Skip to content

Conversation

@sosukesuzuki
Copy link
Member

Upgrades WebKit


WebKit/JavaScriptCore Changes Summary

This document summarizes the significant changes in JavaScriptCore between the previous and current WebKit versions used by Bun.

Major Changes

Promise System Rewrite (Most Impactful)

[JSC] Move most of Promise operations to C++ (7598b7e)

  • Major refactoring of the Promise implementation
  • Moved promise operations from JavaScript builtins to C++ for better performance
  • JSPromise::reject(), JSPromise::fulfill(), JSPromise::rejectAsHandled(), and JSPromise::performPromiseThen() now require a VM& parameter
  • JSPromiseReaction changed from JSInternalFieldObjectImpl to a plain JSCell
  • Removed Promise.$resolve and Promise.$reject static properties - replaced with @promiseResolve and @promiseReject link-time constant functions

[JSC] Make all of Microtask defined via InternalMicrotask ID (8844dcd)

  • Refactored microtask system to use numeric IDs instead of JavaScript functions
  • New InternalMicrotask enum values for different promise operation types
  • Better performance by avoiding JavaScript function calls for internal operations

[JSC] Always associate JSGlobalObject to microtask (a69a3f6)

  • Microtasks now track their associated global object

[JSC] Support Promise.race in async stack trace (eb9fff6)

  • Enhanced async stack trace support for Promise.race

WebAssembly IPInt SIMD Support

Multiple commits added SIMD support to the IPInt (Interpreter) tier:

  • WASM IPInt SIMD: allow SIMD when BBQ disabled (14131cb)
  • WASM IPInt SIMD: support GC types with v128 fields/elements (3f16b36)
  • WASM IPInt SIMD: support exceptions with v128 (7043565)
  • WASM IPInt SIMD: support v128 in IPInt to BBQ loop OSR (e392e01)
  • WASM IPInt SIMD: zero initialize high 8-bytes of locals (e728c9d)
  • Various register usage and clobber fixes for SIMD operations

Temporal API Implementation Progress

Significant progress on the Temporal API (ECMAScript proposal):

  • TemporalDuration::round() implementation (52738be)
  • TemporalDuration::subtract() implementation (0275bce)
  • TemporalDuration::total() reimplementation (ae59647)
  • TemporalCalendar and TemporalDuration addition (59c64c7)
  • Replaced isoDateDifference() with calendarDateUntil() (f1cf8d2)

VM and Runtime Improvements

Implement a Stop the World mechanism for JSC (2e80a20)

  • New VM-level mechanism to stop all JavaScript threads
  • Useful for debugging and certain GC operations

[JSC] Implement Array.of in C++ (8d5b7e4)

  • Moved Array.of from JavaScript builtins to C++ for performance

[JSC] Do not read Structure's classInfo field in the fast path for isThenFastAndNonObservable (c1b92cb)

  • Performance optimization for promise thenable checks

[JSC] Remove @getSetSizeAsInt in SetPrototype.js (c1ecefa)

  • Cleanup of internal Set prototype methods

Bug Fixes

Conditional writes are incorrectly handled in Array allocation sinking (934b1e2)

  • Fixed a DFG/FTL optimization bug with array allocation sinking

ASSERTION FAILED: !needsSlowPutIndexing() at ensureArrayStorageSlow (716536c)

  • Fixed array indexing assertion failure

ASSERTION FAILED: constructor.isObject() when OSR from an inlined function (8b9fc1b)

  • Fixed OSR (On-Stack Replacement) bug with inlined constructors

[JSC] Fix instanceof metadata fields in LLIntPrototypeLoadAdaptiveStructureWatchpoint (7563333)

  • Fixed instanceof operation metadata handling

[JSC] Add stack overflow checks to LiteralParser::parse (06f13ed)

  • Security fix for JSON/literal parsing stack overflow

[JSC] Math.random JIT path uses arithmetic instead of logical right shifts (cf0e17e)

  • Fixed Math.random JIT codegen bug

Fix IPInt catch handler bounds generation (09be147)

  • Fixed WebAssembly exception handling bounds

OMG stack slots should be positioned at the beginning of the OSR buffer when IPInt OSR layout is used (899a38c)

  • Fixed WebAssembly OMG tier OSR buffer layout

Code Quality / SaferCPP

Multiple commits addressing C++ safety warnings:

  • Address Safer CPP warnings in JSC::ArrayBuffer (3ea1357)
  • Address Safer CPP warnings in JSC::Watchpoint (5ff7a5d)
  • Address Safer CPP warnings in inspector code (d1acf19)
  • Adopt LIFETIME_BOUND for WTF::RefPtr (74dea89)

Other Notable Changes

  • [JSC] Remove Wasm string size limit (81ff731)
  • [JSC] Improve error message for calling constructor without new (dabbab2)
  • [JSC] Use tryMakeString for error message on invalid destructuring (ff79c41)
  • [JSC] Enable Fuzzilli build with CMake (a34332a)
  • [Swift in WebKit] Add a modulemap for the private interface of JSC (0d9b3a0)
  • [JSC] Remove masking of tagbits in CalleeBits (e53fd85)

Bun-Specific Patches Applied

The following Bun-specific changes were applied on top of upstream:

  • New async stack trace logic for Bun's async context tracking
  • AsyncLocalStorage support in promise operations
  • New internal microtask types: BunPerformMicrotaskJob and BunInvokeJobWithArguments
  • Exception checking improvements
  • Export of additional functions for Bun bindings

Breaking Changes for Bun Integration

  1. JSPromise API changes: reject(), fulfill(), rejectAsHandled(), performPromiseThen() now require VM& as first parameter
  2. Promise builtin property removal: Promise.$resolve and Promise.$reject removed - must use $promiseResolve() and $promiseReject() functions instead
  3. JSPromiseReaction restructuring: Changed from JSInternalFieldObjectImpl to plain JSCell
  4. JSType enum changes: New types added, requiring ABI sync between Zig and C++

