Branch: refs/heads/webkitglib/2.54
Home: https://github.com/WebKit/WebKit
Commit: 4e66415fa162ad248fcf5d5504f7c8983be7228d
https://github.com/WebKit/WebKit/commit/4e66415fa162ad248fcf5d5504f7c8983be7228d
Author: Shu-yu Guo <[email protected]>
Date: 2026-09-04 (Fri, 04 Sep 2026)
Changed paths:
A JSTests/stress/dfg-getscope-fold-stale-cfa-state.js
M Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp
Log Message:
-----------
Cherry-pick [email protected] (3efb180e50d2).
https://bugs.webkit.org/show_bug.cgi?id=316803
[JSC] Refresh AI state when folding GetScope to Identity
https://bugs.webkit.org/show_bug.cgi?id=316803
rdar://178423757
Reviewed by Yusuke Suzuki.
A GetScope could be constant folded to Identity. When this happens, the
abstract interpreter isn't re-executed on the Identity node. If a previous
run
of the AI left the abstract
value
corresponding
to
the
pre-replacement
GetScope
node as bottom, this stale bottom value can cause downstream consumers to
assume the Identity is unreachable when it is.
This PR re-executes AI after folding to Identity.
Test: JSTests/stress/dfg-getscope-fold-stale-cfa-state.js
* JSTests/stress/dfg-getscope-fold-stale-cfa-state.js: Added.
(try.Trans):
(try.inline):
(foo):
(C):
(opt):
(i.catch):
* Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp:
(JSC::DFG::ConstantFoldingPhase::foldConstants):
Identifier: [email protected]
Canonical link:
https://flagged.apple.com:443/proxy?t2=Dg2t1c2Ys4&o=aHR0cHM6Ly9jb21taXRzLndlYmtpdC5vcmcvMzE3Njk1LjE5N0B3ZWJraXRnbGliLzIuNTQ=&emid=cbf45c4d-c832-478f-ad4d-fefb8cd65902&c=11
Commit: 673d962cd788d7985476681139a6740cb73c115b
https://github.com/WebKit/WebKit/commit/673d962cd788d7985476681139a6740cb73c115b
Author: Kai
Tamkun
<[email protected]>
Date:
2026-09-04 (Fri, 04 Sep 2026)
Changed paths:
A
JSTests/stress/absence-propertycondition-and-non-reified-static-property-tables.js
M
Source/JavaScriptCore/bytecode/PropertyCondition.cpp
Log Message:
-----------
Cherry-pick [email protected] (d0cd53048a11).
https://bugs.webkit.org/show_bug.cgi?id=314836
[JavaScriptCore] Absence PropertyCondition does not consult non-reified
static property tables
https://bugs.webkit.org/show_bug.cgi?id=314836
rdar://176792596
Reviewed by Yusuke Suzuki.
This patch modifies the Absence case for
PropertyCondition::isStillValidAssumingImpurePropertyWatchpoint
to consult the non-reified static property table if the property isn't
present in the property table.
This prevents the Abstract Interpreter from misfolding GetById.
Test:
JSTests/stress/absence-propertycondition-and-non-reified-static-property-tables.js
*
JSTests/stress/absence-propertycondition-and-non-reified-static-property-tables.js:
Added.
(assert):
(assertThrows):
(setup):
(f):
*
Source/JavaScriptCore/bytecode/PropertyCondition.cpp:
(JSC::PropertyCondition::isStillValidAssumingImpurePropertyWatchpoint
const):
Identifier: [email protected]
Canonical link:
https://flagged.apple.com:443/proxy?t2=DP6r0I0ik6&o=aHR0cHM6Ly9jb21taXRzLndlYmtpdC5vcmcvMzE3Njk1LjE5OEB3ZWJraXRnbGliLzIuNTQ=&emid=cbf45c4d-c832-478f-ad4d-fefb8cd65902&c=11
Commit: 6ffbec49a6386c41d16d1af185f26da25b7e40a0
https://github.com/WebKit/WebKit/commit/6ffbec49a6386c41d16d1af185f26da25b7e40a0
Author: Kai Tamkun <[email protected]>
Date: 2026-09-04 (Fri, 04 Sep 2026)
Changed paths:
A JSTests/stress/inc-dec-int32-overflow-dce.js
M Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
Log Message:
-----------
Cherry-pick
[email protected]
(7951c397a1ba).
