Branch: refs/heads/webkitglib/2.52
Home: https://github.com/WebKit/WebKit
Commit: 9898cd2f86822442ec3c1be243e5bb022eeae1bb
https://github.com/WebKit/WebKit/commit/9898cd2f86822442ec3c1be243e5bb022eeae1bb
Author: Ahmad Saleem <[email protected]>
Date: 2026-08-08 (Sat, 08 Aug 2026)
Changed paths:
M Source/WebCore/inspector/InspectorThreadableLoaderClient.h
Log Message:
-----------
Cherry-pick 317472@main (163805a73a69).
https://bugs.webkit.org/show_bug.cgi?id=319738
Web Inspector: InspectorThreadableLoaderClient::m_statusCode is
uninitialized
https://bugs.webkit.org/show_bug.cgi?id=319738
rdar://182578510
Reviewed by Devin Rousso.
m_statusCode had no default member initializer, unlike the other
members of InspectorThreadableLoaderClient. It is set in
didReceiveResponse() and read in didFinishLoading(), which relies on
ThreadableLoaderClient's contract that didReceiveResponse() always
precedes didFinishLoading(). Give it a safe default so a future
change to that contract can't read uninitialized memory
* Source/WebCore/inspector/InspectorThreadableLoaderClient.h:
Canonical link: https://commits.webkit.org/317472@main
Canonical link: https://commits.webkit.org/305877.1065@webkitglib/2.52
Commit: 3559e6b48d1cd2285af70263ca5f1b1357977cfd
https://github.com/WebKit/WebKit/commit/3559e6b48d1cd2285af70263ca5f1b1357977cfd
Author: Brady Eidson <[email protected]>
Date: 2026-08-08 (Sat, 08 Aug 2026)
Changed paths:
M Source/WebKit/UIProcess/AuxiliaryProcessProxy.cpp
M Source/WebKit/UIProcess/AuxiliaryProcessProxy.h
M Source/WebKit/UIProcess/GPU/GPUProcessProxy.cpp
M Source/WebKit/UIProcess/GPU/GPUProcessProxy.h
M Source/WebKit/UIProcess/Model/ModelProcessProxy.cpp
M Source/WebKit/UIProcess/Model/ModelProcessProxy.h
M Source/WebKit/UIProcess/Network/NetworkProcessProxy.cpp
M Source/WebKit/UIProcess/Network/NetworkProcessProxy.h
M Source/WebKit/UIProcess/WebProcessProxy.cpp
M Source/WebKit/UIProcess/WebProcessProxy.h
Log Message:
-----------
Cherry-pick 315828@main (87794cc4aa21).
https://bugs.webkit.org/show_bug.cgi?id=317790
WKWebsiteDataStore dealloc crashes with pure virtual function call in
WebKit::AuxiliaryProcessProxy
rdar://180473685
https://bugs.webkit.org/show_bug.cgi?id=317790
Reviewed by Alex Christensen.
There was no need for this particular virtual dance. So let's just remove
it.
No new tests needed.
* Source/WebKit/UIProcess/AuxiliaryProcessProxy.cpp:
(WebKit::AuxiliaryProcessProxy::AuxiliaryProcessProxy):
(WebKit::AuxiliaryProcessProxy::environmentIdentifier):
* Source/WebKit/UIProcess/AuxiliaryProcessProxy.h:
(WebKit::AuxiliaryProcessProxy::clientName const):
* Source/WebKit/UIProcess/GPU/GPUProcessProxy.cpp:
(WebKit::GPUProcessProxy::GPUProcessProxy):
* Source/WebKit/UIProcess/GPU/GPUProcessProxy.h:
* Source/WebKit/UIProcess/Model/ModelProcessProxy.cpp:
(WebKit::ModelProcessProxy::ModelProcessProxy):
* Source/WebKit/UIProcess/Model/ModelProcessProxy.h:
* Source/WebKit/UIProcess/Network/NetworkProcessProxy.cpp:
(WebKit::NetworkProcessProxy::NetworkProcessProxy):
* Source/WebKit/UIProcess/Network/NetworkProcessProxy.h:
* Source/WebKit/UIProcess/WebProcessProxy.cpp:
(WebKit::WebProcessProxy::WebProcessProxy):
* Source/WebKit/UIProcess/WebProcessProxy.h:
Canonical link: https://commits.webkit.org/315828@main
Canonical link: https://commits.webkit.org/305877.1066@webkitglib/2.52
Commit: 1ecf035a8c4739bae441c1a5dbef73cf28e766e9
https://github.com/WebKit/WebKit/commit/1ecf035a8c4739bae441c1a5dbef73cf28e766e9
Author: Ahmad Saleem <[email protected]>
Date: 2026-08-08 (Sat, 08 Aug 2026)
Changed paths:
M
Source/WebCore/layout/integration/inline/LayoutIntegrationInlineContent.cpp
Log Message:
-----------
Cherry-pick 317456@main (06d1695c9a81).
