Branch: refs/heads/webkitglib/2.54
Home: https://github.com/WebKit/WebKit
Commit: a1f6b4c71ad5f578a79bd8d0d51c1795f9dece27
https://github.com/WebKit/WebKit/commit/a1f6b4c71ad5f578a79bd8d0d51c1795f9dece27
Author: Claudio Saavedra <[email protected]>
Date: 2026-10-06 (Tue, 06 Oct 2026)
Changed paths:
M Source/WebKit/UIProcess/Automation/libwpe/WebAutomationSessionWPE.cpp
Log Message:
-----------
Cherry-pick 322885@main (066a9e53aff3).
https://bugs.webkit.org/show_bug.cgi?id=322100
REGRESSION(319347@main) [WebDriver][WPE] test_move_to_fractional_position
and test_touch_pointer_in_shadow_tree are failing
https://bugs.webkit.org/show_bug.cgi?id=322100
Reviewed by Nikolas Zimmermann.
Since 319347@main, the web process routes touches against the touch event
regions of the last rendering update, and does not send the page a touch
that starts outside of them. WebDriver dispatched a touch down as soon as
the action ran, so listeners added by a previous command, such as Execute
Script, could still be missing from the event regions and the touch was
dropped.
Wait for the next presentation update before dispatching a touch down. The
web process only replies once a rendering update has committed the event
regions, so the touch is routed against the effects of all previous
commands.
* Source/WebKit/UIProcess/Automation/libwpe/WebAutomationSessionWPE.cpp:
(WebKit::WebAutomationSession::platformSimulateTouchInteraction):
* WebDriverTests/TestExpectations.json:
Canonical link: https://commits.webkit.org/322885@main
Canonical link: https://commits.webkit.org/317695.419@webkitglib/2.54
Commit: c38ab87f9a2a24583afec172f86a4abe94a3b553
https://github.com/WebKit/WebKit/commit/c38ab87f9a2a24583afec172f86a4abe94a3b553
Author: Claudio Saavedra <[email protected]>
Date: 2026-10-06 (Tue, 06 Oct 2026)
Changed paths:
M
Source/WebCore/platform/graphics/gstreamer/mse/MediaPlayerPrivateGStreamerMSE.cpp
Log Message:
-----------
Cherry-pick 322855@main (2431cfa314f3).
https://bugs.webkit.org/show_bug.cgi?id=326504
[GStreamer][MSE] ASSERT_NOT_REACHED() in
MediaPlayerPrivateGStreamerMSE::buffered() after the MediaSource is detached
https://bugs.webkit.org/show_bug.cgi?id=326504
Reviewed by Philippe Normand.
HTMLMediaElement::buffered() retrieves the buffered ranges from the
MediaSource while one is attached, and only falls back to the MediaPlayer
otherwise. However, the MediaSource is detached from the element in some
situations where the MSE player is kept alive, for instance by
mediaLoadingFailedFatally() after a decode or network error. Any read of
HTMLMediaElement.buffered in that window (e.g. by the media controls)
reaches MediaPlayerPrivateGStreamerMSE::buffered() with m_source set, and
hits its ASSERT_NOT_REACHED(), crashing builds with assertions enabled.
This was observed on the WPE ARM64 release bot (which has assertions
enabled) in media/media-source/media-source-audio-track-id-switch-play.html,
with the media controls reading video.buffered after a pipeline error.
Return empty ranges without asserting, like
MediaPlayerPrivateMediaSourceAVFObjC::buffered() does.
*
Source/WebCore/platform/graphics/gstreamer/mse/MediaPlayerPrivateGStreamerMSE.cpp:
(WebCore::MediaPlayerPrivateGStreamerMSE::buffered const):
Canonical link: https://commits.webkit.org/322855@main
Canonical link: https://commits.webkit.org/317695.420@webkitglib/2.54
Commit: 7466caaec098fe60fe012492034eba675b46bc32
https://github.com/WebKit/WebKit/commit/7466caaec098fe60fe012492034eba675b46bc32
Author: Fujii Hironori <[email protected]>
Date: 2026-10-06 (Tue, 06 Oct 2026)
Changed paths:
M Source/WebCore/accessibility/atspi/AccessibilityAtspi.cpp
M Source/WebCore/accessibility/atspi/AccessibilityAtspi.h
Log Message:
-----------
Cherry-pick 322632@main (40508b494c52).
https://bugs.webkit.org/show_bug.cgi?id=325485
[ATSPI] Web process still crashes with RELEASE_ASSERT(!m_isConnecting) in
AccessibilityAtspi::registerObject() when an accessibility event is emitted
before the a11y bus name is owned
https://bugs.webkit.org/show_bug.cgi?id=325485
Reviewed by Claudio Saavedra.
AccessibilityAtspi::didConnect() sets m_connection and then requests the
bus name asynchronously. m_isConnecting stays true until didOwnName() is
called. The event emitters only checked m_connection, so an event emitted
in that window, e.g. the "busy" state change after loading about:blank in
a new web process, registered the object and hit
RELEASE_ASSERT(!m_isConnecting) in registerObject().
Add isConnected(), which also requires the bus name to be owned, and use
it in the event emitters and registerHyperlink(). Events emitted before
the name is owned are dropped. No AT can have the objects yet, and it
reads the tree after the root is registered.
* Source/WebCore/accessibility/atspi/AccessibilityAtspi.cpp:
(WebCore::AccessibilityAtspi::registerHyperlink):
(WebCore::AccessibilityAtspi::parentChanged):
(WebCore::AccessibilityAtspi::childrenChanged):
(WebCore::AccessibilityAtspi::stateChanged):
(WebCore::AccessibilityAtspi::textChanged):
(WebCore::AccessibilityAtspi::textAttributesChanged):
(WebCore::AccessibilityAtspi::textCaretMoved):
(WebCore::AccessibilityAtspi::textSelectionChanged):
(WebCore::AccessibilityAtspi::valueChanged):
(WebCore::AccessibilityAtspi::activeDescendantChanged):
(WebCore::AccessibilityAtspi::selectionChanged):
(WebCore::AccessibilityAtspi::loadEvent):
* Source/WebCore/accessibility/atspi/AccessibilityAtspi.h:
(WebCore::AccessibilityAtspi::isConnected const):
Canonical link: https://commits.webkit.org/322632@main
Canonical link: https://commits.webkit.org/317695.421@webkitglib/2.54
Compare: https://github.com/WebKit/WebKit/compare/bfaa7b738292...7466caaec098
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
