Branch: refs/heads/webkitglib/2.52
Home: https://github.com/WebKit/WebKit
Commit: 71b801ce6146294598f75bcb683bfb62f09e99cc
https://github.com/WebKit/WebKit/commit/71b801ce6146294598f75bcb683bfb62f09e99cc
Author: Ahmad Saleem <[email protected]>
Date: 2026-07-15 (Wed, 15 Jul 2026)
Changed paths:
M Source/WebCore/Modules/indexeddb/server/SQLiteIDBBackingStore.cpp
Log Message:
-----------
Cherry-pick 317026@main (986e5185e1c1).
https://bugs.webkit.org/show_bug.cgi?id=319222
IndexedDB getCount() truncates record counts above INT_MAX
https://bugs.webkit.org/show_bug.cgi?id=319222
rdar://182075709
Reviewed by Chris Dumez.
SQLiteIDBBackingStore::getCount() writes the record count into a
uint64_t out-parameter, and SQLite's COUNT(*) is a 64-bit integer,
but the result was read with columnInt(), which returns a 32-bit int.
A count above INT_MAX would be truncated (and sign-extended into a
bogus large value). Read the column with columnInt64() instead,
matching uncheckedGetKeyGeneratorValue() just below it.
No new tests; triggering truncation requires more than 2^31 records
in a single object store, which is not practical to exercise in a
test.
* Source/WebCore/Modules/indexeddb/server/SQLiteIDBBackingStore.cpp:
(WebCore::IDBServer::SQLiteIDBBackingStore::getCount):
Canonical link: https://commits.webkit.org/317026@main
Canonical link: https://commits.webkit.org/305877.979@webkitglib/2.52
Commit: ff42e93a7314b5379d63f3975a0735fe1e1f133c
https://github.com/WebKit/WebKit/commit/ff42e93a7314b5379d63f3975a0735fe1e1f133c
Author: Sabith Saheb <[email protected]>
Date: 2026-07-15 (Wed, 15 Jul 2026)
Changed paths:
M Source/WebCore/loader/TextResourceDecoder.cpp
Log Message:
-----------
Cherry-pick 317011@main (94ff9f23ee9c).
https://bugs.webkit.org/show_bug.cgi?id=318680
Off-by-one out-of-bounds read in KanjiCode::judge()
https://bugs.webkit.org/show_bug.cgi?id=318680
Reviewed by Chris Dumez.
KanjiCode::judge() scans response bytes to guess a Japanese encoding
during charset autodetection. Two branches guard the string[i + 1]
lookahead with (string.size() - i >= 1), which is always true inside the
while (i < string.size()) loop, so when the final byte (i == size - 1)
falls in 0x81..0x9f or 0xfd..0xfe the code reads string[i + 1], one past
the end of the span. string is a std::span and WebKit builds with
hardened libc++, so this is caught as a safe release-assert crash, not a
heap-buffer-overflow or a security bug. The sibling hiragana/katakana
branches already use the correct (string.size() - i > 1) guard; this
makes the two SJIS/EUC lead-byte branches match. Inputs that actually
have a following byte take the same branch as before.
* Source/WebCore/loader/TextResourceDecoder.cpp:
(KanjiCode::judge):
Canonical link: https://commits.webkit.org/317011@main
Canonical link: https://commits.webkit.org/305877.980@webkitglib/2.52
Commit: 77119d1d8af859354151b49ed5c8a357d6cac754
https://github.com/WebKit/WebKit/commit/77119d1d8af859354151b49ed5c8a357d6cac754
Author: Carlos Alberto Lopez Perez <[email protected]>
Date: 2026-07-15 (Wed, 15 Jul 2026)
Changed paths:
M Tools/Scripts/run-jsc-stress-tests
Log Message:
-----------
Cherry-pick 316943@main (25eb2ef52e74).
https://bugs.webkit.org/show_bug.cgi?id=319094
[run-jsc-stress-tests] Should honor the env variable NUMBER_OF_PROCESSORS
if set
https://bugs.webkit.org/show_bug.cgi?id=319094
Reviewed by Claudio Saavedra.
This variable is commonly used on the bots to limit the number of parallel
jobs.
This script should honor it like the other webkit-related test scripts.
run-jsc-stress-tests script is executed on the bots on the step jscore-test
when
it is executed via the main run-javascriptcore-tests script.
* Tools/Scripts/run-jsc-stress-tests:
Canonical link: https://commits.webkit.org/316943@main
Canonical link: https://commits.webkit.org/305877.981@webkitglib/2.52
Commit: 4a0627e66cea75c483aee3f6ae1f16ecfcfb3fad
https://github.com/WebKit/WebKit/commit/4a0627e66cea75c483aee3f6ae1f16ecfcfb3fad
Author: Adrian Perez de Castro <[email protected]>
Date: 2026-07-15 (Wed, 15 Jul 2026)
Changed paths:
M Source/WebCore/platform/gtk/po/pt_BR.po
Log Message:
-----------
Cherry-pick 317131@main (c07665993686).
https://bugs.webkit.org/show_bug.cgi?id=319282
[GTK] Update Brazilian Portuguese (pt_BR.po) translation
https://bugs.webkit.org/show_bug.cgi?id=319282
Unreviewed.
