Upgrade to upstream WebKit 0e86b49069a5#280
Open
robobun wants to merge 842 commits into
Open
Conversation
https://bugs.webkit.org/show_bug.cgi?id=318809 Reviewed by Aakash Jain. This will allow pages on those servers to consume the buildbot API directly. * Tools/CISupport/build-webkit-org-webserver/master.cfg: * Tools/CISupport/ews-build-webserver/master.cfg: Canonical link: https://commits.webkit.org/316707@main
https://bugs.webkit.org/show_bug.cgi?id=318770 Reviewed by Jean-Yves Avenard. We remove those files as they are no longer needed. * Source/WebCore/Headers.cmake: * Source/WebCore/Modules/mediastream/SFrameUtils.cpp: Removed. * Source/WebCore/Modules/mediastream/SFrameUtils.h: Removed. * Source/WebCore/Sources.txt: * Source/WebCore/WebCore.xcodeproj/project.pbxproj: Canonical link: https://commits.webkit.org/316708@main
…tion, high contrast, and dark theme) https://bugs.webkit.org/show_bug.cgi?id=317488 Reviewed by Carlos Garcia Campos. GNOME 50 has a new reduced motion setting, separate from GTK's disable animations setting. We currently have the disable animations setting hooked up to the prefers-reduced-motion CSS media query. Let's stop using that, and use the new reduced motion setting instead. For good measure, I've also created a new WPE API setting matching the new name, and removed the older one (because the WPEPlatform API is not stable yet). I had been planning to stop there, but then I noticed that we have the prefers-contrast media query implemented only for GTK 3. I have implemented it for GTK 4 as well. This required some effort, because WebKit has it implemented as a boolean value, but GNOME and CSS both use a tri-state, so I had to change a bunch of places to expose it as a tri-state. I've also created a new WPE setting for this as well. I considered updating Internals so that I could expose the tri-state to layout tests as well, but it currently uses ForcedAccessibilityValue which is a boolean, and I decided not to try changing this. Finally, I've improved the implementation of the prefers-color-scheme media query for GTK 4. This is an especially significant change because it previously did not respect the user's dark mode preference at all. Now a bunch of websites will become dark. This is my second attempt to land the change. The first attempt, 316627@main, was reverted because it broke the WPE build. * Source/WebCore/css/query/MediaQueryFeatures.cpp: (WebCore::MQ::Features::prefersContrastFeatureSchema): * Source/WebCore/inspector/agents/InspectorPageAgent.cpp: (WebCore::InspectorPageAgent::defaultUserPreferencesDidChange): * Source/WebCore/platform/Theme.h: (WebCore::Theme::userPreferredContrast const): (WebCore::Theme::userPrefersContrast const): Deleted. * Source/WebCore/platform/adwaita/ThemeAdwaita.cpp: (WebCore::ThemeAdwaita::ThemeAdwaita): (WebCore::ThemeAdwaita::refreshSettings): (WebCore::ThemeAdwaita::userPreferredContrast const): (WebCore::ThemeAdwaita::userPrefersContrast const): Deleted. * Source/WebCore/platform/adwaita/ThemeAdwaita.h: * Source/WebCore/platform/glib/SystemSettings.cpp: (WebCore::SystemSettings::updateSettings): * Source/WebCore/platform/glib/SystemSettings.h: (WebCore::SystemSettings::reducedMotion const): (WebCore::SystemSettings::interfaceContrast const): (WebCore::SystemSettings::enableAnimations const): Deleted. * Source/WebCore/platform/ios/ThemeIOS.h: * Source/WebCore/platform/ios/ThemeIOS.mm: (WebCore::ThemeIOS::userPreferredContrast const): (WebCore::ThemeIOS::userPrefersContrast const): Deleted. * Source/WebCore/platform/mac/ThemeMac.h: * Source/WebCore/platform/mac/ThemeMac.mm: (WebCore::ThemeMac::userPreferredContrast const): (WebCore::ThemeMac::userPrefersContrast const): Deleted. * Source/WebCore/rendering/cocoa/RenderThemeCocoa.mm: (WebCore::switchTrackColor): (WebCore::paintSwitchTrackOnOffLabels): (WebCore::paintLiquidGlassSwitchTrackOnOffLabels): (WebCore::renderThemePaintLiquidGlassSwitchThumb): (WebCore::renderThemePaintLiquidGlassSwitchTrack): (WebCore::RenderThemeCocoa::paintCheckboxForVectorBasedControls): (WebCore::RenderThemeCocoa::paintRadioForVectorBasedControls): (WebCore::RenderThemeCocoa::paintButtonForVectorBasedControls): (WebCore::RenderThemeCocoa::paintColorWellForVectorBasedControls): (WebCore::RenderThemeCocoa::paintInnerSpinButtonForVectorBasedControls): (WebCore::paintTextAreaOrTextField): (WebCore::RenderThemeCocoa::paintMeterForVectorBasedControls): (WebCore::RenderThemeCocoa::paintListButtonForVectorBasedControls): (WebCore::RenderThemeCocoa::paintSliderThumbForVectorBasedControls): (WebCore::RenderThemeCocoa::paintSearchFieldForVectorBasedControls): (WebCore::RenderThemeCocoa::paintSearchFieldCancelButtonForVectorBasedControls): (WebCore::RenderThemeCocoa::paintSearchFieldDecorationPartForVectorBasedControls): (WebCore::RenderThemeCocoa::paintPlatformResizerForVectorBasedControls): * Source/WebKit/Shared/glib/SystemSettings.serialization.in: * Source/WebKit/UIProcess/glib/SystemSettingsManagerProxy.cpp: (WebKit::SystemSettingsManagerProxy::reducedMotion const): (WebKit::SystemSettingsManagerProxy::interfaceContrast const): (WebKit::SystemSettingsManagerProxy::settingsDidChange): (WebKit::SystemSettingsManagerProxy::enableAnimations const): Deleted. * Source/WebKit/UIProcess/glib/SystemSettingsManagerProxy.h: * Source/WebKit/UIProcess/gtk/SystemSettingsManagerProxyGtk.cpp: (WebKit::SystemSettingsManagerProxy::darkMode const): (WebKit::SystemSettingsManagerProxy::reducedMotion const): (WebKit::SystemSettingsManagerProxy::interfaceContrast const): (WebKit::SystemSettingsManagerProxy::enableAnimations const): Deleted. * Source/WebKit/UIProcess/wpe/SystemSettingsManagerProxyWPE.cpp: (WebKit::SystemSettingsManagerProxy::reducedMotion const): (WebKit::SystemSettingsManagerProxy::interfaceContrast const): (WebKit::SystemSettingsManagerProxy::enableAnimations const): Deleted. * Source/WebKit/WPEPlatform/wpe/WPESettings.cpp: (_WPESettingsPrivate::_WPESettingsPrivate): * Source/WebKit/WPEPlatform/wpe/WPESettings.h: Canonical link: https://commits.webkit.org/316709@main
https://bugs.webkit.org/show_bug.cgi?id=318858 rdar://181691670 Reviewed by Anne van Kesteren. Before we add support for the properties in the animation-triggers spec [0], we need a runtime flag to guard this new feature. [0] https://drafts.csswg.org/animation-triggers-1/ * Source/WTF/Scripts/Preferences/UnifiedWebPreferences.yaml: Canonical link: https://commits.webkit.org/316710@main
…t phases https://bugs.webkit.org/show_bug.cgi?id=318338 Reviewed by Antti Koivisto. performFlexLayout was one long function that interleaved collecting the flex items, laying out each flex line, recording the first/last line item counts, and finalizing the container height. That made the top-level flow hard to follow next to the modern FlexLayout::layout, which reads as a sequence of named steps. Move the item collection, the per-line layout loop, the first/last line item count bookkeeping, and the empty-line minimum height into named helpers so performFlexLayout reads as a short sequence of phases. numLines is replaced by lineStates.size(), and the two identical hasLineIfEmpty minimum-height blocks are unified. No behavior change. * Source/WebCore/rendering/RenderFlexibleBox.cpp: (WebCore::RenderFlexibleBox::performFlexLayout): (WebCore::RenderFlexibleBox::collectFlexItems): (WebCore::RenderFlexibleBox::layoutFlexLines): (WebCore::RenderFlexibleBox::setFlexItemCountsForFirstAndLastLine): (WebCore::RenderFlexibleBox::adjustLogicalHeightForLineIfEmpty): * Source/WebCore/rendering/RenderFlexibleBox.h: Canonical link: https://commits.webkit.org/316711@main
… should return the topmost hit layer's region types https://bugs.webkit.org/show_bug.cgi?id=318783 Reviewed by Fujii Hironori. In the findEventListenerRegionTypes, we iterate the children in top-down to match the hit testing order. Test: tiled-drawing/scrolling/wheel-event-listener-region-overlapping-composited-layers.html * LayoutTests/tiled-drawing/scrolling/wheel-event-listener-region-overlapping-composited-layers-expected.txt: Added. * LayoutTests/tiled-drawing/scrolling/wheel-event-listener-region-overlapping-composited-layers.html: Added. * Source/WebCore/page/scrolling/coordinated/ScrollingTreeCoordinated.cpp: (WebCore::findEventListenerRegionTypes): Modified to reverse the iteration order. Canonical link: https://commits.webkit.org/316712@main
