Branch: refs/heads/safari-7620.1.16.10-branch
Home: https://github.com/WebKit/WebKit
Commit: 8600f7e4a76088995b4272dcf08ea34c1c8ea7e9
https://github.com/WebKit/WebKit/commit/8600f7e4a76088995b4272dcf08ea34c1c8ea7e9
Author: Mohsin Qureshi <[email protected]>
Date: 2024-11-06 (Wed, 06 Nov 2024)
Changed paths:
M Configurations/Version.xcconfig
Log Message:
-----------
Versioning.
WebKit-7620.1.16.10.1
Canonical link: https://commits.webkit.org/[email protected]
Commit: d6b783be87f255d38b8db17767fd22263b5e0229
https://github.com/WebKit/WebKit/commit/d6b783be87f255d38b8db17767fd22263b5e0229
Author: Kiet Ho <[email protected]>
Date: 2024-11-06 (Wed, 06 Nov 2024)
Changed paths:
A LayoutTests/fast/dom/view-transition-lifetime-crash-expected.txt
A LayoutTests/fast/dom/view-transition-lifetime-crash.html
M Source/WebCore/Modules/screen-wake-lock/WakeLockManager.cpp
M Source/WebCore/Modules/screen-wake-lock/WakeLockManager.h
M Source/WebCore/Modules/screen-wake-lock/WakeLockSentinel.cpp
M Source/WebCore/dom/Document.cpp
M Source/WebCore/dom/ViewTransition.cpp
M Source/WebCore/dom/ViewTransition.h
M Source/WebCore/dom/VisibilityChangeClient.h
Log Message:
-----------
Cherry-pick c8d323b1851e. rdar://138799302
REGRESSION (283084@main): Document::visibilityStateChanged does not hold
reference to callback clients
rdar://138799302
https://bugs.webkit.org/show_bug.cgi?id=282360
Reviewed by Tim Nguyen, Ryosuke Niwa, and Chris Dumez.
Document::visibilityStateChanged() invokes visibility state callback
clients, but does not
hold a reference to them before invoking. The client could then
accidentally free itself
and cause an UAF. One possible route that leads to an UAF is through
ViewTransition,
which the test case demonstrates:
* The ViewTransition C++ objects are allocated by
document.startViewTransition().
After the call, each object has a ref count of at least 2 (one in the JS
wrapper
that wraps the C++ object, one in Document::m_activeViewTransition)
* The GC is invoked, which releases the JS wrappers and decreases the ref
count to 1
* The document visibility state is changed. This invokes
ViewTransition::visibilityStateChanged
on each object, which calls ::skipViewTransition, which calls
::clearViewTransition.
::clearViewTransition sets Document::m_activeViewTransition to null, so
the object ref
count is 0 and it's deallocated. ::clearViewTransition then continues to
modify the
(already deallocated) object, leading to an UAF.
Fix this by holding a reference to the callback clients before invoking it.
This involves
making VisibilityChangeClient ref counted. Then
Document::visibilityStateChanged()
would hold a reference to the client before invoking it. As WakeLockManager
(which inherits VisibilityChangeClient) wasn't ref counted, this patch also
makes it
ref counted.
It's also observed that the JS wrapper should not be deallocated by the GC
before the
view transition has completed. This commit fixes this by implementing
ViewTransition::virtualHasPendingActivity(), which the GC consults to
determine whether
to deallocate the wrapper or not.
* LayoutTests/fast/dom/view-transition-lifetime-crash-expected.txt: Added.
* LayoutTests/fast/dom/view-transition-lifetime-crash.html: Added.
* Source/WebCore/Modules/screen-wake-lock/WakeLockManager.cpp:
(WebCore::WakeLockManager::ref const): Delegated ref() to the document.
(WebCore::WakeLockManager::deref const): Delegated deref() to the document.
* Source/WebCore/Modules/screen-wake-lock/WakeLockManager.h: Made
WakeLockManager ref counted by declaring ref() and deref().
* Source/WebCore/Modules/screen-wake-lock/WakeLockSentinel.cpp:
(WebCore::WakeLockSentinel::release): Hold a reference to the document's
WakeLockManager before using it.
* Source/WebCore/dom/Document.cpp:
(WebCore::Document::visibilityStateChanged): Hold a reference to the
visibility state callback client before calling it.
(WebCore::Document::wakeLockManager): Used makeUniqueWithoutRefCountedCheck
to create new WakeLockManager.
* Source/WebCore/dom/ViewTransition.cpp:
(WebCore::ViewTransition::virtualHasPendingActivity const): Added
implementation.
* Source/WebCore/dom/ViewTransition.h:
* Source/WebCore/dom/VisibilityChangeClient.h: Made VisibilityChangeClient
ref counted.
Canonical link: https://commits.webkit.org/286136@main
Commit: 95592e593a068e068e9b186ebb26980ceb429ec5
https://github.com/WebKit/WebKit/commit/95592e593a068e068e9b186ebb26980ceb429ec5
Author: Dan Hecht <[email protected]>
Date: 2024-11-06 (Wed, 06 Nov 2024)
Changed paths:
M Source/JavaScriptCore/wasm/WasmModuleInformation.h
M Source/JavaScriptCore/wasm/WasmParser.h
M Source/JavaScriptCore/wasm/WasmSectionParser.cpp
M Source/JavaScriptCore/wasm/WasmTypeDefinition.cpp
M Source/JavaScriptCore/wasm/WasmTypeDefinition.h
M Source/JavaScriptCore/wasm/WasmTypeDefinitionInlines.h
Log Message:
-----------
Cherry-pick 3ec2959867b0. rdar://139266352
[JSC] Fix ref-counting issues with Wasm GC types
https://bugs.webkit.org/show_bug.cgi?id=282576
rdar://139244985
Reviewed by Yusuke Suzuki.
While parsing the wasm type section there are windows where
reference counts to a Wasm GC TypeDefinitions are not held
by the parser. During these windows, a
TypeInformation::tryCleanup() could free these
types out from under the parser. Close these windows.
Also add asserts to help verify and document.
The windows were:
1. parseRecursionGroup() needs to hold ref counts to each
element until it constructs the recursion group, which
takes ownership.
2. parseRecursionGroup() needs to create its projections
and hold references while they are being linked together.
3. While replacing placeholders, we need to be careful to
continue holding a ref count until the unrolling cache
takes ownership.
Also, RTT::tryCreateRTT() was missing an adoptRef which
I think would cause these to leak.
After parsing, everythng is owned by the parser's
WasmModuleInformation either directly, indirectly through
the TypeDefinition tree of (manual kept) ref counts, or
indirectly via the TypeInformation caches (which tie the
lifetime of the value to the key).
In addition to the added asserts, I also ran the
javascriptcore test with more instrumentation added
to TypeDefinition::deref() to help ensure references are no
longer dropped at the wrong times.
* Source/JavaScriptCore/wasm/WasmModuleInformation.h:
* Source/JavaScriptCore/wasm/WasmParser.h:
(JSC::Wasm::ParserBase::parseValueType):
* Source/JavaScriptCore/wasm/WasmSectionParser.cpp:
(JSC::Wasm::SectionParser::parseType):
(JSC::Wasm::SectionParser::parseRecursionGroup):
(JSC::Wasm::SectionParser::parseSubtype):
* Source/JavaScriptCore/wasm/WasmTypeDefinition.cpp:
(JSC::Wasm::TypeDefinition::substitute):
(JSC::Wasm::substituteParent):
(JSC::Wasm::TypeDefinition::replacePlaceholders const):
(JSC::Wasm::TypeDefinition::unroll const):
(JSC::Wasm::RTT::tryCreateRTT):
(JSC::Wasm::TypeInformation::addCachedUnrolling):
(JSC::Wasm::TypeInformation::tryCleanup):
* Source/JavaScriptCore/wasm/WasmTypeDefinition.h:
(JSC::Wasm::TypeDefinition::unownedIndex const):
(JSC::Wasm::TypeDefinition::index const): Deleted.
