Branch: refs/heads/webkitglib/2.46
Home: https://github.com/WebKit/WebKit
Commit: 861d3af01ee102920f1300442646507f3ce301c4
https://github.com/WebKit/WebKit/commit/861d3af01ee102920f1300442646507f3ce301c4
Author: Fujii Hironori <[email protected]>
Date: 2024-09-25 (Wed, 25 Sep 2024)
Changed paths:
M Source/WebCore/workers/service/server/SWServer.cpp
Log Message:
-----------
Cherry-pick 283744@main (5434ca72afd2).
https://bugs.webkit.org/show_bug.cgi?id=279806
Fix use-after-move in SWServer::scheduleJob
https://bugs.webkit.org/show_bug.cgi?id=279806
Reviewed by Chris Dumez.
`jobData` was used after move in SWServer::scheduleJob for Windows
port.
* Source/WebCore/workers/service/server/SWServer.cpp:
(WebCore::SWServer::scheduleJob):
Canonical link: https://commits.webkit.org/283744@main
Canonical link: https://commits.webkit.org/282416.138@webkitglib/2.46
Commit: 15836b92cb35e00ca548f5d00fc9ea0496cc4780
https://github.com/WebKit/WebKit/commit/15836b92cb35e00ca548f5d00fc9ea0496cc4780
Author: Etienne Segonzac <[email protected]>
Date: 2024-09-25 (Wed, 25 Sep 2024)
Changed paths:
A LayoutTests/interaction-region/guard-crash-expected.txt
A LayoutTests/interaction-region/guard-crash.html
M Source/WebCore/rendering/EventRegion.cpp
M Source/WebCore/rendering/EventRegion.h
M
Source/WebKit/UIProcess/RemoteLayerTree/RemoteLayerTreeInteractionRegionLayers.mm
Log Message:
-----------
Cherry-pick 283602@main (42916e1617b6).
https://bugs.webkit.org/show_bug.cgi?id=279584
Fix potential crash with InteractionRegion layers management
https://bugs.webkit.org/show_bug.cgi?id=279584
<rdar://134409589>
Reviewed by Mike Wyrzykowski.
This patches addresses 2 sources of assertion failures which could lead
to a crash:
- duplicate Guard layers covering the same IntRect, breaking the
assertion on the uniqueness of the `<IntRect, InteractionRegion::Type>`
pairs.
- layers reused twice, breaking the assertion on the `insertionPoint`
always being <=the sublayers count.
* Source/WebCore/rendering/EventRegion.h:
* Source/WebCore/rendering/EventRegion.cpp:
(WebCore::EventRegionContext::uniteInteractionRegions):
(WebCore::EventRegionContext::removeSuperfluousInteractionRegions):
Keep track of all guard rects, _including_ the inflated ones we add for
small elements or complex shapes, to avoid duplicates.
We still need to differentiate the two since only the inflated ones can
get collided out in `removeSuperfluousInteractionRegions`.
(WebCore::EventRegionContext::convertGuardContainersToInterationIfNeeded):
Finish migrating the InteractionRegion rect tracking code to use
`HashMap#add()` / `isNewEntry` to avoid extra hash lookups.
*
Source/WebKit/UIProcess/RemoteLayerTree/RemoteLayerTreeInteractionRegionLayers.mm:
(WebKit::updateLayersForInteractionRegions):
Fix a bug where a layer was sometimes not removed from the reusable map
after use.
* LayoutTests/interaction-region/guard-crash-expected.txt: Added.
* LayoutTests/interaction-region/guard-crash.html: Added.
Introduce a test covering those assertion failures.
(The expected layer tree would reveal the bug even in release mode.)
