Skip to content

Upgrade WebKit Jan 4, 2026 - #124

Closed
sosukesuzuki wants to merge 155 commits into
mainfrom
sosuke/upgrade-webkit-20260103
Closed

Upgrade WebKit Jan 4, 2026#124
sosukesuzuki wants to merge 155 commits into
mainfrom
sosuke/upgrade-webkit-20260103

Conversation

@sosukesuzuki

@sosukesuzuki sosukesuzuki commented Jan 4, 2026

Copy link
Copy Markdown
Member

Upgrade WebKit Jan 4, 2026. Happy new year 🎉

WebKit Changes Summary

Merge Range: 1a1813b764ce → 694de82fa83d
Date Range: December 24, 2025 → January 3, 2026
Total Commits: 146

JavaScriptCore (JSC) Performance Improvements

Array Operations

  • Fast path for Array.from(set) - Optimized conversion from Set to Array
  • Fast path for Array.from(arguments) in strict mode - Improved performance for arguments object conversion
  • Use hasSpecialProperties for checking iterable - More efficient iterable detection

Async/Generator Optimizations

  • AsyncGenerator inline first queue item - Reduced memory allocation by embedding the first queue entry
  • Inline async function body when there is no await - Skip unnecessary promise wrapping for sync async functions
  • Move MicrotaskQueue driving AsyncGenerator code to C++ - Removed JS "WithoutPromise" variants
  • Use InternalMicrotask in AsyncFromSyncIterator - More efficient async iteration
  • Embed SuspendReason into State in JSAsyncGenerator - Reduced struct size

String Methods Moved to C++

  • String#padStart and String#padEnd - Native implementation replacing JS builtins
  • String#repeat - Native C++ implementation
  • String.prototype.replace / String.prototype.replaceAll - Full C++ implementation
  • RegExp.prototype[Symbol.replace] - Native C++ implementation
  • HTML-annotation String methods (anchor, big, bold, etc.) - Moved to C++

Promise Improvements

  • Track "then" property addition in Structure - Enables better optimization for promise-like objects
  • Implement @InternalPromise.@internalAll in C++ - Native Promise.all for internal use

Memory Optimizations

  • Shrink sizeof(QueuedTask) by embedding uint8_t payload into CompactRefPtrTuple
  • Treat unused catch binding as optional catch binding - Reduced bytecode size
  • Remove unused @setClone - Dead code removal

Bug Fixes

  • Fix %TypedArray%.prototype.includes to align with ECMA-262
  • Exception check error fixes

WTF (Web Template Framework)

Performance

  • Optimize String::fromUTF8 using simdutf - SIMD-accelerated UTF-8 decoding
  • Simplify SortedArrayMap / SortedArraySet - Removed requirement for separate std::array static variable
  • PlainText(): avoid extra buffer allocation for empty ranges

New Features

  • Introduce ThreadSafeWeakRef and adopt it where appropriate
  • Enable CHECK_REF_COUNTED_LIFECYCLE - Better reference counting validation

Improvements

  • Update Vector's uninitializedCopy() to use std::span
  • Simplify strlenSpan() and compareSpansConstExpr()
  • Fix subtle bug in SortedArrayMap's lessThanASCIICaseFolding()
  • RefCountedWithInlineWeakPtr fixes for GCC Release builds
  • Align ref and weakRef counting on uint32_t

Platform Fixes

  • Use OS(WINDOWS) instead of PLATFORM(WIN) - Consistent platform detection
  • Should not release RefPtr before using - Fixed use-after-free potential

Memory Safety (Safer C++)

Significant effort to reduce unsafe buffer usage across the codebase:

WTF

  • Drop WTF_ALLOW_UNSAFE_BUFFER_USAGE from: DateMath.cpp, MemoryDump, dragonbox, FixedBitVector

WebCore

  • Reduce unsafe member variables in:
    • GraphicsLayer, AudioMediaStreamTrackRenderer
    • AXSearchManager, FrameSnapshotting
    • WebCore/platform/graphics, scrolling code
    • MathMLRowElement, MediaSourcePrivateAVFObjC
    • mediastream code, WebAuthn code, mediasource/ code
    • User* files in WebCore/page

Platform-Specific

  • GLIB: NetworkCacheDataGLib, WebSocketTaskSoup
  • Cocoa: FaceDetectorImplementation.mm

Type Safety

  • Remove static_cast from: InspectorCSSAgent, WebCore/bridge, WebCore/svg, Internals, ScriptModuleLoader, platform/graphics, Modules/mediastream

SVG Improvements

  • Don't check 'visibility' in LegacyRenderSVGResourceMasker - Spec compliance fix
  • Synthesize preserveAspectRatio='none' for SVGs embedded in <img> without viewBox
  • stroke-dasharray applied to markers can now be overridden by ="0"
  • SVG <stop> offset attribute correctly rejects invalid values with trailing garbage
  • SVGLengthValue::setValueAsString avoids unnecessary String allocations
  • Introduce decoratedBoundingBox to fix repaint rect and bounding box conflation in SVG resources
  • Migrate from repaintRectInLocalCoordinates(Accurate) to direct computation
  • Fix typo in SVGRadialGradientElement.h lengths

CSS/Style System

MathML

  • Enable math-depth by default
  • Make math-style and math-shift animate discretely
  • <mpadded> treats percentage values as absent for width/height/depth attribute

Property Handling

  • Convert 'caret-color' property to strong style types
  • Generate logical property getter/setters via RenderStyleGen
  • Generate setters for hasExplicitlySet flags*
  • Remove custom style building code for fill and stroke properties
  • Extract color/transform related computation from RenderStyle to UsedStyle

Layout Fixes

  • -webkit-line-clamp supports inline-block children
  • offsetHeight/offsetWidth of inline box wrapping block box now returns correct values (was 0)
  • getClientRects now includes entry for inline boxes with block children
  • Fix block-in-inline client rects
  • Text layout consistency improvements for list-style-type

Core Image Filter Acceleration

New GPU-accelerated filter implementations for macOS/iOS:

  • FEMerge in Core Image
  • FEOffset in Core Image
  • FEGaussianBlur in Core Image (with geometry fixes)
  • GPU acceleration for morphology filters

AutoFill Debugging

  • Automatically extract items from same-origin subframes
  • Fix text extraction hanging indefinitely when invoked from system daemons
  • Heuristically shorten/redact high-entropy URLs in extracted text
  • Deduplicate shortened URLs and report replacements to client
  • Add system trace points for text extraction performance analysis

Swift in WebKit

  • Work towards modularizing PAL (part 3)
  • Re-land modularization of WebGPU (part 2)
  • Work towards having a proper JSC module (part 3)
  • Fix Swift modules depending on WTF occasionally needing erroneous imports

Platform & Build Changes

Removals

  • Remove ENABLE_TOUCH_EVENT_REGIONS definition
  • Stop using LocalServiceAdditions.h and MockLocalServiceAdditions.h
  • Remove unused WTF_MAKE_TZONE_OR_ISO_ALLOCATED macros

Build Fixes

  • Fix watchOS and tvOS builds after 305052@main
  • Fix WPE generated API header regression
  • Add missing hyphenation dictionaries to GTK APT dependencies
  • Fix LOG_CHANNEL_PREFIXFonts undeclared identifier in FontDescriptionCocoa.cpp
  • Fix ASSERTION FAILED in WTF_OptionSet tests on GTK/WPE

Web Platform Features

  • Expose operator lighter in SVGFECompositeElement IDL
  • Fix HTMLImageElement.currentSrc for empty src attribute
  • Resync web-animations from WPT upstream

Bug Fixes & Gardening

  • Multiple test expectation updates for macOS, iOS, GTK, WPE, GStreamer
  • Fix assertion failures in JSEventListener, PointerLockTests
  • Fix GStreamerVideoFrameConverter weak pointer assertion
  • Fix RecordMetaData::cacheStorageVersion uninitialized member
  • Fix run-builtins-generator-tests --reset-results regression

annevk and others added 30 commits December 24, 2025 08:57
@annevk
Align ref and weakRef counting on uint32_t
26d2fd2 
https://bugs.webkit.org/show_bug.cgi?id=304564

Reviewed by Simon Fraser.

uint32_t is more explicit than unsigned and can reduce memory compared
to size_t on 64-bit platforms. And given that only ThreadSafeWeakPtr is
using size_t at the moment, this should be a reasonable change to make.