…allbacks https://bugs.webkit.org/show_bug.cgi?id=315736 Reviewed by Carlos Garcia Campos and BJ Burg. Currently, the waitForNavigationToComplete callbacks access WebDriverService::m_session directly, although this member could be null if the callback arrives after we started to delete or to replace the session. This commit protects the session instance in these callbacks, as just adding a null check would leave the door open for the callback to be called on an already replaced session. This creates a temporary cycle between the Session, the callback, and the SessionHost (who stashes the pending requests), but the cycle is broken when either the session is closed or the browser disconnects, flushing the pending requests. * Source/WebDriver/WebDriverService.cpp: (WebDriver::WebDriverService::go): (WebDriver::WebDriverService::getCurrentURL): (WebDriver::WebDriverService::back): (WebDriver::WebDriverService::forward): (WebDriver::WebDriverService::refresh): (WebDriver::WebDriverService::getTitle): (WebDriver::WebDriverService::closeWindow): (WebDriver::WebDriverService::switchToFrame): (WebDriver::WebDriverService::switchToParentFrame): (WebDriver::WebDriverService::findElement): (WebDriver::WebDriverService::findElements): (WebDriver::WebDriverService::getActiveElement): (WebDriver::WebDriverService::executeScript): (WebDriver::WebDriverService::executeAsyncScript): (WebDriver::WebDriverService::getAllCookies): (WebDriver::WebDriverService::getNamedCookie): (WebDriver::WebDriverService::addCookie): (WebDriver::WebDriverService::deleteCookie): (WebDriver::WebDriverService::deleteAllCookies): (WebDriver::WebDriverService::dismissAlert): (WebDriver::WebDriverService::acceptAlert): (WebDriver::WebDriverService::getAlertText): (WebDriver::WebDriverService::sendAlertText): (WebDriver::WebDriverService::takeScreenshot): (WebDriver::WebDriverService::takeElementScreenshot): Canonical link: https://commits.webkit.org/316713@main
…action.mm https://bugs.webkit.org/show_bug.cgi?id=318724 rdar://181530252 Reviewed by Abrar Rahman Protyasha and Richard Robinson. Move text-extraction-related code out of `WKWebView.mm`, and into a separate category (and submodule), `WKWebView+TextExtraction.mm`. * Source/WebKit/SourcesCocoa.txt: * Source/WebKit/UIProcess/API/Cocoa/WKWebView+TextExtraction.mm: Added. (-[WKWebView _simulateClickOverFirstMatchingTextInViewportWithUserInteraction:completionHandler:]): (-[WKWebView _takeSnapshotOfNode:completionHandler:]): (-[WKWebView _getSelectorPathDataForNode:completionHandler:]): (-[WKWebView _getSelectorPathData:completionHandler:]): (-[WKWebView _getNodeForSelectorPathData:completionHandler:]): (extractReplacementStrings): (textExtractionOutputFormat): (createEmptyTextExtractionResult): (-[WKWebView _ensureTextExtractionFilterRulesWithCompletionHandler:]): (-[WKWebView _extractDebugTextWithConfigurationWithoutUpdatingFilterRules:assertionScope:completionHandler:]): (-[WKWebView _convertToWebCoreInteraction:nodeIdentifier:]): (nameForAction): (-[WKWebView _performInteraction:inFrame:actionType:nodeIdentifier:staleNodeNote:shouldResolveStaleNodeIdentifier:completionHandler:]): (-[WKWebView _filterExtractedStringWithoutUpdatingFilterRules:options:completionHandler:]): (extractHandleIdentifiersOfNodesToSkip): (extractClientNodeAttributes): (coreEventListenerCategories): (coreDataDetectorTypes): (-[WKWebView _requestTextExtractionInternal:completion:]): (-[WKWebView _requestTextExtraction:completionHandler:]): (-[WKWebView _describeInteraction:completionHandler:]): (-[WKWebView _describeInteraction:inFrame:nodeIdentifier:staleNodeNote:shouldResolveStaleNodeIdentifier:completionHandler:]): (-[WKWebView _textExtractionIdentifier]): (-[WKWebView _validateText:inFrame:inNode:completionHandler:]): (-[WKWebView _clearTextExtractionFilterCache]): (-[WKWebView _requestJSHandleForNodeIdentifier:searchText:completionHandler:]): (-[WKWebView _requestContainerJSHandleForNodeIdentifier:searchText:completionHandler:]): (-[WKWebView _requestContainerJSHandleForSearchTexts:nodeIdentifier:completionHandler:]): * Source/WebKit/UIProcess/API/Cocoa/WKWebView.mm: (WebKit::jsHandleIdentifierInFrame): (-[WKWebView willBeginWritingToolsSession:forProofreadingReview:requestContexts:]): (-[WKWebView _refreshControlVisibleHeight]): (jsHandleIdentifierInFrame): Deleted. (-[WKWebView _simulateClickOverFirstMatchingTextInViewportWithUserInteraction:completionHandler:]): Deleted. (-[WKWebView _takeSnapshotOfNode:completionHandler:]): Deleted. (extractReplacementStrings): Deleted. (textExtractionOutputFormat): Deleted. (-[WKWebView _ensureTextExtractionFilterRulesWithCompletionHandler:]): Deleted. (-[WKWebView _extractDebugTextWithConfigurationWithoutUpdatingFilterRules:assertionScope:completionHandler:]): Deleted. (-[WKWebView _convertToWebCoreInteraction:nodeIdentifier:]): Deleted. (-[WKWebView _performInteraction:inFrame:actionType:nodeIdentifier:staleNodeNote:shouldResolveStaleNodeIdentifier:completionHandler:]): Deleted. (-[WKWebView _getSelectorPathDataForNode:completionHandler:]): Deleted. (-[WKWebView _getSelectorPathData:completionHandler:]): Deleted. (-[WKWebView _getNodeForSelectorPathData:completionHandler:]): Deleted. (-[WKWebView _filterExtractedStringWithoutUpdatingFilterRules:options:completionHandler:]): Deleted. (extractHandleIdentifiersOfNodesToSkip): Deleted. (extractClientNodeAttributes): Deleted. (coreEventListenerCategories): Deleted. (coreDataDetectorTypes): Deleted. (-[WKWebView _requestTextExtractionInternal:completion:]): Deleted. (-[WKWebView _requestTextExtraction:completionHandler:]): Deleted. (-[WKWebView _describeInteraction:completionHandler:]): Deleted. (-[WKWebView _describeInteraction:inFrame:nodeIdentifier:staleNodeNote:shouldResolveStaleNodeIdentifier:completionHandler:]): Deleted. (-[WKWebView _textExtractionIdentifier]): Deleted. (-[WKWebView _validateText:inFrame:inNode:completionHandler:]): Deleted. (-[WKWebView _clearTextExtractionFilterCache]): Deleted. (-[WKWebView _requestJSHandleForNodeIdentifier:searchText:completionHandler:]): Deleted. (-[WKWebView _requestContainerJSHandleForNodeIdentifier:searchText:completionHandler:]): Deleted. (-[WKWebView _requestContainerJSHandleForSearchTexts:nodeIdentifier:completionHandler:]): Deleted. * Source/WebKit/UIProcess/API/Cocoa/WKWebViewInternal.h: * Source/WebKit/UIProcess/API/Cocoa/WKWebViewPrivate.h: * Source/WebKit/WebKit.xcodeproj/project.pbxproj: Canonical link: https://commits.webkit.org/316714@main
…iOS devices with wide-gamut displays https://bugs.webkit.org/show_bug.cgi?id=318764 rdar://181625143 Reviewed by Alan Baradlay. Partial revert of 310012@main for iOS; using extended sRGB for VT buffers results in darkened results on iOS hardware only. Not testable because it only affects iOS hardware with extended range displays. * Source/WebCore/dom/ViewTransition.cpp: Canonical link: https://commits.webkit.org/316715@main
https://bugs.webkit.org/show_bug.cgi?id=318369 Reviewed by Carlos Garcia Campos. With WEBKIT_SKIA_USE_VIVANTE_SUPER_TILED_TILE_TEXTURES=1 on Vivante GPUs, super-tiled tile buffers are allocated padded up to 64-pixel multiples, so BitmapTexture::allocatedSize() exceeds the logical size(). SkiaBackingStore built the borrowed GL image from size() and sampled it using the image's own dimensions, so Skia's normalized u=1.0/v=1.0 mapped to the padded edge of the physical texture rather than the logical edge. The content was stretched and the garbage padding columns/rows bled in, producing the observed glitches. The TextureMapper compositor avoids this with its uvMax clamp - the Skia path had no equivalent (linear tiles are unaffected since allocatedSize == size). Describe the borrowed image at the physical allocatedSize() and restrict sampling to the logical region via the new Tile::imageSourceRect(), mirroring the uvMax clamp. The accelerated display-list path is unchanged as its surface snapshot is already sized to the logical tile. * Source/WebCore/platform/graphics/skia/SkiaBackingStore.cpp: (WebCore::SkiaBackingStore::paintToCanvas): (WebCore::SkiaBackingStore::buildImageSet const): (WebCore::SkiaBackingStore::Tile::image const): (WebCore::SkiaBackingStore::Tile::imageSourceRect const): * Source/WebCore/platform/graphics/skia/SkiaBackingStore.h: Canonical link: https://commits.webkit.org/316716@main
…tion-trigger` https://bugs.webkit.org/show_bug.cgi?id=318857 rdar://181691667 Reviewed by Anne van Kesteren. Before we start work on the properties in the animation-triggers [0] spec, we need to update our WPT snapshot to establish a baseline. Upstream commit: web-platform-tests/wpt@48fb658 [0] https://drafts.csswg.org/animation-triggers-1 * LayoutTests/imported/w3c/web-platform-tests/scroll-animations/animation-trigger/animation-trigger-addAnimation.tentative.html: * LayoutTests/imported/w3c/web-platform-tests/scroll-animations/animation-trigger/animation-trigger-disarmed-by-apis.tentative.html: * LayoutTests/imported/w3c/web-platform-tests/scroll-animations/animation-trigger/animation-trigger-fill-mode-both-ref.html: * LayoutTests/imported/w3c/web-platform-tests/scroll-animations/animation-trigger/animation-trigger-fill-mode-both.tentative-expected.html: * LayoutTests/imported/w3c/web-platform-tests/scroll-animations/animation-trigger/animation-trigger-fill-mode-both.tentative.html: * LayoutTests/imported/w3c/web-platform-tests/scroll-animations/animation-trigger/animation-trigger-fill-mode-none.tentative.html: * LayoutTests/imported/w3c/web-platform-tests/scroll-animations/animation-trigger/animation-trigger-multiple-triggers.tentative.html: * LayoutTests/imported/w3c/web-platform-tests/scroll-animations/animation-trigger/animation-trigger-play.tentative-expected.txt: * LayoutTests/imported/w3c/web-platform-tests/scroll-animations/animation-trigger/animation-trigger-play.tentative.html: * LayoutTests/imported/w3c/web-platform-tests/scroll-animations/animation-trigger/animation-trigger-replay.tentative.html: * LayoutTests/imported/w3c/web-platform-tests/scroll-animations/animation-trigger/trigger-scope-add.tentative.html: Canonical link: https://commits.webkit.org/316717@main