* Source/WebCore/platform/gtk/po/pt_BR.po:
Canonical link: https://commits.webkit.org/317131@main
Canonical link: https://commits.webkit.org/305877.982@webkitglib/2.52
Commit: 24f406500bb92706dc8c320fde3f36ce9f2f9f09
https://github.com/WebKit/WebKit/commit/24f406500bb92706dc8c320fde3f36ce9f2f9f09
Author: Ahmad Saleem <[email protected]>
Date: 2026-07-15 (Wed, 15 Jul 2026)
Changed paths:
M Source/WebInspectorUI/UserInterface/Models/Color.js
Log Message:
-----------
Cherry-pick 317047@main (aa596b0d59eb).
https://bugs.webkit.org/show_bug.cgi?id=319241
Web Inspector: crimson named color maps to wrong RGB value
https://bugs.webkit.org/show_bug.cgi?id=319241
rdar://182090064
Reviewed by Abrar Rahman Protyasha and Devin Rousso.
The `crimson` keyword was mapped to [237, 164, 61] (a dull orange)
instead of its correct value #DC143C ([220, 20, 60]).
* Source/WebInspectorUI/UserInterface/Models/Color.js:
Canonical link: https://commits.webkit.org/317047@main
Canonical link: https://commits.webkit.org/305877.983@webkitglib/2.52
Commit: a3ed95996e868d81d6dd5750db2dc4d2b8cc8a32
https://github.com/WebKit/WebKit/commit/a3ed95996e868d81d6dd5750db2dc4d2b8cc8a32
Author: Ahmad Saleem <[email protected]>
Date: 2026-07-15 (Wed, 15 Jul 2026)
Changed paths:
M Source/WebCore/svg/SVGLengthContext.cpp
Log Message:
-----------
Cherry-pick 317004@main (8256a3cb6c19).
https://bugs.webkit.org/show_bug.cgi?id=318852
Null-deref of documentElement() when resolving root-font-relative SVG
lengths
https://bugs.webkit.org/show_bug.cgi?id=318852
rdar://181677854
Reviewed by Taher Ali.
SVGLengthContext::removeZoomFromFontOrRootFontRelativeLength() dereferenced
Document::documentElement() without a null check when resolving a
root-font-relative unit (e.g. rem/rlh). documentElement() can return null
(document without a root element, or one being torn down), so this could
crash during length/style resolution.
The sibling helper rootRenderStyleForLengthResolving() already guards this
exact access with `if (!rootElement || !rootElement->renderer())`. Guard
documentElement() before reading its renderer, mirroring the sibling helper.
* Source/WebCore/svg/SVGLengthContext.cpp:
(WebCore::SVGLengthContext::removeZoomFromFontOrRootFontRelativeLength
const):
Canonical link: https://commits.webkit.org/317004@main
Canonical link: https://commits.webkit.org/305877.984@webkitglib/2.52
Commit: fe8ce1ffd41dcd96220cac38a8a2fa31fc430b7c
https://github.com/WebKit/WebKit/commit/fe8ce1ffd41dcd96220cac38a8a2fa31fc430b7c
Author: Tyler Wilcock <[email protected]>
Date: 2026-07-15 (Wed, 15 Jul 2026)
Changed paths:
A
LayoutTests/accessibility/relations-update-during-node-removal-crash-expected.txt
A LayoutTests/accessibility/relations-update-during-node-removal-crash.html
M Source/WebCore/accessibility/AXObjectCache.cpp
M Source/WebCore/accessibility/AXObjectCache.h
Log Message:
-----------
Cherry-pick 316915@main (62d7f19ba485).
https://bugs.webkit.org/show_bug.cgi?id=318992
AX: Null-pointer dereference rebuilding accessibility relations during node
removal
https://bugs.webkit.org/show_bug.cgi?id=318992
rdar://181844005
Reviewed by Chris Fleizach.
During node teardown (e.g. a GC sweep destroying DOM nodes),
AXObjectCache::remove(Node&)
-> remove(AXID) -> AXIsolatedTree::queueNodeRemoval() computes the removed
object's parent via
parentInCoreTree() -> AccessibilityNodeObject::ownerParentObject(). When
relations are dirty,
that reaches owners() -> relatedObjects(AXRelation::OwnedBy) ->
relatedObjectIDsFor(...,
UpdateRelations::Yes), which synchronously runs updateRelationsIfNeeded().
Rebuilding relations
walks the DOM and creates accessibility objects in the middle of node
destruction, dereferencing
a null pointer.
Guard against this with an m_isRemovingNode flag set across remove(AXID).
updateRelationsIfNeeded()
returns early while it is set. queueNodeRemoval() already reads relations
without updating them
for its LabelFor lookup (UpdateRelations::No), so this is consistent with
the existing intent.
Reading the current (stale) relations during removal is also correct. The
parent ID recorded by
queueNodeRemoval() must match the isolated tree's m_nodeMap, which reflects
the same last-built
relations. A fresh rebuild would desync from it and make
removeSubtreeFromNodeMap() bail.