Canonical link: https://commits.webkit.org/304921@main
@annevk
Enable downcasting of all EventTarget classes
68cbd8d 
https://bugs.webkit.org/show_bug.cgi?id=304670

Reviewed by Simon Fraser.

This is a fairly mechanical change, but there are a couple noteworthy
aspects:

- TrackListBase derived classes already supported downcasting, but this
  was not being used and it was incorrect for AudioTrackList as that
  advertised itself as a VideoTrackList. This change removes all that
  infrastructure.
- SPECIALIZE_TYPE_TRAITS_CANVAS is removed as it remained only useful
  for CustomPaintCanvas.
- ManagedMediaSource and ManagedSourceBuffer did not implement
  eventTargetInterface(), but they do appear in EventTargetFactory.in.
  So patch adds eventTargetInterface() to them.

See also https://github.com/WebKit/WebKit/wiki/Safer-CPP-Guidelines

Canonical link: https://commits.webkit.org/304922@main
@weinig
[UsedStyle] Migrate callers from RenderStyle::initial*() to Style::Co…
8d495bc 
…mputedStyle::initial*()

https://bugs.webkit.org/show_bug.cgi?id=304647

Reviewed by Darin Adler.

Migrate all callers of the `RenderStyle::initial*()` functions to use
`Style::ComputedStyle::initial*()` and remove the now unnecessary
forwarded initial value functions.

* Source/WebCore/CMakeLists.txt:
* Source/WebCore/DerivedSources-output.xcfilelist:
* Source/WebCore/DerivedSources.make:
* Source/WebCore/Headers.cmake:
* Source/WebCore/WebCore.xcodeproj/project.pbxproj:
* Source/WebCore/animation/ScrollTimeline.cpp:
* Source/WebCore/css/scripts/process-css-properties.py:
* Source/WebCore/css/scripts/test/TestCSSPropertiesResults/RenderStyleProperties+InitialInlines.h: Removed.
* Source/WebCore/css/scripts/test/TestCSSPropertiesResults/RenderStyleProperties.h:
* Source/WebCore/css/scripts/test/TestCSSPropertiesResults/StyleBuilderGenerated.cpp:
* Source/WebCore/html/HTMLInputElement.cpp:
* Source/WebCore/layout/formattingContexts/grid/UnplacedGridItem.cpp:
* Source/WebCore/layout/formattingContexts/inline/InlineLineBoxVerticalAligner.cpp:
* Source/WebCore/layout/formattingContexts/inline/InlineLineBuilder.cpp:
* Source/WebCore/layout/formattingContexts/inline/IntrinsicWidthHandler.cpp:
* Source/WebCore/layout/formattingContexts/inline/RangeBasedLineBuilder.cpp:
* Source/WebCore/layout/formattingContexts/inline/TextOnlySimpleLineBuilder.cpp:
* Source/WebCore/layout/integration/LayoutIntegrationBoxTreeUpdater.cpp:
* Source/WebCore/layout/integration/LayoutIntegrationCoverage.cpp:
* Source/WebCore/rendering/RenderBox.cpp:
* Source/WebCore/rendering/RenderDeprecatedFlexibleBox.cpp:
* Source/WebCore/rendering/RenderFlexibleBox.cpp:
* Source/WebCore/rendering/RenderImage.cpp:
* Source/WebCore/rendering/RenderReplaced.cpp:
* Source/WebCore/rendering/RenderTheme.cpp:
* Source/WebCore/rendering/adwaita/RenderThemeAdwaita.cpp:
* Source/WebCore/rendering/mac/RenderThemeMac.mm:
* Source/WebCore/rendering/style/RenderStyle+InitialInlines.h: Removed.
* Source/WebCore/rendering/style/RenderStyle.h:
* Source/WebCore/rendering/style/SVGRenderStyle.cpp:
* Source/WebCore/rendering/style/SVGRenderStyleDefs.cpp:
* Source/WebCore/rendering/style/StyleAppleColorFilterData.cpp:
* Source/WebCore/rendering/style/StyleBackdropFilterData.cpp:
* Source/WebCore/rendering/style/StyleBackgroundData.cpp:
* Source/WebCore/rendering/style/StyleBorderImageData.cpp:
* Source/WebCore/rendering/style/StyleBoxData.cpp:
* Source/WebCore/rendering/style/StyleDeprecatedFlexibleBoxData.cpp:
* Source/WebCore/rendering/style/StyleFilterData.cpp:
* Source/WebCore/rendering/style/StyleFlexibleBoxData.cpp:
* Source/WebCore/rendering/style/StyleFontData.cpp:
* Source/WebCore/rendering/style/StyleGridData.cpp:
* Source/WebCore/rendering/style/StyleGridItemData.cpp:
* Source/WebCore/rendering/style/StyleInheritedData.cpp:
* Source/WebCore/rendering/style/StyleMarqueeData.cpp:
* Source/WebCore/rendering/style/StyleMaskBorderData.cpp:
* Source/WebCore/rendering/style/StyleMiscNonInheritedData.cpp:
* Source/WebCore/rendering/style/StyleMultiColData.cpp:
* Source/WebCore/rendering/style/StyleRareInheritedData.cpp:
* Source/WebCore/rendering/style/StyleRareNonInheritedData.cpp:
* Source/WebCore/rendering/style/StyleTransformData.cpp:
* Source/WebCore/rendering/style/StyleVisitedLinkColorData.cpp:
* Source/WebCore/rendering/svg/SVGPaintServerHandling.h:
* Source/WebCore/rendering/svg/SVGRenderTreeAsText.cpp:
* Source/WebCore/rendering/svg/legacy/LegacyRenderSVGResource.cpp:
* Source/WebCore/rendering/updating/RenderTreeBuilderSVG.cpp:
* Source/WebCore/style/MatchedDeclarationsCache.cpp:
* Source/WebCore/style/StyleAdjuster.cpp:
* Source/WebCore/style/StyleBuilder.cpp:
* Source/WebCore/style/StyleBuilderCustom.h:
* Source/WebCore/style/StyleExtractorCustom.h:
* Source/WebCore/style/values/backgrounds/StyleBorderImage.cpp:
* Source/WebCore/style/values/masking/StyleMaskBorder.cpp:
* Source/WebCore/style/values/motion/StyleOffsetAnchor.cpp:
* Source/WebCore/style/values/motion/StyleOffsetPosition.cpp:
* Tools/TestWebKitAPI/Tests/WebCore/PlatformDynamicRangeLimitTests.cpp:

Canonical link: https://commits.webkit.org/304923@main
@annevk
Enable downcasting of WebInjectedScriptManager
d612f7a 
https://bugs.webkit.org/show_bug.cgi?id=304641

Reviewed by Simon Fraser.

And apply https://github.com/WebKit/WebKit/wiki/Safer-CPP-Guidelines to
it and associated files.

Canonical link: https://commits.webkit.org/304924@main
@lilyspiniolas
[Gardening] 2x imported/w3c/web-platform-tests/uievents/mouse/ fail
fe2ab46 
https://bugs.webkit.org/show_bug.cgi?id=301224
rdar://163144949

Unreviewed test gardening.

