectors/focus-visible-script-focus-inside-focused-ancestor-expected.txt: Added.\n* LayoutTests/fast/selectors/focus-visible-script-focus-inside-focused-ancestor.html: Added.\n* Source/WebCore/page/EventHandler.cpp:\n(WebCore::EventHandler::dispatchMouseEvent):\n\nCanonical link: https://commits.webkit.org/318775@main\n"
    },
    {
      "commit": "2bed988b197be9756a5112e82085920c99b8da96",
      "tree": "64d8c05423b0b17ab44a7dfd67c7422e48fb2fb3",
      "parents": [
        "aa6c61fcb0020c75099f15ccbfaa14380fb55c89"
      ],
      "author": {
        "name": "Yusuke Suzuki",
        "email": "ysuzuki@apple.com",
        "time": "Fri Aug 07 10:37:26 2026"
      },
      "committer": {
        "name": "Yusuke Suzuki",
        "email": "ysuzuki@apple.com",
        "time": "Fri Aug 07 10:37:26 2026"
      },
      "message": "Unreviewed, update test262\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d321269\nrdar://184320090\n\n* JSTests/test262/expectations.yaml:\n* JSTests/test262/harness/assert.js:\n* JSTests/test262/harness/compareArray.js:\n* JSTests/test262/latest-changes-summary.txt:\n* JSTests/test262/test/built-ins/Array/prototype/Symbol.unscopables/at.js: Added.\n* JSTests/test262/test/built-ins/Iterator/prototype/chunks/argument-effect-order.js: Added.\n(Iterator.prototype.chunks.call.get next):\n* JSTests/test262/test/built-ins/Iterator/prototype/chunks/argument-validation-failure-close-throws.js: Added.\n(let.closable.get next):\n(let.closable.get return):\n* JSTests/test262/test/built-ins/Iterator/prototype/chunks/argument-validation-failure-closes-underlying.js: Added.\n(let.closable.get next):\n(let.closable.return):\n* JSTests/test262/test/built-ins/Iterator/prototype/chunks/callable.js: Added.\n(g):\n* JSTests/test262/test/built-ins/Iterator/prototype/chunks/chunkSize-no-coercion.js: Added.\n(let.iterator):\n(iterator.chunks.valueOf):\n(iterator.chunks.toString):\n* JSTests/test262/test/built-ins/Iterator/prototype/chunks/chunkSize-not-a-number.js: Added.\n(let.iterator):\n* JSTests/test262/test/built-ins/Iterator/prototype/chunks/chunkSize-out-of-range.js: Added.\n(let.iterator):\n* JSTests/test262/test/built-ins/Iterator/prototype/chunks/chunks-evenly-divisible.js: Added.\n(g):\n* JSTests/test262/test/built-ins/Iterator/prototype/chunks/chunks-last-chunk-partial.js: Added.\n(g):\n* JSTests/test262/test/built-ins/Iterator/prototype/chunks/chunks-size-1.js: Added.\n(g):\n* JSTests/test262/test/built-ins/Iterator/prototype/chunks/chunks-size-larger-than-iterator.js: Added.\n(g):\n* JSTests/test262/test/built-ins/Iterator/prototype/chunks/exhaustion-does-not-call-return.js: Added.\n(g):\n(TestIterator.prototype.get next):\n(TestIterator.prototype.return):\n(TestIterator):\n* JSTests/test262/test/built-ins/Iterator/prototype/chunks/get-next-method-only-once.js: Added.\n(CountingIterator.get next.let.iter):\n(CountingIterator.prototype.get next):\n(CountingIterator):\n* JSTests/test262/test/built-ins/Iterator/prototype/chunks/get-next-method-throws.js: Added.\n(ThrowingIterator.prototype.get next):\n(ThrowingIterator.prototype.get return):\n(ThrowingIterator):\n* JSTests/test262/test/built-ins/Iterator/prototype/chunks/get-return-method-throws.js: Added.\n(TestIterator.prototype.next):\n(TestIterator.prototype.get return):\n(TestIterator):\n* JSTests/test262/test/built-ins/Iterator/prototype/chunks/is-function.js: Added.\n* JSTests/test262/test/built-ins/Iterator/prototype/chunks/iterator-already-exhausted.js: Added.\n(g):\n* JSTests/test262/test/built-ins/Iterator/prototype/chunks/iterator-return-method-throws.js: Added.\n(IteratorThrows.prototype.next):\n(IteratorThrows.prototype.return):\n(IteratorThrows):\n* JSTests/test262/test/built-ins/Iterator/prototype/chunks/length.js: Added.\n* JSTests/test262/test/built-ins/Iterator/prototype/chunks/name.js: Added.\n* JSTests/test262/test/built-ins/Iterator/prototype/chunks/next-method-returns-non-object.js: Added.\n(NonObjectIterator.prototype.next):\n(NonObjectIterator.prototype.get return):\n(NonObjectIterator):\n* JSTests/test262/test/built-ins/Iterator/prototype/chunks/next-method-returns-throwing-done.js: Added.\n(ThrowingIterator.prototype.next.return.get done):\n(ThrowingIterator.prototype.next):\n(ThrowingIterator.prototype.get return):\n(ThrowingIterator):\n* JSTests/test262/test/built-ins/Iterator/prototype/chunks/next-method-returns-throwing-value-done.js: Added.\n(ThrowingIterator.prototype.next.return.get value):\n(ThrowingIterator.prototype.next):\n(ThrowingIterator.prototype.get return):\n(ThrowingIterator):\n* JSTests/test262/test/built-ins/Iterator/prototype/chunks/next-method-returns-throwing-value.js: Added.\n(ThrowingIterator.prototype.next.return.get value):\n(ThrowingIterator.prototype.next):\n(ThrowingIterator.prototype.get return):\n(ThrowingIterator):\n* JSTests/test262/test/built-ins/Iterator/prototype/chunks/next-method-throws.js: Added.\n(ThrowingIterator.prototype.next):\n(ThrowingIterator.prototype.get return):\n(ThrowingIterator):\n* JSTests/test262/test/built-ins/Iterator/prototype/chunks/non-constructible.js: Added.\n(g):\n* JSTests/test262/test/built-ins/Iterator/prototype/chunks/prop-desc.js: Added.\n* JSTests/test262/test/built-ins/Iterator/prototype/chunks/proto.js: Added.\n* JSTests/test262/test/built-ins/Iterator/prototype/chunks/result-is-iterator.js: Added.\n(assert):\n* JSTests/test262/test/built-ins/Iterator/prototype/chunks/return-is-forwarded-to-underlying-iterator.js: Added.\n(TestIterator.prototype.next):\n(TestIterator.prototype.return):\n(TestIterator):\n* JSTests/test262/test/built-ins/Iterator/prototype/chunks/return-is-not-forwarded-after-exhaustion.js: Added.\n(TestIterator.prototype.next):\n(TestIterator.prototype.return):\n(TestIterator):\n* JSTests/test262/test/built-ins/Iterator/prototype/chunks/this-non-callable-next.js: Added.\n* JSTests/test262/test/built-ins/Iterator/prototype/chunks/this-non-object.js: Added.\n* JSTests/test262/test/built-ins/Iterator/prototype/chunks/this-plain-iterator.js: Added.\n(let.iter.get next):\n* JSTests/test262/test/built-ins/Iterator/prototype/chunks/throws-typeerror-when-generator-is-running.js: Added.\n(iterator.get next):\n* JSTests/test262/test/built-ins/Iterator/prototype/chunks/underlying-iterator-advanced-in-parallel.js: Added.\n(let.iterator):\n* JSTests/test262/test/built-ins/Iterator/prototype/chunks/underlying-iterator-closed-in-parallel.js: Added.\n(let.iterator):\n* JSTests/test262/test/built-ins/Iterator/prototype/chunks/yields-distinct-arrays.js: Added.\n(g):\n* JSTests/test262/test/built-ins/Iterator/prototype/drop/argument-effect-order.js:\n(Iterator.prototype.drop.call.get next):\n(valueOf):\n* JSTests/test262/test/built-ins/Iterator/prototype/drop/argument-validation-failure-closes-underlying.js:\n* JSTests/test262/test/built-ins/Iterator/prototype/drop/limit-rangeerror.js:\n* JSTests/test262/test/built-ins/Iterator/prototype/includes/argument-effect-order.js: Added.\n(Iterator.prototype.includes.call.get next):\n(Iterator.prototype.includes.call.return):\n* JSTests/test262/test/built-ins/Iterator/prototype/includes/argument-validation-failure-closes-underlying.js: Added.\n(let.closable.get next):\n(let.closable.return):\n* JSTests/test262/test/built-ins/Iterator/prototype/includes/basic-match-and-miss.js: Added.\n* JSTests/test262/test/built-ins/Iterator/prototype/includes/callable.js: Added.\n(g):\n* JSTests/test262/test/built-ins/Iterator/prototype/includes/closes-on-match.js: Added.\n(let.iter.next):\n(let.iter.return):\n* JSTests/test262/test/built-ins/Iterator/prototype/includes/exhaustion-does-not-call-return.js: Added.