Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: c420ed2f891b194801c3ceaf17a9e17887300bb5
https://github.com/WebKit/WebKit/commit/c420ed2f891b194801c3ceaf17a9e17887300bb5
Author: Jer Noble <[email protected]>
Date: 2025-10-04 (Sat, 04 Oct 2025)
Changed paths:
M Source/WebKit/UIProcess/WebPageProxy.cpp
M Tools/TestWebKitAPI/Tests/WebKit/GetUserMedia.mm
M Tools/TestWebKitAPI/Tests/WebKitCocoa/media-session-capture.html
Log Message:
-----------
gUM() for video does not issue permission request after muting and requesting
gUM() for audio
rdar://150695123
https://bugs.webkit.org/show_bug.cgi?id=296153
Reviewed by Andy Estes.
Apply the adjusted media capture state to WebPageProxy's internal capture
state, which
forces each capture type to require a permission prompt to unmute.
* Source/WebKit/UIProcess/WebPageProxy.cpp:
(WebKit::WebPageProxy::setMuted):
* Tools/TestWebKitAPI/Tests/WebKit/GetUserMedia.mm:
(TestWebKitAPI::(WebKit2, GetUserMediaAfterMuting)):
* Tools/TestWebKitAPI/Tests/WebKitCocoa/media-session-capture.html:
Originally-landed-as: 297297.104@safari-7622-branch (e36cad1573d4).
rdar://159891139
Canonical link: https://commits.webkit.org/301014@main
Commit: 75633338db6f14ada96d61fd6385086a17255570
https://github.com/WebKit/WebKit/commit/75633338db6f14ada96d61fd6385086a17255570
Author: Yijia Huang <[email protected]>
Date: 2025-10-04 (Sat, 04 Oct 2025)
Changed paths:
M
Source/JavaScriptCore/bytecode/LLIntPrototypeLoadAdaptiveStructureWatchpoint.cpp
Log Message:
-----------
[JSC] Fix instanceof metadata fields in
LLIntPrototypeLoadAdaptiveStructureWatchpoint
https://bugs.webkit.org/show_bug.cgi?id=296226
rdar://156196469
Reviewed by Mark Lam and Yusuke Suzuki.
OpInstanceof::getHasInstance should clear m_hasInstanceModeMetadata.
OpInstanceof::getPrototype should clear m_prototypeModeMetadata.
Originally-landed-as: 297297.140@safari-7622-branch (881d4e9ef8e5).
rdar://159891098
Canonical link: https://commits.webkit.org/301015@main
Commit: 8b9fc1b8515151cca3a4a46b3b537ab81948bb61
https://github.com/WebKit/WebKit/commit/8b9fc1b8515151cca3a4a46b3b537ab81948bb61
Author: Yijia Huang <[email protected]>
Date: 2025-10-04 (Sat, 04 Oct 2025)
Changed paths:
A JSTests/stress/instanceof-osr-exit-hasInstance-getter.js
A JSTests/stress/instanceof-osr-exit-prototype-getter.js
M Source/JavaScriptCore/bytecode/BytecodeList.rb
M Source/JavaScriptCore/dfg/DFGOSRExitCompilerCommon.cpp
M Source/JavaScriptCore/llint/LLIntOpcode.h
M Source/JavaScriptCore/llint/LLIntSlowPaths.cpp
M Source/JavaScriptCore/llint/LowLevelInterpreter64.asm
Log Message:
-----------
ASSERTION FAILED: constructor.isObject() when OSR from an inlined function
https://bugs.webkit.org/show_bug.cgi?id=296042
rdar://155947925
Reviewed by Keith Miller.
The checkpoint OSR exit handler for op_instanceof was incorrectly trying to
re-execute the instanceof logic instead of processing the result of the
already-completed inlined call.
The fix simplifies the OpInstanceof::getPrototype case to directly use the
inlined call result and proceed with JSObject::defaultHasInstance(), which
is the correct behavior for OSR exit handlers.
In addition, both OpInstanceof::getHasInstance and OpInstanceof::instanceof
should never be reached in llint_slow_path_checkpoint_osr_exit_from_inlined_call
since:
1. OpInstanceof::instanceof has no inlined calls.
2. OpInstanceof::getHasInstance as the first checkpoint, the inlined call exit
would directly exit to the OSR exit site in the callee and finish the callee,
then resume the caller from baseline/LLInt.
Originally-landed-as: 297297.141@safari-7622-branch (ed4e91038f2b).
rdar://159890919
Canonical link: https://commits.webkit.org/301016@main
Compare: https://github.com/WebKit/WebKit/compare/51e241d84832...8b9fc1b85151
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