Tests imported/w3c/web-platform-tests/uievents/mouse/mouseover-at-removing-mousedown-target.html?duration=16 &
imported/w3c/web-platform-tests/uievents/mouse/mouseover-at-removing-mousedown-target.html?duration=42 fail
for iOS EWS builds. Update the expected results accordingly.

* LayoutTests/platform/ios/TestExpectations:
* LayoutTests/platform/ios/imported/w3c/web-platform-tests/uievents/mouse/mouseover-at-removing-mousedown-target_duration=16-expected.txt: Added.
* LayoutTests/platform/ios/imported/w3c/web-platform-tests/uievents/mouse/mouseover-at-removing-mousedown-target_duration=42-expected.txt: Added.

Canonical link: https://commits.webkit.org/304925@main
@rr-codes
[Swift in WebKit] Work towards having a proper JSC module (part 3)
6f14c54 
https://bugs.webkit.org/show_bug.cgi?id=304667
rdar://167114539

Reviewed by Mike Wyrzykowski.

- Complete the modularization of JSC by fully enabling the module verifier and not suppressing any errors
- Enable the JSC private module in more configurations and platforms
- Disable the JSC private module in configurations where it was previously ill-formed

* Source/JavaScriptCore/Configurations/JavaScriptCore.xcconfig:

Canonical link: https://commits.webkit.org/304926@main
@whsieh
[AutoFill Debugging] Part 1/2: Add an option to heuristically shorten…
a551f89 
…/redact high-entropy URLs in extracted text

https://bugs.webkit.org/show_bug.cgi?id=304653
rdar://165847831

Reviewed by Richard Robinson.

Add support for a flag, `-shortenURLs`, that clients can use to opt into aggressive policy around
shortening link `href` and image `src` when performing text extraction. For links, we discard all
query parameters and fragments, and any path components that are not "low-entropy" (based on the
results of a fast, very lightweight binary classifier — see below). For images, we use the last path
component only if it's "low-entropy", and otherwise fall back to "image" (preserving any existing
file extension).

Test: fast/text-extraction/debug-text-extraction-shorten-urls.html

* LayoutTests/fast/text-extraction/debug-text-extraction-shorten-urls-expected.txt: Added.
* LayoutTests/fast/text-extraction/debug-text-extraction-shorten-urls.html: Added.

Add a layout test to exercise this new option.

* Source/WebCore/Headers.cmake:
* Source/WebCore/Sources.txt:
* Source/WebCore/WebCore.xcodeproj/project.pbxproj:
* Source/WebCore/page/text-extraction/TextExtraction.cpp:
(WebCore::TextExtraction::extractItemData):
* Source/WebCore/page/text-extraction/TextExtractionTypes.h:

Use the helpers below to strip out high-entropy path components from extracted URLs, along with any
query parameters and fragment.

* Source/WebCore/platform/StringEntropyHelpers.cpp: Added.
(WebCore::StringEntropyHelpers::symbol):
(WebCore::StringEntropyHelpers::dequantize):
(WebCore::StringEntropyHelpers::bigramWeight):
(WebCore::StringEntropyHelpers::entropyScore):
(WebCore::StringEntropyHelpers::isProbablyHumanReadable):
(WebCore::StringEntropyHelpers::lowEntropyLastPathComponent):
(WebCore::StringEntropyHelpers::removeHighEntropyComponents):

Add the fast path component classifier; see above for more details. Each character is mapped to one
of 10 character symbol types (e.g. uppercase hex, lowercase hex, uppercase non-hex, lowercase non-
hex, digits, etc.); the classifier is a very simple single-layer perceptron that takes (as inputs)
bigrams where each bigram consists of two adjacent symbol types. The 100 weights corresponding to
each bigram are encoded in a tiny lookup table, where each weight is quantized to a single byte
(`uint8_t`).

* Source/WebCore/platform/StringEntropyHelpers.h: Added.
* Source/WebKit/Shared/TextExtractionToStringConversion.cpp:
(WebKit::centerEllipsize):
(WebKit::TextExtractionAggregator::shortenURLs const):
(WebKit::addPartsForItem):
(WebKit::addTextRepresentationRecursive):
(WebKit::normalizedURLString): Deleted.

Honor the `shortenURLs` flag by using the shortened versions of link hrefs and image sources.

* Source/WebKit/Shared/TextExtractionToStringConversion.h:
* Source/WebKit/Shared/WebCoreArgumentCoders.serialization.in:
* Source/WebKit/UIProcess/API/Cocoa/WKWebView.mm:
(-[WKWebView _extractDebugTextWithConfigurationWithoutUpdatingFilterRules:completionHandler:]):
* Source/WebKit/UIProcess/API/Cocoa/_WKTextExtraction.h:
* Source/WebKit/UIProcess/API/Cocoa/_WKTextExtraction.mm:
(-[_WKTextExtractionConfiguration setShortenURLs:]):
* Tools/TestRunnerShared/UIScriptContext/Bindings/UIScriptController.idl:
* Tools/TestRunnerShared/UIScriptContext/UIScriptController.h:
* Tools/TestRunnerShared/UIScriptContext/UIScriptControllerShared.cpp:
(WTR::toTextExtractionTestOptions):

Add plumbing from `UIHelper` -> `WebKitTestRunner`, for the new `shortenURLs` flag.

* Tools/WebKitTestRunner/cocoa/UIScriptControllerCocoa.mm:
(WTR::createTextExtractionConfiguration):

Canonical link: https://commits.webkit.org/304927@main
@alanbaradlay
offsetHeight and offsetWidth of inline box wrapping a block box is 0
f004711 
https://bugs.webkit.org/show_bug.cgi?id=47618

Reviewed by Antti Koivisto.

This has been progressed by [blocks-in-inline].

* LayoutTests/fast/inline/inline-box-offset-width-height-and-continuation-expected.txt: Added.
* LayoutTests/fast/inline/inline-box-offset-width-height-and-continuation.html: Added.

Canonical link: https://commits.webkit.org/304928@main
@sosukesuzuki
[WTF] Use OS(WINDOWS) instead of PLATFORM(WIN)
8a8d1c5 
https://bugs.webkit.org/show_bug.cgi?id=304681

Reviewed by Anne van Kesteren.

304701@main changed to use `PLATFORM(WIN)` to detect being in Windows.

But since the `PLATFORM` macro isn't provided JSCOnly build, we cannot build JSCOnly on Windows.

So this patch changes to use `OS(WINDOWS)` instead  of `PLATFORM(WIN)`.

* Source/WTF/wtf/RefCountDebugger.cpp:

Canonical link: https://commits.webkit.org/304929@main
@sosukesuzuki
[JSC] Implment @InternalPromise.@internalAll in C++
a5f67b2 
https://bugs.webkit.org/show_bug.cgi?id=303965

Reviewed by Yusuke Suzuki.

This patch reverts 304888@main to reland 304331@main.

The original patch used PromiseAllResolveJob which calls resolve() to settle
the result promise. However, resolve() looks up the "then" property on the
resolution value, which can have user-observable side effects. For example,
if Object.prototype.then is set to a custom function, it would be called
when resolving the result array, breaking the InternalPromise pipeline.

InternalPromise requires using fulfill() instead of resolve() because
fulfill() directly settles the promise without looking up "then". This is
the key difference between InternalPromise and regular Promise - InternalPromise
must not trigger any user-observable operations.

This patch:

- Adds InternalPromiseAllResolveJob which uses fulfill() instead of resolve()
- Updates JSInternalPromiseConstructor to use InternalPromiseAllResolveJob
- Also uses fulfill() for the empty array case
- Adds a test to verify Object.prototype.then is not called through module loader

---

This patch changes to implement `@InternalPromiseAll.@internalAll` in C++.