Migration Notes

When updating Bun bindings for this WebKit version:

  1. Update all promise->reject(globalObject, value) calls to promise->reject(vm, globalObject, value)
  2. Update all promise->rejectAsHandled(globalObject, value) calls to promise->rejectAsHandled(vm, globalObject, value)
  3. Replace Promise.$resolve(value) with $promiseResolve(Promise, value) in JavaScript builtins
  4. Replace Promise.$reject(value) with $promiseReject(Promise, value) in JavaScript builtins
  5. Sync JSType enum values in Zig bindings with new WebKit values

annevk and others added 30 commits December 3, 2025 09:29
https://bugs.webkit.org/show_bug.cgi?id=302851

Reviewed by Ryosuke Niwa.

Since attachShadow() no longer looks at the host's custom element
registry, but rather the host document registry, we should do something
similar when serializing.

WPT PR: web-platform-tests/wpt#56419

Canonical link: https://commits.webkit.org/303841@main
rdar://165712922
https://bugs.webkit.org/show_bug.cgi?id=303410

Unreviewed test gardening

Applying a new rebaseline for viewport tests in iOS.

* LayoutTests/platform/ios/fast/viewport/ios/responsive-viewport-with-minimum-width-after-changing-view-scale-expected.txt:
* LayoutTests/platform/ios/fast/viewport/ios/shrink-to-fit-for-page-without-viewport-meta-expected.txt:
* LayoutTests/platform/ios/fast/viewport/ios/viewport-fit-auto-expected.txt: Added.
* LayoutTests/platform/ios/fast/viewport/ios/viewport-fit-contain-expected.txt: Added.
* LayoutTests/platform/ios/fast/viewport/ios/viewport-fit-cover-expected.txt: Added.
* LayoutTests/platform/ios/fast/viewport/ios/width-is-device-width-expected.txt:
* LayoutTests/platform/ios/fast/viewport/ios/width-is-device-width-overflowing-body-overflow-hidden-expected.txt:
* LayoutTests/platform/ios/fast/viewport/ios/width-is-device-width-overflowing-body-overflow-hidden-tall-expected.txt:
* LayoutTests/platform/ios/fast/viewport/ios/width-is-device-width-overflowing-expected.txt:
* LayoutTests/platform/ios/fast/viewport/ios/width-is-device-width-overflowing-no-shrink-to-fit-expected.txt:

Canonical link: https://commits.webkit.org/303842@main
…tems.

https://bugs.webkit.org/show_bug.cgi?id=303441
rdar://165728471

Reviewed by Brandon Stewart and Alan Baradlay.

The automatic sizes of grid items is defined in:
https://drafts.csswg.org/css-grid-1/#grid-item-sizing

This patch adds some initial code to start supporting the automatic
*inline* sizes of grid items that we can build upon. In particular, this
is for content in which the grid item:

1.) is non-replaced element
2.) does not have a preferred aspect ratio
3.) has non-auto margins
4.) has an alignment position of normal

This ends up placing us into the "Fill grid area," portion of this
section of the spec. "Fill grid area," seems to refer to "the grid item is
sized as for align-self: stretch," which after following a couple of
spec links leads to:
https://www.w3.org/TR/css-align-3/#justify-self-property

This is the core logic that is implemented as part of
usedInlineSizeForGridItem.

* Source/WebCore/layout/formattingContexts/grid/GridLayout.cpp:
(WebCore::Layout::GridLayout::performInlineAxisSelfAlignment):
Since "Normal," is handled by grid item sizing there is nothing to do
here as part of alignment.

* Source/WebCore/layout/formattingContexts/grid/GridLayoutUtils.cpp:
(WebCore::Layout::GridLayoutUtils::usedInlineSizeForGridItem):
This is the core of the logic that is written to implement the
aforementioned portion of the spec. Basically we need to determine the
total size of the columns the grid item spans and then stretch it to fit
within that size while still respecting the min and max sizes specified
by style.

Note that there was was small change made when for the fixed inline size
case. Now we add in the border and padding within this function instead
of it being done on top of what we returned from this function. This is
because we need the border and padding in order to properly stretch the
grid item.

Canonical link: https://commits.webkit.org/303843@main
https://bugs.webkit.org/show_bug.cgi?id=299999
rdar://162244690

Reviewed by Tim Nguyen.

This patch aligns WebKit with Gecko / Firefox and Blink / Chromium.

This patch fixes an issue in serialization where in the past, we used to not serialize `border` property
and were not canonical. Now it aligns with other browsers and returns canonical reference.

CSS spec: https://drafts.csswg.org/cssom/#serialize-a-css-declaration-block

* LayoutTests/fast/css/remove-shorthand-expected.txt:
* LayoutTests/imported/w3c/web-platform-tests/css/css-sizing/stretch/block-height-008-expected.txt:
* LayoutTests/imported/w3c/web-platform-tests/css/cssom/shorthand-values-expected.txt:
* LayoutTests/platform/glib/imported/w3c/web-platform-tests/css/css-sizing/stretch/block-height-008-expected.txt:
* Source/WebCore/css/StyleProperties.cpp:
(WebCore::canUseShorthandForLonghand):

Canonical link: https://commits.webkit.org/303844@main
…-attribute-basic.html is constant failure

https://bugs.webkit.org/show_bug.cgi?id=302741
rdar://164998514

Unreviewed test gardening

Removing extra lines from the expectation file.

* LayoutTests/platform/ios/imported/w3c/web-platform-tests/html/semantics/popovers/popover-attribute-basic-expected.txt:

Canonical link: https://commits.webkit.org/303845@main
…View`

https://bugs.webkit.org/show_bug.cgi?id=303431
rdar://165724968

Reviewed by Wenson Hsieh.