\n(let.iterator.next):\n(let.iterator.get return):\n* JSTests/test262/test/built-ins/Iterator/prototype/includes/get-next-method-only-once.js: Added.\n(let.iterator.get next):\n* JSTests/test262/test/built-ins/Iterator/prototype/includes/get-next-method-throws.js: Added.\n(let.iterator.get next):\n(let.iterator.get return):\n* JSTests/test262/test/built-ins/Iterator/prototype/includes/get-return-method-throws.js: Added.\n(let.iterator.next):\n(let.iterator.get return):\n* JSTests/test262/test/built-ins/Iterator/prototype/includes/infinite-iterator.js: Added.\n(let.gen):\n* JSTests/test262/test/built-ins/Iterator/prototype/includes/is-function.js: Added.\n* JSTests/test262/test/built-ins/Iterator/prototype/includes/iterator-already-exhausted.js: Added.\n(let.iterator):\n* JSTests/test262/test/built-ins/Iterator/prototype/includes/iterator-has-no-return.js: Added.\n* JSTests/test262/test/built-ins/Iterator/prototype/includes/iterator-return-method-throws.js: Added.\n(let.iterator.next):\n(let.iterator.return):\n* JSTests/test262/test/built-ins/Iterator/prototype/includes/length.js: Added.\n* JSTests/test262/test/built-ins/Iterator/prototype/includes/name.js: Added.\n* JSTests/test262/test/built-ins/Iterator/prototype/includes/next-method-returns-non-object.js: Added.\n(let.iterator.next):\n(let.iterator.get return):\n* JSTests/test262/test/built-ins/Iterator/prototype/includes/next-method-returns-throwing-done.js: Added.\n(let.iterator.next.return.get done):\n(let.iterator.next):\n(let.iterator.get return):\n* JSTests/test262/test/built-ins/Iterator/prototype/includes/next-method-returns-throwing-value-done.js: Added.\n(let.iterator.next.return.get value):\n(let.iterator.next):\n* JSTests/test262/test/built-ins/Iterator/prototype/includes/next-method-returns-throwing-value.js: Added.\n(let.iterator.next.return.get value):\n(let.iterator.next):\n(let.iterator.get return):\n* JSTests/test262/test/built-ins/Iterator/prototype/includes/next-method-throws.js: Added.\n(let.iterator.next):\n(let.iterator.get return):\n* JSTests/test262/test/built-ins/Iterator/prototype/includes/non-constructible.js: Added.\n(g):\n* JSTests/test262/test/built-ins/Iterator/prototype/includes/object-identity.js: Added.\n(let.o.get toString):\n(let.o.get valueOf):\n(assert.sameValue.arr.values.includes.get toString):\n(assert.sameValue.arr.values.includes.get valueOf):\n* JSTests/test262/test/built-ins/Iterator/prototype/includes/prop-desc.js: Added.\n* JSTests/test262/test/built-ins/Iterator/prototype/includes/proto.js: Added.\n* JSTests/test262/test/built-ins/Iterator/prototype/includes/result-is-boolean.js: Added.\n(g):\n* JSTests/test262/test/built-ins/Iterator/prototype/includes/samevaluezero-nan.js: Added.\n* JSTests/test262/test/built-ins/Iterator/prototype/includes/samevaluezero-zeroes.js: Added.\n* JSTests/test262/test/built-ins/Iterator/prototype/includes/skipped-elements-default.js: Added.\n* JSTests/test262/test/built-ins/Iterator/prototype/includes/skipped-elements-max-safe-integer.js: Added.\n(let.iter.next):\n(let.iter.return):\n* JSTests/test262/test/built-ins/Iterator/prototype/includes/skipped-elements-nan-typeerror.js: Added.\n(let.iterator.get next):\n(let.iterator.return):\n* JSTests/test262/test/built-ins/Iterator/prototype/includes/skipped-elements-negative-infinity-rangeerror.js: Added.\n(let.iterator.get next):\n(let.iterator.return):\n* JSTests/test262/test/built-ins/Iterator/prototype/includes/skipped-elements-negative-integral-rangeerror.js: Added.\n(let.iterator.get next):\n(let.iterator.return):\n* JSTests/test262/test/built-ins/Iterator/prototype/includes/skipped-elements-no-coercion.js: Added.\n(let.iterator.get next):\n(let.iterator.return):\n(valueOf):\n(toString):\n* JSTests/test262/test/built-ins/Iterator/prototype/includes/skipped-elements-non-integral-typeerror.js: Added.\n(let.iterator.get next):\n(let.iterator.return):\n* JSTests/test262/test/built-ins/Iterator/prototype/includes/skipped-elements-not-a-number.js: Added.\n(let.iterator.get next):\n(assertTypeErrorAndClosed):\n* JSTests/test262/test/built-ins/Iterator/prototype/includes/skipped-elements-positive-infinity.js: Added.\n(let.iter.next):\n(let.iter.return):\n* JSTests/test262/test/built-ins/Iterator/prototype/includes/skipped-elements-positive-integral.js: Added.\n* JSTests/test262/test/built-ins/Iterator/prototype/includes/skipped-elements-too-large-rangeerror.js: Added.\n(let.iterator.get next):\n(assertRangeErrorAndClosed):\n* JSTests/test262/test/built-ins/Iterator/prototype/includes/skipped-elements-zero-and-negative-zero.js: Added.\n* JSTests/test262/test/built-ins/Iterator/prototype/includes/symbol-identity.js: Added.\n* JSTests/test262/test/built-ins/Iterator/prototype/includes/this-non-callable-next.js: Added.\n* JSTests/test262/test/built-ins/Iterator/prototype/includes/this-non-object.js: Added.\n* JSTests/test262/test/built-ins/Iterator/prototype/includes/this-plain-iterator.js: Added.\n(let.iter.get next):\n* JSTests/test262/test/built-ins/Iterator/prototype/join/closes-on-contents-coercion-exception.js: Added.\n(throwy.toString):\n(it.next):\n(it.return):\n* JSTests/test262/test/built-ins/Iterator/prototype/join/closes-on-separator-coercion-exception.js: Added.\n(throwy.toString):\n(it.get next):\n(it.return):\n* JSTests/test262/test/built-ins/Iterator/prototype/join/contents-nullish.js: Added.\n* JSTests/test262/test/built-ins/Iterator/prototype/join/contents-tostring.js: Added.\n(coercible.toString):\n* JSTests/test262/test/built-ins/Iterator/prototype/join/descriptor.js: Added.\n* JSTests/test262/test/built-ins/Iterator/prototype/join/does-not-close-on-iterator-error.js: Added.\n(it.next):\n(it.get return):\n* JSTests/test262/test/built-ins/Iterator/prototype/join/does-not-close-on-iterator-exhaustion.js: Added.\n(it.next):\n(it.get return):\n* JSTests/test262/test/built-ins/Iterator/prototype/join/does-not-close-on-iterator-protocol-violation.js: Added.\n(it.next):\n(it.get return):\n* JSTests/test262/test/built-ins/Iterator/prototype/join/does-not-close-on-next-getter-error.js: Added.\n(it.get next):\n(it.get return):\n* JSTests/test262/test/built-ins/Iterator/prototype/join/length.js: Added.\n* JSTests/test262/test/built-ins/Iterator/prototype/join/name.js: Added.\n* JSTests/test262/test/built-ins/Iterator/prototype/join/next-lookup-after-separator-tostring.js: Added.\n(separator.toString):\n(it.get next):\n* JSTests/test262/test/built-ins/Iterator/prototype/join/not-a-constructor.js: Added.\n* JSTests/test262/test/built-ins/Iterator/prototype/join/receiver-not-object.js: Added.\n* JSTests/test262/test/built-ins/Iterator/prototype/join/results-empty-separator.js: Added.\n* JSTests/test262/test/built-ins/Iterator/prototype/join/results-no-separator.js: Added.\n* JSTests/test262/test/built-ins/Iterator/prototype/join/results-nonempty-separator.js: Added.\n* JSTests/test262/test/built-ins/Iterator/prototype/join/separator-tostring.js: Added.\n(coercible.toString):\n* JSTests/test262/test/built-ins/Iterator/prototype/take/argument-effect-order.js:\n(Iterator.prototype.take.call.get next):\n(valueOf):\n* JSTests/test262/test/built-ins/Iterator/prototype/take/argument-validation-failure-closes-underlying.js:\n* JSTests/test262/test/built-ins/Iterator/prototype/take/limit-rangeerror.js:\n* JSTests/test262/test/built-ins/Iterator/prototype/windows/argument-effect-order.js: Added.\n(Iterator.prototype.windows.call.get next):\n* JSTests/test262/test/built-ins/Iterator/prototype/windows/argument-validation-failure-close-throws.js: Added.\n(let.closable.get next):\n(let.closable.get return):\n* JSTests/test262/test/built-ins/Iterator/prototype/windows/argument-validation-failure-closes-underlying.js: Added.