                                       TipOfTree                  Patched

internal-promise-internal-all        7.2714+-0.6089     ^      4.1862+-0.2744        ^ definitely 1.7370x faster

* JSTests/microbenchmarks/internal-promise-internal-all.js: Added.
* JSTests/modules/object-prototype-then-should-not-be-called-through-internal-promise.js: Added.
(Object.prototype.then):
* JSTests/modules/object-prototype-then-should-not-be-called-through-internal-promise/test.js: Added.
* Source/JavaScriptCore/CMakeLists.txt:
* Source/JavaScriptCore/DerivedSources-input.xcfilelist:
* Source/JavaScriptCore/DerivedSources.make:
* Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj:
* Source/JavaScriptCore/builtins/InternalPromiseConstructor.js: Removed.
* Source/JavaScriptCore/runtime/JSInternalPromiseConstructor.cpp:
(JSC::JSC_DEFINE_HOST_FUNCTION):
* Source/JavaScriptCore/runtime/JSMicrotask.cpp:
(JSC::internalPromiseAllResolveJob):
(JSC::runInternalMicrotask):
* Source/JavaScriptCore/runtime/Microtask.h:

Canonical link: https://commits.webkit.org/304930@main
@csaavedra
[GLIB] Unskip passing tests
87ff1de 
https://bugs.webkit.org/show_bug.cgi?id=304687

Unreviewed gardening.

* LayoutTests/platform/glib/TestExpectations:
* LayoutTests/platform/gtk/TestExpectations:
* LayoutTests/platform/wpe/TestExpectations:
* LayoutTests/platform/wpe/fast/forms/datalist/datalist-searchinput-appearance-expected.txt: Added.
* LayoutTests/platform/wpe/fast/forms/datalist/datalist-textinput-appearance-expected.txt: Added.

Canonical link: https://commits.webkit.org/304931@main
@fujii
REGRESSION(304920@main): run-builtins-generator-tests --reset-results
355a182 
https://bugs.webkit.org/show_bug.cgi?id=304630

Unreviewed test gardening by invoking `./Tools/Scripts/run-builtins-generator-tests --reset-results`.

* Source/JavaScriptCore/Scripts/tests/builtins/expected/JavaScriptCore-Builtin.Promise-Combined.js-result:
* Source/JavaScriptCore/Scripts/tests/builtins/expected/JavaScriptCore-Builtin.Promise-Separate.js-result:
* Source/JavaScriptCore/Scripts/tests/builtins/expected/JavaScriptCore-Builtin.prototype-Combined.js-result:
* Source/JavaScriptCore/Scripts/tests/builtins/expected/JavaScriptCore-Builtin.prototype-Separate.js-result:
* Source/JavaScriptCore/Scripts/tests/builtins/expected/JavaScriptCore-BuiltinConstructor-Combined.js-result:
* Source/JavaScriptCore/Scripts/tests/builtins/expected/JavaScriptCore-BuiltinConstructor-Separate.js-result:
* Source/JavaScriptCore/Scripts/tests/builtins/expected/JavaScriptCore-InternalClashingNames-Combined.js-result:
* Source/JavaScriptCore/Scripts/tests/builtins/expected/WebCore-AnotherGuardedInternalBuiltin-Separate.js-result:
* Source/JavaScriptCore/Scripts/tests/builtins/expected/WebCore-ArbitraryConditionalGuard-Separate.js-result:
* Source/JavaScriptCore/Scripts/tests/builtins/expected/WebCore-GuardedBuiltin-Separate.js-result:
* Source/JavaScriptCore/Scripts/tests/builtins/expected/WebCore-GuardedInternalBuiltin-Separate.js-result:
* Source/JavaScriptCore/Scripts/tests/builtins/expected/WebCore-UnguardedBuiltin-Separate.js-result:
* Source/JavaScriptCore/Scripts/tests/builtins/expected/WebCore-xmlCasingTest-Separate.js-result:
* Source/JavaScriptCore/Scripts/tests/builtins/expected/WebCoreJSBuiltins.h-result:

Canonical link: https://commits.webkit.org/304932@main
@annevk
Reduce unsafeness in MathMLRowElement
b43f2f0 
https://bugs.webkit.org/show_bug.cgi?id=304672

Reviewed by Rob Buis.

Apply https://github.com/WebKit/WebKit/wiki/Safer-CPP-Guidelines and
address a couple of minor nits in surrounding code.

Canonical link: https://commits.webkit.org/304933@main
@fujii
[GTK][WPE] Unmarked offscreen tests which are passing these days
370609b 
https://bugs.webkit.org/show_bug.cgi?id=245334

Unreviewed test gardening.

* LayoutTests/platform/glib/TestExpectations:

Canonical link: https://commits.webkit.org/304934@main
@csaavedra
[GTK] Unskip layout test editing/deleting/delete-emoji.html
8993543 
https://bugs.webkit.org/show_bug.cgi?id=160120

Unreviewed gardening.

These are passing in GTK/WPE so they can be unskipped. Also remove
redundant expectations that are exactly the same in all platforms.

* LayoutTests/editing/caret/emoji-expected.txt: Renamed from LayoutTests/platform/mac/editing/caret/emoji-expected.txt.
* LayoutTests/editing/deleting/delete-emoji-2-expected.txt: Renamed from LayoutTests/platform/ios/editing/deleting/delete-emoji-2-expected.txt.
* LayoutTests/editing/deleting/delete-emoji-3-expected.txt: Renamed from LayoutTests/platform/ios/editing/deleting/delete-emoji-3-expected.txt.
* LayoutTests/editing/deleting/delete-emoji-4-expected.txt: Renamed from LayoutTests/platform/ios/editing/deleting/delete-emoji-4-expected.txt.
* LayoutTests/editing/deleting/delete-emoji-5-expected.txt: Renamed from LayoutTests/platform/ios/editing/deleting/delete-emoji-5-expected.txt.
* LayoutTests/editing/deleting/delete-emoji-6-expected.txt: Renamed from LayoutTests/platform/ios/editing/deleting/delete-emoji-6-expected.txt.
* LayoutTests/editing/deleting/delete-emoji-7-expected.txt: Renamed from LayoutTests/platform/ios/editing/deleting/delete-emoji-7-expected.txt.
* LayoutTests/editing/deleting/delete-emoji-8-expected.txt: Renamed from LayoutTests/platform/ios/editing/deleting/delete-emoji-8-expected.txt.
* LayoutTests/editing/deleting/delete-emoji-9-expected.txt: Renamed from LayoutTests/platform/ios/editing/deleting/delete-emoji-9-expected.txt.
* LayoutTests/platform/glib/TestExpectations:
* LayoutTests/platform/mac/editing/deleting/delete-emoji-2-expected.txt: Removed.
* LayoutTests/platform/mac/editing/deleting/delete-emoji-3-expected.txt: Removed.
* LayoutTests/platform/mac/editing/deleting/delete-emoji-4-expected.txt: Removed.
* LayoutTests/platform/mac/editing/deleting/delete-emoji-5-expected.txt: Removed.
* LayoutTests/platform/mac/editing/deleting/delete-emoji-6-expected.txt: Removed.
* LayoutTests/platform/mac/editing/deleting/delete-emoji-7-expected.txt: Removed.
* LayoutTests/platform/mac/editing/deleting/delete-emoji-8-expected.txt: Removed.
* LayoutTests/platform/mac/editing/deleting/delete-emoji-9-expected.txt: Removed.
* LayoutTests/platform/win/editing/caret/emoji-expected.txt: Removed.
* LayoutTests/platform/win/editing/deleting/delete-emoji-2-expected.txt: Removed.
* LayoutTests/platform/win/editing/deleting/delete-emoji-3-expected.txt: Removed.
* LayoutTests/platform/win/editing/deleting/delete-emoji-4-expected.txt: Removed.
* LayoutTests/platform/win/editing/deleting/delete-emoji-5-expected.txt: Removed.
* LayoutTests/platform/win/editing/deleting/delete-emoji-6-expected.txt: Removed.
* LayoutTests/platform/win/editing/deleting/delete-emoji-7-expected.txt: Removed.
* LayoutTests/platform/win/editing/deleting/delete-emoji-8-expected.txt: Removed.
* LayoutTests/platform/win/editing/deleting/delete-emoji-9-expected.txt: Removed.