`-[UIScreen mainScreen]` was deprecated in iOS 26. Work towards removing its
use in WebKit.

* Source/WebKit/UIProcess/Inspector/ios/WKInspectorHighlightView.mm:
(-[WKInspectorHighlightView update:scale:frame:]):
* Source/WebKit/UIProcess/ios/WKContentView.mm:
(-[WKContentView _showInspectorHighlight:]):

`-intrinsicDeviceScaleFactor` gets the display scale from the view's trait
collection and falls back to using `UIScreen` if the value is unspecified.

Canonical link: https://commits.webkit.org/303846@main
https://bugs.webkit.org/show_bug.cgi?id=303442

Reviewed by Jonathan Bedard.

We don't need to enumerate all branches and then check whether the
default branch name exists in each source remote: we can instead just
rely on merge-base to fail when the ref doesn't exist.

With a very large number of branches (mostly from numerous remotes),
this is a 3.9x speedup for
`git-webkit pickable origin/main~10..origin/main`.

* Tools/Scripts/libraries/webkitscmpy/webkitscmpy/local/git.py:
(Git._is_on_default_branch):

Canonical link: https://commits.webkit.org/303847@main
https://bugs.webkit.org/show_bug.cgi?id=303439
rdar://165728567

Reviewed by Darin Adler.

libc++ marks std::make_unique's return value as [[nodiscard]].
Apply the same to WTF::makeUnique and variants to warn against
discarding return values.

LLVM/libc++ docs: https://libcxx.llvm.org/CodingGuidelines.html#apply-nodiscard-where-relevant

* Source/WTF/wtf/StdLibExtras.h:
(WTF::makeUnique):
(WTF::makeUniqueWithoutRefCountedCheck):
(WTF::makeUniqueWithoutFastMallocCheck):
* Source/WTF/wtf/UniqueArray.h:
(WTF::makeUniqueArray):
* Source/WTF/wtf/UniqueRef.h:
(WTF::makeUniqueRefWithoutFastMallocCheck):
(WTF::makeUniqueRefWithoutRefCountedCheck):
(WTF::makeUniqueRef):

Canonical link: https://commits.webkit.org/303848@main
…itmapTexture

https://bugs.webkit.org/show_bug.cgi?id=303312

Reviewed by Carlos Garcia Campos.

Introduce m_allocatedSize to BitmapTexture to track the actual allocated
buffer size, which may differ from the logical m_size when using
specific tiled texture formats that require e.g. 64x64 alignment.

When rendering textures with allocated size differences, adjust UV
coordinates via drawTextureWithPhysicalSize() to sample only the logical
region, preventing rendering artifacts from the padding area.

Add a new ClampUVBounds shader option that clamps texture coordinates
to stay within the logical texture region. This prevents GPU bilinear
filtering from sampling texels in the padding area when the allocated
texture is larger than the logical size, which would otherwise cause
visible artifacts at texture edges.

* Source/WebCore/platform/graphics/gbm/MemoryMappedGPUBuffer.cpp:
(WebCore::MemoryMappedGPUBuffer::allocatedSize const):
* Source/WebCore/platform/graphics/gbm/MemoryMappedGPUBuffer.h:
* Source/WebCore/platform/graphics/texmap/BitmapTexture.cpp:
(WebCore::BitmapTexture::allocatedSize const):
* Source/WebCore/platform/graphics/texmap/BitmapTexture.h:
* Source/WebCore/platform/graphics/texmap/TextureMapper.cpp:
(WebCore::TextureMapper::drawTexture):
(WebCore::TextureMapper::drawTextureWithPhysicalSize):
* Source/WebCore/platform/graphics/texmap/TextureMapper.h:
* Source/WebCore/platform/graphics/texmap/TextureMapperShaderProgram.cpp:
(WebCore::TextureMapperShaderProgram::create):
* Source/WebCore/platform/graphics/texmap/TextureMapperShaderProgram.h:

Canonical link: https://commits.webkit.org/303849@main
https://bugs.webkit.org/show_bug.cgi?id=303314

Reviewed by Alex Christensen.

The tag deduping test cases are failing for multiple reasons:
* Invalid tag rules are causing the entire Speculation Rules script to fail, rather than just the relevant rule.
* `null` rules are not being sorted properly, as they are treated as strings.
* Consecutive speculationrules scripts are being considered individually, rather than wait for the next microtask checkpoint.

This PR fixes all of the above, and with it most of the test cases of the relevant test.

No new tests, but this progresses a currently failing test.

* LayoutTests/imported/w3c/web-platform-tests/speculation-rules/speculation-tags/deduped-and-sorted-tags.https_type=prefetch-expected.txt: Progression.
* LayoutTests/imported/w3c/web-platform-tests/speculation-rules/speculation-tags/prefetch-eagerness-pointer-down.https-expected.txt: Progression.
* LayoutTests/imported/w3c/web-platform-tests/speculation-rules/speculation-tags/prefetch-eagerness-pointer-hover.https-expected.txt: Expectation change.
* Source/WebCore/dom/Document.cpp:
(WebCore::Document::considerSpeculationRules): Align to spec. Queue a microtask.
(WebCore::Document::processSpeculationRules): Moved the actual logic here. Aligned to spec when it comes to tag deduping.
* Source/WebCore/dom/Document.h: Add m_speculationRulesConsiderationScheduled.
* Source/WebCore/loader/DocumentPrefetcher.cpp:
(WebCore::makePrefetchRequest): Handle null string as a tag.
* Source/WebCore/loader/SpeculationRules.cpp:
(WebCore::parseSingleRule): Dedupe tag if identical to ruleset tag. Append null instead of "null".
(WebCore::parseRules): Don't terminate speculation rules processing due to an invalid rule.
(WebCore::SpeculationRules::parseSpeculationRules): Add spec comments.