https://bugs.webkit.org/show_bug.cgi?id=319724
shrinkToFit() operates on a temporary copy in
InlineContent::nonRootInlineBoxIndexesForLayoutBox()
https://bugs.webkit.org/show_bug.cgi?id=319724
rdar://182557883
Reviewed by Alan Baradlay.
When building the inline box index cache, the loop that trims each
vector's excess capacity iterated the HashMap by value:
for (auto entry : *m_inlineBoxIndexCache)
entry.value.shrinkToFit();
Since InlineBoxIndexCache is a HashMap<CheckedRef<const Layout::Box>,
Vector<size_t>>, `auto entry` copies each key-value pair, so shrinkToFit()
trims a throwaway copy of the vector while the vector stored in the map
keeps its over-allocated capacity. The optimization was a no-op, and each
iteration paid for a needless copy of the vector (plus CheckedRef churn).
Iterate by reference so shrinkToFit() acts on the stored vector.
*
Source/WebCore/layout/integration/inline/LayoutIntegrationInlineContent.cpp:
(WebCore::LayoutIntegration::InlineContent::nonRootInlineBoxIndexesForLayoutBox
const):
Canonical link: https://commits.webkit.org/317456@main
Canonical link: https://commits.webkit.org/305877.1067@webkitglib/2.52
Commit: 6a8fe579197b051d9e902b8af708081b5068a0c9
https://github.com/WebKit/WebKit/commit/6a8fe579197b051d9e902b8af708081b5068a0c9
Author: Ahmad Saleem <[email protected]>
Date: 2026-08-08 (Sat, 08 Aug 2026)
Changed paths:
M Source/WTF/wtf/MathExtras.h
M Tools/TestWebKitAPI/Tests/WTF/MathExtras.cpp
Log Message:
-----------
Cherry-pick 317292@main (3aa0615a5649).
https://bugs.webkit.org/show_bug.cgi?id=319520
Unreviewed backport.
WTF::divideRoundedUp can overflow for dividends near the type's maximum
https://bugs.webkit.org/show_bug.cgi?id=319520
rdar://182336325
Reviewed by Chris Dumez.
divideRoundedUp(a, b) computed (a + b - 1) / b, whose intermediate
a + b - 1 overflows when a is close to the maximum representable value
of T. All callers use size_t, so this wraps silently: for example
divideRoundedUp<uint8_t>(255, 2) computes 255 + 2 - 1 = 256, which
wraps to 0, yielding 0 instead of the correct 128.
Rewrite it in the overflow-safe form a / b + !!(a % b), which is
mathematically equivalent for non-negative operands (the ceil-division
domain) and cannot overflow: a / b <= a, and the +1 is never added when
a / b is already at the maximum (b == 1 implies a % b == 0).
Test: Tools/TestWebKitAPI/Tests/WTF/MathExtras.cpp
* Source/WTF/wtf/MathExtras.h:
(divideRoundedUp):
* Tools/TestWebKitAPI/Tests/WTF/MathExtras.cpp:
(TestWebKitAPI::TEST(WTF, divideRoundedUp)):
Canonical link: https://commits.webkit.org/317292@main
Canonical link: https://commits.webkit.org/305877.1068@webkitglib/2.52
Compare: https://github.com/WebKit/WebKit/compare/26272727d539...6a8fe579197b
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