\n(let.closable.get next):\n(let.closable.return):\n* JSTests/test262/test/built-ins/Iterator/prototype/windows/callable.js: Added.\n(g):\n* JSTests/test262/test/built-ins/Iterator/prototype/windows/exhaustion-does-not-call-return.js: Added.\n(g):\n(TestIterator.prototype.get next):\n(TestIterator.prototype.return):\n(TestIterator):\n* JSTests/test262/test/built-ins/Iterator/prototype/windows/get-next-method-only-once.js: Added.\n(CountingIterator.get next.let.iter):\n(CountingIterator.prototype.get next):\n(CountingIterator):\n* JSTests/test262/test/built-ins/Iterator/prototype/windows/get-next-method-throws.js: Added.\n(ThrowingIterator.prototype.get next):\n(ThrowingIterator.prototype.get return):\n(ThrowingIterator):\n* JSTests/test262/test/built-ins/Iterator/prototype/windows/get-return-method-throws.js: Added.\n(TestIterator.prototype.next):\n(TestIterator.prototype.get return):\n(TestIterator):\n* JSTests/test262/test/built-ins/Iterator/prototype/windows/is-function.js: Added.\n* JSTests/test262/test/built-ins/Iterator/prototype/windows/iterator-already-exhausted.js: Added.\n(g):\n* JSTests/test262/test/built-ins/Iterator/prototype/windows/iterator-return-method-throws.js: Added.\n(IteratorThrows.prototype.next):\n(IteratorThrows.prototype.return):\n(IteratorThrows):\n* JSTests/test262/test/built-ins/Iterator/prototype/windows/length.js: Added.\n* JSTests/test262/test/built-ins/Iterator/prototype/windows/name.js: Added.\n* JSTests/test262/test/built-ins/Iterator/prototype/windows/next-method-returns-non-object.js: Added.\n(NonObjectIterator.prototype.next):\n(NonObjectIterator.prototype.get return):\n(NonObjectIterator):\n* JSTests/test262/test/built-ins/Iterator/prototype/windows/next-method-returns-throwing-done.js: Added.\n(ThrowingIterator.prototype.next.return.get done):\n(ThrowingIterator.prototype.next):\n(ThrowingIterator.prototype.get return):\n(ThrowingIterator):\n* JSTests/test262/test/built-ins/Iterator/prototype/windows/next-method-returns-throwing-value-done.js: Added.\n(ThrowingIterator.prototype.next.return.get value):\n(ThrowingIterator.prototype.next):\n(ThrowingIterator.prototype.get return):\n(ThrowingIterator):\n* JSTests/test262/test/built-ins/Iterator/prototype/windows/next-method-returns-throwing-value.js: Added.\n(ThrowingIterator.prototype.next.return.get value):\n(ThrowingIterator.prototype.next):\n(ThrowingIterator.prototype.get return):\n(ThrowingIterator):\n* JSTests/test262/test/built-ins/Iterator/prototype/windows/next-method-throws.js: Added.\n(ThrowingIterator.prototype.next):\n(ThrowingIterator.prototype.get return):\n(ThrowingIterator):\n* JSTests/test262/test/built-ins/Iterator/prototype/windows/non-constructible.js: Added.\n(g):\n* JSTests/test262/test/built-ins/Iterator/prototype/windows/prop-desc.js: Added.\n* JSTests/test262/test/built-ins/Iterator/prototype/windows/proto.js: Added.\n* JSTests/test262/test/built-ins/Iterator/prototype/windows/result-is-iterator.js: Added.\n(assert):\n* JSTests/test262/test/built-ins/Iterator/prototype/windows/return-is-forwarded-to-underlying-iterator.js: Added.\n(TestIterator.prototype.next):\n(TestIterator.prototype.return):\n(TestIterator):\n* JSTests/test262/test/built-ins/Iterator/prototype/windows/return-is-not-forwarded-after-exhaustion.js: Added.\n(TestIterator.prototype.next):\n(TestIterator.prototype.return):\n(TestIterator):\n* JSTests/test262/test/built-ins/Iterator/prototype/windows/this-non-callable-next.js: Added.\n* JSTests/test262/test/built-ins/Iterator/prototype/windows/this-non-object.js: Added.\n* JSTests/test262/test/built-ins/Iterator/prototype/windows/this-plain-iterator.js: Added.\n(let.iter.get next):\n* JSTests/test262/test/built-ins/Iterator/prototype/windows/throws-typeerror-when-generator-is-running.js: Added.\n(iterator.get next):\n* JSTests/test262/test/built-ins/Iterator/prototype/windows/underlying-iterator-advanced-in-parallel.js: Added.\n(let.iterator):\n* JSTests/test262/test/built-ins/Iterator/prototype/windows/underlying-iterator-closed-in-parallel.js: Added.\n(let.iterator):\n* JSTests/test262/test/built-ins/Iterator/prototype/windows/undersized-default.js: Added.\n(g):\n* JSTests/test262/test/built-ins/Iterator/prototype/windows/undersized-invalid.js: Added.\n(let.iterator):\n* JSTests/test262/test/built-ins/Iterator/prototype/windows/windowSize-no-coercion.js: Added.\n(let.iterator):\n(iterator.windows.valueOf):\n(iterator.windows.toString):\n* JSTests/test262/test/built-ins/Iterator/prototype/windows/windowSize-not-a-number.js: Added.\n(let.iterator):\n* JSTests/test262/test/built-ins/Iterator/prototype/windows/windowSize-out-of-range.js: Added.\n(let.iterator):\n* JSTests/test262/test/built-ins/Iterator/prototype/windows/windows-allow-partial.js: Added.\n(g):\n* JSTests/test262/test/built-ins/Iterator/prototype/windows/windows-basic.js: Added.\n(g):\n* JSTests/test262/test/built-ins/Iterator/prototype/windows/windows-size-1.js: Added.\n(g):\n* JSTests/test262/test/built-ins/Iterator/prototype/windows/windows-size-3.js: Added.\n(g):\n* JSTests/test262/test/built-ins/Iterator/prototype/windows/yields-distinct-arrays.js: Added.\n(g):\n* JSTests/test262/test/built-ins/Object/freeze/15.2.3.9-1-1.js:\n* JSTests/test262/test/built-ins/Object/freeze/15.2.3.9-1-2.js:\n* JSTests/test262/test/built-ins/Object/freeze/15.2.3.9-1-3.js:\n* JSTests/test262/test/built-ins/Object/freeze/15.2.3.9-1-4.js:\n* JSTests/test262/test/built-ins/Object/freeze/15.2.3.9-1.js:\n* JSTests/test262/test/built-ins/Object/isExtensible/15.2.3.13-1-1.js:\n* JSTests/test262/test/built-ins/Object/isExtensible/15.2.3.13-1-2.js:\n* JSTests/test262/test/built-ins/Object/isExtensible/15.2.3.13-1-3.js:\n* JSTests/test262/test/built-ins/Object/isExtensible/15.2.3.13-1-4.js:\n* JSTests/test262/test/built-ins/Object/isExtensible/15.2.3.13-1.js:\n* JSTests/test262/test/built-ins/Object/isFrozen/15.2.3.12-1-1.js:\n* JSTests/test262/test/built-ins/Object/isFrozen/15.2.3.12-1-2.js:\n* JSTests/test262/test/built-ins/Object/isFrozen/15.2.3.12-1-3.js:\n* JSTests/test262/test/built-ins/Object/isFrozen/15.2.3.12-1-4.js:\n* JSTests/test262/test/built-ins/Object/isFrozen/15.2.3.12-1.js:\n* JSTests/test262/test/built-ins/Object/isSealed/15.2.3.11-1.js:\n* JSTests/test262/test/built-ins/Object/keys/15.2.3.14-1-1.js:\n* JSTests/test262/test/built-ins/Object/keys/15.2.3.14-1-2.js:\n* JSTests/test262/test/built-ins/Object/keys/15.2.3.14-1-3.js:\n* JSTests/test262/test/built-ins/Object/seal/seal-boolean-literal.js:\n* JSTests/test262/test/built-ins/Object/seal/seal-infinity.js:\n* JSTests/test262/test/built-ins/Object/seal/seal-nan.js:\n* JSTests/test262/test/built-ins/Object/seal/seal-null.js:\n* JSTests/test262/test/built-ins/Object/seal/seal-symbol.js:\n* JSTests/test262/test/built-ins/Object/seal/seal-undefined.js:\n* JSTests/test262/test/built-ins/Promise/allSettledKeyed/result-property-descriptors.js:\n(asyncTest):\n* JSTests/test262/test/built-ins/TypedArray/prototype/slice/speciesctor-return-same-buffer-with-offset.js:\n(testWithTypedArrayConstructors):\n* JSTests/test262/test/built-ins/TypedArrayConstructors/internals/GetOwnProperty/BigInt/index-prop-desc.js:\n(testWithBigIntTypedArrayConstructors):\n* JSTests/test262/test/built-ins/TypedArrayConstructors/internals/GetOwnProperty/index-prop-desc.js:\n(testWithTypedArrayConstructors):\n* JSTests/test262/test/built-ins/TypedArrayConstructors/internals/Set/BigInt/null-tobigint.js:\n(testWithBigIntTypedArrayConstructors):\n* JSTests/test262/test/built-ins/TypedArrayConstructors/internals/Set/BigInt/number-tobigint.js:\n(testWithBigIntTypedArrayConstructors):\n* JSTests/test262/test/built-ins/TypedArrayConstructors/internals/Set/BigInt/string-nan-tobigint.js:\n(testWithBigIntTypedArrayConstructors):\n* JSTests/test262/test/built-ins/TypedArrayConstructors/internals/Set/BigInt/symbol-tobigint.js:\n(s.Symbol.testWithBigIntTypedArrayConstructors):\n* JSTests/test262/test/built-ins/TypedArrayConstructors/internals/Set/BigInt/tonumber-value-throws.js:\n(testWithBigIntTypedArrayConstructors):\n* JSTests/test262/test/built-ins/TypedArrayConstructors/internals/Set/BigInt/undefined-tobigint.js:\n(testWithBigIntTypedArrayConstructors):\n* JSTests/test262/test/built-ins/TypedArrayConstructors/internals/Set/bigint-tonumber.js:\n(testWithTypedArrayConstructors):\n* JSTests/test262/test/built-ins/TypedArrayConstructors/internals/Set/tonumber-value-throws.js:\n(testWithTypedArrayConstructors):\n* JSTests/test262/test/intl402/Locale/prototype/getCalendars/likely-subtags-region.js: Added.