Canonical link: https://commits.webkit.org/283602@main
Canonical link: https://commits.webkit.org/282416.139@webkitglib/2.46
Commit: e182570702b8e4e9193b982ac1c440a81a2fcd4d
https://github.com/WebKit/WebKit/commit/e182570702b8e4e9193b982ac1c440a81a2fcd4d
Author: Jani Hautakangas <[email protected]>
Date: 2024-09-25 (Wed, 25 Sep 2024)
Changed paths:
M Source/WebKit/UIProcess/Automation/libwpe/WebAutomationSessionWPE.cpp
Log Message:
-----------
Cherry-pick 283541@main (133e49a1e0db).
https://bugs.webkit.org/show_bug.cgi?id=279438
[WebDriver][WPE] Mouse interaction simulation needs to take accout device
scale with old API
https://bugs.webkit.org/show_bug.cgi?id=279438
Reviewed by Carlos Garcia Campos.
WebAutomationSession misses scaling mouse interaction simulation in case of
old WPE API.
* Source/WebKit/UIProcess/Automation/libwpe/WebAutomationSessionWPE.cpp:
(WebKit::WebAutomationSession::platformSimulateMouseInteraction):
Canonical link: https://commits.webkit.org/283541@main
Canonical link: https://commits.webkit.org/282416.140@webkitglib/2.46
Commit: 30139de441873ba9da3e9f2892a06df357e94b85
https://github.com/WebKit/WebKit/commit/30139de441873ba9da3e9f2892a06df357e94b85
Author: Vitaly Dyachkov <[email protected]>
Date: 2024-09-25 (Wed, 25 Sep 2024)
Changed paths:
M LayoutTests/TestExpectations
M Source/WebCore/platform/text/SegmentedString.cpp
Log Message:
-----------
Cherry-pick 283540@main (818118e729fb).
https://bugs.webkit.org/show_bug.cgi?id=268217
HTML entity parsing hits SegmentedString::pushBack() assert through
document.write()
https://bugs.webkit.org/show_bug.cgi?id=268217
Reviewed by Chris Dumez and Darin Adler.
When advancing past a single-character substring, we should always mark
such a substring as fully consumed (i.e., set its `length` to `0`),
and add its consumed character number to
`m_numberOfCharactersConsumedPriorToCurrentSubstring`.
* LayoutTests/TestExpectations:
* Source/WebCore/platform/text/SegmentedString.cpp:
(WebCore::SegmentedString::advancePastSingleCharacterSubstringWithoutUpdatingLineNumber):
Canonical link: https://commits.webkit.org/283540@main
Canonical link: https://commits.webkit.org/282416.141@webkitglib/2.46
Commit: 84185f402298f488d1bb48461864758a4f9c75e1
https://github.com/WebKit/WebKit/commit/84185f402298f488d1bb48461864758a4f9c75e1
Author: Matt Woodrow <[email protected]>
Date: 2024-09-25 (Wed, 25 Sep 2024)
Changed paths:
A
LayoutTests/compositing/shared-backing/multiple-backing-sharing-providers-expected.html
A
LayoutTests/compositing/shared-backing/multiple-backing-sharing-providers.html
M
LayoutTests/fast/scrolling/ios/event-region-scale-transform-shared-expected.txt
M
LayoutTests/fast/scrolling/ios/event-region-translate-transform-shared-expected.txt
M Source/WebCore/rendering/RenderLayerCompositor.cpp
M Source/WebCore/rendering/RenderLayerCompositor.h
Log Message:
-----------
Cherry-pick 283515@main (73e553cb3575).
https://bugs.webkit.org/show_bug.cgi?id=279036
REGRESSION(279868@main) Alaska Airlines sign in popup loads behind the
website's search field.
https://bugs.webkit.org/show_bug.cgi?id=279036
<rdar://134911588>
Reviewed by Simon Fraser.
This webpage had multiple backing store providers, and content was
incorrectly
added to the back one, despite overlapping the front one.
The overlap test uses the bounds of the provider, not the to-be-added layer
to
check if it overlaps, and the providers themselves didn't overlap.
This restricts multiple backing store providers to only be used when they're
clipped (as was previously the case), so we can be sure the added layer
doesn't
extend beyond the bounds of the provider. This shouldn't break the
performance
improvement, since we still allow other composited layers to be added
infront.