* Source/JavaScriptCore/wasm/WasmTypeDefinitionInlines.h:
(JSC::Wasm::TypeDefinition::index const):
(JSC::Wasm::TypeInformation::get):
Canonical link: https://commits.webkit.org/286140@main
Commit: 878d9bc480d4bfeede2476471c5bb7bb7743366f
https://github.com/WebKit/WebKit/commit/878d9bc480d4bfeede2476471c5bb7bb7743366f
Author: Daniel Liu <[email protected]>
Date: 2024-11-06 (Wed, 06 Nov 2024)
Changed paths:
A JSTests/stress/string-add-conversion-unused.js
M Source/JavaScriptCore/dfg/DFGBackwardsPropagationPhase.cpp
Log Message:
-----------
Cherry-pick 299278ffc3f1. rdar://139373680
DFG ToString should only care about Other uses when it can be Other
https://bugs.webkit.org/show_bug.cgi?id=282661
rdar://138325184
Reviewed by Yusuke Suzuki.
DFG's ToString should only backpropagate a UseAsOther when the use
has the potential to be Other. Otherwise, we end up with a mismatch
in expected value formats.
* Source/JavaScriptCore/dfg/DFGBackwardsPropagationPhase.cpp:
(JSC::DFG::BackwardsPropagationPhase::propagate):
Canonical link: https://commits.webkit.org/283286.438@safari-7620-branch
Commit: 60ee026bd2fe1a9d1749ab5c11499c1d15eefd68
https://github.com/WebKit/WebKit/commit/60ee026bd2fe1a9d1749ab5c11499c1d15eefd68
Author: Chris Dumez <[email protected]>
Date: 2024-11-06 (Wed, 06 Nov 2024)
Changed paths:
M Source/WebKit/UIProcess/Downloads/DownloadProxy.cpp
M Source/WebKit/UIProcess/Downloads/DownloadProxy.h
M Source/WebKit/UIProcess/Downloads/DownloadProxyMap.cpp
M Source/WebKit/UIProcess/Downloads/DownloadProxyMap.h
M Source/WebKit/UIProcess/Network/NetworkProcessProxy.cpp
Log Message:
-----------
Cherry-pick 786ff813716f. rdar://138845738
Cherry-pick 9f69376c782b. rdar://138845738
Cherry-pick 286182@main (9f69376c782b). rdar://138845738
Crash under DownloadProxy::~DownloadProxy()
https://bugs.webkit.org/show_bug.cgi?id=282611
rdar://138845738
Reviewed by Geoffrey Garen.
DownloadProxy is ref-counted and thus can outlive its
DownloadProxyMap.
As a result, DownloadProxy cannot hold a CheckedRef to its
DownloadProxyMap.
Switching to a WeakPtr instead.
* Source/WebKit/UIProcess/Downloads/DownloadProxy.cpp:
(WebKit::DownloadProxy::cancel):
(WebKit::DownloadProxy::didFinish):
(WebKit::DownloadProxy::didFail):
* Source/WebKit/UIProcess/Downloads/DownloadProxy.h:
* Source/WebKit/UIProcess/Downloads/DownloadProxyMap.cpp:
(WebKit::DownloadProxyMap::ref const):
(WebKit::DownloadProxyMap::deref const):
* Source/WebKit/UIProcess/Downloads/DownloadProxyMap.h:
* Source/WebKit/UIProcess/Network/NetworkProcessProxy.cpp:
(WebKit::NetworkProcessProxy::createDownloadProxy):
Canonical link: https://commits.webkit.org/286182@main
Commit: a2bbec32ef7378ee533a0d5aecaa2d7190e8a7e6
https://github.com/WebKit/WebKit/commit/a2bbec32ef7378ee533a0d5aecaa2d7190e8a7e6
Author: Timothy Hatcher <[email protected]>
Date: 2024-11-06 (Wed, 06 Nov 2024)
Changed paths:
M Source/WebKit/WebProcess/Extensions/API/Cocoa/WebExtensionAPIEventCocoa.mm
M
Source/WebKit/WebProcess/Extensions/API/Cocoa/WebExtensionAPIWebNavigationEventCocoa.mm
M
Source/WebKit/WebProcess/Extensions/API/Cocoa/WebExtensionAPIWebRequestEventCocoa.mm
M
Source/WebKit/WebProcess/Extensions/API/Cocoa/WebExtensionAPIWindowsEventCocoa.mm
M
Source/WebKit/WebProcess/Extensions/Cocoa/_WKWebExtensionWebRequestFilter.h
M
Source/WebKit/WebProcess/Extensions/Cocoa/_WKWebExtensionWebRequestFilter.mm
M Tools/TestWebKitAPI/Tests/WebKitCocoa/WKWebExtensionAPIAlarms.mm
M Tools/TestWebKitAPI/Tests/WebKitCocoa/WKWebExtensionAPIWebNavigation.mm
M Tools/TestWebKitAPI/Tests/WebKitCocoa/WKWebExtensionAPIWebRequest.mm
M Tools/TestWebKitAPI/Tests/WebKitCocoa/WKWebExtensionAPIWindows.mm
Log Message:
-----------
Cherry-pick 0628c831bdfb. rdar://139395506
Crash under WebExtensionCallbackHandler::call() when removing event
listener.
https://webkit.org/b/282723
rdar://139326901
Reviewed by Brian Weinstein.
Make a copy of the listeners vector before iterating over it.
*
Source/WebKit/WebProcess/Extensions/API/Cocoa/WebExtensionAPIEventCocoa.mm:
(WebKit::WebExtensionAPIEvent::invokeListeners):
(WebKit::WebExtensionAPIEvent::invokeListenersWithArgument):
*
Source/WebKit/WebProcess/Extensions/API/Cocoa/WebExtensionAPIWebNavigationEventCocoa.mm:
(WebKit::WebExtensionAPIWebNavigationEvent::invokeListenersWithArgument):
*
Source/WebKit/WebProcess/Extensions/API/Cocoa/WebExtensionAPIWebRequestEventCocoa.mm:
(WebKit::WebExtensionAPIWebRequestEvent::invokeListenersWithArgument):
*
Source/WebKit/WebProcess/Extensions/API/Cocoa/WebExtensionAPIWindowsEventCocoa.mm:
(WebKit::WebExtensionAPIWindowsEvent::invokeListenersWithArgument):
*
Source/WebKit/WebProcess/Extensions/Cocoa/_WKWebExtensionWebRequestFilter.h:
*
Source/WebKit/WebProcess/Extensions/Cocoa/_WKWebExtensionWebRequestFilter.mm:
(toWebExtensionWebRequestResourceType): Drive-by rename.
(_WKWebExtensionWebRequestResourceTypeFromResourceLoadInfo): Deleted.
* Tools/TestWebKitAPI/Tests/WebKitCocoa/WKWebExtensionAPIAlarms.mm:
(TestWebKitAPI::TEST(WKWebExtensionAPIAlarms, RemoveListenerDuringEvent)):
Added.
* Tools/TestWebKitAPI/Tests/WebKitCocoa/WKWebExtensionAPIWebNavigation.mm:
(TestWebKitAPI::TEST(WKWebExtensionAPIWebNavigation,
RemoveListenerDuringEvent)): Added.
* Tools/TestWebKitAPI/Tests/WebKitCocoa/WKWebExtensionAPIWebRequest.mm:
(TestWebKitAPI::TEST(WKWebExtensionAPIWebRequest,
RemoveListenerDuringEvent)): Added.
* Tools/TestWebKitAPI/Tests/WebKitCocoa/WKWebExtensionAPIWindows.mm:
(TestWebKitAPI::TEST(WKWebExtensionAPIWindows, RemoveListenerDuringEvent)):
Added.