\n(findSuitableTestData):\n* JSTests/test262/test/intl402/Locale/prototype/getCalendars/region-override.js: Added.\n(findSuitableTestData):\n* JSTests/test262/test/intl402/Locale/prototype/getCalendars/region-priority.js: Added.\n* JSTests/test262/test/intl402/Locale/prototype/getCalendars/subdivision-region.js: Added.\n(findSuitableTestData):\n* JSTests/test262/test/intl402/Locale/prototype/getCollations/collation-keyword.js: Added.\n* JSTests/test262/test/intl402/Locale/prototype/getCollations/output-array-sorted.js: Added.\n* JSTests/test262/test/intl402/Locale/prototype/getCollations/output-array-values.js:\n* JSTests/test262/test/intl402/Locale/prototype/getCollations/output-array.js:\n* JSTests/test262/test/intl402/Locale/prototype/getCollations/und-language.js: Added.\n* JSTests/test262/test/intl402/Locale/prototype/getHourCycles/language-priority.js: Added.\n* JSTests/test262/test/intl402/Locale/prototype/getHourCycles/likely-subtags-region.js: Added.\n(findSuitableTestData):\n* JSTests/test262/test/intl402/Locale/prototype/getHourCycles/region-override.js: Added.\n(findSuitableTestData):\n* JSTests/test262/test/intl402/Locale/prototype/getHourCycles/region-priority.js: Added.\n* JSTests/test262/test/intl402/Locale/prototype/getHourCycles/subdivision-region.js: Added.\n(findSuitableTestData):\n* JSTests/test262/test/intl402/Locale/prototype/getWeekInfo/likely-subtags-region.js: Added.\n(weekInfoEqual):\n(findSuitableTestData):\n* JSTests/test262/test/intl402/Locale/prototype/getWeekInfo/region-override.js: Added.\n(weekInfoEqual):\n(findSuitableTestData):\n* JSTests/test262/test/intl402/Locale/prototype/getWeekInfo/region-priority.js: Added.\n(weekInfoEqual):\n* JSTests/test262/test/intl402/Locale/prototype/getWeekInfo/subdivision-region.js: Added.\n(weekInfoEqual):\n(findSuitableTestData):\n* JSTests/test262/test/language/expressions/assignment/dstr/obj-rest-before-comma-invalid.js: Renamed from JSTests/test262/test/language/expressions/assignment/dstr/array-rest-elision-invalid.js.\n* JSTests/test262/test/language/expressions/assignment/dstr/obj-rest-not-last-element-invalid.js:\n* JSTests/test262/test/language/expressions/dynamic-import/import-fulfilled-member-of-errored-cycle-a_FIXTURE.js: Added.\n* JSTests/test262/test/language/expressions/dynamic-import/import-fulfilled-member-of-errored-cycle-b_FIXTURE.js: Added.\n* JSTests/test262/test/language/expressions/dynamic-import/import-fulfilled-member-of-errored-cycle-c_FIXTURE.js: Added.\n* JSTests/test262/test/language/expressions/dynamic-import/import-fulfilled-member-of-errored-cycle-main_FIXTURE.js: Added.\n* JSTests/test262/test/language/expressions/dynamic-import/import-fulfilled-member-of-errored-cycle-x_FIXTURE.js: Added.\n* JSTests/test262/test/language/expressions/dynamic-import/import-fulfilled-member-of-errored-cycle.js: Added.\n(asyncTest.async var):\n(asyncTest):\n* JSTests/test262/test/language/import/import-defer/deferred-namespace-object/json-module.js: Added.\n* JSTests/test262/test/language/import/import-defer/deferred-namespace-object/json-module_FIXTURE.json: Added.\n* JSTests/test262/test/language/import/import-defer/evaluation-top-level-await/async-cycle-dependency-of-deferred-module/a-tla_FIXTURE.js: Added.\n* JSTests/test262/test/language/import/import-defer/evaluation-top-level-await/async-cycle-dependency-of-deferred-module/b_FIXTURE.js: Added.\n* JSTests/test262/test/language/import/import-defer/evaluation-top-level-await/async-cycle-dependency-of-deferred-module/c_FIXTURE.js: Added.\n* JSTests/test262/test/language/import/import-defer/evaluation-top-level-await/async-cycle-dependency-of-deferred-module/d_FIXTURE.js: Added.\n* JSTests/test262/test/language/import/import-defer/evaluation-top-level-await/async-cycle-dependency-of-deferred-module/main.js: Added.\n* JSTests/test262/test/language/import/import-defer/evaluation-top-level-await/async-cycle-dependency-of-deferred-module/middle_FIXTURE.js: Added.\n* JSTests/test262/test/language/import/import-defer/evaluation-top-level-await/async-cycle-dependency-of-deferred-module/resolve-blocker_FIXTURE.js: Added.\n* JSTests/test262/test/language/import/import-defer/evaluation-top-level-await/async-cycle-dependency-of-deferred-module/setup_FIXTURE.js: Added.\n* JSTests/test262/test/language/statements/await-using/initializer-Symbol.asyncDispose-disposed-at-end-of-imported-module.js: Added.\n* JSTests/test262/test/language/statements/await-using/initializer-Symbol.asyncDispose-disposed-at-end-of-imported-module_FIXTURE.js: Added.\n(await.using.resource.async Symbol):\n* JSTests/test262/test/language/statements/await-using/initializer-Symbol.asyncDispose-disposed-at-end-of-module.js: Added.\n(resource.async Symbol):\n* JSTests/test262/test/language/statements/await-using/initializer-Symbol.dispose-disposed-at-end-of-imported-module.js: Added.\n* JSTests/test262/test/language/statements/await-using/initializer-Symbol.dispose-disposed-at-end-of-imported-module_FIXTURE.js: Added.\n(await.using.resource.Symbol.dispose):\n* JSTests/test262/test/language/statements/await-using/initializer-Symbol.dispose-disposed-at-end-of-module.js: Added.\n(resource.Symbol.dispose):\n* JSTests/test262/test/language/statements/for-in/dstr/obj-rest-before-comma-invalid.js: Renamed from JSTests/test262/test/language/statements/for-in/dstr/array-rest-elision-invalid.js.\n* JSTests/test262/test/language/statements/for-in/dstr/obj-rest-not-last-element-invalid.js:\n* JSTests/test262/test/language/statements/for-in/return-from-catch.js: Added.\n(result):\n* JSTests/test262/test/language/statements/for-in/return-from-finally.js: Added.\n(result):\n* JSTests/test262/test/language/statements/for-in/return-from-try.js: Added.\n(result):\n* JSTests/test262/test/language/statements/for-in/return.js: Added.\n(result):\n* JSTests/test262/test/language/statements/for-of/dstr/obj-rest-before-comma-invalid.js: Renamed from JSTests/test262/test/language/statements/for-of/dstr/array-rest-elision-invalid.js.\n* JSTests/test262/test/language/statements/for-of/dstr/obj-rest-not-last-element-invalid.js:\n* JSTests/test262/test/language/statements/using/initializer-disposed-at-end-of-imported-module.js: Added.\n* JSTests/test262/test/language/statements/using/initializer-disposed-at-end-of-imported-module_FIXTURE.js: Added.\n(using.resource.Symbol.dispose):\n* JSTests/test262/test/language/statements/using/initializer-disposed-at-end-of-module.js: Added.\n(resource.Symbol.dispose):\n* JSTests/test262/test/staging/source-phase-imports/module-source-prototype-chain.js: Added.\n* JSTests/test262/test262-Revision.txt:\n\nCanonical link: https://commits.webkit.org/318774@main\n"
    },
    {
      "commit": "aa6c61fcb0020c75099f15ccbfaa14380fb55c89",
      "tree": "85502c0b10da21fd2e8f12d4096dfcee90392b19",
      "parents": [
        "4c31e5449bb9fda04fc539dfa87aa1e088e28a27"
      ],