Canonical link: https://commits.webkit.org/303850@main
https://bugs.webkit.org/show_bug.cgi?id=302986
rdar://165243794

Reviewed by Sihui Liu and Alex Christensen.

This patch fixes issues with the `UITextSearching` protocol
in site isolation.

It fixes `replaceFoundTextInRange`, `decorateFoundTextRange`,
`scrollRangeToVisible`, `clearAllDecoratedFoundText`, and
`requestRectForFoundTextRange` in site isolation.

The main problem is that a client can search for string in
one WebView and then highlight or replace or scroll in another
that is hosting the same content. We address this issue by storing
the path from the mainFrame to the frame in which the match was
found on each WebFoundTextRange.

This way, we can traverse the frame tree for each
WebFoundTextRange and find, positionally, which frame the range
was found in. This means we do not have to store the frameIdentifier,
which will be different between WebViews.

* Source/WebCore/page/Frame.cpp:
(WebCore::Frame::indexInFrameTreeSiblings const):
(WebCore::Frame::pathToFrame const):
* Source/WebCore/page/Frame.h:
* Source/WebCore/page/Page.cpp:
(WebCore::Page::findFrameByPath const):
* Source/WebCore/page/Page.h:
* Source/WebKit/Shared/WebFoundTextRange.cpp:
(WebKit::WebFoundTextRange::operator== const):
(WebKit::operator<<):
* Source/WebKit/Shared/WebFoundTextRange.h:
(WTF::HashTraits<WebKit::WebFoundTextRange>::constructDeletedValue):
(WTF::HashTraits<WebKit::WebFoundTextRange>::isDeletedValue):
* Source/WebKit/Shared/WebFoundTextRange.serialization.in:
* Source/WebKit/UIProcess/WebFrameProxy.cpp:
(WebKit::WebFrameProxy::childFrame const):
* Source/WebKit/UIProcess/WebFrameProxy.h:
* Source/WebKit/UIProcess/WebPageProxy.cpp:
(WebKit::WebPageProxy::replaceFoundTextRangeWithString):
(WebKit::WebPageProxy::scrollTextRangeToVisible):
(WebKit::WebPageProxy::clearAllDecoratedFoundText):
(WebKit::WebPageProxy::didBeginTextSearchOperation):
(WebKit::WebPageProxy::requestRectForFoundTextRange):
* Source/WebKit/UIProcess/ios/WKContentViewInteraction.mm:
(+[WKFoundTextRange foundTextRangeWithWebFoundTextRange:]):
(-[WKFoundTextRange dealloc]):
(-[WKFoundDOMTextRange webFoundTextRange]):
(-[WKFoundPDFTextRange webFoundTextRange]):
* Source/WebKit/WebProcess/WebPage/WebFoundTextRangeController.cpp:
(WebKit::WebFoundTextRangeController::findTextRangesForStringMatches):
(WebKit::WebFoundTextRangeController::rectsForTextMatchesInRect):
(WebKit::WebFoundTextRangeController::frameForFoundTextRange const):
* Tools/TestRunnerShared/spi/UIKitSPIForTesting.h:
* Tools/TestWebKitAPI/Tests/WebKitCocoa/FindInPage.mm:
(TEST(WebKit, FindAndReplace)):
(swizzledIsEmbeddedScreen): Deleted.
(-[TestScrollViewDelegate init]): Deleted.
(-[TestScrollViewDelegate scrollViewDidEndScrollingAnimation:]): Deleted.
(-[TestFindDelegate setDidAddLayerForFindOverlayHandler:]): Deleted.
(-[TestFindDelegate didAddLayerForFindOverlayHandler]): Deleted.
(-[TestFindDelegate setDidRemoveLayerForFindOverlayHandler:]): Deleted.
(-[TestFindDelegate didRemoveLayerForFindOverlayHandler]): Deleted.
(-[TestFindDelegate _webView:didAddLayerForFindOverlay:]): Deleted.
(-[TestFindDelegate _webViewDidRemoveLayerForFindOverlay:]): Deleted.
* Tools/TestWebKitAPI/Tests/WebKitCocoa/FindInPageUtilities.h:
* Tools/TestWebKitAPI/Tests/WebKitCocoa/FindInPageUtilities.mm:
(swizzledIsEmbeddedScreen):
(-[TestScrollViewDelegate init]):
(-[TestScrollViewDelegate scrollViewDidEndScrollingAnimation:]):
(-[TestFindDelegate setDidAddLayerForFindOverlayHandler:]):
(-[TestFindDelegate didAddLayerForFindOverlayHandler]):
(-[TestFindDelegate setDidRemoveLayerForFindOverlayHandler:]):
(-[TestFindDelegate didRemoveLayerForFindOverlayHandler]):
(-[TestFindDelegate _webView:didAddLayerForFindOverlay:]):
(-[TestFindDelegate _webViewDidRemoveLayerForFindOverlay:]):
* Tools/TestWebKitAPI/Tests/WebKitCocoa/SiteIsolation.mm:
(TestWebKitAPI::(SiteIsolation, FindStringInFrameAndReplaceIOS)):
(TestWebKitAPI::(SiteIsolation, DecorateFoundTextRangeIOS)):
(TestWebKitAPI::(SiteIsolation, ScrollTextRangeToVisibleIOS)):
(TestWebKitAPI::(SiteIsolation, ClearAllDecoratedFoundTextIOS)):
(TestWebKitAPI::(SiteIsolation, RequestRectForFoundTextRangeIOS)):

Canonical link: https://commits.webkit.org/303851@main
…utes instead of sending across an opaque NSDictionary

https://bugs.webkit.org/show_bug.cgi?id=301693
rdar://163710069

Reviewed by Alex Christensen.