Canonical link: https://commits.webkit.org/286260@main
Commit: 62a787ce9d804d9738991496c4296c12f8bf20e4
https://github.com/WebKit/WebKit/commit/62a787ce9d804d9738991496c4296c12f8bf20e4
Author: Mohsin Qureshi <[email protected]>
Date: 2024-11-07 (Thu, 07 Nov 2024)
Changed paths:
R LayoutTests/fast/dom/view-transition-lifetime-crash-expected.txt
R LayoutTests/fast/dom/view-transition-lifetime-crash.html
M Source/WebCore/Modules/screen-wake-lock/WakeLockManager.cpp
M Source/WebCore/Modules/screen-wake-lock/WakeLockManager.h
M Source/WebCore/Modules/screen-wake-lock/WakeLockSentinel.cpp
M Source/WebCore/dom/Document.cpp
M Source/WebCore/dom/ViewTransition.cpp
M Source/WebCore/dom/ViewTransition.h
M Source/WebCore/dom/VisibilityChangeClient.h
Log Message:
-----------
Revert c8d323b1851e. rdar://138799302
This reverts commit d6b783be87f255d38b8db17767fd22263b5e0229.
Commit: 935acac6d7dceddbe413f137a5a4c21fc255e779
https://github.com/WebKit/WebKit/commit/935acac6d7dceddbe413f137a5a4c21fc255e779
Author: Kiet Ho <[email protected]>
Date: 2024-11-07 (Thu, 07 Nov 2024)
Changed paths:
A LayoutTests/fast/dom/view-transition-lifetime-crash-expected.txt
A LayoutTests/fast/dom/view-transition-lifetime-crash.html
M Source/WebCore/Modules/screen-wake-lock/WakeLockManager.cpp
M Source/WebCore/Modules/screen-wake-lock/WakeLockManager.h
M Source/WebCore/Modules/screen-wake-lock/WakeLockSentinel.cpp
M Source/WebCore/dom/Document.cpp
M Source/WebCore/dom/ViewTransition.cpp
M Source/WebCore/dom/ViewTransition.h
M Source/WebCore/dom/VisibilityChangeClient.h
Log Message:
-----------
Cherry-pick 430e2dd31ad1. rdar://138799302
Cherry-pick c8d323b1851e. rdar://139301982
REGRESSION (283084@main): Document::visibilityStateChanged does not
hold reference to callback clients
rdar://138799302
https://bugs.webkit.org/show_bug.cgi?id=282360
Reviewed by Tim Nguyen, Ryosuke Niwa, and Chris Dumez.
Document::visibilityStateChanged() invokes visibility state callback
clients, but does not
hold a reference to them before invoking. The client could then
accidentally free itself
and cause an UAF. One possible route that leads to an UAF is through
ViewTransition,
which the test case demonstrates:
* The ViewTransition C++ objects are allocated by
document.startViewTransition().
After the call, each object has a ref count of at least 2 (one in the
JS wrapper
that wraps the C++ object, one in Document::m_activeViewTransition)
* The GC is invoked, which releases the JS wrappers and decreases the
ref count to 1
* The document visibility state is changed. This invokes
ViewTransition::visibilityStateChanged
on each object, which calls ::skipViewTransition, which calls
::clearViewTransition.
::clearViewTransition sets Document::m_activeViewTransition to null,
so the object ref
count is 0 and it's deallocated. ::clearViewTransition then continues
to modify the
(already deallocated) object, leading to an UAF.
Fix this by holding a reference to the callback clients before invoking
it. This involves
making VisibilityChangeClient ref counted. Then
Document::visibilityStateChanged()
would hold a reference to the client before invoking it. As
WakeLockManager
(which inherits VisibilityChangeClient) wasn't ref counted, this patch
also makes it
ref counted.
It's also observed that the JS wrapper should not be deallocated by the
GC before the
view transition has completed. This commit fixes this by implementing
ViewTransition::virtualHasPendingActivity(), which the GC consults to
determine whether
to deallocate the wrapper or not.
* LayoutTests/fast/dom/view-transition-lifetime-crash-expected.txt:
Added.
* LayoutTests/fast/dom/view-transition-lifetime-crash.html: Added.
* Source/WebCore/Modules/screen-wake-lock/WakeLockManager.cpp:
(WebCore::WakeLockManager::ref const): Delegated ref() to the document.
(WebCore::WakeLockManager::deref const): Delegated deref() to the
document.
* Source/WebCore/Modules/screen-wake-lock/WakeLockManager.h: Made
WakeLockManager ref counted by declaring ref() and deref().
* Source/WebCore/Modules/screen-wake-lock/WakeLockSentinel.cpp:
(WebCore::WakeLockSentinel::release): Hold a reference to the
document's WakeLockManager before using it.
* Source/WebCore/dom/Document.cpp:
(WebCore::Document::visibilityStateChanged): Hold a reference to the
visibility state callback client before calling it.
(WebCore::Document::wakeLockManager): Used
makeUniqueWithoutRefCountedCheck to create new WakeLockManager.
* Source/WebCore/dom/ViewTransition.cpp:
(WebCore::ViewTransition::virtualHasPendingActivity const): Added
implementation.
* Source/WebCore/dom/ViewTransition.h:
* Source/WebCore/dom/VisibilityChangeClient.h: Made
VisibilityChangeClient ref counted.
Canonical link: https://commits.webkit.org/286136@main
Canonical link: https://commits.webkit.org/283286.444@safari-7620-branch
Commit: 91c5b2e06b9c35a0e8d776425da004cd490f54c6
https://github.com/WebKit/WebKit/commit/91c5b2e06b9c35a0e8d776425da004cd490f54c6
Author: Dan Robson <[email protected]>
Date: 2024-11-07 (Thu, 07 Nov 2024)
Changed paths:
A JSTests/stress/oom-test-for-replace-all.js
A JSTests/wasm/stress/omg-tail-call-clobber-pinned-registers.js
M Source/JavaScriptCore/wasm/WasmFunctionParser.h
M Source/JavaScriptCore/wasm/WasmOMGIRGenerator.cpp
M Source/JavaScriptCore/wasm/WasmOMGIRGenerator32_64.cpp
M Source/JavaScriptCore/wasm/WasmOMGPlan.cpp
M Source/JavaScriptCore/wasm/WasmOSREntryPlan.cpp
Log Message:
-----------
Cherry-pick f35184a412c9. rdar://139362369
[JSC] Wasm TailCall should say "pinned registers can be clobbered" in OMG
https://bugs.webkit.org/show_bug.cgi?id=282635 rdar://138178964
Reviewed by Keith Miller and David Degazio.
We need to say that pinned registers are clobbered for transitive tail-calls
in OMG to correctly restore wasm instance.
* JSTests/wasm/stress/omg-tail-call-clobber-pinned-registers.js: Added.
* Source/JavaScriptCore/wasm/WasmFunctionParser.h:
* Source/JavaScriptCore/wasm/WasmOMGIRGenerator.cpp:
(JSC::Wasm::OMGIRGenerator::addCall):
(JSC::Wasm::OMGIRGenerator::addCallRef):
* Source/JavaScriptCore/wasm/WasmOMGIRGenerator32_64.cpp:
(JSC::Wasm::OMGIRGenerator::addCall):
* Source/JavaScriptCore/wasm/WasmOMGPlan.cpp:
(JSC::Wasm::OMGPlan::dumpDisassembly):
* Source/JavaScriptCore/wasm/WasmOSREntryPlan.cpp:
(JSC::Wasm::OSREntryPlan::dumpDisassembly):
Canonical link: https://commits.webkit.org/286193@main
Canonical link: https://commits.webkit.org/[email protected]
Commit: 67161339da87b3139bb0c1c297c3292c22ae9544
https://github.com/WebKit/WebKit/commit/67161339da87b3139bb0c1c297c3292c22ae9544
Author: Dan Robson <[email protected]>
Date: 2024-11-07 (Thu, 07 Nov 2024)
Changed paths:
M Source/WebKit/WebProcess/Extensions/API/Cocoa/WebExtensionAPIEventCocoa.mm
M
Source/WebKit/WebProcess/Extensions/API/Cocoa/WebExtensionAPIWebNavigationEventCocoa.mm
M
Source/WebKit/WebProcess/Extensions/API/Cocoa/WebExtensionAPIWebRequestEventCocoa.mm
M
Source/WebKit/WebProcess/Extensions/API/Cocoa/WebExtensionAPIWindowsEventCocoa.mm
M
Source/WebKit/WebProcess/Extensions/Cocoa/_WKWebExtensionWebRequestFilter.h
M
Source/WebKit/WebProcess/Extensions/Cocoa/_WKWebExtensionWebRequestFilter.mm
M Tools/TestWebKitAPI/Tests/WebKitCocoa/WKWebExtensionAPIAlarms.mm
M Tools/TestWebKitAPI/Tests/WebKitCocoa/WKWebExtensionAPIWebNavigation.mm
M Tools/TestWebKitAPI/Tests/WebKitCocoa/WKWebExtensionAPIWebRequest.mm
M Tools/TestWebKitAPI/Tests/WebKitCocoa/WKWebExtensionAPIWindows.mm
Log Message:
-----------
Revert 0628c831bdfb. rdar://139395506
This reverts commit a2bbec32ef7378ee533a0d5aecaa2d7190e8a7e6.
