Branch: refs/heads/webkitglib/2.52
Home: https://github.com/WebKit/WebKit
Commit: a630c95c5e834713c8dde5bfaf7c259d782a6af1
https://github.com/WebKit/WebKit/commit/a630c95c5e834713c8dde5bfaf7c259d782a6af1
Author: Ahmad Saleem <[email protected]>
Date: 2026-08-09 (Sun, 09 Aug 2026)
Changed paths:
M Source/WebCore/Modules/webaudio/AudioParam.cpp
Log Message:
-----------
Cherry-pick 318052@main (2a2036f697b1).
https://bugs.webkit.org/show_bug.cgi?id=320375
Unreviewed backport.
AudioParam::finalValue() returns an uninitialized float when
calculateFinalValues() bails out
https://bugs.webkit.org/show_bug.cgi?id=320375
rdar://183342212
Reviewed by Chris Dumez.
finalValue() declared `float value;` uninitialized and relied on
calculateFinalValues()
to write it, but that function early-returns without touching the output
span when there
is no context, we are off the audio thread, or the span is empty. The
garbage value then
flows into DSP as an oscillator frequency, filter cutoff, delay time, pan,
compressor
threshold, etc.
Initialize `value` to m_value, which is always set from defaultValue in the
constructor.
The k-rate path fills the span with m_value anyway, so this only changes the
previously-garbage path.
No new test.
* Source/WebCore/Modules/webaudio/AudioParam.cpp:
(WebCore::AudioParam::finalValue):
Canonical link: https://commits.webkit.org/318052@main
Canonical link: https://commits.webkit.org/305877.1069@webkitglib/2.52
Commit: 3b7f04245471524fa756022fb1aaba184674cb67
https://github.com/WebKit/WebKit/commit/3b7f04245471524fa756022fb1aaba184674cb67
Author: Kristian Monsen <[email protected]>
Date: 2026-08-09 (Sun, 09 Aug 2026)
Changed paths:
A
LayoutTests/navigation-api/navigation-navigate-state-clone-exception-crash-expected.txt
A
LayoutTests/navigation-api/navigation-navigate-state-clone-exception-crash.html
A
LayoutTests/navigation-api/navigation-reload-state-clone-exception-crash-expected.txt
A
LayoutTests/navigation-api/navigation-reload-state-clone-exception-crash.html
M Source/WebCore/bindings/js/JSDOMPromiseDeferred.cpp
Log Message:
-----------
Cherry-pick 318836@main (37cfccb3c6c9).
https://bugs.webkit.org/show_bug.cgi?id=321250
Fix crash from double-consuming the pending exception in
DeferredPromise::reject() during Navigation reload()/navigate() error handling
https://bugs.webkit.org/show_bug.cgi?id=321250
rdar://183911429
Reviewed by Rupin Mittal.
Navigation::createErrorResult() rejects both the committed and finished
promises with the same Exception. When that exception carries
ExceptionCode::ExistingExceptionError — the
sentinel meaning "the real JS exception is already sitting on the VM's
exception scope" — DeferredPromise::reject() pulled the value straight off
scope.exception() and called
scope.clearException() as a side effect. That works for the first reject()
call, but clears the exception before the second call runs, so it finds nothing
there: an assert in
debug/ASan builds, a null-pointer read of Exception::m_value in release
builds — either way, a crash on every reload()/navigate() whose state argument
throws during
structured-clone.
The fix reuses the exceptionObject out-parameter that's already threaded
through both reject() calls (the same parameter the plain-ExceptionCode branch
a few lines below already
uses to build the DOMException once and share it across calls). On the
first call, if exceptionObject is still empty, it extracts the value from the
exception scope, clears it, and
caches the result in exceptionObject; on the second call, exceptionObject
is already populated, so it skips touching the exception scope entirely and
just rejects with the cached
value. This matches the pattern already used elsewhere in Navigation.cpp
(rejectFinishedPromise, which precomputes a DOMException once and passes it to
both promise rejections),
and it satisfies the spec requirement that committed and finished reject
with the identical error value — which a "swallow and fall back to a generic
error" fix would not have.