Replaces FontPlatformDataAttributes attributes dictionary with the
existing FontPlatformSerializedAttributes.

* Source/WebCore/platform/graphics/FontPlatformData.h:
* Source/WebCore/platform/graphics/coretext/FontPlatformDataCoreText.cpp:
(WebCore::FontPlatformDataAttributes::serializableAttributes const):
(WebCore::FontPlatformDataAttributes::FontPlatformDataAttributes):
* Source/WebKit/Scripts/webkit/opaque_ipc_types.tracking.in:
* Source/WebKit/Shared/WebCoreFont.serialization.in:

Canonical link: https://commits.webkit.org/303852@main
https://bugs.webkit.org/show_bug.cgi?id=303487
rdar://165771567

Reviewed by Dan Hecht.

Temporarily disabling this feature due to stability concerns while
we continue development.

Canonical link: https://commits.webkit.org/303853@main
…anes orientation switch"

https://bugs.webkit.org/show_bug.cgi?id=303424
rdar://problem/165722322

Reviewed by Elika Etemad.

The upstream WPT change adds grid-auto-flow in places that are missing.

Upstream commit: web-platform-tests/wpt@e2ce61e

* LayoutTests/TestExpectations:
* LayoutTests/imported/w3c/web-platform-tests/css/css-grid/grid-lanes/tentative/grid-placement/row-explicit-placement-001.html:
* LayoutTests/imported/w3c/web-platform-tests/css/css-grid/grid-lanes/tentative/grid-placement/row-explicit-placement-002.html:
* LayoutTests/imported/w3c/web-platform-tests/css/css-grid/grid-lanes/tentative/grid-placement/row-explicit-placement-003.html:
* LayoutTests/imported/w3c/web-platform-tests/css/css-grid/grid-lanes/tentative/grid-placement/row-explicit-placement-004.html:
* LayoutTests/imported/w3c/web-platform-tests/css/css-grid/grid-lanes/tentative/grid-placement/row-explicit-placement-005.html:
* LayoutTests/imported/w3c/web-platform-tests/css/css-grid/grid-lanes/tentative/grid-placement/row-explicit-placement-006.html:
* LayoutTests/imported/w3c/web-platform-tests/css/css-grid/grid-lanes/tentative/grid-placement/row-explicit-placement-007.html:
* LayoutTests/imported/w3c/web-platform-tests/css/css-grid/grid-lanes/tentative/item-placement/row-negative-margin-001.html:

Canonical link: https://commits.webkit.org/303854@main
https://bugs.webkit.org/show_bug.cgi?id=303492
rdar://165780580

Reverting 303842@main

Reverted change:

    [iOS26]: 12x fast/viewport/ios tests are constant text failures
    rdar://165712922
    https://bugs.webkit.org/show_bug.cgi?id=303410
    303842@main (a415a5d)

Canonical link: https://commits.webkit.org/303855@main
https://bugs.webkit.org/show_bug.cgi?id=303245

Reviewed by Yusuke Suzuki.

Implement basic support for PlainYearMonth, without its methods.

Test: JSTests/stress/temporal-plainyearmonth.js
* JSTests/stress/temporal-plainyearmonth.js: Added.
(shouldBe):
(shouldThrow):
(const.yearMonth.new.Temporal.PlainYearMonth):
* JSTests/test262/config.yaml:
* JSTests/test262/expectations.yaml:
* Source/JavaScriptCore/CMakeLists.txt:
* Source/JavaScriptCore/DerivedSources-input.xcfilelist:
* Source/JavaScriptCore/DerivedSources-output.xcfilelist:
* Source/JavaScriptCore/DerivedSources.make:
* Source/JavaScriptCore/Sources.txt:
* Source/JavaScriptCore/runtime/ISO8601.h:
* Source/JavaScriptCore/runtime/JSGlobalObject.cpp:
(JSC::JSGlobalObject::init):
(JSC::JSGlobalObject::visitChildrenImpl):
* Source/JavaScriptCore/runtime/JSGlobalObject.h:
(JSC::JSGlobalObject::plainYearMonthStructure):
* Source/JavaScriptCore/runtime/TemporalCalendar.cpp:
(JSC::TemporalCalendar::isoDateFromFields):
(JSC::TemporalCalendar::isoDateAdd):
(JSC::TemporalCalendar::calendarDateUntil):
* Source/JavaScriptCore/runtime/TemporalObject.cpp:
(JSC::createPlainYearMonthConstructor):
* Source/JavaScriptCore/runtime/TemporalPlainYearMonth.cpp: Added.
(JSC::TemporalPlainYearMonth::create):
(JSC::TemporalPlainYearMonth::createStructure):
(JSC::TemporalPlainYearMonth::TemporalPlainYearMonth):
(JSC::TemporalPlainYearMonth::finishCreation):
(JSC::TemporalPlainYearMonth::visitChildrenImpl):
(JSC::TemporalPlainYearMonth::tryCreateIfValid):
(JSC::TemporalPlainYearMonth::monthCode const):
* Source/JavaScriptCore/runtime/TemporalPlainYearMonth.h: Added.
* Source/JavaScriptCore/runtime/TemporalPlainYearMonthConstructor.cpp: Added.
(JSC::TemporalPlainYearMonthConstructor::create):
(JSC::TemporalPlainYearMonthConstructor::createStructure):
(JSC::TemporalPlainYearMonthConstructor::TemporalPlainYearMonthConstructor):
(JSC::TemporalPlainYearMonthConstructor::finishCreation):
(JSC::JSC_DEFINE_HOST_FUNCTION):
* Source/JavaScriptCore/runtime/TemporalPlainYearMonthConstructor.h: Added.
* Source/JavaScriptCore/runtime/TemporalPlainYearMonthPrototype.cpp: Added.
(JSC::TemporalPlainYearMonthPrototype::create):
(JSC::TemporalPlainYearMonthPrototype::createStructure):
(JSC::TemporalPlainYearMonthPrototype::TemporalPlainYearMonthPrototype):
(JSC::TemporalPlainYearMonthPrototype::finishCreation):
(JSC::JSC_DEFINE_CUSTOM_GETTER):
* Source/JavaScriptCore/runtime/TemporalPlainYearMonthPrototype.h: Added.