*
LayoutTests/accessibility/relations-update-during-node-removal-crash-expected.txt:
Added.
*
LayoutTests/accessibility/relations-update-during-node-removal-crash.html:
Added.
* Source/WebCore/accessibility/AXObjectCache.cpp:
(WebCore::AXObjectCache::remove):
(WebCore::AXObjectCache::updateRelationsIfNeeded):
* Source/WebCore/accessibility/AXObjectCache.h:
Canonical link: https://commits.webkit.org/316915@main
Canonical link: https://commits.webkit.org/305877.985@webkitglib/2.52
Commit: 2091b9a3d7e23d4a0e8817867623d01f90b72ad4
https://github.com/WebKit/WebKit/commit/2091b9a3d7e23d4a0e8817867623d01f90b72ad4
Author: Brady Eidson <[email protected]>
Date: 2026-07-15 (Wed, 15 Jul 2026)
Changed paths:
M Source/WebKit/UIProcess/WebPageProxy.cpp
Log Message:
-----------
Cherry-pick 316666@main (bff3064cc420).
https://bugs.webkit.org/show_bug.cgi?id=318800
Null check pageClient() inside WebPageProxy::didAttachToRunningProcess
rdar://180575637
https://bugs.webkit.org/show_bug.cgi?id=318800
Reviewed by Rupin Mittal.
Many, many pieces of PSON commit machinery null check pageClient(), which
can legitimately become null.
WebPageProxy::didAttachToRunningProcess missed such a check. Let's add it.
Unable to reproduce, so no test.
* Source/WebKit/UIProcess/WebPageProxy.cpp:
(WebKit::WebPageProxy::didAttachToRunningProcess):
Canonical link: https://commits.webkit.org/316666@main
Canonical link: https://commits.webkit.org/305877.986@webkitglib/2.52
Commit: f8e73ca729116af05b52ac34df3182b407c11246
https://github.com/WebKit/WebKit/commit/f8e73ca729116af05b52ac34df3182b407c11246
Author: Ryosuke Niwa <[email protected]>
Date: 2026-07-15 (Wed, 15 Jul 2026)
Changed paths:
M Source/WebCore/SaferCPPExpectations/UncheckedCallArgsCheckerExpectations
M Source/WebCore/SaferCPPExpectations/UncountedCallArgsCheckerExpectations
M Source/WebCore/page/NavigateEvent.cpp
Log Message:
-----------
Cherry-pick 316500@main (7b7429195b07).
https://bugs.webkit.org/show_bug.cgi?id=313606
Use-after-free in LocalFrameView::scrollToAnchorFragment via
NavigateEvent:finish
https://bugs.webkit.org/show_bug.cgi?id=313606
Reviewed by Anne van Kesteren and Rupin Mittal.
Deployed more smart pointers to fix the bug.
Test: navigation-api/navigation-api-fragment-intercept-crash.html
*
LayoutTests/navigation-api/navigation-api-fragment-intercept-crash-expected.txt:
Added.
* LayoutTests/navigation-api/navigation-api-fragment-intercept-crash.html:
Added.
*
LayoutTests/navigation-api/resources/navigation-api-fragment-intercept-crash-inner.html:
Added.
Originally-landed-as: 305413.777@safari-7624-branch (0e113df3124c).
rdar://180428609
Canonical link: https://commits.webkit.org/316500@main
Canonical link: https://commits.webkit.org/305877.987@webkitglib/2.52
Commit: ab25e210be218861e75479a64d7cbaa366ce3ccd
https://github.com/WebKit/WebKit/commit/ab25e210be218861e75479a64d7cbaa366ce3ccd
Author: Ahmad Saleem <[email protected]>
Date: 2026-07-15 (Wed, 15 Jul 2026)
Changed paths:
M Source/WebCore/inspector/agents/InspectorCSSAgent.cpp
Log Message:
-----------
Cherry-pick 316490@main (30dcf5d1c940).
https://bugs.webkit.org/show_bug.cgi?id=318537
[Web Inspector] Null InspectorStyleSheet dereference in
InspectorCSSAgent::setActiveStyleSheetsForDocument when removing a stylesheet
https://bugs.webkit.org/show_bug.cgi?id=318537
rdar://181307890
Reviewed by Devin Rousso.
When processing removed stylesheets, InspectorCSSAgent dereferenced the
result of m_cssStyleSheetToInspectorStyleSheet.get() without a null check
to read id(), unlike its twin FrameCSSAgent::setActiveStyleSheetsForDocument
which guards the same access. Add the missing null check to match.
* Source/WebCore/inspector/agents/InspectorCSSAgent.cpp:
(WebCore::InspectorCSSAgent::setActiveStyleSheetsForDocument):
Canonical link: https://commits.webkit.org/316490@main
Canonical link: https://commits.webkit.org/305877.988@webkitglib/2.52
Compare: https://github.com/WebKit/WebKit/compare/9d11fa1a37e6...ab25e210be21
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