https://bugs.webkit.org/show_bug.cgi?id=318866 It broke internal builds Reverted changeset: "Remove SFrameUtils.h/.cpp" https://bugs.webkit.org/show_bug.cgi?id=318770 https://commits.webkit.org/316708@main Canonical link: https://commits.webkit.org/316718@main
https://bugs.webkit.org/show_bug.cgi?id=318736 rdar://181517699 Unreviewed. Reverts 316303@main and 316394@main. * LayoutTests/fast/mediastream/audio-session-active-when-capture-starts-and-stops-expected.txt: Removed. * LayoutTests/fast/mediastream/audio-session-active-when-capture-starts-and-stops.html: Removed. * LayoutTests/fast/mediastream/audio-session-stays-active-during-capture-expected.txt: Removed. * LayoutTests/fast/mediastream/audio-session-stays-active-during-capture.html: Removed. * LayoutTests/fast/mediastream/audio-session-stays-active-when-removing-session-during-capture-expected.txt: Removed. * LayoutTests/fast/mediastream/audio-session-stays-active-when-removing-session-during-capture.html: Removed. * LayoutTests/media/picture-in-picture/video-playback-system-interruption-and-resume-expected.txt: * LayoutTests/media/picture-in-picture/video-playback-system-interruption-and-resume.html: * LayoutTests/media/video-currenttime-monotonic.html: * LayoutTests/media/video-seek-after-end-play-expected.txt: * LayoutTests/platform/glib/TestExpectations: * LayoutTests/platform/glib/media/video-seek-after-end-play-expected.txt: Removed. * LayoutTests/platform/mac-site-isolation/TestExpectations: * Source/WTF/Scripts/Preferences/UnifiedWebPreferences.yaml: * Source/WebCore/Modules/audiosession/DOMAudioSession.cpp: (WebCore::DOMAudioSession::scheduleStateChangeEvent): * Source/WebCore/Modules/mediasession/MediaSession.cpp: (WebCore::MediaSession::updateCaptureState): * Source/WebCore/Modules/mediastream/MediaStreamTrack.cpp: (WebCore::MediaStreamTrack::trackMutedChanged): (WebCore::MediaStreamTrack::isCapturingAudio const): (WebCore::MediaStreamTrack::wantsToCaptureAudio const): * Source/WebCore/Modules/mediastream/UserMediaRequest.cpp: (WebCore::UserMediaRequest::allow): * Source/WebCore/Modules/webaudio/AudioContext.cpp: (WebCore::AudioContext::close): (WebCore::AudioContext::suspendRendering): (WebCore::AudioContext::resumeRendering): (WebCore::AudioContext::startRendering): (WebCore::AudioContext::lazyInitialize): (WebCore::AudioContext::mayResumePlayback): (WebCore::AudioContext::suspendPlayback): * Source/WebCore/Modules/webaudio/BaseAudioContext.h: (WebCore::BaseAudioContext::isClosed const): (WebCore::BaseAudioContext::isRunning const): Deleted. * Source/WebCore/html/HTMLMediaElement.cpp: (WebCore::HTMLMediaElement::load): (WebCore::HTMLMediaElement::prepareForLoad): (WebCore::HTMLMediaElement::selectMediaResource): (WebCore::HTMLMediaElement::completePlayInternal): (WebCore::HTMLMediaElement::playInternal): (WebCore::HTMLMediaElement::pauseInternal): * Source/WebCore/html/HTMLMediaElement.h: * Source/WebCore/platform/LogMessages.in: * Source/WebCore/platform/audio/AudioSession.cpp: (WebCore::AudioSession::tryToSetActive): (WebCore::AudioSession::tryToSetActiveInternal): * Source/WebCore/platform/audio/AudioSession.h: * Source/WebCore/platform/audio/MediaSessionManagerInterface.cpp: (WebCore::MediaSessionManagerInterface::processWillSuspend): (WebCore::MediaSessionManagerInterface::sessionWillBeginPlayback): (WebCore::MediaSessionManagerInterface::audioCaptureSourceStateChanged): (WebCore::MediaSessionManagerInterface::removeSession): (WebCore::MediaSessionManagerInterface::maybeDeactivateAudioSession): (WebCore::MediaSessionManagerInterface::maybeActivateAudioSession): (WebCore::MediaSessionManagerInterface::enforceConcurrentPlaybackRestriction): Deleted. * Source/WebCore/platform/audio/MediaSessionManagerInterface.h: * Source/WebCore/platform/audio/PlatformMediaSession.cpp: (WebCore::PlatformMediaSession::clientWillBeginPlayback): (WebCore::PlatformMediaSession::processClientWillPausePlayback): (WebCore::PlatformMediaSession::canProduceAudioChanged): * Source/WebCore/platform/audio/cocoa/AudioSessionCocoa.h: * Source/WebCore/platform/audio/cocoa/AudioSessionCocoa.mm: (WebCore::AudioSessionCocoa::tryToSetActiveInternal): * Source/WebCore/testing/Internals.cpp: (WebCore::Internals::resetToConsistentState): * Source/WebKit/GPUProcess/media/RemoteAudioSessionProxy.cpp: (WebKit::RemoteAudioSessionProxy::tryToSetActive): (WebKit::RemoteAudioSessionProxy::tryToSetActiveSync): Deleted. * Source/WebKit/GPUProcess/media/RemoteAudioSessionProxy.h: * Source/WebKit/GPUProcess/media/RemoteAudioSessionProxy.messages.in: * Source/WebKit/GPUProcess/media/RemoteAudioSessionProxyManager.cpp: (WebKit::RemoteAudioSessionProxyManager::tryToSetActiveForProcess): * Source/WebKit/GPUProcess/media/RemoteAudioSessionProxyManager.h: * Source/WebKit/GPUProcess/webrtc/UserMediaCaptureManagerProxy.cpp: * Source/WebKit/UIProcess/Media/RemoteMediaSessionManagerProxy.cpp: (WebKit::RemoteMediaSessionManagerProxy::tryToSetActiveInternal): * Source/WebKit/UIProcess/Media/RemoteMediaSessionManagerProxy.h: * Source/WebKit/WebProcess/GPU/media/RemoteAudioSession.cpp: (WebKit::RemoteAudioSession::tryToSetActiveInternal): (WebKit::RemoteAudioSession::sendNextActivationIPC): Deleted. * Source/WebKit/WebProcess/GPU/media/RemoteAudioSession.h: * Source/WebKit/WebProcess/Media/RemoteMediaSessionManager.cpp: (WebKit::RemoteMediaSessionManager::tryToSetAudioSessionActive): * Tools/TestWebKitAPI/Tests/WebKit/WKWebView/MediaSession.mm: (TestWebKitAPI::MediaSessionTest::loadPageAndBecomeNowPlaying): Canonical link: https://commits.webkit.org/316719@main
https://bugs.webkit.org/show_bug.cgi?id=311427 Reviewed by Michael Catanzaro. Check that the accessible has a child before accessing it. * LayoutTests/accessibility/gtk/text-attribute-empty-li-expected.txt: Added. * LayoutTests/accessibility/gtk/text-attribute-empty-li.html: Added. * Source/WebCore/accessibility/atspi/AccessibilityObjectTextAtspi.cpp: (WebCore::AccessibilityObjectAtspi::textAttributes const): Canonical link: https://commits.webkit.org/316720@main
* LayoutTests/platform/win/TestExpectations: Canonical link: https://commits.webkit.org/316721@main
https://bugs.webkit.org/show_bug.cgi?id=318730 rdar://181533057 Reviewed by Simon Fraser. Implement the CSS Borders Level 4 'corner-shape' property for the bevel (superellipse parameter s = 0), per https://drafts.csswg.org/css-borders-4/#corner-shaping. A box with 'corner-shape: bevel' and a border-radius now renders its border, background, and outline with beveled corners instead of round. Passes tests written in another commit * LayoutTests/TestExpectations: * Source/WebCore/platform/graphics/CornerShapeUtilities.cpp: * Source/WebCore/platform/graphics/FloatSize.h: (WebCore::FloatSize::directionScaledBy const): Canonical link: https://commits.webkit.org/316722@main
…e boundary https://bugs.webkit.org/show_bug.cgi?id=318620 rdar://181414022 Reviewed by Joshua Hoffman. Based on a patch originally started by Tyler. Each frame has its own AXObjectCache and isolated tree, and only the focused frame's own cache handles its focus change, so an ancestor tree (including the main frame's, which VoiceOver queries) was never pointed at a focused descendant local frame. Point each ancestor local frame's isolated-tree focused object at the AXLocalFrame leading toward the focused subframe (focusedObjectForLocalFrame / localFrameLeadingToFocusedFrame / updateAncestorFramesFocusedObject), and have AXIsolatedObject::focusedUIElementInAnyLocalFrame() descend that chain to the real focused element. Test: accessibility/mac/local-frame-focused-text-input.html * LayoutTests/accessibility/mac/local-frame-focused-text-input-expected.txt: Added. * LayoutTests/accessibility/mac/local-frame-focused-text-input.html: Added. * LayoutTests/accessibility/resources/local-frame-text-input.html: Added. * Source/WebCore/accessibility/AXObjectCache.cpp: (WebCore::AXObjectCache::focusedObjectForLocalFrame): (WebCore::AXObjectCache::localFrameLeadingToFocusedFrame): (WebCore::AXObjectCache::updateAncestorFramesFocusedObject): (WebCore::AXObjectCache::handleFocusedUIElementChanged): * Source/WebCore/accessibility/AXObjectCache.h: * Source/WebCore/accessibility/AccessibilityScrollView.h: * Source/WebCore/accessibility/isolatedtree/AXIsolatedObject.cpp: (WebCore::AXIsolatedObject::focusedUIElementInAnyLocalFrame const): * Source/WebCore/accessibility/isolatedtree/AXIsolatedObject.h: Canonical link: https://commits.webkit.org/316723@main
…BlockingScope https://bugs.webkit.org/show_bug.cgi?id=316687 rdar://179141754 Reviewed by Mark Lam. Worker threads blocked in Atomics.wait/memory.atomic.wait or WebCore synchronous operations (SubtleCrypto, IndexedDB, WebSocket, FileSystem, Notification) previously polled NeedStopTheWorld every 50ms to cooperate with the WASM debugger's Stop-The-World protocol. Replace with VMBlockingScope RAII: entering a blocking op increments m_numberOfBlockedVMs, making the STW trigger (stopped + blocked == active) fire without polling. On unblock, the VM atomically transitions to the stopped counter and proceeds through normal STW participation. Design assumption: the main thread VM is never OS-blocked while entered, ensuring m_numberOfStoppedVMs > 0 when the condition fires so a VM is always available to service the callback. Tests: * JSTests/wasm/debugger/tests/tests.py: (MemoryAtomicWaitTestCase.execute): (MemoryAtomicWaitNoTimeoutTestCase.execute): Canonical link: https://commits.webkit.org/316724@main