Canonical link: https://commits.webkit.org/303856@main
… parent

https://bugs.webkit.org/show_bug.cgi?id=303417
rdar://163028025

Reviewed by Sammy Gill.

When a frameset enters fullscreen while being a grid item of a parent with container-type: size, container query interleaving
(StyleTreeResolver.cpp:1382-1403) defers descendant style resolution, preventing StyleAdjuster from setting position:absolute on the top layer
element. This creates a broken invariant where isGridItem() returns true but containingBlock() returns RenderView (per top layer rules),
causing an invalid downcast from RenderView to RenderGrid in computeInlineDirectionMargins. The fix changes the downcast to dynamicDowncast,
returning nullptr when the containing block is RenderView and safely avoiding the crash. This is a defensive workaround; the deeper
architectural issue of container query interleaving blocking StyleAdjuster on top layer elements is tracked separately
in https://bugs.webkit.org/show_bug.cgi?id=303414#.

This specific test/crash requires several specific conditions. display: grid on the parent makes the frameset a grid item.
container-type: size triggers both the container query interleaving and the shouldApplySizeContainment() check that causes a second track sizing
pass in RenderGrid. content: test on the frameset makes it a RenderBlockFlow instead of a RenderFrameSet, allowing it to participate in grid layout.
And the fullscreen request triggers the layout that exposes the type confusion.

Test: fullscreen/fullscreen-grid-item-container-type-crash.html

* LayoutTests/TestExpectations:
* LayoutTests/fullscreen/fullscreen-grid-item-container-type-crash-expected.txt: Added.
* LayoutTests/fullscreen/fullscreen-grid-item-container-type-crash.html: Added.
* LayoutTests/platform/glib/TestExpectations:
* Source/WebCore/rendering/RenderBox.cpp:
(WebCore::RenderBox::computeInlineDirectionMargins const):

Canonical link: https://commits.webkit.org/303857@main
https://bugs.webkit.org/show_bug.cgi?id=271360
rdar://problem/125529396

Reviewed by Brent Fulgham.

This patch aligns WebKit with Gecko / Firefox, Blink / Chromium and
Web Specification [1]:

[1] https://drafts.csswg.org/css-highlight-api/#highlightregistry

This removes `constructor` since it is not in web specification.

Additionally, this patch addresses two issues with the HighlightRegistry
tampered prototype test:

1. Removes reliance on the non-standard HighlightRegistry constructor and
   instead uses CSS.highlights to access the standard HighlightRegistry
   instance.

2. Properly restores Map.prototype to its original state after the test
   completes. Since Map.prototype is frozen during the test, restoration is
   done by creating a new prototype object with the saved descriptors and
   replacing Map's prototype, rather than attempting to modify the frozen
   object directly.

NOTE: Both of above changes were suggested by Alexey Shvaika (original
test author).

* LayoutTests/highlight/highlight-interfaces-expected.txt:
* LayoutTests/highlight/highlight-interfaces.html:
* LayoutTests/imported/w3c/web-platform-tests/css/css-highlight-api/idlharness.window-expected.txt:
* Source/WebCore/Modules/highlight/HighlightRegistry.idl:
* LayoutTests/imported/w3c/web-platform-tests/css/css-highlight-api/HighlightRegistry-maplike-tampered-Map-prototype.html:
* LayoutTests/imported/w3c/web-platform-tests/css/css-highlight-api/HighlightRegistry-maplike-expected.txt:

Canonical link: https://commits.webkit.org/303858@main
https://bugs.webkit.org/show_bug.cgi?id=303486
rdar://165770860

Reviewed by Geoffrey Garen.

303784@main wasn't sufficient.  Something strange is going on,
and it's unclear why it doesn't happen on Tahoe.  Skip the tests
on debug until we investigate.

Test: Tools/TestWebKitAPI/Tests/WebKitCocoa/SiteIsolation.mm

* Source/WebKit/Platform/IPC/MessageReceiverMap.cpp:
(IPC::MessageReceiverMap::addMessageReceiver):
* Tools/TestWebKitAPI/Tests/WebKitCocoa/SiteIsolation.mm:

Canonical link: https://commits.webkit.org/303859@main
…pport

https://bugs.webkit.org/show_bug.cgi?id=303453
rdar://165741135

Reviewed by Tim Nguyen.

* LayoutTests/TestExpectations:
* Source/WTF/Scripts/Preferences/UnifiedWebPreferences.yaml:
* Source/WebKit/Shared/WebPreferencesDefaultValues.h:

Canonical link: https://commits.webkit.org/303860@main
…ive-outside-range-test.html` fails with "Threaded Scroll-driven Animations" enabled

https://bugs.webkit.org/show_bug.cgi?id=303407
rdar://165710235

Reviewed by Simon Fraser.

We need to clamp the scroll offset for scroll timelines such that the current time does not
account for rubber-banding.

Note that there is no test change in this patch since the flag is not yet enabled on bots. This
was caught in preparation of that running animation tests locally using
`--experimental-feature ThreadedScrollDrivenAnimationsEnabled=true`.

