Branch: refs/heads/safari-7624.5.1.11-branch
Home: https://github.com/WebKit/WebKit
Commit: cb28d6b7a1f61fe33bf365ef19933b1d1d07168c
https://github.com/WebKit/WebKit/commit/cb28d6b7a1f61fe33bf365ef19933b1d1d07168c
Author: Mohsin Qureshi <[email protected]>
Date: 2026-07-22 (Wed, 22 Jul 2026)
Changed paths:
R
LayoutTests/fast/canvas/offscreen-canvas-measureText-unrealized-font-crash-expected.txt
R
LayoutTests/fast/canvas/offscreen-canvas-measureText-unrealized-font-crash.html
M Source/WebCore/html/canvas/CanvasRenderingContext2DBase.cpp
Log Message:
-----------
Revert e285624d2fce. rdar://181710351
CheerG did not approve rdar://181710351 to submit; reverting from
safari-7624.5.1.11-branch to match approved content.
Canonical link: https://commits.webkit.org/[email protected]
Commit: 9a43918ccd7b812521f14699997fc0fb880f6aed
https://github.com/WebKit/WebKit/commit/9a43918ccd7b812521f14699997fc0fb880f6aed
Author: Mohsin Qureshi <[email protected]>
Date: 2026-07-22 (Wed, 22 Jul 2026)
Changed paths:
M Source/WebKit/UIProcess/WebPageProxy.cpp
M Tools/TestWebKitAPI/Tests/WebKitCocoa/PasteImage.mm
Log Message:
-----------
Revert 124fc4324a5a. rdar://181739239
CheerG did not approve rdar://181739239 to submit; reverting from
safari-7624.5.1.11-branch to match approved content.
Canonical link: https://commits.webkit.org/[email protected]
Commit: 0a137d83dbee8b96d150fc588b9898979a859a1a
https://github.com/WebKit/WebKit/commit/0a137d83dbee8b96d150fc588b9898979a859a1a
Author: Mohsin Qureshi <[email protected]>
Date: 2026-07-22 (Wed, 22 Jul 2026)
Changed paths:
M Source/ThirdParty/libwebrtc/Source/webrtc/rtc_base/event.cc
Log Message:
-----------
Revert 3c99db1f1186. rdar://181124228
CheerG did not approve rdar://181124228 to submit; reverting from
safari-7624.5.1.11-branch to match approved content.
Canonical link: https://commits.webkit.org/[email protected]
Commit: 4da049db8acb010cd96682d5ddb014299e5328e0
https://github.com/WebKit/WebKit/commit/4da049db8acb010cd96682d5ddb014299e5328e0
Author: Devin Rousso <[email protected]>
Date: 2026-07-22 (Wed, 22 Jul 2026)
Changed paths:
A LayoutTests/inspector/animation/keyframes-custom-property-expected.txt
A LayoutTests/inspector/animation/keyframes-custom-property.html
M Source/WebCore/inspector/agents/InspectorAnimationAgent.cpp
Log Message:
-----------
Cherry-pick 401e156fe3e8. rdar://182883114
Web Inspector: Crash when opened with CSS Variable @keyframes Animation
https://bugs.webkit.org/show_bug.cgi?id=283981
<rdar://problem/140880870>
Reviewed by Antoine Quint.
Custom properties in a keyframe should be serialized from the keyframe's
own style instead of the current computed style.
* Source/WebCore/inspector/agents/InspectorAnimationAgent.cpp:
(WebCore::buildObjectForKeyframes):
* LayoutTests/inspector/animation/keyframes-custom-property.html: Added.
* LayoutTests/inspector/animation/keyframes-custom-property-expected.txt:
Added.
Canonical link: https://commits.webkit.org/316540@main
Canonical link: https://commits.webkit.org/[email protected]
Commit: 95068ef9b427b068bf6dca6731d4058c5d0438a2
https://github.com/WebKit/WebKit/commit/95068ef9b427b068bf6dca6731d4058c5d0438a2
Author: Mohsin Qureshi <[email protected]>
Date: 2026-07-22 (Wed, 22 Jul 2026)
Changed paths:
M Configurations/Version.xcconfig
Log Message:
-----------
Versioning. WebKit-7624.5.1.11.1
Canonical link: https://commits.webkit.org/[email protected]
Commit: 71bc7c3636a5e250f9b7fe6cdfc337e7b0378c4d
https://github.com/WebKit/WebKit/commit/71bc7c3636a5e250f9b7fe6cdfc337e7b0378c4d
Author: Abrar Rahman Protyasha <[email protected]>
Date: 2026-07-31 (Fri, 31 Jul 2026)
Changed paths:
M
Source/WebKit/UIProcess/RemoteLayerTree/mac/RemoteLayerTreeDrawingAreaProxyMac.h
M
Source/WebKit/UIProcess/RemoteLayerTree/mac/RemoteLayerTreeDrawingAreaProxyMac.mm
M
Source/WebKit/UIProcess/RemoteLayerTree/mac/RemoteLayerTreeEventDispatcher.h
M
Source/WebKit/UIProcess/RemoteLayerTree/mac/RemoteLayerTreeEventDispatcher.mm
Log Message:
-----------
REGRESSION([email protected]): UI process crash under
DisplayLink callbacks for RemoteLayerTree DisplayLink clients
rdar://183524149
Reviewed by NOBODY.