It does mean in some cases we keep the scroll clipped backing store provider
open, and prevent accumulating sharing layers into a further forward
unclipped
backing provider. I think given the support for multiple open clipped
providers,
this is a good tradeoff.
Ideally, we'd allow accumulating bounds and adding to any provider, but that
seems like a riskier change, as we have to account for scrolling.
This also does a bit of cleanup, unifying the BackingSharingSnapshot and
preDescendantProviderStartLayer using a generation counter. It also adds a
few
more comments, as I found the logic of why we end backing sharing sequences
to
be hard to follow.
*
LayoutTests/compositing/shared-backing/multiple-backing-sharing-providers-expected.html:
Added.
*
LayoutTests/compositing/shared-backing/multiple-backing-sharing-providers.html:
Added.
* Source/WebCore/rendering/RenderLayerCompositor.cpp:
(WebCore::RenderLayerCompositor::BackingSharingState::snapshot const):
(WebCore::RenderLayerCompositor::BackingSharingState::generation const):
(WebCore::RenderLayerCompositor::BackingSharingState::addBackingSharingCandidate):
(WebCore::RenderLayerCompositor::BackingSharingState::endBackingSharingSequence):
(WebCore::RenderLayerCompositor::BackingSharingState::backingProviderCandidateForLayer):
(WebCore::RenderLayerCompositor::computeCompositingRequirements):
(WebCore::RenderLayerCompositor::traverseUnchangedSubtree):
(WebCore::RenderLayerCompositor::updateBackingSharingBeforeDescendantTraversal):
(WebCore::RenderLayerCompositor::updateBackingSharingAfterDescendantTraversal):
* Source/WebCore/rendering/RenderLayerCompositor.h:
Canonical link: https://commits.webkit.org/283515@main
Canonical link: https://commits.webkit.org/282416.142@webkitglib/2.46
Commit: 112166db5a9a7ce5bc3da6b3525089ba17255389
https://github.com/WebKit/WebKit/commit/112166db5a9a7ce5bc3da6b3525089ba17255389
Author: Jer Noble <[email protected]>
Date: 2024-09-25 (Wed, 25 Sep 2024)
Changed paths:
M Source/WebCore/Modules/webaudio/AudioWorkletGlobalScope.cpp
Log Message:
-----------
Cherry-pick 283510@main (f81ff1af098d).
https://bugs.webkit.org/show_bug.cgi?id=279537
CRASH: JSC::construct() under AudioWorkletGlobalScope::createProcessor()
https://bugs.webkit.org/show_bug.cgi?id=279537
rdar://133488018
Reviewed by Ryan Reno.
JSCallbackData's m_callback ivar is weakly held, so it must be null-checked
at access time.
* Source/WebCore/Modules/webaudio/AudioWorkletGlobalScope.cpp:
(WebCore::AudioWorkletGlobalScope::createProcessor):
Canonical link: https://commits.webkit.org/283510@main
Canonical link: https://commits.webkit.org/282416.143@webkitglib/2.46
Commit: 8467fdfde3848ce1f50088c8a4f7c335ea2aedb9
https://github.com/WebKit/WebKit/commit/8467fdfde3848ce1f50088c8a4f7c335ea2aedb9
Author: Said Abou-Hallawa <[email protected]>
Date: 2024-09-25 (Wed, 25 Sep 2024)
Changed paths:
A LayoutTests/fast/canvas/canvas-filter-text-drawing-expected.html
A LayoutTests/fast/canvas/canvas-filter-text-drawing.html
A LayoutTests/fast/canvas/canvas-layer-filter-text-drawing-expected.html
A LayoutTests/fast/canvas/canvas-layer-filter-text-drawing.html
M LayoutTests/platform/glib/TestExpectations
M Source/WebCore/html/canvas/CanvasRenderingContext2DBase.cpp
Log Message:
-----------
Cherry-pick 283451@main (59e4b7c01999).
https://bugs.webkit.org/show_bug.cgi?id=279348
Crash happens when applying filter and drawing text in 2D canvas
https://bugs.webkit.org/show_bug.cgi?id=279348
rdar://135455808
Reviewed by Simon Fraser.