Tests: navigation-api/navigation-navigate-state-clone-exception-crash.html
navigation-api/navigation-reload-state-clone-exception-crash.html
*
LayoutTests/navigation-api/navigation-navigate-state-clone-exception-crash-expected.txt:
Added.
*
LayoutTests/navigation-api/navigation-navigate-state-clone-exception-crash.html:
Added.
*
LayoutTests/navigation-api/navigation-reload-state-clone-exception-crash-expected.txt:
Added.
*
LayoutTests/navigation-api/navigation-reload-state-clone-exception-crash.html:
Added.
* Source/WebCore/bindings/js/JSDOMPromiseDeferred.cpp:
(WebCore::DeferredPromise::reject):
Canonical link: https://commits.webkit.org/318836@main
Canonical link: https://commits.webkit.org/305877.1070@webkitglib/2.52
Commit: 719d55a174aed27d36c534c93f351b835976d7de
https://github.com/WebKit/WebKit/commit/719d55a174aed27d36c534c93f351b835976d7de
Author: Carlos Garcia Campos <[email protected]>
Date: 2026-08-09 (Sun, 09 Aug 2026)
Changed paths:
M Source/WebCore/SaferCPPExpectations/UncheckedCallArgsCheckerExpectations
M Source/WebCore/accessibility/AccessibilityMenuListPopup.cpp
Log Message:
-----------
Cherry-pick 318692@main (e04f9dd61dc4).
https://bugs.webkit.org/show_bug.cgi?id=321077
Crash in AccessibilityMenuListPopup::menuListOptionAccessibilityObject
https://bugs.webkit.org/show_bug.cgi?id=321077
Reviewed by Tyler Wilcock.
Null check AXCache we get from document and return early if it's nullptr.
* Source/WebCore/accessibility/AccessibilityMenuListPopup.cpp:
(WebCore::AccessibilityMenuListPopup::menuListOptionAccessibilityObject
const):
* Source/WebCore/SaferCPPExpectations/UncheckedCallArgsCheckerExpectations:
Canonical link: https://commits.webkit.org/318692@main
Canonical link: https://commits.webkit.org/305877.1071@webkitglib/2.52
Commit: 97b45927eca5408ac86edc492f6116af436bd3d4
https://github.com/WebKit/WebKit/commit/97b45927eca5408ac86edc492f6116af436bd3d4
Author: Fujii Hironori <[email protected]>
Date: 2026-08-09 (Sun, 09 Aug 2026)
Changed paths:
M Source/cmake/WebKitMacros.cmake
Log Message:
-----------
Cherry-pick 318630@main (4bfeff8c67ad).
https://bugs.webkit.org/show_bug.cgi?id=321081
[CMake 4.4][WPE] _WEBKIT_TARGET_LINK_FRAMEWORK reports "Unknown arguments
specified" error
https://bugs.webkit.org/show_bug.cgi?id=321081
Reviewed by Adrian Perez de Castro.
CMake 4.4 reports the following error for WPE.
> -- Using platform-specific CMakeLists:
/run/build/webkitwpe/Source/JavaScriptCore/shell/PlatformWPE.cmake
> CMake Error at Source/cmake/WebKitMacros.cmake:554 (if):
> if given arguments:
>
> "(" "NOT" "_linked_into" ")" "OR" "(" "JavaScriptCore" "STREQUAL" ")"
"OR" "(" "NOT" "IN_LIST" "jsc_FRAMEWORKS" ")"
>
> Unknown arguments specified
> Call Stack (most recent call first):
> Source/cmake/WebKitMacros.cmake:756 (_WEBKIT_TARGET_LINK_FRAMEWORK)
> Source/JavaScriptCore/shell/CMakeLists.txt:126 (WEBKIT_EXECUTABLE)
Replaced `${_linked_into}` with `_linked_into`.
* Source/cmake/WebKitMacros.cmake(_WEBKIT_TARGET_LINK_FRAMEWORK):
Canonical link: https://commits.webkit.org/318630@main
Canonical link: https://commits.webkit.org/305877.1072@webkitglib/2.52
Compare: https://github.com/WebKit/WebKit/compare/6a8fe579197b...97b45927eca5
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