The UI process crashes on the CVDisplayLink thread in when calling
displayLinkFired() on a DisplayLink::Client that was freed while still
registered. Two independent teardown paths can leave a client registered
at destruction. This commit fixes both:
1. We cherry-pick 314099@main (rdar://178074044) to address the issue
where a client is never removed if existingDisplayLink() returns null.
2. More importantly, [email protected] dropped the
if (mED) guard around startOrStopDisplayLink() when stopping the
displayDidRefresh callbacks. That method is re-entered during teardown
since invalidate() destroys mED and its destructor calls back through
into stopDisplayDidRefreshCallbacks().
Without the guard, startOrStopDisplayLink() re-adds the DisplayLink
client that invalidate() just removed via removeDisplayLinkClient().
The client is then freed, so the next display refresh invokes
displayLinkFired() on a freed client, producing a UAF.
We fix the latter by re-introducing the if (mED) guard dropped in the
regressing commit.
*
Source/WebKit/UIProcess/RemoteLayerTree/mac/RemoteLayerTreeDrawingAreaProxyMac.h:
*
Source/WebKit/UIProcess/RemoteLayerTree/mac/RemoteLayerTreeDrawingAreaProxyMac.mm:
(WebKit::RemoteLayerTreeDrawingAreaProxyMac::RemoteLayerTreeDrawingAreaProxyMac):
(WebKit::RemoteLayerTreeDrawingAreaProxyMac::~RemoteLayerTreeDrawingAreaProxyMac):
* Source/WebKit/UIProcess/RemoteLayerTree/mac/RemoteLayerTreeEventDispatcher.h:
* Source/WebKit/UIProcess/RemoteLayerTree/mac/RemoteLayerTreeEventDispatcher.mm:
(WebKit::RemoteLayerTreeEventDispatcher::removeDisplayLinkClient):
(WebKit::RemoteLayerTreeEventDispatcher::stopDisplayDidRefreshCallbacks):
(cherry picked from commit 3e0f5a301b019de6f8f2fec85586c85f51f5bb47)
Canonical link: https://commits.webkit.org/[email protected]
Commit: 491d690f7da151b59c086ae0466012a780ed70c3
https://github.com/WebKit/WebKit/commit/491d690f7da151b59c086ae0466012a780ed70c3
Author: Ishaan Kohli <[email protected]>
Date: 2026-07-31 (Fri, 31 Jul 2026)
Changed paths:
M Configurations/Version.xcconfig
Log Message:
-----------
Versioning. WebKit-7624.5.1.11.2
Canonical link: https://commits.webkit.org/[email protected]
Commit: ff4bd2b184b6308452c1728bd848561517cc7905
https://github.com/WebKit/WebKit/commit/ff4bd2b184b6308452c1728bd848561517cc7905
Author: Mohsin Qureshi <[email protected]>
Date: 2026-08-12 (Wed, 12 Aug 2026)
Changed paths:
M Configurations/Version.xcconfig
Log Message:
-----------
Versioning. WebKit-7624.5.1.11.3
Canonical link: https://commits.webkit.org/[email protected]
Commit: 26695efdefc6076049ec50713a2c4e54b90b4d47
https://github.com/WebKit/WebKit/commit/26695efdefc6076049ec50713a2c4e54b90b4d47
Author: Matthew Finkel <[email protected]>
Date: 2026-08-12 (Wed, 12 Aug 2026)
Changed paths:
M Source/WebKit/NetworkProcess/webrtc/NetworkRTCUtilitiesCocoa.h
M Source/WebKit/NetworkProcess/webrtc/NetworkRTCUtilitiesCocoa.mm
M
Source/WebKit/NetworkProcess/webtransport/cocoa/NetworkTransportSessionCocoa.mm
Log Message:
-----------
Cherry-pick ca088424bb54. rdar://184669124
[cocoa] WebTransport is not marking connections
https://bugs.webkit.org/show_bug.cgi?id=321065
rdar://184076013
Reviewed by Rupin Mittal and Brady Eidson.
WebTransport connections aren't correctly marked in two ways:
1) correctly delegating the connection from the application
2) marking connections to known tracking domains
Therefore, the networking stack can't make informed decisions about how the
connection should be routed. For example, in some cases, these connections
should be proxied instead of allowing a direct connection to the server.
WebRTC already correctly supports this behavior, so this patch simply
leverages
those existing helper functions. I adjusted the LibWebRTC guard so it only
protects the WebRTC-specific behavior.
* Source/WebKit/NetworkProcess/webrtc/NetworkRTCUtilitiesCocoa.h:
* Source/WebKit/NetworkProcess/webrtc/NetworkRTCUtilitiesCocoa.mm:
(WebKit::setNWParametersTrackerOptions):
*
Source/WebKit/NetworkProcess/webtransport/cocoa/NetworkTransportSessionCocoa.mm:
(WebKit::createParameters):
Identifier: 316606.331@safari-7625-branch
Canonical link: https://commits.webkit.org/[email protected]
Compare: https://github.com/WebKit/WebKit/compare/cb28d6b7a1f6%5E...26695efdefc6
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