CanvasRenderingContext2DBase::drawTextUnchecked() calls fontProxy() which
returns
a pointer to state().font. Then drawTextUnchecked() calls save() through
CanvasFilterContextSwitcher::create(). This save() appends a new state to
m_stateStack. Vector::append() may reallocate its buffer. Reallocating the
buffer
will make the pointer to fontProxy() invalid. This causes a crash when
accessing
the members of fontProxy.
To fix this make sure, CanvasRenderingContext2D::fontProxy() is called after
calling CanvasFilterContextSwitcher::create().
* LayoutTests/fast/canvas/canvas-filter-text-drawing-expected.html: Added.
* LayoutTests/fast/canvas/canvas-filter-text-drawing.html: Added.
* LayoutTests/fast/canvas/canvas-layer-filter-text-drawing-expected.html:
Added.
* LayoutTests/fast/canvas/canvas-layer-filter-text-drawing.html: Added.
* LayoutTests/platform/glib/TestExpectations:
* Source/WebCore/html/canvas/CanvasRenderingContext2DBase.cpp:
(WebCore::CanvasRenderingContext2DBase::drawTextUnchecked):
Canonical link: https://commits.webkit.org/283451@main
Canonical link: https://commits.webkit.org/282416.144@webkitglib/2.46
Commit: 6043664de3985910667e09d4145d810858b48902
https://github.com/WebKit/WebKit/commit/6043664de3985910667e09d4145d810858b48902
Author: Aditya Keerthi <[email protected]>
Date: 2024-09-25 (Wed, 25 Sep 2024)
Changed paths:
A LayoutTests/editing/deleting/delete-picture-expected.txt
A LayoutTests/editing/deleting/delete-picture.html
A LayoutTests/editing/deleting/delete-text-before-picture-expected.txt
A LayoutTests/editing/deleting/delete-text-before-picture.html
M Source/WebCore/editing/DeleteSelectionCommand.cpp
Log Message:
-----------
Cherry-pick 283457@main (1d56845bb42e).
https://bugs.webkit.org/show_bug.cgi?id=279467
Deleting content immediately before a `<picture>` unexpectedly removes
`<source>`s
https://bugs.webkit.org/show_bug.cgi?id=279467
rdar://128100106
Reviewed by Wenson Hsieh and Abrar Rahman Protyasha.
`<picture>` elements may contain one or more `<source>` elements (which are
not
rendered) and an `<img>` element. When making selections around a
`<picture>`
element, the selection is anchored before or after the `<img>` child.
Consequently, when the selection is visually before a `<picture>` element,
and
deletion is performed, all `<source>` elements before the selection are also
removed. This is incorrect, as the `<picture>` element and all its children
should
be left intact.
Fix by avoiding removal of nodes that have a parent node which cannot have
children for editing. Only the direct parent is checked, since traversal is
performed in document order.
A longer term solution would be to (again) experiment with making
`canContainRangeEndPoint` return `false` for `HTMLPictureElement`. That
change would
solve this issue by ensuring the selection could never be inside a
`<picture>`.
However, that change is much higher risk, and also causes other selection
related
issues, which need to be investigated independently.
* LayoutTests/editing/deleting/delete-picture-expected.txt: Added.
* LayoutTests/editing/deleting/delete-picture.html: Added.
Test already working behavior to delete a `<picture> element.
* LayoutTests/editing/deleting/delete-text-before-picture-expected.txt:
Added.
* LayoutTests/editing/deleting/delete-text-before-picture.html: Added.
Test the issue fixed by this patch.
