Branch: refs/heads/webkitglib/2.54
Home: https://github.com/WebKit/WebKit
Commit: d6105d03c475000432040b7fe22fc35e8df848ab
https://github.com/WebKit/WebKit/commit/d6105d03c475000432040b7fe22fc35e8df848ab
Author: Lauro Moura <[email protected]>
Date: 2026-08-11 (Tue, 11 Aug 2026)
Changed paths:
M Source/WebKit/WebProcess/glib/WebProcessGLib.cpp
M WebDriverTests/TestExpectations.json
Log Message:
-----------
Cherry-pick 318898@main (2865d793ebdc).
https://bugs.webkit.org/show_bug.cgi?id=321277
[WebDriver][GLIB] Flaky WPEWebProcess portal crashes in eager JSWindowProxy
creation
https://bugs.webkit.org/show_bug.cgi?id=321277
Reviewed by Carlos Alberto Lopez Perez.
Since 310527@main, WebAutomationSession::createBrowsingContext calls
WebAutomationSessionProxy::ensureRealmForInitialEmptyDocument, which in
turn tries to create an early JSWindowProxy for the realm. This can lead
to a race in the RemoteInspector initialization, resulting in dbus
critical messages in the portal negotiation.
While this eager JSWindowProxy eager initialization is properly handled
within bug310506, this commit works around this issue by pre-warming the
RemoteInspector on the WebProcess when its address is set (e.g.
automated pages), allowing the configuration to settle before
ensureRealmForInitialEmptyDocument is called.
Also, drive-by gardening of some related issues mistakenly attributed to
this issue.
* Source/WebKit/WebProcess/glib/WebProcessGLib.cpp:
(WebKit::WebProcess::platformInitializeWebProcess):
* WebDriverTests/TestExpectations.json:
Canonical link: https://commits.webkit.org/318898@main
Canonical link: https://commits.webkit.org/317695.91@webkitglib/2.54
Commit: 03cfb775f8e972d5d608ec74d18bde8bebdba0c0
https://github.com/WebKit/WebKit/commit/03cfb775f8e972d5d608ec74d18bde8bebdba0c0
Author: Ahmad Saleem <[email protected]>
Date: 2026-08-11 (Tue, 11 Aug 2026)
Changed paths:
M Source/WebCore/Modules/webaudio/BaseAudioContext.cpp
Log Message:
-----------
Cherry-pick 318867@main (9f39c1d4c9b0).
https://bugs.webkit.org/show_bug.cgi?id=321367
BaseAudioContext::clear() leaks AudioNodes marked for deletion during
uninitialize()
https://bugs.webkit.org/show_bug.cgi?id=321367
rdar://184421456
Reviewed by Chris Dumez.
clear() assigned m_nodesMarkedForDeletion over m_nodesToDelete instead of
appending
to it. m_nodesToDelete is not necessarily empty on entry: uninitialize()
sets
m_isAudioThreadFinished before calling
handleDeferredDecrementConnectionCounts() and
handleDeferredDerefs(), and those reach markForDeletion(), which appends
straight to
m_nodesToDelete once the audio thread is finished, without the
deleteMarkedNodes()
call that the public deref() / decrementConnectionCount() wrappers make.
Those nodes
were dropped by the assignment. They are deleted by hand, and each holds a
Ref to its
context, so a single dropped node leaks the whole BaseAudioContext and its
graph.
The loop was dead too: deleteMarkedNodes() drains m_nodesToDelete, so the
condition
was always false and nodes marked while deleting other nodes were never
collected.
Append instead of assign and loop on m_nodesMarkedForDeletion, restoring
the behavior
from before 6eceb6d922f3, which drained before moving.
No test: the deferred lists are only populated when the audio thread failed
a
tryLock() on the graph lock, so this cannot be triggered deterministically.