      "author": {
        "name": "Carlos Alberto Lopez Perez",
        "email": "clopez@igalia.com",
        "time": "Fri Aug 07 10:34:44 2026"
      },
      "committer": {
        "name": "Carlos Alberto Lopez Perez",
        "email": "clopez@igalia.com",
        "time": "Fri Aug 07 10:34:44 2026"
      },
      "message": "[GTK][WPE][CMake] Do not allow to build with make, require ninja instead.\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d321266\n\nReviewed by Carlos Garcia Campos.\n\nCurrently for building GTK or WPE there are two ways: use the build-webkit script\nor use CMake directly. The build-webkit script is only intended for webkit\ndevelopers, for production releases or users of webkit the idea is to use cmake\ndirectly.\n\nThe problem is that we have a split on how WebKit is built. With build-webkit\nninja is used by default, but when using cmake directly it uses whatever cmake\ngenerator has as default (make usually) and that is causing issues because of\nbuild errors due to dependencies between targets, ninja has its own dependency\ngraph, but plain makefiles don\u0027t.\n\nAnd this causes issues when someone tries to use make because no one usually\ntests the make build.\n\nThis patch makes ninja mandatory for GTK and WPE ports and also changes the\nmake-dist script to use it.\n\n* Source/cmake/WebKitCommon.cmake:\n* Tools/Scripts/make-dist:\n(Distcheck.configure):\n(Distcheck.build):\n(Distcheck.install):\n\nCanonical link: https://commits.webkit.org/318773@main\n"
    },
    {
      "commit": "4c31e5449bb9fda04fc539dfa87aa1e088e28a27",
      "tree": "4e01b4920561163807cb66c1e949c555eb23d27d",
      "parents": [
        "1eb4c74604e953e73ab237cf0fca967e2cf9b188"
      ],
      "author": {
        "name": "Phinehas Fuachie",
        "email": "pfuachie2@apple.com",
        "time": "Fri Aug 07 08:52:57 2026"
      },
      "committer": {
        "name": "Phinehas Fuachie",
        "email": "phinehas133@gmail.com",
        "time": "Fri Aug 07 08:52:57 2026"
      },
      "message": "[Site Isolation] http/tests/site-isolation/iframe-reinsert-same-src-commits.html times out\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d321224\nrdar://184078411\n\nReviewed by Jer Noble.\n\nThe frame-commit behavior the test covers is unaffected; the test was too expensive to finish in\ntime. It created five cross-origin iframes and re-inserted all five, so a run performed ten\nsite-isolated commits and launched five WebContent processes. One frame covers the same path. The\nfallback timer was also installed after frame creation, so a failure before that point reported\nnothing at all.\n\nUse a single iframe, arm the fallback first, and log steps only on failure.\n\n* LayoutTests/http/tests/site-isolation/iframe-reinsert-same-src-commits-expected.txt:\n* LayoutTests/http/tests/site-isolation/iframe-reinsert-same-src-commits.html:\n\nCanonical link: https://commits.webkit.org/318772@main\n"
    },
    {
      "commit": "1eb4c74604e953e73ab237cf0fca967e2cf9b188",
      "tree": "ceb6c0231a21235074080a17e1b6daa174673c94",
      "parents": [
        "65b9c9315250f79b3f4f63a8833527fd5f73baaf"
      ],
      "author": {
        "name": "Abrar Rahman Protyasha",
        "email": "a_protyasha@apple.com",
        "time": "Fri Aug 07 07:54:49 2026"
      },
      "committer": {
        "name": "Abrar Rahman Protyasha",
        "email": "a_protyasha@apple.com",
        "time": "Fri Aug 07 07:54:49 2026"
      },
      "message": "[macOS] Support gesture event handling without a backing NSEvent\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d321223\nrdar://184273141\n\nReviewed by Richard Robinson.\n\nForthcoming changes will make it possible to synthesize work for\nViewGestureController without going through the NSResponder/NSEvent\nmachinery that drives it today. Since these paths will not have a\nbacking NSEvent, we introduce this refactor that undoes a couple of\nassumptions.\n\n1. We teach WebGestureEvent about the gesture phase. This field is\n   either populated by reading the `NSEvent.phase` property, or through\n   other means.\n2. We add a `Kind` enum to NativeWebGestureEvent, recording whether the\n   gesture is a magnification or a rotation.\n3. We make it possible to create a NativeWebGestureEvent instance from\n   either an NSEvent, or from an explicit initialization structure that\n   describes the gesture. In the latter case, we will store a null\n   native event field, inspired by precedent established in 303084@main.\n4. We pass around the entire NativeWebGestureEvent instance, rather than\n   its native event, in the gestureEventWasNotHandledByWebCore path.\n   This allows us to drive the namesake SPI when there is a backing\n   event, and go straight to ViewGestureController magnification if not.\n\nThe new initialization method has no callers yet, and as such this patch\ndoes not introduce a behavior change.\n\n* Source/WebKit/Shared/NativeWebGestureEvent.h:\n* Source/WebKit/Shared/WebEvent.serialization.in:\n* Source/WebKit/Shared/mac/NativeWebGestureEventMac.mm:\n(WebKit::webEventTypeForPhase):\n(WebKit::positionInView):\n(WebKit::initForEvent):\n(WebKit::NativeWebGestureEvent::create):\n(WebKit::NativeWebGestureEvent::NativeWebGestureEvent):\n(WebKit::webEventTypeForNSEvent): Deleted.\n(WebKit::pointForEvent): Deleted.\n* Source/WebKit/Shared/mac/WebGestureEvent.h:\n(WebKit::WebGestureEvent::WebGestureEvent):\n(WebKit::WebGestureEvent::phase const):\n* Source/WebKit/UIProcess/ViewGestureController.h:\n\nAlso drop PlatformMagnificationEvent, which has no remaining users now\nthat nothing in ViewGestureController takes an NSEvent directly.\n\n* Source/WebKit/UIProcess/mac/PageClientImplMac.mm:\n(WebKit::PageClientImpl::gestureEventWasNotHandledByWebCore):\n* Source/WebKit/UIProcess/mac/ViewGestureControllerMac.mm:\n(WebKit::ViewGestureController::gestureEventWasNotHandledByWebCore): Deleted.\n* Source/WebKit/UIProcess/mac/WebViewImpl.h:\n* Source/WebKit/UIProcess/mac/WebViewImpl.mm:\n(WebKit::WebViewImpl::gestureEventWasNotHandledByWebCore):\n(WebKit::WebViewImpl::gestureEventWasNotHandledByWebCoreFromViewOnly):\n(WebKit::WebViewImpl::magnificationGestureWasNotHandledByWebCoreFromViewOnly):\n\nCanonical link: https://commits.webkit.org/318771@main\n"
    },
    {
      "commit": "65b9c9315250f79b3f4f63a8833527fd5f73baaf",
      "tree": "6bb85902d64a1870411510e18f394d7959c72ce6",
      "parents": [
        "3ef900755534715b0197ad55cbc13deb977236a2"
      ],
      "author": {
        "name": "Carlos Garcia Campos",
        "email": "cgarcia@igalia.com",
        "time": "Fri Aug 07 07:15:22 2026"
      },
      "committer": {
        "name": "Carlos Garcia Campos",
        "email": "cgarcia@igalia.com",
        "time": "Fri Aug 07 07:15:22 2026"
      },
      "message": "[GTK][WPE] Disable UseDamagingInformationForCompositing by default\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d321254\n\nReviewed by Nikolas Zimmermann.\n\nIt caused regressions in compositing performance tests.\n\n* Source/WTF/Scripts/Preferences/UnifiedWebPreferences.yaml:\n\nCanonical link: https://commits.webkit.org/318770@main\n"
    },
    {
      "commit": "3ef900755534715b0197ad55cbc13deb977236a2",
      "tree": "5f530689274e4c33a5a05262db6e07fb9e2b16f3",
      "parents": [
        "3e31762de6b1e418d94bfc40abd088466c7d5c28"
      ],
      "author": {
        "name": "Nikolas Zimmermann",
        "email": "nzimmermann@igalia.com",
        "time": "Fri Aug 07 05:55:21 2026"
      },
      "committer": {
        "name": "Nikolas Zimmermann",
        "email": "zimmermann@kde.org",
        "time": "Fri Aug 07 05:55:21 2026"
      },