* Source/WebCore/editing/DeleteSelectionCommand.cpp:
(WebCore::DeleteSelectionCommand::handleGeneralDelete):
Canonical link: https://commits.webkit.org/283457@main
Canonical link: https://commits.webkit.org/282416.145@webkitglib/2.46
Commit: c591879306ae302b0242c86c56f85c6cda433127
https://github.com/WebKit/WebKit/commit/c591879306ae302b0242c86c56f85c6cda433127
Author: Vitaly Dyachkov <[email protected]>
Date: 2024-09-25 (Wed, 25 Sep 2024)
Changed paths:
M LayoutTests/TestExpectations
M Source/WebCore/cssjit/SelectorCompiler.cpp
Log Message:
-----------
Cherry-pick 283428@main (b9e946421ea6).
https://bugs.webkit.org/show_bug.cgi?id=278654
[Debug] ASSERTION FAILED on `fast/rendering/render-list-marker-select.html`
https://bugs.webkit.org/show_bug.cgi?id=278654
Reviewed by Matthieu Dubet.
Do not compile `:is()` selector if it contains a pseudo-element subselector.
* LayoutTests/TestExpectations:
* Source/WebCore/cssjit/SelectorCompiler.cpp:
(WebCore::SelectorCompiler::addPseudoClassType)
Canonical link: https://commits.webkit.org/283428@main
Canonical link: https://commits.webkit.org/282416.146@webkitglib/2.46
Commit: 3e35d6447d1d10db6d318e97d2b6ffe0d674a233
https://github.com/WebKit/WebKit/commit/3e35d6447d1d10db6d318e97d2b6ffe0d674a233
Author: Jean-Yves Avenard <[email protected]>
Date: 2024-09-25 (Wed, 25 Sep 2024)
Changed paths:
M LayoutTests/platform/mac/TestExpectations
M Source/WebCore/Modules/mediasession/MediaSession.cpp
M Source/WebCore/Modules/mediasession/MediaSession.h
Log Message:
-----------
Cherry-pick 283269@main (e7ba88dca5e7).
https://bugs.webkit.org/show_bug.cgi?id=278052
REGRESSION (282158@main): [macOS] inspector/console/webcore-logging.html is
a flaky failure
https://bugs.webkit.org/show_bug.cgi?id=278052
rdar://133791485
Reviewed by Eric Carlson.
Don't add default `favicon.ico` to the list of icons to retrieve if the
document is local.
Don't attempt to use favicons that aren't served over HTTP. The
DocumentLoader automatically adds
a search for '/favicon.ico' of none were set in the Document.
Attempting to load a non-existent icon caused unnecessary verbosity in the
web inspector's console
which caused the test to intermittently fail.
Covered by existing tests and the re-enabled one.
* LayoutTests/platform/mac/TestExpectations:
* Source/WebCore/Modules/mediasession/MediaSession.cpp:
(WebCore::fallbackArtwork):
(WebCore::MediaSession::updateNowPlayingInfo):
* Source/WebCore/Modules/mediasession/MediaSession.h:
Canonical link: https://commits.webkit.org/283269@main
Canonical link: https://commits.webkit.org/282416.147@webkitglib/2.46
Commit: 2921c5f62577ea49de19fd04c8a6f265b818dc47
https://github.com/WebKit/WebKit/commit/2921c5f62577ea49de19fd04c8a6f265b818dc47
Author: Ryosuke Niwa <[email protected]>
Date: 2024-09-25 (Wed, 25 Sep 2024)
Changed paths:
M Source/WebCore/platform/Timer.cpp
M Source/WebCore/platform/ios/wak/WebCoreThread.h
M Source/WebCore/platform/ios/wak/WebCoreThread.mm
Log Message:
-----------
Cherry-pick 283280@main (d9fd562a20d0).
https://bugs.webkit.org/show_bug.cgi?id=279275
Release assert in TimerBase::TimerBase on a worker thread
https://bugs.webkit.org/show_bug.cgi?id=279275
Reviewed by Chris Dumez.
Allow the release assert to pass in worker threads.