…C++ interoperability <https://bugs.webkit.org/show_bug.cgi?id=318801> <rdar://181623908> Reviewed by Adrian Taylor. A newer version of Apple's Swift C++ interoperability importer fails to synthesize a `bool` conversion for a class that inherits `explicit operator bool` from a dependent template base, so importing a `GenericTimeMixin`-derived time class (`MonotonicTime`, `WallTime`, and others) into a Swift module fails with "cannot convert ... to 'bool' without a conversion operator" (rdar://181622867). The operator cannot be hidden from the importer, because the synthesis is eager and the same module compiles C++ callers such as `TimerBase::isActive()` that need it. Re-declare the operator with a `using` declaration in each derived class. The importer synthesizes the conversion correctly when the operator is declared on the non-dependent derived class, while the base keeps it for all C++ callers. No new tests since this change is not directly testable. * Source/WTF/wtf/ApproximateTime.h: (WTF::ApproximateTime): * Source/WTF/wtf/ContinuousApproximateTime.h: (WTF::ContinuousApproximateTime): * Source/WTF/wtf/ContinuousTime.h: (WTF::ContinuousTime): * Source/WTF/wtf/GenericTimeMixin.h: (WTF::GenericTimeMixin::operator bool): * Source/WTF/wtf/MonotonicTime.h: (WTF::MonotonicTime): * Source/WTF/wtf/ReducedResolutionSeconds.h: (WTF::ReducedResolutionSeconds): * Source/WTF/wtf/UnbarrieredMonotonicTime.h: (WTF::UnbarrieredMonotonicTime): * Source/WTF/wtf/WallTime.h: (WTF::WallTime): Canonical link: https://commits.webkit.org/316725@main
…ng frames after a RemoteFrame under Site Isolation https://bugs.webkit.org/show_bug.cgi?id=318483 rdar://181274065 Reviewed by Rupin Mittal. Under Site Isolation a cross-origin subframe is a RemoteFrame that lives in another WebProcess. HistoryController::recursiveGatherFramesToNavigate iterates the target HistoryItem's children in tree order to collect the frames a back/forward traversal must navigate. For each child it looks up the corresponding frame and, when the frame is not a LocalFrame, it did a bare `return` that abandoned the entire remaining sibling loop -- not just the remote child. So any local sibling ordered after a RemoteFrame child was never appended to framesToNavigate and never received loadItem(): it silently failed to traverse, and a Navigation API traverseTo()/back()/forward() targeting that frame left its committed/finished promise unsettled. The two sibling walkers (recursiveSetProvisionalItem, recursiveGoToItem) already use skip semantics -- `if (RefPtr childFrame = dynamicDowncast<LocalFrame>(...))` -- and simply move on to the next sibling. Match them: skip the RemoteFrame child (its traversal is driven in its own process) and continue gathering the remaining local siblings. * LayoutTests/http/wpt/navigation-api/traverse-subframe-remote-sibling.sub.html: Added. A Site-Isolation-pinned test with a cross-origin RemoteFrame sibling ordered before a same-origin LocalFrame; a joint traversal must still move the local frame. Fails today (committed never settles, index unchanged); passes with the fix. * LayoutTests/http/wpt/navigation-api/traverse-subframe-remote-sibling.sub-expected.txt: Added. * LayoutTests/http/wpt/navigation-api/resources/traverse-subframe-child.html: Added. * Source/WebCore/loader/HistoryController.cpp: (WebCore::HistoryController::recursiveGatherFramesToNavigate): Skip (continue) a non-LocalFrame child instead of returning from the whole loop, so local sibling frames ordered after a RemoteFrame are still gathered for traversal. Canonical link: https://commits.webkit.org/316726@main
… are flaky timeouts. https://bugs.webkit.org/show_bug.cgi?id=318834 rdar://181645582 Unreviewed test gardening. * TestExpectations/apitests: Canonical link: https://commits.webkit.org/316727@main
https://bugs.webkit.org/show_bug.cgi?id=318825 rdar://181639994 Reviewed by Eric Carlson. Added logging around call sites of MediaPlaybackTargetCocoa::hasAirPlayDevice(). * Source/WebCore/platform/audio/ios/MediaSessionHelperIOS.mm: (MediaSessionHelper::activeRoutesDidChange): (-[WebMediaSessionHelper activeOutputDeviceDidChange:]): Canonical link: https://commits.webkit.org/316728@main
https://bugs.webkit.org/show_bug.cgi?id=318721 rdar://181531016 Reviewed by Elliott Williams. Xcode links libAccessibility, libnetworkextension and libbsm into WebKit.framework via FRAMEWORK_AND_LIBRARY_LDFLAGS. libbsm supplies audit_token_to_asid, referenced by WebPushD::PushClientConnection::create, so without it WebKit.framework fails to link with an undefined symbol. Link the three SDK usr/lib stubs with -weak_library (an unreferenced stub is harmless), matching Xcode. WebKit links via swiftc, which rejects the bare -weak_library flag, so pass it through -Xlinker. * Source/WebKit/PlatformMac.cmake: Canonical link: https://commits.webkit.org/316729@main
https://bugs.webkit.org/show_bug.cgi?id=318441 Reviewed by Antti Koivisto. Each flex line used to be collected into its own FlexLayoutItems vector and then moved into the LineState, so a line's items were copies that relocate on the move -- which is why anything referencing them had to hold the renderer. Collect the flex items once into a stable allItems list that is never copied or moved, and have computeFlexLines produce every line's range (WTF::Range<size_t>) up front. A line is now a std::span into allItems; the per-line hypothetical main size that columnInnerMainSize needs rides alongside the ranges. No change in behavior. * Source/WebCore/rendering/RenderFlexibleBox.h: * Source/WebCore/rendering/RenderFlexibleBox.cpp: (WebCore::RenderFlexibleBox::LineState::LineState): (WebCore::RenderFlexibleBox::resolveFlexibleLengthsForLineItems): (WebCore::RenderFlexibleBox::computeFlexLines): (WebCore::RenderFlexibleBox::layoutFlexLines): (WebCore::RenderFlexibleBox::computeNextFlexLine): (WebCore::RenderFlexibleBox::autoMarginOffsetInMainAxis): (WebCore::RenderFlexibleBox::freezeInflexibleItems): (WebCore::RenderFlexibleBox::resolveFlexibleLengths): (WebCore::RenderFlexibleBox::layoutAndPlaceFlexItems): (WebCore::RenderFlexibleBox::layoutColumnReverse): Canonical link: https://commits.webkit.org/316730@main
https://bugs.webkit.org/show_bug.cgi?id=318720 rdar://181529363 Reviewed by Elliott Williams. The .sb sandbox profiles are preprocessed with clang -E but without -isysroot, so clang uses its default SDK. WebKit's C++ is compiled with the target SDK, where USE(APPLE_INTERNAL_SDK) is decided by __has_include of internal headers that only resolve under the Internal SDK's -isysroot; the sandbox preprocess then takes the wrong branch and cannot resolve SDK headers like <AppleFeatures/AppleFeatures.h>. Xcode's rule uses -isysroot $(SDKROOT). Seed _sb_extra_includes with -isysroot ${CMAKE_OSX_SYSROOT} (and append, rather than overwrite, the additions-SDK include so the seed survives). * Source/WebKit/PlatformMac.cmake: Canonical link: https://commits.webkit.org/316731@main
https://bugs.webkit.org/show_bug.cgi?id=318716 rdar://181529150 Reviewed by Elliott Williams and Zak Ridouh. OptionsCocoa.cmake force-disables ENABLE_AV1 behind a FIXME noting dav1d used meson. dav1d now has a CMake build (Source/ThirdParty/dav1d/CMakeLists.txt defines the dav1d static library, which WebCore links when ENABLE_AV1), so the FIXME is stale. Xcode enables AV1 (FEATURE_AND_PLATFORM_DEFINES); drop the force-off so the OptionsMac ON default resolves. * Source/cmake/OptionsCocoa.cmake: Canonical link: https://commits.webkit.org/316732@main
…the HID framework link https://bugs.webkit.org/show_bug.cgi?id=318698 rdar://181513616 Reviewed by Elliott Williams and Zak Ridouh. Xcode's TestWebKitAPILibrary compiles the nine Tools/TestWebKitAPI/Helpers/mac/GamepadMappings/*.mm files that define TestWebKitAPI::VirtualGamepad::*Mapping(), referenced by Helpers/mac/VirtualGamepad.mm and the HID gamepad tests, and links the HID framework for HIDUserDevice (WK_HID_LDFLAGS_macosx = -framework HID). The CMake port's PlatformMac.cmake lists VirtualGamepad.mm but omits the mapping sources and the HID link, so TestWebKitAPI fails to link with undefined VirtualGamepad mapping symbols and _OBJC_CLASS_$_HIDUserDevice. Add the mapping sources and -framework HID to match Xcode. * Tools/TestWebKitAPI/PlatformMac.cmake: Canonical link: https://commits.webkit.org/316733@main
https://bugs.webkit.org/show_bug.cgi?id=318705 rdar://181518639 Reviewed by Elliott Williams. Xcode installs both MODULEMAP_FILE and MODULEMAP_PRIVATE_FILE into WebCore.framework's Modules directory (module.modulemap and module.private.modulemap). The private map declares the WebCore_Private clang module, whose PlatformExportMacros submodule defines WEBCORE_EXPORT. The CMake port stages only the public WebCore.modulemap, so a Swift or C++-interop consumer that resolves <WebCore/...> through the framework module reads the private headers textually and WEBCORE_EXPORT is left undefined. Stage WebCore_Private.modulemap alongside the public map, into the same Modules directory the bundle already symlinks, matching Xcode's WebCore.framework product. * Source/WebCore/PlatformCocoa.cmake: Canonical link: https://commits.webkit.org/316734@main
