Branch: refs/heads/webkitglib/2.50
Home: https://github.com/WebKit/WebKit
Commit: fbe01734a08b94759e2a1759bcf0ea1f279c95a4
https://github.com/WebKit/WebKit/commit/fbe01734a08b94759e2a1759bcf0ea1f279c95a4
Author: Jer Noble <[email protected]>
Date: 2025-09-16 (Tue, 16 Sep 2025)
Changed paths:
M Source/WebKit/UIProcess/WebPageProxy.cpp
M Tools/TestWebKitAPI/Tests/WebKit/GetUserMedia.mm
M Tools/TestWebKitAPI/Tests/WebKitCocoa/media-session-capture.html
Log Message:
-----------
Cherry-pick 297297.104@safari-7622-branch (e36cad1573d4).
https://bugs.webkit.org/show_bug.cgi?id=296153
gUM() for video does not issue permission request after muting and
requesting gUM() for audio
rdar://150695123
https://bugs.webkit.org/show_bug.cgi?id=296153
Reviewed by Andy Estes.
Apply the adjusted media capture state to WebPageProxy's internal capture
state, which
forces each capture type to require a permission prompt to unmute.
* Source/WebKit/UIProcess/WebPageProxy.cpp:
(WebKit::WebPageProxy::setMuted):
* Tools/TestWebKitAPI/Tests/WebKit/GetUserMedia.mm:
(TestWebKitAPI::(WebKit2, GetUserMediaAfterMuting)):
* Tools/TestWebKitAPI/Tests/WebKitCocoa/media-session-capture.html:
Canonical link: https://commits.webkit.org/297297.104@safari-7622-branch
Canonical link: https://commits.webkit.org/298234.131@webkitglib/2.50
Commit: e132906ac091f6f758ef0b052992710a086858e7
https://github.com/WebKit/WebKit/commit/e132906ac091f6f758ef0b052992710a086858e7
Author: Yijia Huang <[email protected]>
Date: 2025-09-16 (Tue, 16 Sep 2025)
Changed paths:
M
Source/JavaScriptCore/bytecode/LLIntPrototypeLoadAdaptiveStructureWatchpoint.cpp
Log Message:
-----------
Cherry-pick 297297.140@safari-7622-branch (881d4e9ef8e5).
https://bugs.webkit.org/show_bug.cgi?id=296226
[JSC] Fix instanceof metadata fields in
LLIntPrototypeLoadAdaptiveStructureWatchpoint
https://bugs.webkit.org/show_bug.cgi?id=296226
rdar://156196469
Reviewed by Mark Lam and Yusuke Suzuki.
OpInstanceof::getHasInstance should clear m_hasInstanceModeMetadata.
OpInstanceof::getPrototype should clear m_prototypeModeMetadata.
Canonical link: https://commits.webkit.org/297297.140@safari-7622-branch
Canonical link: https://commits.webkit.org/298234.132@webkitglib/2.50
Commit: f3f7e7880c36ac7d0735efc084c618382194382e
https://github.com/WebKit/WebKit/commit/f3f7e7880c36ac7d0735efc084c618382194382e
Author: Yijia Huang <[email protected]>
Date: 2025-09-16 (Tue, 16 Sep 2025)
Changed paths:
A JSTests/stress/instanceof-osr-exit-hasInstance-getter.js
A JSTests/stress/instanceof-osr-exit-prototype-getter.js
M Source/JavaScriptCore/bytecode/BytecodeList.rb
M Source/JavaScriptCore/dfg/DFGOSRExitCompilerCommon.cpp
M Source/JavaScriptCore/llint/LLIntOpcode.h
M Source/JavaScriptCore/llint/LLIntSlowPaths.cpp
M Source/JavaScriptCore/llint/LowLevelInterpreter64.asm
Log Message:
-----------
Cherry-pick 297297.141@safari-7622-branch (ed4e91038f2b).
https://bugs.webkit.org/show_bug.cgi?id=296042
ASSERTION FAILED: constructor.isObject() when OSR from an inlined function
https://bugs.webkit.org/show_bug.cgi?id=296042
rdar://155947925
Reviewed by Keith Miller.
The checkpoint OSR exit handler for op_instanceof was incorrectly trying to
re-execute the instanceof logic instead of processing the result of the
already-completed inlined call.
The fix simplifies the OpInstanceof::getPrototype case to directly use the
inlined call result and proceed with JSObject::defaultHasInstance(), which
is the correct behavior for OSR exit handlers.
In addition, both OpInstanceof::getHasInstance and OpInstanceof::instanceof
should never be reached in
llint_slow_path_checkpoint_osr_exit_from_inlined_call
since:
1. OpInstanceof::instanceof has no inlined calls.
2. OpInstanceof::getHasInstance as the first checkpoint, the inlined call
exit
would directly exit to the OSR exit site in the callee and finish the
callee,
then resume the caller from baseline/LLInt.
Canonical link: https://commits.webkit.org/297297.141@safari-7622-branch
Canonical link: https://commits.webkit.org/298234.133@webkitglib/2.50
Commit: 80e483466d35c5f2eacb75ebbc427a7925c07a15
https://github.com/WebKit/WebKit/commit/80e483466d35c5f2eacb75ebbc427a7925c07a15
Author: Yusuke Suzuki <[email protected]>
Date: 2025-09-16 (Tue, 16 Sep 2025)
Changed paths:
A JSTests/stress/regexp-matches-array-should-respect-have-a-bad-time.js
M Source/JavaScriptCore/runtime/JSGlobalObjectInlines.h
Log Message:
-----------
Cherry-pick 289651.443@safari-7621-branch (e4c46a52540e).
https://bugs.webkit.org/show_bug.cgi?id=291745
[JSC]ASSERTION FAILED: !needsSlowPutIndexing() at ensureArrayStorageSlow
https://bugs.webkit.org/show_bug.cgi?id=291745
rdar://149546458
Reviewed by Keith Miller.
We should not create Contiguous array when have-a-bad-time happened for
RegExp match results.
* JSTests/stress/regexp-matches-array-should-respect-have-a-bad-time.js:
Added.
(F0.C4):
(F0.f5):
(F0):
(set get for):
* Source/JavaScriptCore/runtime/JSGlobalObjectInlines.h:
(JSC::tryCreateContiguousArrayWithPattern):
Canonical link: https://commits.webkit.org/289651.443@safari-7621-branch
Canonical link: https://commits.webkit.org/297297.193@safari-7622-branch
Canonical link: https://commits.webkit.org/298234.134@webkitglib/2.50
Compare: https://github.com/WebKit/WebKit/compare/e26600576b1d...80e483466d35
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