      "message": "REGRESSION(314540@main): When damage propagation is turned on, scrollbars are flickering\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d321211\n\nReviewed by Carlos Garcia Campos and Fujii Hironori.\n\nThe scrollbar buffer is cleared and painted from scratch on every update, so the\nregion that changes is the union of what the previous buffer painted and what\nthis one paints. 314540@main reported only the latter, so the frame that erases\nthe faded out overlay thumb propagated no damage and left the thumb on\nscreen.\n\nIt flickers rather than just leaving a stale thumb because an empty frame damage\nmakes ThreadedCompositor::recordFrameDamage() skip setFrameDamage() altogether,\nand that is also what accumulates the frame into every swap chain target. The\ntarget being composited still repaints the thumb region, since its own\naccumulated damage covers it, but the other targets never learn that region\nchanged and keep the old thumb. The thumb then comes and goes with the target\nthat happens to be current...\n\nThis is only visible on WPE since 318729@main turned damage propagation\non by default there -- GTK was already affected.\n\nThis gives up 314540@main\u0027s optimization. Restoring it needs the previous\nbuffer\u0027s painted area tracked across updates, which is not worth it.\n\n* Source/WebCore/page/scrolling/coordinated/ScrollerCoordinated.cpp:\n(WebCore::ScrollerCoordinated::updateValues):\n* Source/WebCore/platform/adwaita/AdwaitaScrollbarPainter.cpp:\n(WebCore::AdwaitaScrollbarPainter::paint):\n* Source/WebCore/platform/adwaita/AdwaitaScrollbarPainter.h:\n* Source/WebCore/platform/adwaita/ScrollerImpAdwaita.h:\n(WebCore::ScrollerImpAdwaita::paint):\n* Source/WebCore/platform/graphics/Damage.h:\n\nCanonical link: https://commits.webkit.org/318769@main\n"
    },
    {
      "commit": "3e31762de6b1e418d94bfc40abd088466c7d5c28",
      "tree": "e3101553b2377583ee23793b81932b021889ac43",
      "parents": [
        "f9278fbdddf165aeac989c670010b057d5407fb9"
      ],
      "author": {
        "name": "Anthony Tarbinian",
        "email": "a_tarbinian@apple.com",
        "time": "Fri Aug 07 05:13:30 2026"
      },
      "committer": {
        "name": "Sihui Liu",
        "email": "sihui_liu@apple.com",
        "time": "Fri Aug 07 05:13:30 2026"
      },
      "message": "[Site Isolation] Stale iframe layers are left hosted after a cross-process navigation\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d321009\nrdar://123701232\n\nReviewed by Sihui Liu.\n\nWith site isolation, the UIProcess is responsible for managing rendering layers which comes\nfrom frames in different processes. A web process will send the content that should be\nrendered in its iframe. Then, it\u0027s the UIProcess\u0027s job to put the rendered content in the\nright place on the screen.\n\nOn a process swap of an iframe, the UIProcess needs to receive the new content from the new\nweb process and replace the iframe\u0027s old content.\n\nThe bug is that the UIProcess only appends the iframe\u0027s new content without detaching the\niframe\u0027s old content.\n\nThis bug became visible when an iframe load is blocked by X-Frame-Options and DocumentLoader::loadErrorDocument()\ncommits an empty, transparent document. Then, the iframe\u0027s previous document\nis still visible while appearing unresponsive since the old web process isn\u0027t repainting\nthe stale layer anymore. Usually new content is opaque, which is why I suspect this wasn\u0027t\nnoticed before.\n\nThis patch updates RemoteLayerTreeHost::updateLayerTree to detach any existing layer before\nplacing the new layer.\n\nThe regression test page is blue with a 200x200 iframe. The iframe loads a\ncross-site red page from localhost, and that page then navigates itself to a URL\non web-platform.test that responds with X-Frame-Options: deny.\n\nA blank frame is transparent, so the whole page should end up blue. The reference file is\nthe same page with an \u003ciframe src\u003d\"about:blank\"\u003e instead of the real one. Without the fix\nthe iframe is stuck as red.\n\nTest: http/tests/site-isolation/draw-after-blocked-cross-origin-navigation.html\n\n* LayoutTests/http/tests/site-isolation/draw-after-blocked-cross-origin-navigation-expected.html: Added.\n* LayoutTests/http/tests/site-isolation/draw-after-blocked-cross-origin-navigation.html: Added.\n* LayoutTests/http/tests/site-isolation/resources/red-frame-navigating-to-x-frame-options-deny.html: Added.\n* Source/WebKit/UIProcess/RemoteLayerTree/RemoteLayerTreeHost.mm:\n(WebKit::RemoteLayerTreeHost::updateLayerTree):\n\nCanonical link: https://commits.webkit.org/318768@main\n"
    },
    {
      "commit": "f9278fbdddf165aeac989c670010b057d5407fb9",
      "tree": "6c5d0cf2aecc8892965b66cf210949c4b72a8bfa",
      "parents": [
        "f261a909c8d9b0b93313035017599dee5ee7090f"
      ],
      "author": {
        "name": "Chris Dumez",
        "email": "cdumez@apple.com",
        "time": "Fri Aug 07 04:36:28 2026"
      },
      "committer": {
        "name": "Chris Dumez",
        "email": "cdumez@apple.com",
        "time": "Fri Aug 07 04:36:28 2026"
      },
      "message": "Turn on the back/forward cache for all web-platform-tests\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d321061\n\nReviewed by Basuke Suzuki.\n\nTurn on the back/forward cache for all web-platform-tests, since they\nexpect it to be on. We use to turn it on on a per-folder basis but this\nis unnecessarily cumbersome.\n\nThis PR also rebaselines WPT tests that have different output now that they\nrun with the bfcache enabled.\n\n* Tools/TestRunnerShared/TestFeatures.cpp:\n(WTR::shouldUseBackForwardCache):\n* LayoutTests/imported/w3c/web-platform-tests/IndexedDB/back-forward-cache-open-connection.window-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/IndexedDB/back-forward-cache-open-transaction.window-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-view-transitions/navigation/old_vt_promises_bfcache-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/fs/FileSystemFileHandle-sync-access-handle-back-forward-cache.https.tentative.window-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/fs/FileSystemFileHandle-writable-file-stream-back-forward-cache.https.tentative.window-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/html/browsers/browsing-the-web/back-forward-cache/broadcastchannel/broadcastchannel.window-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/html/browsers/browsing-the-web/back-forward-cache/broadcastchannel/dedicatedworker.tentative.window-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/html/browsers/browsing-the-web/back-forward-cache/broadcastchannel/evict-on-message.tentative.window-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/html/browsers/browsing-the-web/back-forward-cache/eligibility/broadcast-channel-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/html/browsers/browsing-the-web/back-forward-cache/eligibility/dedicated-worker-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/html/browsers/browsing-the-web/back-forward-cache/eligibility/inflight-fetch-1-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/html/browsers/browsing-the-web/back-forward-cache/eligibility/inflight-fetch-2-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/html/browsers/browsing-the-web/back-forward-cache/eligibility/inflight-fetch-cors-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/html/browsers/browsing-the-web/back-forward-cache/eligibility/inflight-fetch-redirects-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/html/browsers/browsing-the-web/back-forward-cache/eligibility/shared-worker-active-client.window-