https://bugs.webkit.org/show_bug.cgi?id=315213
[JSC] NodeMustGenerate incorrectly cleared on CheckOverflow
ArithAdd/ArithSub in DFGFixupPhase Inc/Dec handler
https://bugs.webkit.org/show_bug.cgi?id=315213
rdar://176984293
Reviewed by Yijia Huang.
This patch prevents overflow checks for increment/decrement in DFG from
being mistakenly DCE'd.
Test: JSTests/stress/inc-dec-int32-overflow-dce.js
* JSTests/stress/inc-dec-int32-overflow-dce.js: Added.
(shouldBe):
(inc):
(dec):
* Source/JavaScriptCore/dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
Identifier: [email protected]
Canonical link:
https://flagged.apple.com:443/proxy?t2=DH4i3l4FF0&o=aHR0cHM6Ly9jb21taXRzLndlYmtpdC5vcmcvMzE3Njk1LjE5OUB3ZWJraXRnbGliLzIuNTQ=&emid=cbf45c4d-c832-478f-ad4d-fefb8cd65902&c=11
Commit: f7b3aa828c41ad1a260e0ad5f07292adf34febd1
https://github.com/WebKit/WebKit/commit/f7b3aa828c41ad1a260e0ad5f07292adf34febd1
Author: Said Abou-Hallawa <[email protected]>
Date: 2026-09-04 (Fri, 04 Sep 2026)
Changed paths:
M
Source/WebKit/GPUProcess/graphics/RemoteRenderingBackend.cpp
Log Message:
-----------
Cherry-pick [email protected] (33120ad29238).
https://bugs.webkit.org/show_bug.cgi?id=316439
RemoteRenderingBackend can still allocateImageBuffer() with
RenderingMode::DisplayList
https://bugs.webkit.org/show_bug.cgi?id=316439
rdar://176382472
Reviewed by Simon Fraser.
RemoteRenderingBackend::allocateImageBuffer() is called from
1. RemoteRenderingBackend::createImageBuffer()
2. RemoteImageBufferSet::ensureBufferForDisplay().
In 311931@main, which fixes bug 307843, a MESSAGE_CHECK() was added in
RemoteRenderingBackend::allocateImageBuffer() to prevent creating a remote
ImageBufferDisplayListBackend. But
this
change
left
the call from
RemoteImageBufferSet::ensureBufferForDisplay().
The fix is to move the MESSAGE_CHECK from
RemoteRenderingBackend::createImageBuffer()
to
RemoteRenderingBackend::allocateImageBuffer().
* Source/WebKit/GPUProcess/graphics/RemoteRenderingBackend.cpp:
(WebKit::RemoteRenderingBackend::allocateImageBuffer):
(WebKit::RemoteRenderingBackend::createImageBuffer):
Identifier: [email protected]
Canonical link:
https://flagged.apple.com:443/proxy?t2=DF8U9Y6oU1&o=aHR0cHM6Ly9jb21taXRzLndlYmtpdC5vcmcvMzE3Njk1LjIwMEB3ZWJraXRnbGliLzIuNTQ=&emid=cbf45c4d-c832-478f-ad4d-fefb8cd65902&c=11
Commit: 03eda1e66c764309492350d2013a82d7a01dd564
https://github.com/WebKit/WebKit/commit/03eda1e66c764309492350d2013a82d7a01dd564
Author: Chris Dumez <[email protected]>
Date: 2026-09-04 (Fri, 04 Sep 2026)
Changed paths:
A
LayoutTests/http/tests/cookies/resources/set-raw-cookie-in-third-party-iframe-frame.html
A
LayoutTests/http/tests/cookies/set-raw-cookie-in-third-party-iframe-expected.txt
A
LayoutTests/http/tests/cookies/set-raw-cookie-in-third-party-iframe.html
A LayoutTests/ipc/set-raw-cookie-empty-commenturl-crash-expected.txt
A LayoutTests/ipc/set-raw-cookie-empty-commenturl-crash.html
A LayoutTests/ipc/set-raw-cookie-firstparty-message-check-expected.txt
A LayoutTests/ipc/set-raw-cookie-firstparty-message-check.html
M
Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.cpp
Log Message:
-----------
Cherry-pick 320304@main (d4867a890432).