Canonical link: https://commits.webkit.org/304935@main
@annevk
Split AnimationValue and friends out of GraphicsLayer
364c784 
https://bugs.webkit.org/show_bug.cgi?id=304677

Reviewed by Sam Weinig.

Address a couple of existing FIXMEs asking for these classes to be
moved out of GraphicsLayer to enable us to reduce unsafeness in a
subsequent change (so we can clearly attribute blame in case something
goes amiss).

We did take the liberty of making GraphicLayerAnimationValue's
m_timingFunction const as part of this change as that's trivial enough.

Canonical link: https://commits.webkit.org/304936@main
@weinig
Fix layering violation in WebCore's PathUtilities.h
b1557d1 
https://bugs.webkit.org/show_bug.cgi?id=304678

Reviewed by Alan Baradlay.

Fixes layering violation in WebCore's PathUtilities.h by moving
PathUtilities::pathWithShrinkWrappedRectsForOutline(...) to live
on OutlinePainter.

The issue was that `pathWithShrinkWrappedRectsForOutline` used
non-platform layer types `Style::BorderRadius` and `WritingMode`,
so, the function needed to live above the platform layer.

To make this possible, the `FloatPointGraph` that used to live
in PathUtilities.cpp was moved into its own files, along with
the `polygonsForRect` utility function.

* Source/WebCore/Sources.txt:
* Source/WebCore/WebCore.xcodeproj/project.pbxproj:
* Source/WebCore/platform/graphics/FloatPointGraph.cpp: Added.
* Source/WebCore/platform/graphics/FloatPointGraph.h: Added.
* Source/WebCore/platform/graphics/PathUtilities.cpp:
* Source/WebCore/platform/graphics/PathUtilities.h:
* Source/WebCore/rendering/OutlinePainter.cpp:
* Source/WebCore/rendering/OutlinePainter.h:

Canonical link: https://commits.webkit.org/304937@main
@weinig
[UsedStyle] Extract transform related computation from RenderStyle
7fe27ed 
https://bugs.webkit.org/show_bug.cgi?id=304656

Reviewed by Alan Baradlay.

Extracts the transform related functions from `RenderStyle` into
a new class, `Style::TransformResolver`.

`Style::TransformResolver` has static functions that directly
parallel the functions from RenderStyle (except they take the
style as a parameter), but can also be instantiated with a
style and TransformationMatrix reference, and then used to
apply multiple operations, simplifying some callers.

* Source/WebCore/Sources.txt:
* Source/WebCore/WebCore.xcodeproj/project.pbxproj:
* Source/WebCore/animation/KeyframeEffect.cpp:
* Source/WebCore/platform/animation/AcceleratedEffectValues.cpp:
* Source/WebCore/rendering/MotionPath.cpp:
* Source/WebCore/rendering/MotionPath.h:
* Source/WebCore/rendering/RenderBox.cpp:
* Source/WebCore/rendering/RenderBox.h:
* Source/WebCore/rendering/RenderBoxModelObject.cpp:
* Source/WebCore/rendering/RenderBoxModelObject.h:
* Source/WebCore/rendering/RenderLayer.cpp:
* Source/WebCore/rendering/RenderLayer.h:
* Source/WebCore/rendering/RenderLayerBacking.cpp:
* Source/WebCore/rendering/RenderLayerModelObject.cpp:
* Source/WebCore/rendering/RenderLayerModelObject.h:
* Source/WebCore/rendering/style/RenderStyle+GettersInlines.h:
* Source/WebCore/rendering/style/RenderStyle+SettersInlines.h:
* Source/WebCore/rendering/style/RenderStyle.cpp:
* Source/WebCore/rendering/style/RenderStyle.h:
* Source/WebCore/rendering/svg/RenderSVGForeignObject.cpp:
* Source/WebCore/rendering/svg/RenderSVGForeignObject.h:
* Source/WebCore/rendering/svg/RenderSVGHiddenContainer.h:
* Source/WebCore/rendering/svg/RenderSVGImage.cpp:
* Source/WebCore/rendering/svg/RenderSVGImage.h:
* Source/WebCore/rendering/svg/RenderSVGModelObject.cpp:
* Source/WebCore/rendering/svg/RenderSVGResourceClipper.cpp:
* Source/WebCore/rendering/svg/RenderSVGResourceClipper.h:
* Source/WebCore/rendering/svg/RenderSVGResourceMarker.cpp:
* Source/WebCore/rendering/svg/RenderSVGResourceMarker.h:
* Source/WebCore/rendering/svg/RenderSVGShape.cpp:
* Source/WebCore/rendering/svg/RenderSVGShape.h:
* Source/WebCore/rendering/svg/RenderSVGText.cpp:
* Source/WebCore/rendering/svg/RenderSVGText.h:
* Source/WebCore/rendering/svg/RenderSVGTextPath.cpp:
* Source/WebCore/rendering/svg/RenderSVGTransformableContainer.cpp:
* Source/WebCore/rendering/svg/RenderSVGTransformableContainer.h:
* Source/WebCore/rendering/svg/RenderSVGViewportContainer.cpp:
* Source/WebCore/rendering/svg/RenderSVGViewportContainer.h:
* Source/WebCore/style/StyleExtractorCustom.h:
* Source/WebCore/style/StyleTransformResolver.cpp: Added.
* Source/WebCore/style/StyleTransformResolver.h: Added.
* Source/WebCore/style/computed/StyleComputedStyle.cpp:
* Source/WebCore/style/computed/StyleComputedStyle.h:
* Source/WebCore/style/values/motion/StyleOffsetPath.h:
* Source/WebCore/svg/SVGGraphicsElement.cpp:

Canonical link: https://commits.webkit.org/304938@main
@csaavedra
[GLIB] Update expectations for passing tests
981ede3 
https://bugs.webkit.org/show_bug.cgi?id=304695

Unreviewed gardening.

* LayoutTests/TestExpectations:
* LayoutTests/platform/glib/TestExpectations:
* LayoutTests/platform/gtk/TestExpectations:
* LayoutTests/platform/ios/TestExpectations:
* LayoutTests/platform/wpe-legacy-api/TestExpectations:
* LayoutTests/platform/wpe/TestExpectations:

Canonical link: https://commits.webkit.org/304939@main
@Gumichocopengin8 Ahmad Saleem
[JSC] Fix %TypedArray%.prototype.includes to Align with ECMA-262 Part2
4a83564 
https://bugs.webkit.org/show_bug.cgi?id=304569

Reviewed by Yusuke Suzuki.

This patch fixes `%TypedArray%.prototype.includes`
by adding range check to ensure the `index` is less than the array length,
aligning the behavior with ECMA-262[1].

[1]: https://tc39.es/ecma262/#sec-%typedarray%.prototype.includes

* JSTests/stress/typedarray-resize-includes.js:
(throw.new.Error):
* JSTests/test262/expectations.yaml:
* Source/JavaScriptCore/runtime/JSGenericTypedArrayViewPrototypeFunctions.h:
(JSC::genericTypedArrayViewProtoFuncIncludes):

Canonical link: https://commits.webkit.org/304940@main
@nullhook
Expose operator lighter in SVGFECompositeElement IDL
89a77dc 
https://bugs.webkit.org/show_bug.cgi?id=304105
rdar://problem/166704079

Reviewed by Said Abou-Hallawa.