… active and focused. https://bugs.webkit.org/show_bug.cgi?id=305846 rdar://168467484 Reviewed by Abrar Rahman Protyasha. If a window comes into focus, the focus controller may dispatch excess events currently. We should only dispatch events when a window either becomes both focused & active or when a window transition out of being both focused and active. Test: Tools/TestWebKitAPI/Tests/WebKit/WKWebView/FocusWebView.mm * Source/WebCore/page/FocusController.cpp: (WebCore::FocusController::setFocusedInternal): (WebCore::FocusController::setActivityState): (WebCore::FocusController::setActiveInternal): * Source/WebCore/page/FocusController.h: * Tools/TestWebKitAPI/Tests/WebKit/WKWebView/FocusWebView.mm: (TestWebKitAPI::NoFocusEventsForBackgroundWindow)): (TestWebKitAPI::SingleBlurEventWhenNoLongerActiveAndFocused)): Canonical link: https://commits.webkit.org/316735@main
…re constant crashes. https://bugs.webkit.org/show_bug.cgi?id=318739 rdar://181539181 Unreviewed test gardening. * TestExpectations/apitests: Canonical link: https://commits.webkit.org/316736@main
https://bugs.webkit.org/show_bug.cgi?id=319103 rdar://181919706 Unreviewed. Update safer C++ expectations. * Source/WebKitLegacy/SaferCPPExpectations/NoDeleteCheckerExpectations: Canonical link: https://commits.webkit.org/316944@main
…harness and enable the passing tests https://bugs.webkit.org/show_bug.cgi?id=319008 rdar://181853035 Reviewed by Alex Christensen. The WPT webtransport/ tests could not connect because the layout-test harness never launched the WPT WebTransport-over-HTTP/3 (webtransport-h3) QUIC server. The vendored aioquic-based server exists under tools/webtransport/h3/ and upstream's `wpt serve` supports it, but it is opt-in (skipped without --webtransport-h3) and the harness did not declare the port, pass the flag, check its liveness, or provision aioquic. Every data-flow test thus failed to establish a session. Wire the harness to launch the server and provision its dependency: - Declare a webtransport-h3 UDP port in the WPT config and pass --webtransport-h3 to `wpt serve`. The tests reach the port via the server-side {{ports[webtransport-h3][0]}} config substitution, so no Python-side URL accessor is needed. - Add a real UDP-listener liveness check (QUIC is UDP; the inherited TCP connect() check never sees it), matching EADDRINUSE only. - Provision aioquic through webkitpy's AutoInstall so a fresh checkout / CI bot needs no manual pip install. aioquic 1.2.0 needs a newer crypto stack than webkitpy pinned and AutoInstall uses a single shared per-interpreter directory with one version per package name, so this bumps the shared pins (cryptography -> 43.0.3, the highest with prebuilt py3.9 wheels while satisfying aioquic's >=42; pyOpenSSL -> 24.3.0; cffi kept 1.17.1) and registers the webtransport-only packages in a new autoinstalled/aioquic.py. AutoInstall only mutates the in-process sys.path, so the harness injects the AutoInstall directory into the wpt subprocess's PYTHONPATH for both the probe and the serve launch. - Any provisioning failure (offline, missing wheel) degrades to the existing "h3 disabled" path instead of taking down unrelated WPT runs. WebTransportEnabled is already Stable/default-on; no feature flag. With the server running, un-skip the WebTransport tests that pass on Cocoa (connect, constructor, congestion-control, csp, datagram-bad-chunk, incoming-multiple-streams, sendstream-bad-chunk, server-certificate-hashes, in-removed-iframe) and add their expectations. The remaining tests stay skipped, grouped by reason (internal timeout in the streams-echo/streams-close family, backend gaps in datagrams/stats/sendorder/close/historical/idlharness, BFCache variants, and the crash tests). Add a Cocoa-only skip of the suite to platform/glib (GTK/WPE have no QUIC/HTTP-3 backend; Windows already skips it). The un-skipped tests need the Network.framework QUIC SPI that ships on Tahoe but not Sequoia, so skip the suite in platform/mac-sequoia (open-source CI runs Tahoe; the Sequoia bots would otherwise fail every un-skipped test). * LayoutTests/imported/w3c/resources/config.json: Add the webtransport-h3 port. * LayoutTests/TestExpectations: Un-skip the passing WebTransport tests; group the remaining skips by reason. * LayoutTests/platform/glib/TestExpectations: Skip the Cocoa-only WebTransport suite on GTK/WPE. * LayoutTests/platform/mac-sequoia/TestExpectations: Skip the WebTransport suite on Sequoia (QUIC SPI is Tahoe-only). * LayoutTests/imported/w3c/web-platform-tests/webtransport/*-expected.txt: Baselines for the un-skipped tests. * Tools/Scripts/libraries/webkitcorepy/webkitcorepy/__init__.py: Bump pyOpenSSL to 24.3.0 and collapse the per-Python cryptography branch into a single 43.0.3 pin to satisfy aioquic 1.2.0. * Tools/Scripts/webkitpy/autoinstalled/aioquic.py: Added; register aioquic 1.2.0 and its deps. * Tools/Scripts/webkitpy/layout_tests/servers/web_platform_test_server.py: (_aioquic_autoinstall_directory): Added; trigger AutoInstall and return its directory. (_env_with_pythonpath_appended): Added. (WebPlatformTestServer.__init__): Provision aioquic, probe it in the serve interpreter, and append --webtransport-h3 plus the UDP mapping only when available; else warn. (WebPlatformTestServer.ports_to_forward): Exclude UDP ports from TCP device forwarding. (WebPlatformTestServer._is_udp_port_listening): Added. (WebPlatformTestServer._is_server_running_on_all_ports): Added; validate the UDP h3 listener via a bind()->EADDRINUSE probe alongside the existing TCP port checks. (WebPlatformTestServer._spawn_process): Pass the aioquic-provisioned env to the wpt serve process. * Tools/Scripts/webkitpy/layout_tests/servers/web_platform_test_server_unittest.py: (TestWebPlatformTestServer.setUp): Added; stub the autoinstall trigger to keep construction hermetic. (TestWebPlatformTestServer.test_is_udp_port_listening): Added. Canonical link: https://commits.webkit.org/316945@main
https://bugs.webkit.org/show_bug.cgi?id=319127 REGRESSION(316735@main?): [macOS] TestWebKitAPI.WKWebView.InputChangeFiresOnWindowBlur is flaky failure Reverted change: Blur and Focus events should only be dispatched if the window is both active and focused. https://bugs.webkit.org/show_bug.cgi?id=305846 316735@main (742452b) Canonical link: https://commits.webkit.org/316946@main
https://bugs.webkit.org/show_bug.cgi?id=319139 rdar://181955332 REGRESSION(316945@main): [WebTransport] WPT webtransport-h3 harness change breaks the WPT server on Internal builds. The change bumped the shared aioquic/cryptography/pyOpenSSL AutoInstall pins, which breaks the WPT server on Internal builds. Reverted change: [WebTransport] Run the WPT webtransport-h3 server in the layout test harness and enable the passing tests https://bugs.webkit.org/show_bug.cgi?id=319008 316945@main (f555e55) Canonical link: https://commits.webkit.org/316947@main
…ts to the default font https://bugs.webkit.org/show_bug.cgi?id=318776 rdar://51409819 Reviewed by Ryosuke Niwa. The <font face> attribute accepts literal font family names (HTML legacy semantics), but CSSValuePool::createFontFaceValue parsed it with the strict CSS <family-name> grammar. Family names that are not valid unquoted CSS identifiers -- notably names containing a numeric token such as "Bodoni 72" -- were rejected, so font-family was never applied and the text silently reverted to the default font. Relax the family-name grammar to accept a numeric token as part of a literal family name, but only for the <font face> attribute: add a legacyFontFaceAttributeMode flag to CSSParserContext, enable it from createFontFaceValue, and honor it in the font-family consumer. Regular CSS font-family parsing is unaffected and still rejects such names, so "font-family: Bodoni 72" (unquoted) remains invalid. The value reaches the face attribute unquoted because StyleChange::extractTextStyles unconditionally strips every quote from the serialized font-family for Outlook 2007 compatibility (EditingStyle.cpp, webkit.org/b/79448). That is broader than 79448 intended -- it meant to drop only superfluous quotes and keep them for names that genuinely need them -- so the quotes "Bodoni 72" actually requires are stripped too. Fixing the reader here also covers static or pasted <font face> values from any source; tightening the emitter to strip quotes selectively could be a follow-up, but it touches the 79448 compatibility behavior and is intentionally out of scope here. * Source/WebCore/css/CSSValuePool.cpp: (WebCore::CSSValuePool::createFontFaceValue): * Source/WebCore/css/parser/CSSParserContext.h: * Source/WebCore/css/parser/CSSParserContext.cpp: (WebCore::add): * Source/WebCore/css/parser/CSSPropertyParserConsumer+Font.cpp: (WebCore::CSSPropertyParserHelpers::concatenateFamilyName): (WebCore::CSSPropertyParserHelpers::consumeFamilyNameUnresolved): (WebCore::CSSPropertyParserHelpers::consumeFamilyName): * LayoutTests/editing/style/font-face-numeric-family.html: Added. * LayoutTests/editing/style/font-face-numeric-family-expected.txt: Added. Canonical link: https://commits.webkit.org/316948@main