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/html/browsers/browsing-the-web/back-forward-cache/eligibility/shared-worker-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/html/browsers/browsing-the-web/back-forward-cache/events-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/html/browsers/browsing-the-web/back-forward-cache/focus-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/html/browsers/browsing-the-web/back-forward-cache/pagehide-event-handler-microtasks.window-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/html/browsers/browsing-the-web/back-forward-cache/pushstate.https-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/html/browsers/browsing-the-web/back-forward-cache/service-worker-client-postmessage.https-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/html/browsers/browsing-the-web/back-forward-cache/service-worker-clients-claim.https-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/html/browsers/browsing-the-web/back-forward-cache/service-worker-clients-matchall.https-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/html/browsers/browsing-the-web/back-forward-cache/service-worker-controlled-after-restore.https-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/html/browsers/browsing-the-web/back-forward-cache/service-worker-unregister.https-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/html/browsers/browsing-the-web/back-forward-cache/storage-events-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/html/browsers/browsing-the-web/back-forward-cache/timers-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/embedded-content/bfcache/embedded-html-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/embedded-content/bfcache/embedded-img-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/embedded-content/bfcache/embedded-js-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/embedded-content/bfcache/embedded-mp4-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/embedded-content/bfcache/embedded-not-found-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/embedded-content/bfcache/embedded-type-only-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/web-locks/bfcache/abort.tentative.https-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/web-locks/bfcache/held.tentative.https-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/web-locks/bfcache/release-across-thread.tentative.https-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/web-locks/bfcache/release.tentative.https-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/web-locks/bfcache/sharedworker-multiple.tentative.https-expected.txt:\n\nCanonical link: https://commits.webkit.org/318767@main\n"
    },
    {
      "commit": "f261a909c8d9b0b93313035017599dee5ee7090f",
      "tree": "0b5eb719d38599f5124b24d65b9f376398171eae",
      "parents": [
        "95ffc89f5eb494d6b3918b7f6e98cc85bad52892"
      ],
      "author": {
        "name": "Lauro Moura",
        "email": "lmoura@igalia.com",
        "time": "Fri Aug 07 04:30:39 2026"
      },
      "committer": {
        "name": "Lauro Moura",
        "email": "lmoura@igalia.com",
        "time": "Fri Aug 07 04:30:39 2026"
      },
      "message": "[WebDriver][WPE] Gardening W32 2026 edition\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d321152\n\nUnreviewed test gardening.\n\nGardening the most persistent flakies.\n\n* WebDriverTests/TestExpectations.json:\n\nCanonical link: https://commits.webkit.org/318766@main\n"
    },
    {
      "commit": "95ffc89f5eb494d6b3918b7f6e98cc85bad52892",
      "tree": "66315f5237dadeeaf6bfad1a34dc3cfa9ae9976a",
      "parents": [
        "01ea2a8eb95530c8af1ba9596658bc3acbfefc9e"
      ],
      "author": {
        "name": "Sosuke Suzuki",
        "email": "sosuke@bun.sh",
        "time": "Fri Aug 07 04:04:07 2026"
      },
      "committer": {
        "name": "Sosuke Suzuki",
        "email": "sosuke@bun.com",
        "time": "Fri Aug 07 04:04:07 2026"
      },
      "message": "[JSC] `JSC_JIT_CAGE_PROBE{,_IMPL}` fallback macros in `JITOperationValidation.h` do not compile\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d321214\n\nReviewed by Keith Miller.\n\n318675@main added no-op fallbacks for JSC_JIT_CAGE_PROBE and\nJSC_JIT_CAGE_PROBE_IMPL for when \u003cWebKitAdditions/JITCageAdditions.h\u003e does not\nprovide them, but both had copy-paste mistakes:\n\n1. Both bodies were `(void)x` while the parameter is `v`, so any expansion\n   (LLIntData.cpp) fails with an undeclared identifier.\n2. The `#ifndef JSC_JIT_CAGE_PROBE_IMPL` block defined JSC_JIT_CAGE_PROBE\n   again instead of JSC_JIT_CAGE_PROBE_IMPL, leaving the latter with no\n   fallback (LLIntThunks.cpp) and redefining the former if the SDK header\n   only provides JSC_JIT_CAGE_PROBE.\n\nUse `(void)(v)` in both and define JSC_JIT_CAGE_PROBE_IMPL in the second block.\nNo behavior change for open-source builds since ENABLE(JIT_CAGE) is off there.\n\n* Source/JavaScriptCore/assembler/JITOperationValidation.h:\n\nCanonical link: https://commits.webkit.org/318765@main\n"
    },
    {
      "commit": "01ea2a8eb95530c8af1ba9596658bc3acbfefc9e",
      "tree": "ecff76e51aae0e5099e0726c71d1be8d840333b3",
      "parents": [
        "440598309f6d34f0b5cde3e5ef519df58fc97e5c"
      ],
      "author": {
        "name": "Sosuke Suzuki",
        "email": "sosuke@bun.sh",
        "time": "Fri Aug 07 03:59:05 2026"
      },
      "committer": {
        "name": "Sosuke Suzuki",
        "email": "sosuke@bun.com",
        "time": "Fri Aug 07 03:59:05 2026"
      },
      "message": "[JSC] `String#split` should not atomize the results of a non-atom subject\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d320966\n\nReviewed by Yusuke Suzuki.\n\nSplitting strings built at runtime (e.g. parsing CSV/log rows) is common, and such\nsubjects are not atom strings. stringSplitFast still atomized every identifier-like\nresult string and built an atom-strings array for them, even though the split cache\nonly accepts atom subjects, so the atomization was pure waste.\n\nOnly take the atomize-and-cache path when the subject is an atom, matching what\nregExpSplitFast already does. Non-atom subjects now produce plain substrings.\n\nWith this change, elements of the result array are no longer atom strings when the\nsubject is not an atom. That being a performance regression is not a common case; we\nconfirmed that no such case exists in JetStream.\n\n                                       base                    patched\n\nstring-split-non-atom-subject   156.1447+-4.6023     ^     41.2708+-0.7647        ^ definitely 3.7834x faster\n\nTest: JSTests/microbenchmarks/string-split-non-atom-subject.js\n\n* JSTests/microbenchmarks/string-split-non-atom-subject.js: Added.\n(parseRow):\n* Source/JavaScriptCore/runtime/StringPrototype.cpp:\n(JSC::stringSplitFast):\n\nCanonical link: https://commits.webkit.org/318764@main\n"
    },
    {
      "commit": "440598309f6d34f0b5cde3e5ef519df58fc97e5c",
      "tree": "e7cb7e3582f863265490b88edbb2a149c0d93615",
      "parents": [
        "c6bd8acdac1fdbc4f3836f5841a207e24cb2bc46"
      ],
      "author": {
        "name": "Sihui Liu",
        "email": "sihui_liu@apple.com",
        "time": "Fri Aug 07 03:35:21 2026"
      },
      "committer": {
        "name": "Sihui Liu",
        "email": "sihui_liu@apple.com",
        "time": "Fri Aug 07 03:35:21 2026"
      },