As defined in the Compositing and Blending spec [1], the 'lighter'
operator is specified.

This PR, as discussed in [2], exposes the 'lighter' value to IDL.

[1] https://www.w3.org/TR/compositing-1/#porterduffcompositingoperators_plus
[2] w3c/svgwg#424

* LayoutTests/imported/w3c/web-platform-tests/svg/types/scripted/SVGAnimatedEnumeration-SVGFECompositeElement-expected.txt:

* LayoutTests/svg/dom/SVGAnimatedEnumeration-SVGFECompositeElement-expected.txt: Removed.
* LayoutTests/svg/dom/SVGAnimatedEnumeration-SVGFECompositeElement.html: Removed.

Removed this test because it is duplicated in WPT.

* Source/WebCore/svg/SVGFECompositeElement.h:
(WebCore::SVGIDLEnumLimits<CompositeOperationType>::highestExposedEnumValue): Deleted.
* Source/WebCore/svg/SVGFECompositeElement.idl:
* Source/WebCore/svg/properties/SVGDecoratedEnumeration.h:
* Source/WebCore/svg/properties/SVGPropertyTraits.h:
(WebCore::SVGIDLEnumLimits::highestExposedEnumValue): Deleted.

Canonical link: https://commits.webkit.org/304941@main
@nullhook
Fix error: use of undeclared identifier 'LOG_CHANNEL_PREFIXFonts' in …
80345fd 
…FontDescriptionCocoa.cpp

https://bugs.webkit.org/show_bug.cgi?id=304699
rdar://167189789

Reviewed by Vitor Roriz.

Add Logging.h header

* Source/WebCore/platform/graphics/cocoa/FontDescriptionCocoa.cpp:

Canonical link: https://commits.webkit.org/304942@main
@annevk
Remove some static_cast in WebCore/svg
82203fd 
https://bugs.webkit.org/show_bug.cgi?id=304692

Reviewed by Nikolas Zimmermann.

Apply https://github.com/WebKit/WebKit/wiki/Safer-CPP-Guidelines

Canonical link: https://commits.webkit.org/304943@main
@csaavedra
[GTK] Gardening for passing tests
98e39b7 
https://bugs.webkit.org/show_bug.cgi?id=304702

Unreviewed gardening.

* LayoutTests/platform/glib/TestExpectations:
* LayoutTests/platform/gtk/TestExpectations:
* LayoutTests/platform/wpe/TestExpectations:

Canonical link: https://commits.webkit.org/304944@main
@nullhook
Introduce decoratedBoundingBox to fix repaint rect and bounding box c…
0a40ee0 
…onflation in SVG resources

https://bugs.webkit.org/show_bug.cgi?id=278551
rdar://problem/134573463

Reviewed by Simon Fraser.

SVG mask and gradient incorrectly used repaintRectInLocalCoordinates(Accurate)
when they needed a geometric bounding box. This conflates two distinct
concepts: repaint rects (for damage/invalidation, can be approximate)
and bounding boxes (for geometric calculations, must be accurate).

This change introduces decoratedBoundingBox, which returns the
bounding box including fill, stroke, and markers. It is intended
for use with masks, gradients, and clippers, separate from repaint semantics.

This PR only adds the decoratedBoundingBox infrastructure and updates
call-sites for semantic correctness without altering rendering behavior.
It still forwards to repaintRectInLocalCoordinates(Accurate), so
rendering remains unchanged.

A follow-up PR will remove the dependency on repaintRectInLocalCoordinates(Accurate)
and compute decorated bounds directly.

* Source/WebCore/rendering/RenderObject.cpp:
(WebCore::RenderObject::decoratedBoundingBox const):
* Source/WebCore/rendering/RenderObject.h:
* Source/WebCore/rendering/svg/RenderSVGContainer.h:
* Source/WebCore/rendering/svg/RenderSVGForeignObject.h:
* Source/WebCore/rendering/svg/RenderSVGImage.h:
* Source/WebCore/rendering/svg/RenderSVGInline.cpp:
(WebCore::RenderSVGInline::decoratedBoundingBox const):
* Source/WebCore/rendering/svg/RenderSVGInline.h:
* Source/WebCore/rendering/svg/RenderSVGResourceMasker.cpp:
(WebCore::RenderSVGResourceMasker::applyMask):
* Source/WebCore/rendering/svg/RenderSVGRoot.h:
* Source/WebCore/rendering/svg/RenderSVGShape.h:
* Source/WebCore/rendering/svg/RenderSVGText.cpp:
(WebCore::RenderSVGText::decoratedBoundingBox const):
* Source/WebCore/rendering/svg/RenderSVGText.h:
* Source/WebCore/rendering/svg/SVGBoundingBoxComputation.h:
(WebCore::SVGBoundingBoxComputation::computeDecoratedBoundingBox):
* Source/WebCore/rendering/svg/legacy/LegacyRenderSVGContainer.cpp:
(WebCore::LegacyRenderSVGContainer::decoratedBoundingBox const):
* Source/WebCore/rendering/svg/legacy/LegacyRenderSVGContainer.h:
* Source/WebCore/rendering/svg/legacy/LegacyRenderSVGForeignObject.h:
* Source/WebCore/rendering/svg/legacy/LegacyRenderSVGImage.h:
* Source/WebCore/rendering/svg/legacy/LegacyRenderSVGResourceGradient.cpp:
(WebCore::calculateGradientGeometry):
* Source/WebCore/rendering/svg/legacy/LegacyRenderSVGResourceMasker.cpp:
(WebCore::LegacyRenderSVGResourceMasker::applyResource):
* Source/WebCore/rendering/svg/legacy/LegacyRenderSVGRoot.cpp:
(WebCore::LegacyRenderSVGRoot::decoratedBoundingBox const):
* Source/WebCore/rendering/svg/legacy/LegacyRenderSVGRoot.h:
* Source/WebCore/rendering/svg/legacy/LegacyRenderSVGShape.cpp:
(WebCore::LegacyRenderSVGShape::decoratedBoundingBox const):
* Source/WebCore/rendering/svg/legacy/LegacyRenderSVGShape.h:

Canonical link: https://commits.webkit.org/304945@main
@csaavedra
[Debug][GStreamer] ASSERTION FAILED: canSafelyBeUsed(); TF::WeakPtr<W…
c7a581a 
…ebCore::GStreamerVideoFrameConverter, WTF::DefaultWeakPtrImpl, WTF::RawPtrTraits<WTF::DefaultWeakPtrImpl> >::get() const

https://bugs.webkit.org/show_bug.cgi?id=304705

Reviewed by Philippe Normand.

* Source/WebCore/platform/graphics/gstreamer/GStreamerVideoFrameConverter.h:

Canonical link: https://commits.webkit.org/304946@main
@alanbaradlay
WebKit handles text layout inconsistently depending on list-style-type
2062ed7 
https://bugs.webkit.org/show_bug.cgi?id=302099
<rdar://problem/164650313>

Reviewed by Antti Koivisto.

Outside list markers should not contribute to the min/max width (they are not even supposed to be here in IFC.)

Test: fast/lists/list-marker-outside-inside-flex-item.html

* LayoutTests/fast/lists/list-marker-outside-inside-flex-item-expected.html: Added.
* LayoutTests/fast/lists/list-marker-outside-inside-flex-item.html: Added.
* Source/WebCore/layout/formattingContexts/inline/IntrinsicWidthHandler.cpp:
(WebCore::Layout::IntrinsicWidthHandler::computedIntrinsicWidthForConstraint):

Canonical link: https://commits.webkit.org/304947@main
@alanbaradlay
[cleanup][IFC] Rename isBetweenShapingBoundaries to isInsideShapingBo…
5eec534 
…undary

https://bugs.webkit.org/show_bug.cgi?id=304691

Reviewed by Antti Koivisto.