https://bugs.webkit.org/show_bug.cgi?id=318916 rdar://181750071 Reviewed by Brandon Stewart. When computing the automatic preferred size of a grid item there are two ways that the item can get stretched to fill its grid area based on its self alignment in that axis: 1.) normal - If the grid item has no preferred aspect ratio, and no natural size in the relevant axis (if it is a replaced element) 2.) stretch - As long as there are no auto margins. We currently implement 1 but not 2 so we just expand our current logic by taking this extra bit of information into consideration. The isStretchedForAutomaticSize helper reuses the same bit of logic in both axes since the only difference is the alignment and margins we are checking. All of its callers only reach it once the preferred size in the axis is known to be auto, so it asserts that precondition rather than re-checking it. Canonical link: https://commits.webkit.org/316949@main
…ll enums https://bugs.webkit.org/show_bug.cgi?id=319026 rdar://181880375 Reviewed by Eric Carlson. m_displayDirection (CSSValueID, a uint16_t enum) was declared immediately before the double m_displaySize. Sitting on an 8-byte-aligned offset, its 2 bytes forced 6 bytes of padding before the double, wasting a full word. Move it up next to m_writingDirection and m_cueAlignment (both 1-byte enums), which already left 6 bytes of padding before the following RefPtr<VTTRegion>. The enum now folds into that existing hole at no cost, and m_displaySize leads its group without a preceding gap. This shrinks the object by 8 bytes with no behavioral change. * Source/WebCore/html/track/VTTCue.h: Canonical link: https://commits.webkit.org/316950@main
…b49069a5 Upstream WebKit/WebKit@0e86b49069a5 (2026-07-11). 752 upstream commits since d81bcc3; 92 touch Source/JavaScriptCore, 54 touch Source/WTF, 12 touch Source/bmalloc. Conflict resolutions: - runtime/DeferredWorkTimer.{h,cpp}: upstream renamed TicketData to Ticket and introduced WeakTicket (bug 314671). Bun's onAddPendingWork/onScheduleWorkSoon/ onCancelPendingWork hooks kept and ported to the new types (Ref<Ticket>&&, Ticket*). scheduleWorkSoonIfActive now invokes onScheduleWorkSoon only after the new dead/cancelled-ticket guard, matching the new contract. - runtime/JSDateMath.{h,cpp}: upstream moved lastTimeZoneID into WTF and introduced USE(TIME_ZONE_CHANGE_NOTIFICATIONS) (bugs 314414, 318841). Dropped the fork's JSC::lastTimeZoneID atomic and resetIfNecessary()/timeZoneChanged(); kept the fast-path cache for Bun by adding || USE(BUN_JSC_ADDITIONS) to the hasTimeZoneChange() and retrieveTimeZoneInformation() guards. Bun callers should use WTF::timeZoneDidChange() + DateCache::clearForTimeZoneChange(). - runtime/JSFinalizationRegistry.cpp: upstream removed the hasPendingWork() ASSERT Bun had guarded with BUN_SKIP_FAILING_ASSERTIONS, replacing it with scheduleWorkSoonIfActive + RELEASE_ASSERT(queued). Took upstream. - runtime/JSMicrotask.cpp, runtime/MicrotaskQueueInlines.h: upstream's polymorphic microtask call cache and inline queueMicrotask (bug 318847); Bun's USE(BUN_JSC_ADDITIONS) async-context wrapping kept. - runtime/PropertySlot.h: upstream added LastAttribute for SparseArrayValueMap's static_assert. Set LastAttribute = Constructable under BUN_JSC_ADDITIONS. - runtime/SparseArrayValueMap.h, tools/JSDollarVM.h, wasm/WasmFormat.h, wasm/WasmTable.h: upstream refactors adopted; fork's quote-style includes kept. - wasm/WasmStreamingCompiler.cpp: upstream's WeakTicket/scheduleWorkSoonIfActive refactor adopted; Bun's BUN_SKIP_FAILING_ASSERTIONS guard preserved. - builtins/BuiltinNames.{h,cpp}: upstream moved intlLegacyConstructedSymbol to JSGlobalObject; fork's explicit-resource-management macro folding kept. - interpreter/Interpreter.h, runtime/DeferredWorkTimer.h: fork's quote-style JSC includes kept; upstream's new includes added. - wtf/RunLoop.h: upstream's TimerBase thread-affinity comments and ASSERT_WITH_SECURITY_IMPLICATION in assertIsCurrent; BUN_EVENT_LOOP kept. - b3/B3EliminateWasmGCAllocations.h: spurious rename-detection conflict against DeferredWorkTimerInlines.h; took upstream's new file verbatim. - CMakeLists.txt: dropped the removed DeferredWorkTimerInlines.h header entry. - runtime/JSGlobalObject.h: upstream's Temporal LazyClassStructure and addWeakTicket(Ticket&); Bun's m_weakTickets/addWeakTicket additions kept.
…T_LOOP Upstream 318088 added assertIsCurrent(m_runLoop) in TimerBase::~TimerBase and TimerBase::stop. Under USE(BUN_EVENT_LOOP) the fork's m_runLoop macro rewrites the token to (m_runLoop->m_genericState), a std::optional<RunLoopGenericState>, so the new call did not match any assertIsCurrent overload. Reach the owning RunLoop via RunLoopGenericState::m_parent in that configuration. Also restore || USE(BUN_JSC_ADDITIONS) on the retrieveTimeZoneInformation cache guard so Bun keeps the host-zone cache fast path after 318841 moved the atomic to WTF.
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
No issues found by automated review, but this is a 752-commit upstream merge with hand-resolved conflicts in core runtime paths — deferring to human review.
What was reviewed:
- Conflict-resolution areas called out in the description:
DeferredWorkTimerTicket/WeakTicket port of Bun hooks,JSDateMathfast-path guard (|| USE(BUN_JSC_ADDITIONS)),PropertySlotLastAttributesplit, and theRunLoopGenericassertIsCurrentrouting throughm_parent. - Spot-checked that
onScheduleWorkSoonnow fires after the dead/cancelled-ticket guard as described, and that theBUN_SKIP_FAILING_ASSERTIONSguards were preserved where stated. - Noted the documented build verification (JSCOnly debug + ASAN compiles,
jsc -eruns, Bun debug links with companion changes).
Extended reasoning...
Overview
This PR merges upstream WebKit/WebKit@0e86b49069a5 into the Bun fork — 752 upstream commits, 300+ changed files, ~700KB diff. The bulk is upstream-authored (JSTests, test262, LayoutTests, JSC runtime/JIT/wasm changes), but the review-relevant portion is the set of hand-resolved merge conflicts where Bun's fork-local modifications intersect upstream refactors: DeferredWorkTimer.{h,cpp} (TicketData→Ticket + WeakTicket, hook signature changes), JSDateMath.{h,cpp} (timezone cache invalidation moved to WTF), JSMicrotask.cpp/MicrotaskQueueInlines.h (polymorphic call cache + Bun async-context wrapping), PropertySlot.h (LastAttribute), WasmStreamingCompiler.cpp, RunLoopGeneric.cpp (assertIsCurrent under BUN_EVENT_LOOP), and BuiltinNames/JSGlobalObject.
Security risks
The upstream commits themselves carry WebKit's own review; the fork-specific risk is in the conflict resolutions. These touch GC-visible lifetime management (DeferredWorkTimer tickets, wasm streaming compiler tickets), run-loop thread-affinity assertions, and microtask dispatch — all areas where a mis-merge could produce use-after-free, wrong-thread access, or lost async-context propagation. No specific defect was identified, but these are exactly the paths that warrant a second pair of eyes rather than automated sign-off.
Level of scrutiny
High. This is a periodic upstream sync, so the pattern is routine, but each one carries bespoke conflict resolutions in production-critical JIT/runtime/GC code and introduces Bun-side API breaks that require a companion oven-sh/bun PR. The PR description is thorough and documents build/smoke verification, which raises confidence, but the scale and the nature of the touched code place it well outside the "simple, mechanical, obvious" bar for auto-approval.
Other factors
- No prior reviews or comments on the PR; this is the first pass.
- The author documented that a JSCOnly debug+ASAN build compiles clean and a full Bun debug build links and passes smoke tests with the companion changes — a strong signal, but not a substitute for review of the conflict hunks.
- The bug-hunting system reported no findings; given the diff size, that should be read as "nothing obvious surfaced" rather than exhaustive coverage.
- Companion Bun-side API breaks (
TicketData→Ticket,SparseArrayEntry.index(),isDetachable(),clearForTimeZoneChange()) mean this needs to land coordinated with the oven-sh/bun PR.
…Only headers on Apple bug 318706 folded m_locked into m_pinCount and removed isLocked(). Bun's SerializedScriptValue needs to distinguish a pinAndLock()ed buffer (WASM memory, JSC C API) from a plain pin() borrow (Bun async I/O): the former must throw on transfer, the latter must fall through to transferTo()'s copy path. isLocked() now reads m_pinCount & s_lockedFlag. bug 317899 moved Apple header output into framework bundles. The JSCOnly port builds a static archive, so _WEBKIT_CREATE_FRAMEWORK_BUNDLE_STRUCTURE never runs and the Bun macOS prebuilt packaging still copies from JavaScriptCore/Headers/. Skip the framework-bundle override for JSCOnly so the flat layout is preserved on Apple.
robobun
added a commit
to oven-sh/bun
that referenced
this pull request
Jul 11, 2026
…uffers Swapping isLocked() for !isDetachable() regressed Bun's documented contract (bindings.cpp:3147): a buffer that Bun has pin()ed for an async borrow (zlib, fs, crypto, shell, Bun.Image, SQL) must fall through to transferTo()'s copy path, not throw. oven-sh/WebKit#280 now re-adds ArrayBuffer::isLocked() under USE(BUN_JSC_ADDITIONS) as the s_lockedFlag bit of m_pinCount, so the guard goes back to isLocked() and rejects only WASM-memory / C-API buffers. Also: bump WEBKIT_VERSION to preview 03a6cd14 (macOS header-layout fix for bug 317899), make the smoke tests concurrent, and add coverage for the pinned-buffer-copies case.