Canonical link: https://commits.webkit.org/[email protected]
Commit: f627ad7ddb31fb34b4e7f7ddb3577e326761a6dd
https://github.com/WebKit/WebKit/commit/f627ad7ddb31fb34b4e7f7ddb3577e326761a6dd
Author: Dan Robson <[email protected]>
Date: 2024-11-08 (Fri, 08 Nov 2024)
Changed paths:
M Configurations/Version.xcconfig
Log Message:
-----------
Versioning.
WebKit-7620.1.16.10.2
Canonical link: https://commits.webkit.org/[email protected]
Commit: 97f6a887dde13fb425a4be5751730946adb8c053
https://github.com/WebKit/WebKit/commit/97f6a887dde13fb425a4be5751730946adb8c053
Author: Russell Epstein <[email protected]>
Date: 2024-11-11 (Mon, 11 Nov 2024)
Changed paths:
M Configurations/Version.xcconfig
Log Message:
-----------
Versioning.
WebKit-7620.1.16.10.3
Canonical link: https://commits.webkit.org/[email protected]
Commit: 8799b558188efbeae182f22cc66bac216a911d05
https://github.com/WebKit/WebKit/commit/8799b558188efbeae182f22cc66bac216a911d05
Author: Keith Miller <[email protected]>
Date: 2024-11-11 (Mon, 11 Nov 2024)
Changed paths:
M Source/WTF/wtf/LockAlgorithm.h
Log Message:
-----------
Cherry-pick 4d456933d70e. rdar://139645285
LockAlgorithm::unlockFast is too fast
https://bugs.webkit.org/show_bug.cgi?id=282865
rdar://139548123
Reviewed by Yusuke Suzuki.
Right now it has relaxed ordering but that's not correct since it means
writes to the critical section
could happen after the lock is unlocked. This could lead to arbitrary
crashes or other general badness.
* Source/WTF/wtf/LockAlgorithm.h:
(WTF::LockAlgorithm::unlockFast):
Canonical link: https://commits.webkit.org/283286.466@safari-7620-branch
Canonical link: https://commits.webkit.org/[email protected]
Commit: fb95ff6901e67c1190b923a53f776d3373fefa52
https://github.com/WebKit/WebKit/commit/fb95ff6901e67c1190b923a53f776d3373fefa52
Author: Nitin Mahendru <[email protected]>
Date: 2024-11-11 (Mon, 11 Nov 2024)
Changed paths:
M
LayoutTests/http/wpt/webauthn/public-key-credential-get-failure-hid.https-expected.txt
M
LayoutTests/http/wpt/webauthn/public-key-credential-get-failure-hid.https.html
M
LayoutTests/http/wpt/webauthn/public-key-credential-get-success-hid.https-expected.txt
M
LayoutTests/http/wpt/webauthn/public-key-credential-get-success-hid.https.html
M Source/WebCore/Modules/webauthn/fido/DeviceRequestConverter.cpp
M Source/WebCore/Modules/webauthn/fido/DeviceRequestConverter.h
M Source/WebKit/UIProcess/WebAuthentication/fido/CtapAuthenticator.cpp
M Source/WebKit/UIProcess/WebAuthentication/fido/CtapAuthenticator.h
Log Message:
-----------
Cherry-pick fbc1283a4a99. rdar://138281493
Unreviewed, reverting "[WebAuthn] Implement batching for checking
allowCredentials (48851c3d135a)"
https://bugs.webkit.org/show_bug.cgi?id=282880
rdar://138281493
Fix Login Issues with newer Yubikeys.
Reverted change:
Cherry-pick 52a47cb. rdar://133711978
[WebAuthn] Implement batching for checking allowCredentials
rdar://133711978
https://bugs.webkit.org/show_bug.cgi?id=277979
Reviewed by Brent Fulgham.
This change implements checking the allowCredentials in batches as
supported by
the authenticator during getAssertion. This is accomplished with
smaller up=0,
get requests to determine if credentials are present on the
authenticator.
Then if a credential is detected as present, it is included in the
allowCredentials list
in the real request. If no credentials matched, then we already know
the call will not
be able to succeed, so we just include the last batch.
Added layout tests for the new behaviors.
*
LayoutTests/http/wpt/webauthn/public-key-credential-get-failure-hid.https-expected.txt:
*
LayoutTests/http/wpt/webauthn/public-key-credential-get-failure-hid.https.html:
*
LayoutTests/http/wpt/webauthn/public-key-credential-get-success-hid.https-expected.txt:
*
LayoutTests/http/wpt/webauthn/public-key-credential-get-success-hid.https.html:
* Source/WebKit/UIProcess/WebAuthentication/fido/CtapAuthenticator.cpp:
(WebKit::CtapAuthenticator::makeCredential):
(WebKit::CtapAuthenticator::continueSlientlyCheckCredentials):
(WebKit::CtapAuthenticator::continueMakeCredentialAfterCheckExcludedCredentials):
(WebKit::CtapAuthenticator::getAssertion):
(WebKit::CtapAuthenticator::continueGetAssertionAfterCheckAllowCredentials):
(WebKit::CtapAuthenticator::continueCheckExcludedCredentialsAfterResponseRecieved):
Deleted.
* Source/WebKit/UIProcess/WebAuthentication/fido/CtapAuthenticator.h:
Canonical link: https://commits.webkit.org/282246@main
Canonical link: https://commits.webkit.org/283286.467@safari-7620-branch
Canonical link: https://commits.webkit.org/[email protected]
Commit: 104d9e972cd5764fe8b4349d867e8a80e9c0e20a
https://github.com/WebKit/WebKit/commit/104d9e972cd5764fe8b4349d867e8a80e9c0e20a
Author: Nitin Mahendru <[email protected]>
Date: 2024-11-11 (Mon, 11 Nov 2024)
Changed paths:
M
LayoutTests/http/wpt/webauthn/public-key-credential-create-failure-hid.https-expected.txt
M
LayoutTests/http/wpt/webauthn/public-key-credential-create-failure-hid.https.html
M
LayoutTests/http/wpt/webauthn/public-key-credential-create-success-hid.https-expected.txt
M
LayoutTests/http/wpt/webauthn/public-key-credential-create-success-hid.https.html
M LayoutTests/http/wpt/webauthn/resources/util.js
M Source/WebCore/Modules/webauthn/fido/AuthenticatorGetInfoResponse.cpp
M Source/WebCore/Modules/webauthn/fido/AuthenticatorGetInfoResponse.h
M Source/WebCore/Modules/webauthn/fido/DeviceRequestConverter.cpp
M Source/WebCore/Modules/webauthn/fido/DeviceRequestConverter.h
M Source/WebCore/Modules/webauthn/fido/DeviceResponseConverter.cpp
M Source/WebCore/Modules/webauthn/fido/FidoConstants.h
M Source/WebCore/testing/MockWebAuthenticationConfiguration.h
M Source/WebCore/testing/MockWebAuthenticationConfiguration.idl
M Source/WebKit/Shared/WebCoreArgumentCoders.serialization.in
M Source/WebKit/UIProcess/WebAuthentication/Mock/MockHidConnection.cpp
M Source/WebKit/UIProcess/WebAuthentication/fido/CtapAuthenticator.cpp
M Source/WebKit/UIProcess/WebAuthentication/fido/CtapAuthenticator.h
Log Message:
-----------
Cherry-pick aaafcd1e5687. rdar://138281493
Unreviewed, reverting [WebAuthn] Implement batching for checking
excludeCredentials
https://bugs.webkit.org/show_bug.cgi?id=282878
rdar://138281493
Revert to Fix rdar://138281493 Unable to enter PIN for Yubikey
Reverted change:
Cherry-pick f56198757e4b. rdar://133307666
[WebAuthn] Implement batching for checking excludeCredentials
rdar://133307666
https://bugs.webkit.org/show_bug.cgi?id=277695
Reviewed by Charlie Wolfe.