The term "IsBetween" is somewhat misleading, as it suggests an (unshaped) run occurring between two shaped runs.

* Source/WebCore/layout/formattingContexts/inline/InlineLine.h:
(WebCore::Layout::Line::Run::isInsideShapingBoundary const):
(WebCore::Layout::Line::Run::isBetweenShapingBoundaries const): Deleted.
* Source/WebCore/layout/formattingContexts/inline/InlineLineBuilder.cpp:
(WebCore::Layout::LineBuilder::commitCandidateContent):
* Source/WebCore/layout/formattingContexts/inline/display/InlineDisplayBox.h:
(WebCore::InlineDisplay::Box::Text::isInsideShapingBoundary const):
(WebCore::InlineDisplay::Box::Text::isBetweenShapingBoundaries const): Deleted.
* Source/WebCore/layout/formattingContexts/inline/display/InlineDisplayContentBuilder.cpp:
(WebCore::Layout::InlineDisplayContentBuilder::appendTextDisplayBox):
* Source/WebCore/rendering/TextBoxPainter.cpp:
(WebCore::TextBoxPainter::isInsideShapedContent const):

Canonical link: https://commits.webkit.org/304948@main
@alanbaradlay
[blocks-in-inline] getClientRects is missing an entry when called on …
8a9a5a9 
…an inline box

https://bugs.webkit.org/show_bug.cgi?id=304665

Reviewed by Antti Koivisto.

A single block inside inline (<span><div></div></span>) generates 3 "lines" and getClientRects is supposed to return all of them.
However due to ignoring 0px width (non-leading) inline boxes in collectInlineBoxRects, we only return 2 (the first, leading (0px tall)
line and the one generated by the block).
Having all lines included makes block-in-inline-client-rects-001.html fail but we already render such content incorrectly on trunk.

<div>
  <span style="outline: 1px solid green">
    <div style="width: 500px"></div>
  </span>
</div>

There should _not_ be a green line here.

* LayoutTests/TestExpectations:
* LayoutTests/fast/block/inside-inlines/getClientRects-on-inline-box-missing-entry-expected.txt: Added.
* LayoutTests/fast/block/inside-inlines/getClientRects-on-inline-box-missing-entry.html: Added.
* LayoutTests/fast/inline/blocks-in-inline-client-rects-expected.txt: Removed.  : this is a copy of block-in-inline-client-rects-001.html
* LayoutTests/fast/inline/blocks-in-inline-client-rects.html: Removed.
* Source/WebCore/layout/integration/inline/LayoutIntegrationLineLayout.cpp:
(WebCore::LayoutIntegration::LineLayout::collectInlineBoxRects const):

Canonical link: https://commits.webkit.org/304949@main
@weinig
[RenderStyleGen] Generate logical property getter/setters
46ea4df 
https://bugs.webkit.org/show_bug.cgi?id=304679

Reviewed by Darin Adler.

Replaces hand written logical property getters and setters
on RenderStyle with generated equivalents.

Currently, only properties that are part of a "logical property
group" of type 'axis' or 'side' get generated logical functions.
There are currently no 'corner' logical property getters or
setters on RenderStyle, so this is not a change.

For named "logical property group" of type "axis", like 'size',
which contains the 'width' and height' properties, we generate:

    inline const Style::PreferredSize& logicalWidth(WritingMode) const;
    inline const Style::PreferredSize& logicalHeight(WritingMode) const;
    inline const Style::PreferredSize& logicalWidth() const;
    inline const Style::PreferredSize& logicalHeight() const;
    inline void setLogicalWidth(Style::PreferredSize&&);
    inline void setLogicalHeight(Style::PreferredSize&&);

For named "logical property group" of type "side", like 'padding',
which contains the 'padding-left', 'padding-right', etc. properties,
we generate:

    inline const Style::PaddingEdge& paddingStart(WritingMode) const;
    inline const Style::PaddingEdge& paddingEnd(WritingMode) const;
    inline const Style::PaddingEdge& paddingBefore(WritingMode) const;
    inline const Style::PaddingEdge& paddingAfter(WritingMode) const;
    inline const Style::PaddingEdge& paddingLogicalLeft(WritingMode) const;
    inline const Style::PaddingEdge& paddingLogicalRight(WritingMode) const;
    inline const Style::PaddingEdge& paddingStart() const;
    inline const Style::PaddingEdge& paddingEnd() const;
    inline const Style::PaddingEdge& paddingBefore() const;
    inline const Style::PaddingEdge& paddingAfter() const;
    inline const Style::PaddingEdge& paddingLogicalLeft() const;
    inline const Style::PaddingEdge& paddingLogicalRight() const;
    inline void setPaddingStart(Style::PaddingEdge&&);
    inline void setPaddingEnd(Style::PaddingEdge&&);
    inline void setPaddingBefore(Style::PaddingEdge&&);
    inline void setPaddingAfter(Style::PaddingEdge&&);
    inline void setPaddingLogicalLeft(Style::PaddingEdge&&);
    inline void setPaddingLogicalRight(Style::PaddingEdge&&);

A few small renames were necessary to achieve a consistent naming convention:

- containIntrinsicLogicalWidth/containIntrinsicLogicalHeight were renamed to
logicalContainIntrinsicWidth/logicalContainIntrinsicHeight.

- borderAfterWidth/borderBeforeWidth/borderStartWidth/borderEndWidth were
renamed to borderWidthAfter/borderWidthBefore/borderWidthStart/borderWidthEnd.

The logical inset functions logicalLeft/logicalRight/logicalTop/logicalBottom
were left as aliases for now, as I wasn't clear on whether the convention should
of logicalTop/logicalBottom was something to bring forward.

* Source/WebCore/css/scripts/process-css-properties.py:
* Source/WebCore/css/scripts/test/TestCSSProperties.json:
* Source/WebCore/css/scripts/test/TestCSSPropertiesResults/RenderStyleProperties+GettersInlines.h:
* Source/WebCore/css/scripts/test/TestCSSPropertiesResults/RenderStyleProperties+SettersInlines.h:
* Source/WebCore/css/scripts/test/TestCSSPropertiesResults/RenderStyleProperties.h:
* Source/WebCore/css/scripts/test/TestCSSPropertiesResults/StyleChangedAnimatablePropertiesGenerated.cpp:
* Source/WebCore/css/scripts/test/TestCSSPropertiesResults/StyleComputedStyleProperties+GettersInlines.h:
* Source/WebCore/css/scripts/test/TestCSSPropertiesResults/StyleComputedStyleProperties+InitialInlines.h:
* Source/WebCore/css/scripts/test/TestCSSPropertiesResults/StyleComputedStyleProperties+SettersInlines.h:
* Source/WebCore/css/scripts/test/TestCSSPropertiesResults/StyleComputedStyleProperties.h:
* Source/WebCore/dom/Document.cpp:
* Source/WebCore/rendering/RenderBoxModelObjectInlines.h:
* Source/WebCore/rendering/cocoa/RenderThemeCocoa.mm:
* Source/WebCore/rendering/style/RenderStyle+GettersInlines.h:
* Source/WebCore/rendering/style/RenderStyle+SettersInlines.h:
* Source/WebCore/rendering/style/RenderStyle.cpp:
* Source/WebCore/rendering/style/RenderStyle.h:
* Source/WebCore/rendering/updating/RenderTreeUpdater.cpp:

Canonical link: https://commits.webkit.org/304950@main
@github-actions

github-actions Bot commented Jan 4, 2026

Copy link
Copy Markdown

⚠️ Preview build was cancelled

This may have been caused by a newer build being triggered for the same PR.