* Source/WebCore/Modules/webaudio/BaseAudioContext.cpp:
(WebCore::BaseAudioContext::clear):
Canonical link: https://commits.webkit.org/318867@main
Canonical link: https://commits.webkit.org/317695.92@webkitglib/2.54
Commit: 942924a2391051ed647e457055173235b32c115e
https://github.com/WebKit/WebKit/commit/942924a2391051ed647e457055173235b32c115e
Author: Ryosuke Niwa <[email protected]>
Date: 2026-08-11 (Tue, 11 Aug 2026)
Changed paths:
M Source/WebCore/SaferCPPExpectations/NoDeleteCheckerExpectations
M Source/WebCore/css/CSSComputedStyleDeclaration.h
M Source/WebCore/css/CSSPropertyInitialValues.cpp
M Source/WebCore/css/DOMMatrixReadOnly.h
M Source/WebCore/css/SelectorChecker.cpp
M Source/WebCore/css/StyleSheetList.h
M Source/WebCore/css/parser/CSSPropertyParserConsumer+String.h
M Source/WebCore/css/values/color/CSSKeywordColor.cpp
Log Message:
-----------
Cherry-pick 318810@main (65b1821f100e).
https://bugs.webkit.org/show_bug.cgi?id=320518
Remove incorrect NODELETE annotations from Source/WebCore/css
https://bugs.webkit.org/show_bug.cgi?id=320518
Reviewed by Geoffrey Garen.
Removed NODELETE annotations from a bunch of functions in
Source/WebCore/css.
* Source/WebCore/SaferCPPExpectations/NoDeleteCheckerExpectations:
* Source/WebCore/css/CSSComputedStyleDeclaration.h:
* Source/WebCore/css/CSSPropertyInitialValues.cpp:
(WebCore::isNumber):
* Source/WebCore/css/DOMMatrixReadOnly.h:
* Source/WebCore/css/SelectorChecker.cpp:
(WebCore::localContextForParent):
* Source/WebCore/css/StyleSheetList.h:
* Source/WebCore/css/parser/CSSPropertyParserConsumer+String.h:
* Source/WebCore/css/values/color/CSSKeywordColor.cpp:
(WebCore::CSS::isDeprecatedSystemColorKeyword):
Canonical link: https://commits.webkit.org/318810@main
Canonical link: https://commits.webkit.org/317695.93@webkitglib/2.54
Commit: 1b52066fd9dc37aedb06d69bd5dfb094eea07f3d
https://github.com/WebKit/WebKit/commit/1b52066fd9dc37aedb06d69bd5dfb094eea07f3d
Author: Ryosuke Niwa <[email protected]>
Date: 2026-08-11 (Tue, 11 Aug 2026)
Changed paths:
M Source/WebCore/Modules/notifications/NotificationPayload.h
M Source/WebCore/Modules/streams/ReadableByteStreamController.h
M Source/WebCore/Modules/streams/ReadableStreamBYOBReader.h
M Source/WebCore/Modules/webtransport/WebTransportDatagramsWritable.h
M Source/WebCore/SaferCPPExpectations/NoDeleteCheckerExpectations
Log Message:
-----------
Cherry-pick 318136@main (8862b90b0bd7).
https://bugs.webkit.org/show_bug.cgi?id=320512
Remove incorrect NODELETE annotations from Source/WebCore/Modules
https://bugs.webkit.org/show_bug.cgi?id=320512
Reviewed by Chris Dumez.
Removed NODELETE annotations from various functions in
Source/WebCore/Modules.
* Source/WebCore/Modules/notifications/NotificationPayload.h:
* Source/WebCore/Modules/streams/ReadableByteStreamController.h:
* Source/WebCore/Modules/streams/ReadableStreamBYOBReader.h:
* Source/WebCore/Modules/webtransport/WebTransportDatagramsWritable.h:
* Source/WebCore/SaferCPPExpectations/NoDeleteCheckerExpectations:
Canonical link: https://commits.webkit.org/318136@main
Canonical link: https://commits.webkit.org/317695.94@webkitglib/2.54
Commit: ea86346f1e002d3b36fc767fb624af30ada2b331
https://github.com/WebKit/WebKit/commit/ea86346f1e002d3b36fc767fb624af30ada2b331
Author: Nikolas Zimmermann <[email protected]>
Date: 2026-08-11 (Tue, 11 Aug 2026)
Changed paths:
A
LayoutTests/svg/foreignObject/foreignobject-svgdom-x-property-update-expected.html
A LayoutTests/svg/foreignObject/foreignobject-svgdom-x-property-update.html
A
LayoutTests/svg/foreignObject/foreignobject-svgdom-y-property-update-expected.html
A LayoutTests/svg/foreignObject/foreignobject-svgdom-y-property-update.html
M Source/WebCore/svg/SVGForeignObjectElement.cpp
Log Message:
-----------
Cherry-pick 318669@main (27a59f0ec20e).
https://bugs.webkit.org/show_bug.cgi?id=321122
Unreviewed backport.