This change starts to implement checking the excludeCredential list
in batches as
supported by the authenticator during a makeCredential. This is
accomplished by using
smaller, up=0, get requests to detect if a credential is present on
the authenticator.
Then if a credential is detected, only that credential may be
included with the actual
makeCredential request to get the proper error code back from the
authenticator. If none
matched, we don't need to include a excludeCredentials list to the
authenticator since
we already know those credentials aren't present.
This patch only implements this logic for makeCredential,
getAssertion will be done in
another patch.
Added layout tests to test matching exclude list with batching,
non-matching exclude list with
batching, and a security key that supports batches greater than 1.
*
LayoutTests/http/wpt/webauthn/public-key-credential-create-failure-hid.https-expected.txt:
*
LayoutTests/http/wpt/webauthn/public-key-credential-create-failure-hid.https.html:
*
LayoutTests/http/wpt/webauthn/public-key-credential-create-success-hid.https-expected.txt:
*
LayoutTests/http/wpt/webauthn/public-key-credential-create-success-hid.https.html:
* LayoutTests/http/wpt/webauthn/resources/util.js:
*
Source/WebCore/Modules/webauthn/fido/AuthenticatorGetInfoResponse.cpp:
(fido::AuthenticatorGetInfoResponse::setMaxCredentialCountInList):
(fido::AuthenticatorGetInfoResponse::setMaxCredentialIDLength):
(fido::encodeAsCBOR):
*
Source/WebCore/Modules/webauthn/fido/AuthenticatorGetInfoResponse.h:
* Source/WebCore/Modules/webauthn/fido/DeviceRequestConverter.cpp:
(fido::encodeSilentGetAssertion):
* Source/WebCore/Modules/webauthn/fido/DeviceRequestConverter.h:
* Source/WebCore/Modules/webauthn/fido/DeviceResponseConverter.cpp:
(fido::readCTAPGetInfoResponse):
* Source/WebCore/Modules/webauthn/fido/FidoConstants.h:
* Source/WebCore/testing/MockWebAuthenticationConfiguration.h:
* Source/WebCore/testing/MockWebAuthenticationConfiguration.idl:
* Source/WebKit/Shared/WebCoreArgumentCoders.serialization.in:
*
Source/WebKit/UIProcess/WebAuthentication/Mock/MockHidConnection.cpp:
(WebKit::MockHidConnection::feedReports):
*
Source/WebKit/UIProcess/WebAuthentication/fido/CtapAuthenticator.cpp:
(WebKit::CtapAuthenticator::makeCredential):
(WebKit::CtapAuthenticator::continueCheckExcludedCredentialsAfterResponseRecieved):
(WebKit::CtapAuthenticator::continueMakeCredentialAfterCheckExcludedCredentials):
*
Source/WebKit/UIProcess/WebAuthentication/fido/CtapAuthenticator.h:
Canonical link: https://commits.webkit.org/282019@main
Canonical link: https://commits.webkit.org/280938.236@safari-7619-branch
Canonical link: https://commits.webkit.org/283286.468@safari-7620-branch
Canonical link: https://commits.webkit.org/[email protected]
Commit: 6f8c75580aeb93e66603fc9bf0f82c331d0ad35f
https://github.com/WebKit/WebKit/commit/6f8c75580aeb93e66603fc9bf0f82c331d0ad35f
Author: David Kilzer <[email protected]>
Date: 2024-11-11 (Mon, 11 Nov 2024)
Changed paths:
M Source/ThirdParty/ANGLE/src/libANGLE/renderer/metal/mtl_library_cache.mm
M Source/ThirdParty/ANGLE/src/libANGLE/renderer/metal/mtl_utils.mm
Log Message:
-----------
Cherry-pick 8826887be8c6. rdar://139660591
[ANGLE] Fix leaks in NewMetalLibraryFromMetallib() on every call
<https://bugs.webkit.org/show_bug.cgi?id=282890>
<rdar://139586222>
Reviewed by Kimmo Kinnunen.
* Source/ThirdParty/ANGLE/src/libANGLE/renderer/metal/mtl_library_cache.mm:
(rx::(anonymous)::NewMetalLibraryFromMetallib):
- Use adoptObjCObj() to fix leak of id<MTLLibrary>.
- Call dispatch_release() to fix leak of dispatch_data_t.
* Source/ThirdParty/ANGLE/src/libANGLE/renderer/metal/mtl_utils.mm:
(rx::mtl::CreateShaderLibraryFromBinary):
- Use DISPATCH_DATA_DESTRUCTOR_DEFAULT instead of empty block.
- Replace ANGLE_MTL_AUTORELEASE with adoptObjCObj() to avoid unneeded
autorelease of id<MTLLibrary> object.
Canonical link: https://commits.webkit.org/286425@main
Commit: 66f9820bd796a58a2db1f04de0b796d819055e3c
https://github.com/WebKit/WebKit/commit/66f9820bd796a58a2db1f04de0b796d819055e3c
Author: Yusuke Suzuki <[email protected]>
Date: 2024-11-11 (Mon, 11 Nov 2024)
Changed paths:
A JSTests/wasm/stress/wasm-bbq-catch-unbind.js
M Source/JavaScriptCore/wasm/WasmBBQJIT.cpp
Log Message:
-----------
Cherry-pick 39727612b542. rdar://139502479
[JSC] Aborted in JSC::Wasm::BBQJITImpl::BBQJIT::bind
https://bugs.webkit.org/show_bug.cgi?id=282825
rdar://139502479
Reviewed by David Degazio.
This patch adds unbinding for all registers for addCatch and addCatchAll
too since they also should not carry any bindings from the other blocks.
* JSTests/wasm/stress/wasm-bbq-catch-unbind.js: Added.
* Source/JavaScriptCore/wasm/WasmBBQJIT.cpp:
(JSC::Wasm::BBQJITImpl::BBQJIT::addCatch):
(JSC::Wasm::BBQJITImpl::BBQJIT::addCatchAll):
Canonical link: https://commits.webkit.org/283286.470@safari-7620-branch
Commit: bedd61cf20637c148d9b47376ecad29d4a5e01bc
https://github.com/WebKit/WebKit/commit/bedd61cf20637c148d9b47376ecad29d4a5e01bc
Author: Mohsin Qureshi <[email protected]>
Date: 2024-11-11 (Mon, 11 Nov 2024)
Changed paths:
M Source/ThirdParty/ANGLE/src/libANGLE/renderer/metal/mtl_library_cache.mm
M Source/ThirdParty/ANGLE/src/libANGLE/renderer/metal/mtl_utils.mm
Log Message:
-----------
Revert 8826887be8c6. rdar://139660591
This reverts commit 6f8c75580aeb93e66603fc9bf0f82c331d0ad35f.
Commit: 70b592dbd8c54b0772e7522c1efbd014df284c41
https://github.com/WebKit/WebKit/commit/70b592dbd8c54b0772e7522c1efbd014df284c41
Author: Mohsin Qureshi <[email protected]>
Date: 2024-11-11 (Mon, 11 Nov 2024)
Changed paths:
M Source/WTF/wtf/LockAlgorithm.h
Log Message:
-----------
Revert 4d456933d70e. rdar://139645285
This reverts commit 8799b558188efbeae182f22cc66bac216a911d05.
Commit: 8e5f4c7314e1c070e085a988d9894411545cbaf1
https://github.com/WebKit/WebKit/commit/8e5f4c7314e1c070e085a988d9894411545cbaf1
Author: Mohsin Qureshi <[email protected]>
Date: 2024-11-12 (Tue, 12 Nov 2024)
Changed paths:
M Configurations/Version.xcconfig
Log Message:
-----------
Versioning.