* Source/WebCore/page/scrolling/ScrollingTreeScrollingNode.cpp:
(WebCore::ScrollingTreeScrollingNode::clampedCurrentScrollOffset const):
* Source/WebCore/page/scrolling/ScrollingTreeScrollingNode.h:
* Source/WebKit/UIProcess/RemoteLayerTree/RemoteProgressBasedTimeline.cpp:
(WebKit::RemoteProgressBasedTimeline::updateCurrentTime):

Canonical link: https://commits.webkit.org/303861@main
…64301290)

https://bugs.webkit.org/show_bug.cgi?id=303488
rdar://165774936

Reviewed by Aditya Keerthi and Abrar Rahman Protyasha.

Fix the build after the changes in rdar://164301290; we avoid importing `<UIFoundation/NSTextTable.h>`
on Catalyst, since the header does not declare `NSTextBlock` when `TARGET_OS_MACCATALYST` is defined
(so we need to fall back on forward declarations).

* Source/WebCore/PAL/pal/spi/ios/UIKitSPI.h:
* Source/WebCore/editing/cocoa/AttributedString.mm:
(WebCore::extractParagraphStyle):
* Source/WebCore/editing/cocoa/NodeHTMLConverter.mm:
(HTMLConverter::_exitElement):

Canonical link: https://commits.webkit.org/303862@main
…k that message comes from process containing frame

rdar://165728342
https://bugs.webkit.org/show_bug.cgi?id=303437

Reviewed by Matt Woodrow.

WebPageProxy::{broadcastFrameTreeSyncData,broadcastAllFrameTreeSyncData}
contains a MESSAGE_CHECK that supposedly checks that the message is coming
from the process that owns the frame, according to the comment. But the
MESSAGE_CHECK itself actually checks if the process sending the message
is the main process. Fix the check to follow the comment.

* Source/WebKit/UIProcess/WebPageProxy.cpp:
(WebKit::WebPageProxy::broadcastFrameTreeSyncData):
(WebKit::WebPageProxy::broadcastAllFrameTreeSyncData):

Canonical link: https://commits.webkit.org/303863@main
https://bugs.webkit.org/show_bug.cgi?id=303449
rdar://165738264

Reviewed by Brent Fulgham.

Currently, we check the column and positioning style independently when
determining if we can take GFC. This is fine, but it seems like we will
want to check the start and end values together in certain scenarios as
we continue to relax these restrictions. For example, if we have an auto
column-start, we may only want to allow this if the column-end is an
explicit position or auto.

This patch refactors this code to better handle this dependency between
the start and end positioning properties. This is done by:

1.) Switching on the start (e.g. grid-column-start) property
2.) If we have a valid start, then calling a helper function to check
the corresponding end property based upon the type of start.

For example, now if we have an explicit grid-column-start and we meet
all other criteria, we will check the column-end by calling
hasValidColumnEnd. Currently, we have a hasValidColumnEnd/hasValidRowEnd
that takes in a Style::GridPositionExplicit, but as we continue to allow
more types of content, we can create more overloads of these functions to
check the column/row end corresponding to a specific type of start.

Canonical link: https://commits.webkit.org/303864@main
rdar://165607857
https://bugs.webkit.org/show_bug.cgi?id=303306

Reviewed by Chris Dumez.

We finalize the support of end of iteration by having ReadableStream::Iterator implement a isFinished getter.
This is usd by JSDOMAsyncIteratorBase to identify when the next promise resolves whether the iteration is done.
We then mark the IsFinish object as finished according ReadableStream::Iterator isFinished getter.
This is done in getNextIterationResult.

We also add a way to iterate asynchronously via DOMPromise:
- ReadableStream::Iterator::next returns a Ref<DOMPromise>
- JSDOMAsyncIteratorBase::getNextIterationResult will return the promise.
This allows ReadableStream::Iterator to forward any error that may be given to it.

We use IsAsyncIteratorNextReturningPromise concept to detect whether ReadableStream::Iterator::next is using the new code path.
We keep the old code path and plan to rework it in a follow-up.

All ReadableStream async iterator tests are now passing.

Covered by existing tests.

Canonical link: https://commits.webkit.org/303865@main
…YearMonth

https://bugs.webkit.org/show_bug.cgi?id=303413

Reviewed by Darin Adler.

Implement these methods.

Co-authored-by: Darin Adler <[email protected]>

* JSTests/stress/temporal-plainyearmonth.js:
(shouldThrow):
* JSTests/test262/config.yaml:
* JSTests/test262/expectations.yaml:
* Source/JavaScriptCore/runtime/ISO8601.cpp:
(JSC::ISO8601::temporalYearMonthToString):
* Source/JavaScriptCore/runtime/ISO8601.h:
* Source/JavaScriptCore/runtime/TemporalPlainYearMonth.cpp:
(JSC::TemporalPlainYearMonth::toString const):
* Source/JavaScriptCore/runtime/TemporalPlainYearMonth.h:
* Source/JavaScriptCore/runtime/TemporalPlainYearMonthPrototype.cpp:
(JSC::JSC_DEFINE_HOST_FUNCTION):

Canonical link: https://commits.webkit.org/303866@main
…g to start

https://bugs.webkit.org/show_bug.cgi?id=283546

Reviewed by Adrian Perez de Castro.

Third time is the charm! We have previously landed two failed attempts
to fix frequent crashing in WebPageProxy::sendWheelEvent. Turns out
Lauro Moura had already debugged this and proposed a fix, which had
never landed. An AuxiliaryProcessProxy does not initially have a valid
IPC::Connection; instead it stores IPC messages into a queue, to be
processed and sent when the auxiliary process has finished launching. We
simply need to use that functionality instead of trying to access the
connection manually.

This commit is a rebased version of Lauro's work, except I use
WebPageProxy::sendToProcessContainingFrame to avoid breaking site
isolation, and have also changed
WebPageProxy::sendWheelEventScrollingAccelerationCurveIfNecessary, which
has the same bug. Finally, I also revert the unnecessary changes that I
previously landed in 302030@main.