There was a problem hiding this comment.
I didn't find any bugs, but this is a 752-commit upstream sync with ~10 hand-resolved conflicts in fork-critical integration points (DeferredWorkTimer hooks, JSDateMath TZ cache gating, RunLoopGeneric assertIsCurrent routing, PropertySlot::LastAttribute), plus Bun-side API breaks that need to land in lockstep with the companion oven-sh/bun PR — worth a human pass.
What was reviewed:
- Conflict-resolution descriptions cross-checked against the listed upstream bugs; the
onScheduleWorkSoonreordering behind the dead/cancelled-ticket guard and the|| USE(BUN_JSC_ADDITIONS)TZ fast-path gating look internally consistent. LastAttribute = ConstructableunderBUN_JSC_ADDITIONSmatches the fork's extra PropertyAttribute bit so the new SparseArrayEntry static_assert should hold.- The
-s oursfixup of the squashed #263 base and theArrayBuffer::isLocked()re-add underBUN_JSC_ADDITIONS(per HEAD commit) look right for keeping downstream callers building.
Extended reasoning...
Overview
This PR merges 752 upstream WebKit commits (d81bcc3d833c..0e86b49069a5) into the Bun fork: 92 touch JavaScriptCore, 54 touch WTF, 12 touch bmalloc, plus hundreds of JSTests/test262/LayoutTests. The diff is ~700 KB across 300+ files. Beyond the pure upstream import, the substantive fork-authored content is the conflict resolutions in DeferredWorkTimer.{h,cpp}, JSDateMath.{h,cpp}, JSMicrotask.cpp/MicrotaskQueueInlines.h, PropertySlot.h/SparseArrayValueMap.h, WasmStreamingCompiler.cpp, BuiltinNames.{h,cpp}/JSGlobalObject.h, and wtf/RunLoop.h/RunLoopGeneric.cpp, plus a merge-base fixup commit and a re-add of ArrayBuffer::isLocked() under BUN_JSC_ADDITIONS.
Security risks
The upstream content itself is Apple-reviewed WebKit; the fork-side risk is in the conflict resolutions. Nothing here is auth/crypto/permissions in the application-security sense, but several resolutions sit on correctness-critical paths: the DeferredWorkTimer Ticket/WeakTicket lifetime rework (use-after-free territory if the hook ordering is wrong), the RunLoopGeneric assertIsCurrent routing through m_parent under BUN_EVENT_LOOP, and the JSDateMath cache-invalidation gating. A mistake in any of these would manifest as crashes or stale-cache bugs rather than a security hole per se, but they're exactly the class of thing a JIT/runtime engine treats as security-adjacent.
Level of scrutiny
High. This is not a mechanical change — it's a periodic upstream sync where the interesting bits are hand-authored merges of Bun's USE(BUN_JSC_ADDITIONS) / USE(BUN_EVENT_LOOP) hooks against upstream refactors that changed the surrounding types and control flow. The PR description is thorough and the author reports a clean ASAN JSCOnly build plus a linking Bun debug build, which is a strong signal, but the conflict resolutions each encode a semantic judgment (e.g. firing onScheduleWorkSoon only after the new IfActive guard, or choosing Constructable as LastAttribute) that a maintainer familiar with why those hooks exist should confirm.
Other factors
- There is a companion oven-sh/bun PR that must land together (four API breaks listed); merging this alone would break Bun's build.
- No prior reviews or comments on the PR; this is the first pass.
- The bug hunting system found nothing, but coverage over a 700 KB engine merge is necessarily shallow relative to the surface area.
- Test/microbenchmark additions are upstream-authored and low-risk; the LayoutTests/test262 churn is import noise.
Given the size, the hand-resolved conflicts in runtime/event-loop integration points, and the cross-repo coordination required, this should be reviewed by a human maintainer rather than auto-approved.
Preview Builds
|
robobun
added a commit
to oven-sh/bun
that referenced
this pull request
Jul 13, 2026
Point WEBKIT_VERSION at the oven-sh/WebKit#280 preview build and port Bun's C++ bindings to the upstream API changes it carries: - DeferredWorkTimer: TicketData renamed to Ticket, hooks now take Ref<Ticket>&& / Ticket*, and Task is Function<void(Ticket&)>. JSCTaskScheduler and BunClientData updated; the unused getVM helper and the TicketData alias are removed. - JSDateMath: resetIfNecessarySlow() is gone. After setTimeZoneOverride(), bump WTF::timeZoneDidChange() and call dateCache.clearForTimeZoneChange() in ZigGlobalObject, JSEnvironmentVariableMap and BunJSCModule. - SparseArrayValueMap: entries expose .index() instead of .key. - ArrayBuffer: isLocked() replaced by !isDetachable() in SerializedScriptValue.
robobun
added a commit
to oven-sh/bun
that referenced
this pull request
Jul 13, 2026
…uffers Swapping isLocked() for !isDetachable() regressed Bun's documented contract (bindings.cpp:3147): a buffer that Bun has pin()ed for an async borrow (zlib, fs, crypto, shell, Bun.Image, SQL) must fall through to transferTo()'s copy path, not throw. oven-sh/WebKit#280 now re-adds ArrayBuffer::isLocked() under USE(BUN_JSC_ADDITIONS) as the s_lockedFlag bit of m_pinCount, so the guard goes back to isLocked() and rejects only WASM-memory / C-API buffers. Also: bump WEBKIT_VERSION to preview 03a6cd14 (macOS header-layout fix for bug 317899), make the smoke tests concurrent, and add coverage for the pinned-buffer-copies case.
There was a problem hiding this comment.
No issues found by the automated review, but this is a 752-commit upstream merge with hand-resolved conflicts in core JSC/WTF paths, so it needs a human sign-off.
What was reviewed:
- The
DeferredWorkTimerTicket/WeakTicket port andonScheduleWorkSoonplacement after the dead-ticket guard. JSDateMathfast-path guard change to|| USE(BUN_JSC_ADDITIONS)and the drop of fork-locallastTimeZoneID.RunLoopGenericassertIsCurrentrouting throughm_parentunderUSE(BUN_EVENT_LOOP).PropertySlot::LastAttributeconditional and theArrayBuffer::isLocked()re-add underBUN_JSC_ADDITIONS.
Extended reasoning...
Overview
This PR merges upstream WebKit 0e86b49069a5 into the Bun fork — 752 upstream commits (92 in JSC, 54 in WTF, 12 in bmalloc) across 300+ files. The bulk is upstream test additions (JSTests, test262, LayoutTests) and upstream source changes taken verbatim. The Bun-authored surface is the conflict resolutions listed in the description: DeferredWorkTimer.{h,cpp}, JSDateMath.{h,cpp}, JSMicrotask.cpp/MicrotaskQueueInlines.h, PropertySlot.h/SparseArrayValueMap.h, WasmStreamingCompiler.cpp, BuiltinNames, RunLoop.h/RunLoopGeneric.cpp, plus include-style-only touches in a handful of headers.
Security risks
The upstream changes include JIT (DFG/FTL/B3), Yarr, wasm, and heap code — all security-sensitive by nature — but those are upstream-reviewed commits taken as-is. The fork-specific risk is in the conflict resolutions: mis-porting the Ticket/WeakTicket lifetime semantics, the RunLoop assertion routing, or the JSDateMath cache guard could introduce UAF or stale-cache bugs specific to Bun builds. No such issues were found by the automated pass.
Level of scrutiny
High. This is not a mechanical change: each conflict resolution encodes a judgment call about how a Bun-specific hook or guard maps onto a refactored upstream API (e.g., firing onScheduleWorkSoon only after the new IfActive dead-ticket check, or redefining LastAttribute conditionally). These are exactly the decisions a maintainer familiar with the Bun-side consumers should verify. The PR also introduces API breaks that require a companion oven-sh/bun PR, so the two need to land together.
Other factors
The description reports a clean JSCOnly ASAN debug build and a linked Bun debug build passing smoke tests, and CI preview builds are posted. The bug-hunting system found nothing. Given the scale, the hand-resolved conflicts in core runtime/event-loop code, and the coordinated Bun-side changes, I'm deferring rather than approving.
robobun
added a commit
to oven-sh/bun
that referenced
this pull request
Jul 13, 2026
oven-sh/WebKit#280 was merged with fork main to pick up oven-sh/WebKit#278 (the DFG/FTL PerformPromiseThenOneHandler async-context bailout for #33806); the preview release is published with 43 artifacts.
robobun
added a commit
to oven-sh/bun
that referenced
this pull request
Jul 14, 2026
Point WEBKIT_VERSION at the oven-sh/WebKit#280 preview build and port Bun's C++ bindings to the upstream API changes it carries: - DeferredWorkTimer: TicketData renamed to Ticket, hooks now take Ref<Ticket>&& / Ticket*, and Task is Function<void(Ticket&)>. JSCTaskScheduler and BunClientData updated; the unused getVM helper and the TicketData alias are removed. - JSDateMath: resetIfNecessarySlow() is gone. After setTimeZoneOverride(), bump WTF::timeZoneDidChange() and call dateCache.clearForTimeZoneChange() in ZigGlobalObject, JSEnvironmentVariableMap and BunJSCModule. - SparseArrayValueMap: entries expose .index() instead of .key. - ArrayBuffer: isLocked() replaced by !isDetachable() in SerializedScriptValue.
robobun
added a commit
to oven-sh/bun
that referenced
this pull request
Jul 14, 2026
…uffers Swapping isLocked() for !isDetachable() regressed Bun's documented contract (bindings.cpp:3147): a buffer that Bun has pin()ed for an async borrow (zlib, fs, crypto, shell, Bun.Image, SQL) must fall through to transferTo()'s copy path, not throw. oven-sh/WebKit#280 now re-adds ArrayBuffer::isLocked() under USE(BUN_JSC_ADDITIONS) as the s_lockedFlag bit of m_pinCount, so the guard goes back to isLocked() and rejects only WASM-memory / C-API buffers. Also: bump WEBKIT_VERSION to preview 03a6cd14 (macOS header-layout fix for bug 317899), make the smoke tests concurrent, and add coverage for the pinned-buffer-copies case.