WebKit-7620.1.16.10.4
Canonical link: https://commits.webkit.org/[email protected]
Commit: 558ba4a0e54b2aad1c5397ab0056c73d169a241f
https://github.com/WebKit/WebKit/commit/558ba4a0e54b2aad1c5397ab0056c73d169a241f
Author: Mohsin Qureshi <[email protected]>
Date: 2024-11-13 (Wed, 13 Nov 2024)
Changed paths:
M Configurations/Version.xcconfig
Log Message:
-----------
Versioning.
WebKit-7620.1.16.10.5
Canonical link: https://commits.webkit.org/[email protected]
Commit: 752066c7a7cd36bdf72eb81ffb5afb4664afc4ff
https://github.com/WebKit/WebKit/commit/752066c7a7cd36bdf72eb81ffb5afb4664afc4ff
Author: Daniel Liu <[email protected]>
Date: 2024-11-13 (Wed, 13 Nov 2024)
Changed paths:
M Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
Log Message:
-----------
Cherry-pick ded4d02c0a93. rdar://139822639
Don't allocate DFG register after a slow path
https://bugs.webkit.org/show_bug.cgi?id=283063
rdar://139747120
Reviewed by Yusuke Suzuki.
Allocating a DFG register after a slow path means that if the slow path
is taken, we end up with an incorrect global state.
* Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compilePutByValForIntTypedArray):
Canonical link: https://commits.webkit.org/283286.475@safari-7620-branch
Commit: 3e09afa7f822796d942ed1d912c732b1fe578758
https://github.com/WebKit/WebKit/commit/3e09afa7f822796d942ed1d912c732b1fe578758
Author: Russell Epstein <[email protected]>
Date: 2024-11-14 (Thu, 14 Nov 2024)
Changed paths:
M Configurations/Version.xcconfig
Log Message:
-----------
Versioning.
WebKit-7620.1.16.10.6
Canonical link: https://commits.webkit.org/[email protected]
Commit: b260bd82cbdd25a3c63c326757df5168d3c0ed17
https://github.com/WebKit/WebKit/commit/b260bd82cbdd25a3c63c326757df5168d3c0ed17
Author: Richard Robinson <[email protected]>
Date: 2024-11-14 (Thu, 14 Nov 2024)
Changed paths:
M Source/WebCore/platform/graphics/Font.cpp
M Source/WebCore/platform/graphics/SystemFallbackFontCache.cpp
M Source/WebCore/platform/graphics/SystemFallbackFontCache.h
M Tools/TestWebKitAPI/Tests/WebKitCocoa/WritingTools.mm
Log Message:
-----------
Cherry-pick 48d994887c94. rdar://139852476
[Writing Tools] Outlook.app quits unexpectedly with Writing Tools
https://bugs.webkit.org/show_bug.cgi?id=283098
rdar://139513909
Reviewed by Wenson Hsieh and Abrar Rahman Protyasha.
The `SystemFallbackFontCache` system depends on using a `WebCore::Timer`.
In the destructor of `Font`,
a font cache is accessed and the font is removed from the cache. Notably,
even if there is no cache,
one is erroneously created anyways.
The `AttributedString` type uses the `Font` type and therefore indirectly
uses a `WebCore::Timer`.
Therefore, any use of `AttributedString` in the UI process is unsafe, as it
is not allowed to use a
`WebCore::Timer` in the UI process.
This issue manifests in the implementation of Writing Tools, which uses
AttributedStrings in the UI
process. This issue was always present, however it turned into a crash once
a release assert was a
dded in `WebCore::Timer`.
To fix this, ensure that a new font cache is not created in the destructor
of Font.
* Source/WebCore/platform/graphics/Font.cpp:
(WebCore::Font::~Font):
* Source/WebCore/platform/graphics/SystemFallbackFontCache.cpp:
(WebCore::SystemFallbackFontCache::forCurrentThreadIfExists):
* Source/WebCore/platform/graphics/SystemFallbackFontCache.h:
* Tools/TestWebKitAPI/Tests/WebKitCocoa/WritingTools.mm:
(TEST(WritingTools, AttributedStringWithWebKitLegacy)):
Canonical link: https://commits.webkit.org/286579@main
Canonical link: https://commits.webkit.org/[email protected]
Commit: ca617ef2bbcebc9e0f6eb97f5189c39ce7cb6cea
https://github.com/WebKit/WebKit/commit/ca617ef2bbcebc9e0f6eb97f5189c39ce7cb6cea
Author: Charlie Wolfe <[email protected]>
Date: 2024-11-14 (Thu, 14 Nov 2024)
Changed paths:
M Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.cpp
M Source/WebKit/NetworkProcess/NetworkProcess.cpp
M Source/WebKit/NetworkProcess/NetworkProcess.h
M Source/WebKit/NetworkProcess/NetworkSession.cpp
M Source/WebKit/NetworkProcess/ServiceWorker/WebSWServerConnection.cpp
M
Source/WebKit/NetworkProcess/SharedWorker/WebSharedWorkerServerConnection.cpp
M Tools/TestWebKitAPI/Tests/WebKitCocoa/IPCTestingAPI.mm
Log Message:
-----------
Cherry-pick 2815b4e29829. rdar://139887841
Data Isolation bypass via attacker controlled firstPartyForCookies
https://bugs.webkit.org/show_bug.cgi?id=283095
rdar://139818629
Reviewed by Matthew Finkel and Alex Christensen.
`NetworkProcess::allowsFirstPartyForCookies` unconditionally allows cookie
access for about:blank or
empty firstPartyForCookies URLs. We tried to remove this in
rdar://105733798 and rdar://107270673, but
we needed to revert both because there were rare and subtle bugs where
certain requests would incorrectly
have about:blank set as their firstPartyForCookies, causing us to kill the
WCP.
This patch is a lower risk change that removes the unconditional cookie
access for requests that have an
empty firstPartyForCookies, but will not kill the WCP that is incorrectly
sending an empty
firstPartyForCookies.
* Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.cpp:
(WebKit::NetworkConnectionToWebProcess::createSocketChannel):
(WebKit::NetworkConnectionToWebProcess::scheduleResourceLoad):
(WebKit::NetworkConnectionToWebProcess::cookiesForDOM):
(WebKit::NetworkConnectionToWebProcess::setCookiesFromDOM):
(WebKit::NetworkConnectionToWebProcess::cookiesEnabled):
(WebKit::NetworkConnectionToWebProcess::cookieRequestHeaderFieldValue):
(WebKit::NetworkConnectionToWebProcess::getRawCookies):
(WebKit::NetworkConnectionToWebProcess::cookiesForDOMAsync):
(WebKit::NetworkConnectionToWebProcess::setCookieFromDOMAsync):
(WebKit::NetworkConnectionToWebProcess::domCookiesForHost):
(WebKit::NetworkConnectionToWebProcess::establishSWContextConnection):
* Source/WebKit/NetworkProcess/NetworkProcess.cpp:
(WebKit::NetworkProcess::allowsFirstPartyForCookies):
* Source/WebKit/NetworkProcess/NetworkProcess.h:
* Source/WebKit/NetworkProcess/NetworkSession.cpp:
(WebKit::NetworkSession::addAllowedFirstPartyForCookies):
* Source/WebKit/NetworkProcess/ServiceWorker/WebSWServerConnection.cpp:
(WebKit::WebSWServerConnection::scheduleJobInServer):
*
Source/WebKit/NetworkProcess/SharedWorker/WebSharedWorkerServerConnection.cpp:
(WebKit::WebSharedWorkerServerConnection::requestSharedWorker):
* Tools/TestWebKitAPI/Tests/WebKitCocoa/IPCTestingAPI.mm:
(EmptyFirstPartyForCookiesCookieRequestHeaderFieldValue)):
Canonical link: https://commits.webkit.org/283286.477@safari-7620-branch
Commit: f235b01eb6e734254fb4f3b19976e92dd2e6a280
https://github.com/WebKit/WebKit/commit/f235b01eb6e734254fb4f3b19976e92dd2e6a280
Author: Per Arne Vollan <[email protected]>
Date: 2024-11-14 (Thu, 14 Nov 2024)
Changed paths:
M
Source/WebKit/Shared/AuxiliaryProcessExtensions/NetworkingExtension-Info.plist
Log Message:
-----------
Cherry-pick 5e0585ea7336. rdar://139903559
[iOS] The Networking process should use the same localization as the UI
process
https://bugs.webkit.org/show_bug.cgi?id=283029
rdar://139264528
Reviewed by Chris Dumez.