Canonical link: https://commits.webkit.org/303867@main
rdar://165741968
https://bugs.webkit.org/show_bug.cgi?id=303455

Reviewed by Eric Carlson.

The -legibleMenuController:didRequestCaptionPreviewForProfileID: delegate callback was not being
called on macOS because we reset the NSMenu's delegate to ourselves after creation; this overrides
AVKit's own delegate, and subsequently, their own delegate methods were not called when menu items
are hovered.

Take this opportunity to refactor the base classes of WKCaptionStyleMenuController so that behavior
when hovering can be shared between the base class and the AVKit subclass. And add support for
additional delegate callbacks like -_WKCaptionStyleMenuControllerInternal.

* Source/WebKit/UIProcess/Cocoa/_WKCaptionStyleMenuControllerInternal.h:
* Source/WebKit/UIProcess/ios/_WKCaptionStyleMenuControllerAVKit.mm:
(-[_WKCaptionStyleMenuControllerAVKit legibleMenuController:didRequestCaptionPreviewForProfileID:]):
(-[_WKCaptionStyleMenuControllerAVKit legibleMenuControllerDidRequestStoppingSubtitleCaptionPreview:]):
(-[_WKCaptionStyleMenuControllerAVKit findAndDismissContextMenus]): Deleted.
(-[_WKCaptionStyleMenuControllerAVKit searchForContextMenuInteractionsInView:]): Deleted.
* Source/WebKit/UIProcess/ios/_WKCaptionStyleMenuControllerIOS.mm:
(+[WKCaptionStyleMenuController menuController]):
(-[WKCaptionStyleMenuController setPreviewProfileID:]):
* Source/WebKit/UIProcess/mac/_WKCaptionStyleMenuControllerAVKitMac.mm:
(-[_WKCaptionStyleMenuControllerAVKitMac rebuildMenu]):
(-[_WKCaptionStyleMenuControllerAVKitMac legibleMenuController:didRequestCaptionPreviewForProfileID:]):
(-[_WKCaptionStyleMenuControllerAVKitMac legibleMenuControllerDidRequestStoppingSubtitleCaptionPreview:]):
(-[_WKCaptionStyleMenuControllerAVKitMac findAndDismissPopoverMenus]): Deleted.
(-[_WKCaptionStyleMenuControllerAVKitMac searchForMenuInteractionsInWindow:]): Deleted.
* Source/WebKit/UIProcess/mac/_WKCaptionStyleMenuControllerMac.mm:
(-[WKCaptionStyleMenuController profileMenuItemHighlighted:]):
(-[WKCaptionStyleMenuController setPreviewProfileID:]):

Canonical link: https://commits.webkit.org/303868@main
… if they should be disallowed (fast/images/page-wide-animation-toggle.html is timing out after 302278@main).

https://bugs.webkit.org/show_bug.cgi?id=301655
rdar://163668078

Unreviewed test gardening

* LayoutTests/platform/mac-wk2/TestExpectations:

Canonical link: https://commits.webkit.org/303869@main
…irectiveGeneration.VerifyFragmentRanges is a flaky timeout

rdar://165630504

Unreviewed test gardening.

* Tools/Scripts/webkitpy/api_tests/allowlist.txt:

Canonical link: https://commits.webkit.org/303870@main
@github-actions
Copy link

github-actions bot commented Dec 9, 2025

🔄 Preview build started

Release tag: autobuild-preview-pr-118-11651087
Workflow: View progress

@github-actions
Copy link

github-actions bot commented Dec 9, 2025

✅ Preview build completed

Release: autobuild-preview-pr-118-11651087

@sosukesuzuki
Copy link
Member Author

/build-preview

@github-actions
Copy link

github-actions bot commented Dec 9, 2025

🔄 Preview build started

Release tag: autobuild-preview-pr-118-3cb865b0
Workflow: View progress

@github-actions
Copy link

github-actions bot commented Dec 9, 2025

✅ Preview build completed

Release: autobuild-preview-pr-118-3cb865b0

@sosukesuzuki
Copy link
Member Author

/build-preview

@github-actions
Copy link

github-actions bot commented Dec 9, 2025

🔄 Preview build started

Release tag: autobuild-preview-pr-118-6ebc1d6e
Workflow: View progress

@github-actions
Copy link

github-actions bot commented Dec 9, 2025

✅ Preview build completed

Release: autobuild-preview-pr-118-6ebc1d6e

@sosukesuzuki
Copy link
Member Author

/build-preview

@github-actions
Copy link

🔄 Preview build started

Release tag: autobuild-preview-pr-118-93c3b800
Workflow: View progress

@github-actions
Copy link

✅ Preview build completed

Release: autobuild-preview-pr-118-93c3b800

@sosukesuzuki
Copy link
Member Author

/build-preview

@github-actions
Copy link

🔄 Preview build started

Release tag: autobuild-preview-pr-118-15810d00
Workflow: View progress

@github-actions
Copy link

✅ Preview build completed

Release: autobuild-preview-pr-118-15810d00

@sosukesuzuki
Copy link
Member Author

/build-preview

@github-actions
Copy link

🔄 Preview build started

Release tag: autobuild-preview-pr-118-578fb0ce
Workflow: View progress

@github-actions
Copy link

❌ Preview build failed

Check the workflow run for details.

@github-actions
Copy link

✅ Preview build completed

Release: autobuild-preview-pr-118-578fb0ce

@sosukesuzuki
Copy link
Member Author

/build-preview

@github-actions
Copy link

🔄 Preview build started

Release tag: autobuild-preview-pr-118-740bfcf2
Workflow: View progress

@github-actions
Copy link

✅ Preview build completed

Release: autobuild-preview-pr-118-740bfcf2

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.