robobun
added a commit
to oven-sh/bun
that referenced
this pull request
Jul 14, 2026
oven-sh/WebKit#280 was merged with fork main to pick up oven-sh/WebKit#278 (the DFG/FTL PerformPromiseThenOneHandler async-context bailout for #33806); the preview release is published with 43 artifacts.
robobun
added a commit
to oven-sh/bun
that referenced
this pull request
Jul 14, 2026
Point WEBKIT_VERSION at the oven-sh/WebKit#280 preview build and port Bun's C++ bindings to the upstream API changes it carries: - DeferredWorkTimer: TicketData renamed to Ticket, hooks now take Ref<Ticket>&& / Ticket*, and Task is Function<void(Ticket&)>. JSCTaskScheduler and BunClientData updated; the unused getVM helper and the TicketData alias are removed. - JSDateMath: resetIfNecessarySlow() is gone. After setTimeZoneOverride(), bump WTF::timeZoneDidChange() and call dateCache.clearForTimeZoneChange() in ZigGlobalObject, JSEnvironmentVariableMap and BunJSCModule. - SparseArrayValueMap: entries expose .index() instead of .key. - ArrayBuffer: isLocked() replaced by !isDetachable() in SerializedScriptValue.
robobun
added a commit
to oven-sh/bun
that referenced
this pull request
Jul 14, 2026
…uffers Swapping isLocked() for !isDetachable() regressed Bun's documented contract (bindings.cpp:3147): a buffer that Bun has pin()ed for an async borrow (zlib, fs, crypto, shell, Bun.Image, SQL) must fall through to transferTo()'s copy path, not throw. oven-sh/WebKit#280 now re-adds ArrayBuffer::isLocked() under USE(BUN_JSC_ADDITIONS) as the s_lockedFlag bit of m_pinCount, so the guard goes back to isLocked() and rejects only WASM-memory / C-API buffers. Also: bump WEBKIT_VERSION to preview 03a6cd14 (macOS header-layout fix for bug 317899), make the smoke tests concurrent, and add coverage for the pinned-buffer-copies case.
robobun
added a commit
to oven-sh/bun
that referenced
this pull request
Jul 14, 2026
oven-sh/WebKit#280 was merged with fork main to pick up oven-sh/WebKit#278 (the DFG/FTL PerformPromiseThenOneHandler async-context bailout for #33806); the preview release is published with 43 artifacts.
| } | ||
|
|
||
| function test(size) { | ||
| const array = new Uint16Array(size); |
There was a problem hiding this comment.
🟣 This test file is named for Int16Array but constructs new Uint16Array(size) at line 19, making it a byte-for-byte duplicate of typedarray-constructor-jit-compliant-toindex-firstarg-uint16array.js and leaving Int16Array uncovered for this JIT compliance path. This is a pre-existing upstream copy-paste error brought in verbatim by the merge — not blocking, but worth reporting to upstream WebKit.
Extended reasoning...
What the bug is
The upstream test suite added a family of files named typedarray-constructor-jit-compliant-toindex-firstarg-<type>.js, one per typed-array constructor, each meant to warm up new <Type>Array(size) into DFG/FTL and then verify that passing Number.POSITIVE_INFINITY throws the correct RangeError per step 9 (ToIndex(firstArgument)) of the spec's TypedArray constructor.
The file typedarray-constructor-jit-compliant-toindex-firstarg-int16array.js is misnamed relative to its contents: line 19 reads
const array = new Uint16Array(size);instead of new Int16Array(size). Every other file in the family matches its filename (e.g. ...-int8array.js uses Int8Array, ...-int32array.js uses Int32Array, ...-uint16array.js uses Uint16Array).
Step-by-step proof
- The filename is
...-int16array.js, so its purpose in the suite is to exercise theInt16Arrayconstructor's DFG/FTLToIndexpath. - Line 19 constructs
new Uint16Array(size), so the JIT warms up and compiles the Uint16Array constructor path. - The final
shouldThrowcall at line 36 then testsnew Uint16Array(Infinity), notnew Int16Array(Infinity). - Diffing this file against
typedarray-constructor-jit-compliant-toindex-firstarg-uint16array.jsshows they are byte-for-byte identical. - Therefore
Int16Arrayis never tested for this specific JIT compliance path anywhere in the family, whileUint16Arrayis tested twice.
Why nothing prevents it
The test still passes (Uint16Array behaves correctly), so no CI failure would flag it. There is no meta-test asserting that each file's constructor matches its filename.
Impact
Purely a test-coverage gap: no functional bug, no failing test, no runtime effect. If a future JSC change broke the Int16Array-specific NewTypedArray DFG/FTL ToIndex handling, this suite would not catch it.
Why this is pre_existing
This file arrives verbatim from upstream WebKit as part of the merge — the fork author did not write it. The fork generally avoids diverging from upstream JSTests/ for cosmetic fixes, so the right place to fix this is upstream (bugs.webkit.org), after which the next sync will pick it up. It should not block this merge PR.
How to fix (upstream)
Change line 19 to const array = new Int16Array(size);. (Aside: the sibling file ...-bitint64.js also has a filename typo — "bitint64" instead of "bigint64" — though its contents correctly use BigInt64Array.)
robobun
added a commit
to oven-sh/bun
that referenced
this pull request
Jul 14, 2026
…in 4895f45d) [skip size check] Carries oven-sh/WebKit#283 (mimalloc build matrix) and the _LINKED_INTO cmake fix from fork main, plus #278. Preview published with 43 artifacts.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
20 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Merge upstream
WebKit/WebKit@0e86b49069a5(2026-07-11) into the Bun fork.752 upstream commits since
d81bcc3d833c(the #263 sync point); 92 touchSource/JavaScriptCore, 54 touchSource/WTF, 12 touchSource/bmalloc.The branch starts with a no-op
-s oursmerge ofd81bcc3d833c(cf6fa69095) because #263 landed as a squash and git would otherwise pickce481c4cfedbas the merge base and try to re-apply 84 commits the tree already contains.Conflict resolutions
runtime/DeferredWorkTimer.{h,cpp}(bug 314671): upstream renamedTicketDatatoTicket, introducedWeakTicket, and replacedscheduleWorkSoonwithscheduleWorkSoonIfActive. Bun'sonAddPendingWork/onScheduleWorkSoon/onCancelPendingWorkhooks kept and ported to the new types (Ref<Ticket>&&,Ticket*).onScheduleWorkSoonnow fires only after upstream's new dead/cancelled-ticket guard, matching theIfActivecontract.runtime/JSDateMath.{h,cpp}(bugs 314414, 318841): upstream movedlastTimeZoneIDinto WTF and gated the cache fast path onUSE(TIME_ZONE_CHANGE_NOTIFICATIONS). Dropped the fork'sJSC::lastTimeZoneID,resetIfNecessary()andtimeZoneChanged(); the fast path is kept for Bun by adding|| USE(BUN_JSC_ADDITIONS)to thehasTimeZoneChange()andretrieveTimeZoneInformation()guards. Bun callers move toWTF::timeZoneDidChange()+DateCache::clearForTimeZoneChange().runtime/JSFinalizationRegistry.cpp: thehasPendingWork()ASSERT Bun guarded withBUN_SKIP_FAILING_ASSERTIONSis gone upstream (replaced byscheduleWorkSoonIfActive+RELEASE_ASSERT(queued)); took upstream.runtime/JSMicrotask.cpp,runtime/MicrotaskQueueInlines.h(bug 318847): upstream's polymorphic microtask call cache and inlinequeueMicrotaskadopted; Bun'sUSE(BUN_JSC_ADDITIONS)async-context wrapping kept.runtime/PropertySlot.h,runtime/SparseArrayValueMap.h(bug 318223): upstream addedLastAttributefor the newSparseArrayEntrystatic_assert.LastAttribute = ConstructableunderBUN_JSC_ADDITIONS, elseDOMJITFunction.wasm/WasmStreamingCompiler.cpp: upstream'sWeakTicketrefactor adopted;BUN_SKIP_FAILING_ASSERTIONSguard preserved around the debug asserts.builtins/BuiltinNames.{h,cpp},runtime/JSGlobalObject.h(bug 318421):intlLegacyConstructedSymbolmoved toJSGlobalObject; fork's explicit-resource-management macro folding kept.wtf/RunLoop.h,wtf/generic/RunLoopGeneric.cpp(bug 318088): upstream addedassertIsCurrent(m_runLoop)inTimerBase::~TimerBaseandstop(). UnderUSE(BUN_EVENT_LOOP)the fork redefinesm_runLoopto(m_runLoop->m_genericState), so the new calls are routed throughm_runLoop->m_parentto reach the owningRunLoop.interpreter/Interpreter.h,tools/JSDollarVM.h,wasm/WasmFormat.h,wasm/WasmTable.h,CMakeLists.txt,b3/B3EliminateWasmGCAllocations.h: upstream changes adopted; fork's quote-style JSC includes kept. TheB3EliminateWasmGCAllocations.hconflict was spurious rename detection against the deletedDeferredWorkTimerInlines.h.Checks
JSType.hdid not change; nosrc/jsc/JSType.rsmirror update needed.Source/WebCore/bindings/scripts/did not change..github/workflows/preserved (fork-only, upstream has none).USE_BUN_JSC_ADDITIONS=ON,USE_BUN_EVENT_LOOP=ON,ENABLE_SANITIZERS=address) compiles clean andjsc -eruns.typeof Temporal === "object"(bug 318885 enables it by default).TicketDatarename,SparseArrayEntry.index(),ArrayBuffer::isDetachable(),clearForTimeZoneChange()).Bun-side API breaks (for the companion oven-sh/bun PR)
DeferredWorkTimer::TicketDatais gone;Ticketis now the class, hook signatures takeRef<Ticket>&&/Ticket*, andTaskisFunction<void(Ticket&)>.DateCache::resetIfNecessarySlow()is gone; callWTF::timeZoneDidChange()thenDateCache::clearForTimeZoneChange().SparseArrayValueMapiteration yieldsconst SparseArrayEntry&; the index is.index(), not.key.ArrayBuffer::isLocked()is gone; use!isDetachable().