REGRESSION(313859@main): SVGForeignObjectElement dynamic x/y take no effect
https://bugs.webkit.org/show_bug.cgi?id=321122
Reviewed by Sam Weinig.
Since 313859@main, LegacyRenderSVGForeignObject::layout() (and the LBSE
RenderSVGForeignObject::layout()) derive the viewport geometry from the
resolved style instead of the SVG animated properties. The x/y/width/height
attributes are presentation attributes mapped to the CSS x/y/width/height
properties, so the resolved style must be invalidated when they change.
SVGForeignObjectElement::svgAttributeChanged() only marked the
presentational
hint style dirty for width/height. For x/y it invalidated the renderer
without
refreshing the presentation style, so a style recalc never happened and
layout
kept reading the stale x/y. Updating x/y via the SVG DOM property
(x.baseVal.value = ...) therefore left the foreignObject at its old
position.
Mark the presentational hint style dirty for all four geometry attributes,
matching how SVGRectElement handles its geometry attributes, and keep
updating
the relative-lengths information for x/y.
Added new reftests to verify this functionality instead of relying on
svg/dynamic-updates/SVGForeignObjectElement-svgdom-x-prop.html which only
verify the logic through pixel testing, which isn't executed by default.
*
LayoutTests/svg/foreignObject/foreignobject-svgdom-x-property-update-expected.html:
Added.
*
LayoutTests/svg/foreignObject/foreignobject-svgdom-x-property-update.html:
Added.
*
LayoutTests/svg/foreignObject/foreignobject-svgdom-y-property-update-expected.html:
Added.
*
LayoutTests/svg/foreignObject/foreignobject-svgdom-y-property-update.html:
Added.
* Source/WebCore/svg/SVGForeignObjectElement.cpp:
(WebCore::SVGForeignObjectElement::svgAttributeChanged):
Canonical link: https://commits.webkit.org/318669@main
Canonical link: https://commits.webkit.org/317695.95@webkitglib/2.54
Commit: 7a1ca6a85456b695bdd07eb18142a89186d850d8
https://github.com/WebKit/WebKit/commit/7a1ca6a85456b695bdd07eb18142a89186d850d8
Author: Adrian Perez de Castro <[email protected]>
Date: 2026-08-11 (Tue, 11 Aug 2026)
Changed paths:
M Source/WebKit/UIProcess/API/glib/WebKitFaviconDatabase.cpp
M Source/WebKit/UIProcess/API/glib/WebKitFaviconDatabase.h.in
M Source/WebKit/UIProcess/API/glib/WebKitWebView.cpp
M Source/WebKit/UIProcess/API/glib/WebKitWebView.h.in
Log Message:
-----------
Cherry-pick 318964@main (848a9b915e9b).
https://bugs.webkit.org/show_bug.cgi?id=311225
[GTK4] Mark old favicon API as deprecated
https://bugs.webkit.org/show_bug.cgi?id=311225
Reviewed by Patrick Griffis.
Deprecate the old favicon public API, and edit the documentation
comments to refer to the new functions that may be used instead.
* Source/WebKit/UIProcess/API/glib/WebKitFaviconDatabase.cpp:
(webkit_favicon_database_class_init):
* Source/WebKit/UIProcess/API/glib/WebKitFaviconDatabase.h.in:
* Source/WebKit/UIProcess/API/glib/WebKitWebView.cpp:
(webkit_web_view_class_init):
* Source/WebKit/UIProcess/API/glib/WebKitWebView.h.in:
Canonical link: https://commits.webkit.org/318964@main
Canonical link: https://commits.webkit.org/317695.96@webkitglib/2.54
Compare: https://github.com/WebKit/WebKit/compare/936571551944...7a1ca6a85456
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