      "message": "[Site Isolation] First-party sites should not enter shared process\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d321033\nrdar://184066679\n\nReviewed by Ryosuke Niwa.\n\nSite Isolation\u0027s shared process mode puts multiple cross-site frames into one WebProcess for performance, trading away\nsome of the process-boundary protection between the co-located sites. 318135@main introduced IsolatedSiteStore to hold\nthe sites that must be kept out of that process, with autofill as the first signal. This patch adds two more signals for\nbetter coverage:\n- Signal::FirstPartyVisit is recorded in WebPageProxy::didCommitLoadForFrame when the commit is for the main frame, from\nthe committed request\u0027s URL, skipping about: and file: URLs. This is deliberately broad: it flags every site the user\nnavigated to at the top level, which might create first-party cookies.\n- Signal::FirstPartyUserGesture is recorded similar to where ITP records hadUserInteraction: in UserGestureIndicator\u0027s\nconstructor, and in EventHandler::keyEvent for a handled key event. Both recording sites are gated on\nProcessInteractionStyle::Immediate. Delayed defers recording to the caller, which records once it knows the event was\nhandled, and Never marks a gesture asserted programmatically rather than made by the user.\n\nRecording the two separately lets a future eviction policy drop the visited-only sites first, and lets us measure what\nnarrowing to gestures would cost before deciding to narrow.\n\nAPI tests: WKWebsiteDataStore.FirstPartyVisitMarksSiteAsIsolated\n           WKWebsiteDataStore.FirstPartyUserGestureInSubframeDoesNotMarkSubframeSite\n\n* Source/WebCore/dom/UserGestureIndicator.cpp:\n(WebCore::UserGestureIndicator::UserGestureIndicator):\n* Source/WebCore/page/ChromeClient.h:\n(WebCore::ChromeClient::didObserveFirstPartyUserGesture):\n* Source/WebCore/page/EventHandler.cpp:\n(WebCore::EventHandler::keyEvent):\n* Source/WebCore/page/Page.cpp:\n(WebCore::Page::didObserveFirstPartyUserGesture):\n* Source/WebCore/page/Page.h:\n* Source/WebKit/UIProcess/API/Cocoa/WKWebsiteDataStore.mm:\n(-[WKWebsiteDataStore _isolatedSiteSignalsForTesting:]):\n(-[WKWebsiteDataStore _isIsolatedSiteForTesting:]): Deleted.\n* Source/WebKit/UIProcess/API/Cocoa/WKWebsiteDataStorePrivate.h:\n* Source/WebKit/UIProcess/WebPageProxy.cpp:\n(WebKit::WebPageProxy::recordFirstPartyVisit):\n(WebKit::WebPageProxy::didCommitLoadForFrame):\n* Source/WebKit/UIProcess/WebPageProxy.h:\n* Source/WebKit/UIProcess/WebProcessProxy.cpp:\n(WebKit::WebProcessProxy::didObserveFirstPartyUserGesture):\n* Source/WebKit/UIProcess/WebProcessProxy.h:\n* Source/WebKit/UIProcess/WebProcessProxy.messages.in:\n* Source/WebKit/UIProcess/WebsiteData/IsolatedSiteStore.h:\n* Source/WebKit/UIProcess/WebsiteData/WebsiteDataStore.cpp:\n(WebKit::WebsiteDataStore::isolatedSiteSignalsForTesting const):\n(WebKit::WebsiteDataStore::isIsolatedSiteForTesting const): Deleted.\n* Source/WebKit/UIProcess/WebsiteData/WebsiteDataStore.h:\n* Source/WebKit/WebProcess/WebCoreSupport/WebChromeClient.cpp:\n(WebKit::WebChromeClient::didObserveFirstPartyUserGesture):\n* Source/WebKit/WebProcess/WebCoreSupport/WebChromeClient.h:\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolation.mm:\n(TestWebKitAPI::(SiteIsolation, SharedProcessAfterKeyDown)):\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/UserContentController.mm:\n(TEST(WKUserContentController, AutofillScriptingMarksSiteAsIsolated)):\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/WKWebsiteDatastore.mm:\n(TestWebKitAPI::(WKWebsiteDataStore, FirstPartyVisitMarksSiteAsIsolated)):\n(TestWebKitAPI::(WKWebsiteDataStore, FirstPartyUserGestureMarksSiteAsIsolated)):\n(TestWebKitAPI::(WKWebsiteDataStore, FirstPartyUserGestureInSubframeDoesNotMarkSubframeSite)):\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/ios/WKWebViewAutofillTests.mm:\n(TestWebKitAPI::TEST(WKWebViewAutoFillTests, AutofillMarksSiteAsIsolated)):\n\nCanonical link: https://commits.webkit.org/318763@main\n"
    },
    {
      "commit": "c6bd8acdac1fdbc4f3836f5841a207e24cb2bc46",
      "tree": "bb38fe9187f6ba6e70cc5885d49cf7324d43900b",
      "parents": [
        "906e60b3d82986684b7907e52b909c4a1e6982d8"
      ],
      "author": {
        "name": "Karl Dubost",
        "email": "karlcow@apple.com",
        "time": "Fri Aug 07 03:11:57 2026"
      },
      "committer": {
        "name": "Karl Dubost",
        "email": "karlcow@apple.com",
        "time": "Fri Aug 07 03:11:57 2026"
      },
      "message": "SVGSVGElement.currentScale is a no-op on non-document-root outermost \u003csvg\u003e\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d318096\nrdar://180889449\n\nReviewed by Nikolas Zimmermann.\n\ncurrentScale was implemented purely as the main frame\u0027s page zoom,\ngated on the \u003csvg\u003e being the document root (frameForCurrentScale() requires\ndocument().documentElement() \u003d\u003d this).\n\nAs a result, setting currentScale on an outermost \u003csvg\u003e embedded in HTML\n(inline, or inside a foreignObject) was silently discarded. The getter\nreturned 1, whereas SVG 2 (\"Interface SVGSVGElement\") only mandates that\nbehavior for non-outermost svg elements. Chrome and Firefox both\nround-trip the value; WebKit was the outlier.\n\nStore the assigned value in a new SVGSVGElement::m_currentScale member\nand return it for an outermost svg element that is not the document root.\nThe document root continues to map currentScale to page zoom, so its\nrendering is unchanged.\n\nAs with Gecko, the stored value is not reflected into rendering for\nnon-root outermost elements (only Blink does that; the existing\ncurrentScale-change-repaint.html reftest indicate that area is\nunderspecified), so this change is limited to the web-observable\ngetter/setter round-trip. We need more discussions in the SVG WG.\n\nTest: imported/w3c/web-platform-tests/svg/struct/scripted/currentScale-outermost.html\n\n* LayoutTests/imported/w3c/web-platform-tests/svg/struct/scripted/currentScale-outermost-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/struct/scripted/currentScale-outermost.html: Added.\n* Source/WebCore/svg/SVGSVGElement.cpp:\n(WebCore::SVGSVGElement::currentScale const):\n(WebCore::SVGSVGElement::setCurrentScale):\n* Source/WebCore/svg/SVGSVGElement.h:\n\nCanonical link: https://commits.webkit.org/318762@main\n"
    },
    {
      "commit": "906e60b3d82986684b7907e52b909c4a1e6982d8",
      "tree": "c3a09b9cb3c6827eb7ff8684ec6ca54dc558da32",
      "parents": [
        "b39e5174fda9493e7dcc1f25dae4dc8817baf1b4"
      ],
      "author": {
        "name": "Lauro Moura",
        "email": "lmoura@igalia.com",
        "time": "Fri Aug 07 02:34:45 2026"
      },
      "committer": {
        "name": "Lauro Moura",
        "email": "lmoura@igalia.com",
        "time": "Fri Aug 07 02:34:45 2026"
      },
      "message": "[WebDriver][Tools] Fix pytest_collection_modifyitems to support proper flaky expectations\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d321175\n\nReviewed by Carlos Alberto Lopez Perez.\n\nEnsure we check the whole expectation list when installing the pytest\nmarkers. Previously, only the first item was checked, effectively\nignoring flaky expectations, which have multiple expected outcomes.\n\nAs pytest has no natural flaky test marker, flakies are marked as xfail,\nwhich, in the case of a pass, currently are reported as XPASS. To avoid\npolluting the final report and hiding true XPASS cases, we also report\nthe flaky passes as regular PASS in the outer harness and resulting\njson. The same approach is used for FAIL/TIMEOUT, to avoid the empty\nxfail to mark an expected flaky timeout as a true timeout.\n\n* Tools/Scripts/webkitpy/webdriver_tests/pytest_runner.py:\n(SubtestResultRecorder.record_pass):\n(TestExpectationsMarker.pytest_collection_modifyitems):\n\nCanonical link: https://commits.webkit.org/318761@main\n"
    }
  ],
  "next": "b39e5174fda9493e7dcc1f25dae4dc8817baf1b4"
}