Use the same property list key/value for this as we do for the WebContent
process.
*
Source/WebKit/Shared/AuxiliaryProcessExtensions/NetworkingExtension-Info.plist:
Canonical link: https://commits.webkit.org/286539@main
Commit: 67635daa733ea5250391d2dba5fd0ddca688a47b
https://github.com/WebKit/WebKit/commit/67635daa733ea5250391d2dba5fd0ddca688a47b
Author: Youenn Fablet <[email protected]>
Date: 2024-11-14 (Thu, 14 Nov 2024)
Changed paths:
M LayoutTests/TestExpectations
M Source/WebCore/platform/mediastream/mac/CoreAudioSharedUnit.cpp
Log Message:
-----------
Cherry-pick 2d1b510c05b1. rdar://139901838
iOS 18.2 - WebRTC audio input device issues
rdar://139797608
Reviewed by Jean-Yves Avenard.
When stopping capture, if audio rendering is ongoing with VPIO, we were
setting kAUVoiceIOProperty_MuteOutput to 1.
This is new in CrystalC code base and is in preparation of supporting voice
activity detection.
We were correctly setting kAUVoiceIOProperty_MuteOutput back to 0 if we
were keeping the same VPIO unit when restarting.
It appears kAUVoiceIOProperty_MuteOutput is sticky so we would need to set
kAUVoiceIOProperty_MuteOutput back to 0 on the new unit.
Instead, we are removing the setting of kAUVoiceIOProperty_MuteOutput.
Setting kAUVoiceIOProperty_MuteOutput is useful to enable muted talker
detection, which is a future feature, not available in this branch.
There is no such issue in WebKit trunk since, after the fork to this
branch, we added explicit mute setting via [AVAudioApplication
setInputMuted:error:].
Marking http/wpt/mediasession/voiceActivityDetection.html as failing since
we no longer instruct the mock audio unit that the output is muted.
Manually tested on iOS.
* LayoutTests/TestExpectations:
* Source/WebCore/platform/mediastream/mac/CoreAudioSharedUnit.cpp:
(WebCore::CoreAudioSharedUnit::isProducingMicrophoneSamplesChanged):
Canonical link: https://commits.webkit.org/283286.478@safari-7620-branch
Commit: b99ab165e234c1ac484e3c40791e48d14519ce9b
https://github.com/WebKit/WebKit/commit/b99ab165e234c1ac484e3c40791e48d14519ce9b
Author: Mohsin Qureshi <[email protected]>
Date: 2024-11-14 (Thu, 14 Nov 2024)
Changed paths:
M Source/WebCore/platform/graphics/Font.cpp
M Source/WebCore/platform/graphics/SystemFallbackFontCache.cpp
M Source/WebCore/platform/graphics/SystemFallbackFontCache.h
M Tools/TestWebKitAPI/Tests/WebKitCocoa/WritingTools.mm
Log Message:
-----------
Revert 48d994887c94. rdar://139852476
This reverts commit b260bd82cbdd25a3c63c326757df5168d3c0ed17.
Commit: 7c54a3520745b1d6d77c1d97da1f37b0d08ea462
https://github.com/WebKit/WebKit/commit/7c54a3520745b1d6d77c1d97da1f37b0d08ea462
Author: Mohsin Qureshi <[email protected]>
Date: 2024-11-15 (Fri, 15 Nov 2024)
Changed paths:
M Configurations/Version.xcconfig
Log Message:
-----------
Versioning.
WebKit-7620.1.16.10.7
Canonical link: https://commits.webkit.org/[email protected]
Commit: e792146f78cb1b059159befbea138c597a8effa1
https://github.com/WebKit/WebKit/commit/e792146f78cb1b059159befbea138c597a8effa1
Author: Matthieu Dubet <[email protected]>
Date: 2024-11-15 (Fri, 15 Nov 2024)
Changed paths:
M LayoutTests/TestExpectations
A
LayoutTests/imported/w3c/web-platform-tests/css/css-scoping/host-descendant-003-expected.html
A
LayoutTests/imported/w3c/web-platform-tests/css/css-scoping/host-descendant-003.html
A
LayoutTests/imported/w3c/web-platform-tests/css/css-scoping/host-multiple-002-expected.html
A
LayoutTests/imported/w3c/web-platform-tests/css/css-scoping/host-multiple-002.html
A
LayoutTests/imported/w3c/web-platform-tests/css/css-scoping/host-multiple-003-expected.html
A
LayoutTests/imported/w3c/web-platform-tests/css/css-scoping/host-multiple-003.html
A
LayoutTests/imported/w3c/web-platform-tests/css/css-scoping/host-multiple-004-expected.html
A
LayoutTests/imported/w3c/web-platform-tests/css/css-scoping/host-multiple-004.html
A
LayoutTests/imported/w3c/web-platform-tests/css/css-scoping/host-multiple-005-expected.html
A
LayoutTests/imported/w3c/web-platform-tests/css/css-scoping/host-multiple-005.html
A
LayoutTests/imported/w3c/web-platform-tests/css/css-scoping/host-multiple-006-expected.html
A
LayoutTests/imported/w3c/web-platform-tests/css/css-scoping/host-multiple-006.html
A
LayoutTests/imported/w3c/web-platform-tests/css/css-scoping/host-not-001-expected.html
A
LayoutTests/imported/w3c/web-platform-tests/css/css-scoping/host-not-001.html
M Source/WebCore/css/SelectorChecker.cpp
Log Message:
-----------
Cherry-pick 33507394bab5. rdar://139908140
[CSS] Don't combine :not() with :host
https://bugs.webkit.org/show_bug.cgi?id=282960
rdar://139198548
Reviewed by Tim Nguyen.
As a featureless element, only :host matches the shadow host.
Functional pseudoclasses pass the behavior to their arguments,
so :is(:host) matches the same as :host (the shadow host).
This fixes a regression introduced in 281963@main.
Before 281963, :host combination with a functional pseudoclass
(or anything but a pseudo-element more generally)
was early returning "not match".
281963 has removed the early return for all functional pseudoclass
(to allow :is() combined with :host, but also :not()).
Properly supporting :host combining with :not() is tricky
and will be handled in a followup patch.
* LayoutTests/TestExpectations:
*
LayoutTests/imported/w3c/web-platform-tests/css/css-scoping/host-descendant-003-expected.html:
Added.
*
LayoutTests/imported/w3c/web-platform-tests/css/css-scoping/host-descendant-003.html:
Added.
*
LayoutTests/imported/w3c/web-platform-tests/css/css-scoping/host-multiple-002-expected.html:
Added.
*
LayoutTests/imported/w3c/web-platform-tests/css/css-scoping/host-multiple-002.html:
Added.
*
LayoutTests/imported/w3c/web-platform-tests/css/css-scoping/host-multiple-003-expected.html:
Added.
*
LayoutTests/imported/w3c/web-platform-tests/css/css-scoping/host-multiple-003.html:
Added.
*
LayoutTests/imported/w3c/web-platform-tests/css/css-scoping/host-multiple-004-expected.html:
Added.
*
LayoutTests/imported/w3c/web-platform-tests/css/css-scoping/host-multiple-004.html:
Added.
*
LayoutTests/imported/w3c/web-platform-tests/css/css-scoping/host-multiple-005-expected.html:
Added.
*
LayoutTests/imported/w3c/web-platform-tests/css/css-scoping/host-multiple-005.html:
Added.
*
LayoutTests/imported/w3c/web-platform-tests/css/css-scoping/host-multiple-006-expected.html:
Added.