@sosukesuzuki

sosukesuzuki commented Jan 4, 2026

Copy link
Copy Markdown
Member Author

/build-preview

@github-actions

github-actions Bot commented Jan 4, 2026

Copy link
Copy Markdown

🔄 Preview build started

Release tag: autobuild-preview-pr-124-ae95679d
Workflow: View progress

@github-actions

github-actions Bot commented Jan 4, 2026

Copy link
Copy Markdown

✅ Preview build completed

Release: autobuild-preview-pr-124-ae95679d

@sosukesuzuki sosukesuzuki mentioned this pull request Jan 4, 2026
Closed
@sosukesuzuki
fix: remove orphaned DECLARE_ALLOCATOR_WITH_HEAP_IDENTIFIER macros
50e669d 
Remove DECLARE_ALLOCATOR_WITH_HEAP_IDENTIFIER macros that no longer have
corresponding DEFINE macros after upstream migrated these classes from
heap-breakdown allocation to TZone/Sequestered allocation:

- SpeculativeJIT: now uses WTF_MAKE_SEQUESTERED_ARENA_ALLOCATED
- StringReplaceCache: now uses WTF_MAKE_TZONE_ALLOCATED
- StringSplitCache: now uses WTF_MAKE_TZONE_ALLOCATED

These orphaned DECLARE macros would cause linker errors when
ENABLE(MALLOC_HEAP_BREAKDOWN) is enabled, as they declare
XMalloc structs without corresponding definitions.
@sosukesuzuki
Revert "fix: remove orphaned DECLARE_ALLOCATOR_WITH_HEAP_IDENTIFIER m…
20e6b23 
…acros"

This reverts commit 50e669d.
@sosukesuzuki
fix: correct functionKeywordStart for async functions in hand-rolled …
de829ef 
…parser

The hand-rolled parser in BuiltinExecutables.cpp was incorrectly calculating
functionKeywordStart for async functions. It was pointing to the 'function'
keyword instead of 'async', causing a mismatch with the JSC parser which
expects functionStart to be at the 'async' keyword position.

This fixes the 'm_functionStart' field mismatch that caused assertion failures
during debug builds.
@sosukesuzuki

sosukesuzuki commented Jan 5, 2026

Copy link
Copy Markdown
Member Author

/build-preview

@github-actions

github-actions Bot commented Jan 5, 2026

Copy link
Copy Markdown

🔄 Preview build started

Release tag: autobuild-preview-pr-124-de829ef3
Workflow: View progress

@github-actions

github-actions Bot commented Jan 5, 2026

Copy link
Copy Markdown

❌ Preview build failed

Check the workflow run for details.

1 similar comment
@github-actions

github-actions Bot commented Jan 5, 2026

Copy link
Copy Markdown

❌ Preview build failed

Check the workflow run for details.

@sosukesuzuki
fix: handle microtask context argument positions for Bun builds
9239cfb 
- Add isEmpty() check before jsDynamicCast to prevent SEGV when ValueEmpty
  (0x0) incorrectly passes isCell() check
- Implement ECMAScript identity function behavior when handler is undefined
  in PromiseReactionJob
- Use correct queueMicrotask argument positions based on task type:
  - Combinator jobs (PromiseAllResolveJob, etc.): context in args[2]
  - AsyncFunctionResume, PromiseReactionJob: context in args[3]
- Fix fulfillWithInternalMicrotask, rejectWithInternalMicrotask, and
  resolveWithInternalMicrotaskForAsyncAwait for AsyncFunctionResume
@sosukesuzuki
Merge branch 'main' into sosuke/upgrade-webkit-20260103
4a684d4
@sosukesuzuki

sosukesuzuki commented Jan 5, 2026

Copy link
Copy Markdown
Member Author

/build-preview

@github-actions

github-actions Bot commented Jan 5, 2026

Copy link
Copy Markdown

🔄 Preview build started

Release tag: autobuild-preview-pr-124-4a684d45
Workflow: View progress

@github-actions

github-actions Bot commented Jan 5, 2026

Copy link
Copy Markdown

✅ Preview build completed

Release: autobuild-preview-pr-124-4a684d45

@sosukesuzuki
fix: pass external context through performPromiseThen for Bun handlers
9a83e72 
Bun's handlePromise passes a context (e.g., NodeHTTPResponse) as the 5th
argument to performPromiseThenFunction, but the host function was only
reading 4 arguments, causing the context to be lost.

Changes:
- Add performPromiseThen overload that accepts externalContext parameter
- Modify performPromiseThen host function to read 5th argument
- Add PromiseReactionJobWithoutPromise to Microtask.h enum
- Add PromiseReactionJobWithoutPromise handler in JSMicrotask.cpp
- Update triggerPromiseReactions to use correct task types

This fixes the 'panic: attempt to use null value' crash in
Bun__NodeHTTPRequest__onResolve where arguments[1] was expected to
contain NodeHTTPResponse but was null.
@sosukesuzuki
fix: correct argument position for AsyncGenerator microtask context
710bb41 
AsyncGenerator tasks (AsyncGeneratorYieldAwaited, AsyncGeneratorBodyCallNormal,
AsyncGeneratorBodyCallReturn, AsyncGeneratorResumeNext) expect the generator
context in arguments[2], same as Promise combinator jobs.

Previously these tasks fell through to the default case which used 6-arg
queueMicrotask, putting context in arguments[3]. This caused a jsCast
assertion failure when JSMicrotask.cpp handlers tried to cast arguments[2]
to JSAsyncGenerator*.

Add AsyncGenerator tasks to the switch statement to use 5-arg queueMicrotask.
@sosukesuzuki

sosukesuzuki commented Jan 5, 2026

Copy link
Copy Markdown
Member Author

/build-preview

@github-actions

github-actions Bot commented Jan 5, 2026

Copy link
Copy Markdown

🔄 Preview build started

Release tag: autobuild-preview-pr-124-4a684d45
Workflow: View progress

@github-actions

github-actions Bot commented Jan 5, 2026

Copy link
Copy Markdown

✅ Preview build completed

Release: autobuild-preview-pr-124-4a684d45

@sosukesuzuki

sosukesuzuki commented Jan 6, 2026

Copy link
Copy Markdown
Member Author

/build-preview

@github-actions

github-actions Bot commented Jan 6, 2026

Copy link
Copy Markdown

🔄 Preview build started

Release tag: autobuild-preview-pr-124-710bb417
Workflow: View progress

@github-actions

github-actions Bot commented Jan 6, 2026

Copy link
Copy Markdown

✅ Preview build completed

Release: autobuild-preview-pr-124-710bb417

@sosukesuzuki
fix: include AsyncGenerator tasks in triggerPromiseReactions switch s…
5432206 
…tatement

AsyncGenerator microtasks (YieldAwaited, BodyCallNormal, BodyCallReturn,
ResumeNext) were falling through to the default case in triggerPromiseReactions,
which used the 6-arg queueMicrotask variant, placing the generator context at
arguments[3]. However, runInternalMicrotask expects these tasks to have the
generator at arguments[2].

This caused jsCast<JSAsyncGenerator*>(arguments[2]) to fail because arguments[2]
was jsUndefined() instead of the actual AsyncGenerator.

The fix adds these four AsyncGenerator tasks to the same switch case as the
combinator jobs, which use the 5-arg queueMicrotask variant that places context
at arguments[2].
@gavinhailey gavinhailey mentioned this pull request Jan 13, 2026
Closed
@sosukesuzuki sosukesuzuki mentioned this pull request Jan 13, 2026
Merged
@robobun robobun mentioned this pull request Aug 27, 2026
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@coderabbitai coderabbitai[bot] coderabbitai[bot] left review comments

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.