https://bugs.webkit.org/show_bug.cgi?id=323060
Regression(314177@main) SetRawCookie's MESSAGE_CHECKs reject legitimate
cookie writes from third-party iframes
https://bugs.webkit.org/show_bug.cgi?id=323060
rdar://177769847
Reviewed by Ben Nham.
NetworkConnectionToWebProcess::setRawCookie validated cookie.domain and
url against firstParty:
```
MESSAGE_CHECK(RegistrableDomain::uncheckedCreateFromHost(cookie.domain).matches(firstParty));
MESSAGE_CHECK(RegistrableDomain(url).matches(firstParty));
```
This is too strict. WebCookieJar::setRawCookie passes
document.firstPartyForCookies() as firstParty (the top-level page's URL)
and
document.cookieURL() as url (the document's own URL). For a
third-party iframe these legitimately differ, so the checks terminate
the WebProcess
whenever Web Inspector or internals.setCookie is used in
a cross-site iframe.
Replace the two checks with an integrity check that cookie.domain's
registrable domain matches url, mirroring the existing posture of
setCookieFromDOMAsync which validates firstParty only and trusts the
url/cookie pair. The new check still rejects a mismatched
cookie.domain/url pair (the most useful
invariant) without coupling
either to the unrelated top-level firstParty.
Tests: http/tests/cookies/set-raw-cookie-in-third-party-iframe.html
ipc/set-raw-cookie-empty-commenturl-crash.html
ipc/set-raw-cookie-firstparty-message-check.html
*
LayoutTests/http/tests/cookies/resources/set-raw-cookie-in-third-party-iframe-frame.html:
Added.
*
LayoutTests/http/tests/cookies/set-raw-cookie-in-third-party-iframe-expected.txt:
Added.
* LayoutTests/http/tests/cookies/set-raw-cookie-in-third-party-iframe.html:
Added.
Add test coverage
for the overly strict checks.
* LayoutTests/ipc/set-raw-cookie-empty-commenturl-crash-expected.txt: Added.
* LayoutTests/ipc/set-raw-cookie-empty-commenturl-crash.html: Added.
* LayoutTests/ipc/set-raw-cookie-firstparty-message-check-expected.txt:
Added.
* LayoutTests/ipc/set-raw-cookie-firstparty-message-check.html: Added.
Add test coverage for what 314177@main was trying to fix, to make
sure
that we don't regress it.
* Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.cpp:
(WebKit::NetworkConnectionToWebProcess::setRawCookie):
Canonical
link:
https://flagged.apple.com:443/proxy?t2=dj2T3y6wY9&o=aHR0cHM6Ly9jb21taXRzLndlYmtpdC5vcmcvMzIwMzA0QG1haW4=&emid=cbf45c4d-c832-478f-ad4d-fefb8cd65902&c=11
Canonical link:
https://flagged.apple.com:443/proxy?t2=DH3s5R2Ir1&o=aHR0cHM6Ly9jb21taXRzLndlYmtpdC5vcmcvMzE3Njk1LjIwMUB3ZWJraXRnbGliLzIuNTQ=&emid=cbf45c4d-c832-478f-ad4d-fefb8cd65902&c=11
Compare: https://github.com/WebKit/WebKit/compare/1f24b788db7f...03eda1e66c76
To
unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