*
LayoutTests/imported/w3c/web-platform-tests/css/css-scoping/host-multiple-006.html:
Added.
*
LayoutTests/imported/w3c/web-platform-tests/css/css-scoping/host-not-001-expected.html:
Added.
*
LayoutTests/imported/w3c/web-platform-tests/css/css-scoping/host-not-001.html:
Added.
* Source/WebCore/css/SelectorChecker.cpp:
(WebCore::SelectorChecker::checkOne const):
Canonical link: https://commits.webkit.org/286611@main
Commit: 8914dc85b26503128a4a74d9ec0c85a585725b26
https://github.com/WebKit/WebKit/commit/8914dc85b26503128a4a74d9ec0c85a585725b26
Author: Mohsin Qureshi <[email protected]>
Date: 2024-11-15 (Fri, 15 Nov 2024)
Changed paths:
M Configurations/Version.xcconfig
Log Message:
-----------
Versioning.
WebKit-7620.1.16.10.8
Canonical link: https://commits.webkit.org/[email protected]
Commit: 3d55faddb73cf1ea48125763f03e04e5513d9abd
https://github.com/WebKit/WebKit/commit/3d55faddb73cf1ea48125763f03e04e5513d9abd
Author: Mohsin Qureshi <[email protected]>
Date: 2024-11-16 (Sat, 16 Nov 2024)
Changed paths:
M Configurations/Version.xcconfig
Log Message:
-----------
Versioning.
WebKit-7620.1.16.10.9
Canonical link: https://commits.webkit.org/[email protected]
Commit: e8db9573d7dfdcd34779b95e52b3126ab0636192
https://github.com/WebKit/WebKit/commit/e8db9573d7dfdcd34779b95e52b3126ab0636192
Author: Mohsin Qureshi <[email protected]>
Date: 2024-11-19 (Tue, 19 Nov 2024)
Changed paths:
M Configurations/Version.xcconfig
Log Message:
-----------
Versioning.
WebKit-7620.1.16.10.10
Canonical link: https://commits.webkit.org/[email protected]
Commit: 605dfc06a112afa4834b5c073354f82784233288
https://github.com/WebKit/WebKit/commit/605dfc06a112afa4834b5c073354f82784233288
Author: Charlie Wolfe <[email protected]>
Date: 2024-11-19 (Tue, 19 Nov 2024)
Changed paths:
M Source/WebCore/loader/FrameLoader.cpp
M Source/WebCore/loader/FrameLoader.h
M Source/WebCore/loader/cache/CachedResourceLoader.cpp
M Source/WebCore/page/SecurityPolicy.h
M Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.cpp
M Tools/TestWebKitAPI/Tests/WebKitCocoa/IPCTestingAPI.mm
M Tools/TestWebKitAPI/Tests/WebKitCocoa/SOAuthorizationTests.mm
M Tools/TestWebKitAPI/Tests/WebKitCocoa/WKHTTPCookieStore.mm
Log Message:
-----------
Cherry-pick b7402f10b17c. rdar://140129837
sameSiteInfo.isSameSite may not match URLs used in Data Isolation checks
https://bugs.webkit.org/show_bug.cgi?id=283309
rdar://140129837
Reviewed by Sihui Liu.
This patch fixes an issue where a WebContent process can send IPC with URLs
that are not same-site, but
contains `sameSiteInfo` that indicates that the request is same-site. This
can lead to requesting cookies
for a URL that was not considered in the data isolation check.
To lower risk, we reject cookie access instead of terminating the sender
process. More details provided
below.
* Source/WebCore/loader/FrameLoader.cpp:
(WebCore::FrameLoader::setOriginalURLForDownloadRequest):
(WebCore::FrameLoader::updateRequestAndAddExtraFields):
(WebCore::FrameLoader::addSameSiteInfoToRequestIfNeeded):
* Source/WebCore/loader/FrameLoader.h:
These quirks were added when cookies were SameSite=Lax by default, which is
no longer the case, so it can
be removed. Keeping this would mean certain requests would unexpectedly be
considered same-site, and
would fail the check being added in the network process.
* Source/WebCore/loader/cache/CachedResourceLoader.cpp:
(WebCore::CachedResourceLoader::requestResource):
This is an existing bug that was revealed by this change, and is needed to
fix
`http/tests/cache/disk-cache/disk-cache-vary-cookie.html`.
* Source/WebCore/page/SecurityPolicy.h:
Export `shouldInheritSecurityOriginFromOwner` so that it can be used in the
network process.
* Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.cpp:
(WebKit::NetworkConnectionToWebProcess::shouldTreatAsSameSite const):
Add a network process side same-site check, similar to
`FrameLoader::addSameSiteInfoToRequestIfNeeded`.
(WebKit::NetworkConnectionToWebProcess::cookiesForDOM):
(WebKit::NetworkConnectionToWebProcess::setCookiesFromDOM):
(WebKit::NetworkConnectionToWebProcess::cookieRequestHeaderFieldValue):
(WebKit::NetworkConnectionToWebProcess::getRawCookies):
(WebKit::NetworkConnectionToWebProcess::cookiesForDOMAsync):
(WebKit::NetworkConnectionToWebProcess::setCookieFromDOMAsync):
Validate all cookie messages that contain `sameSiteInfo`.
* Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.h:
* Tools/TestWebKitAPI/Tests/WebKitCocoa/IPCTestingAPI.mm:
(InvalidSameSiteInfoCookieRequestHeaderFieldValue)):
* Tools/TestWebKitAPI/Tests/WebKitCocoa/SOAuthorizationTests.mm:
(TestWebKitAPI::TEST(SOAuthorizationSubFrame,
InterceptionSucceedWithCookie)):
Fix this test, which was trying to a cookie from example.com on a page with
an empty main frame URL.
Canonical link: https://commits.webkit.org/283286.501@safari-7620-branch
Commit: a58e1d7439d8a5717eb5eeb1c7861b327f7cb79e
https://github.com/WebKit/WebKit/commit/a58e1d7439d8a5717eb5eeb1c7861b327f7cb79e
Author: Ryosuke Niwa <[email protected]>
Date: 2024-11-19 (Tue, 19 Nov 2024)
Changed paths:
M Source/WebCore/platform/Timer.cpp
Log Message:
-----------
Cherry-pick d542dd305ab0. rdar://140233024
Disable the release assert in Timer::Timer
https://bugs.webkit.org/show_bug.cgi?id=283383
<rdar://140233024>
Reviewed by Chris Dumez.
Removed the release assert for now.
* Source/WebCore/platform/Timer.cpp:
(WebCore::TimerBase::TimerBase):
Canonical link: https://commits.webkit.org/283286.502@safari-7620-branch
Commit: 24371a327d61b26e9c9713762de168942a600890
https://github.com/WebKit/WebKit/commit/24371a327d61b26e9c9713762de168942a600890
Author: Mohsin Qureshi <[email protected]>
Date: 2024-11-21 (Thu, 21 Nov 2024)
Changed paths:
M Configurations/Version.xcconfig
Log Message:
-----------
Versioning.
WebKit-7620.1.16.10.11
Canonical link: https://commits.webkit.org/[email protected]
Commit: 67bb03b4ca7a613861e70b6f04edef058de7498d
https://github.com/WebKit/WebKit/commit/67bb03b4ca7a613861e70b6f04edef058de7498d
Author: Youenn Fablet <[email protected]>
Date: 2024-11-21 (Thu, 21 Nov 2024)
Changed paths:
M Source/WTF/Scripts/Preferences/UnifiedWebPreferences.yaml
Log Message:
-----------
Cherry-pick fc73a0b209cf. rdar://140305310
J718/22C5142a: FaceTime video flipped upside-down in Safari call
rdar://140305310
Reviewed by Eric Carlson.
Rotation is incorrect on some iPads when this flag is on.
We temporarily disable the flag until we fix that issue for those iPads.
* Source/WTF/Scripts/Preferences/UnifiedWebPreferences.yaml:
Canonical link: https://commits.webkit.org/283286.516@safari-7620-branch
Compare: https://github.com/WebKit/WebKit/compare/8600f7e4a760%5E...67bb03b4ca7a
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