* Source/WebCore/platform/Timer.cpp:
(WebCore::TimerBase::TimerBase):
(WebCore::TimerBase::setNextFireTime):
* Source/WebCore/platform/ios/wak/WebCoreThread.h:
* Source/WebCore/platform/ios/wak/WebCoreThread.mm:
(WebThreadIsLockedOrDisabledInMainOrWebThread):
Canonical link: https://commits.webkit.org/283280@main
Canonical link: https://commits.webkit.org/282416.148@webkitglib/2.46
Commit: bdf8541e682492b0a2da2ad770d368e4da8ed836
https://github.com/WebKit/WebKit/commit/bdf8541e682492b0a2da2ad770d368e4da8ed836
Author: Said Abou-Hallawa <[email protected]>
Date: 2024-09-25 (Wed, 25 Sep 2024)
Changed paths:
M Source/WebCore/platform/graphics/BitmapImageSource.cpp
Log Message:
-----------
Cherry-pick 283241@main (926b6385eb9e).
https://bugs.webkit.org/show_bug.cgi?id=279221
REGRESSION(276827@main): Possible null pointer dereferencing when an image
frame finishes decoding while the document is getting closed
https://bugs.webkit.org/show_bug.cgi?id=279221
rdar://133487516
Reviewed by Simon Fraser.
When the image decoding thread finishes decoding an image frame, don't cache
this frame unless the ImageDecoder is still available.
The callers of cacheMetadataAtIndex() and cacheNativeImageAtIndex() will
ensure
the ImageDecoder is still available before calling these functions.
* Source/WebCore/platform/graphics/BitmapImageSource.cpp:
(WebCore::BitmapImageSource::imageFrameDecodeAtIndexHasFinished):
(WebCore::BitmapImageSource::cacheNativeImageAtIndex):
Canonical link: https://commits.webkit.org/283241@main
Canonical link: https://commits.webkit.org/282416.149@webkitglib/2.46
Commit: 4e3edb71c8ea8326b9a4429417ceb3cabc47aa2c
https://github.com/WebKit/WebKit/commit/4e3edb71c8ea8326b9a4429417ceb3cabc47aa2c
Author: Pawel Lampe <[email protected]>
Date: 2024-09-25 (Wed, 25 Sep 2024)
Changed paths:
M Source/WebCore/css/FontFace.cpp
Log Message:
-----------
Cherry-pick 284210@main (a05bcda9fa15).
https://bugs.webkit.org/show_bug.cgi?id=280264
Unable to load a font face on nxp imx6 platform
https://bugs.webkit.org/show_bug.cgi?id=280264
Reviewed by Adrian Perez de Castro.
This change extends GCC bug workaround for ARM32 platforms as well.
* Source/WebCore/css/FontFace.cpp:
(WebCore::FontFace::create):
Canonical link: https://commits.webkit.org/284210@main
Canonical link: https://commits.webkit.org/282416.150@webkitglib/2.46
Commit: 71f816fba474e72f7ed029b7b38e90cf1e352bd9
https://github.com/WebKit/WebKit/commit/71f816fba474e72f7ed029b7b38e90cf1e352bd9
Author: Charlie Wolfe <[email protected]>
Date: 2024-09-25 (Wed, 25 Sep 2024)
Changed paths:
M Source/WebKit/Platform/IPC/Connection.h
Log Message:
-----------
herry-pick 283163@main (21bdf1ac2bca).
https://bugs.webkit.org/show_bug.cgi?id=279078
REGRESSION(282321@main): `MESSAGE_CHECK_WITH_MESSAGE_BASE()` does not
return on failure
https://bugs.webkit.org/show_bug.cgi?id=279078
rdar://135007825
Reviewed by Ryosuke Niwa and Sihui Liu.
282321@main removed function returns that would happen if an IPC message
check failed, so we started to
use some invalid objects.
* Source/WebKit/Platform/IPC/Connection.h:
Canonical link: https://commits.webkit.org/283163@main
Canonical link: https://commits.webkit.org/282416.151@webkitglib/2.46
Compare: https://github.com/WebKit/WebKit/compare/5ec13d6e7ae3...71f816fba474
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
