Branch: refs/heads/webkitglib/2.52
Home: https://github.com/WebKit/WebKit
Commit: 8ec5acbed8a1df8058166f454e0bb17b8b3ba68e
https://github.com/WebKit/WebKit/commit/8ec5acbed8a1df8058166f454e0bb17b8b3ba68e
Author: Joshua Hoffman <[email protected]>
Date: 2026-03-17 (Tue, 17 Mar 2026)
Changed paths:
M Source/WebCore/accessibility/AccessibilityRenderObject.cpp
Log Message:
-----------
Cherry-pick 309380@main (e58d0a50ec35).
https://bugs.webkit.org/show_bug.cgi?id=310062
AX: Missing null-check in AccessibilityRenderObject::boundingBoxRect
https://bugs.webkit.org/show_bug.cgi?id=310062
rdar://172703088
Reviewed by Abrar Rahman Protyasha.
We change renderer after it has been null-checked, but do not check it
again. This can cause a crash when we unconditionally dereference it
later.
* Source/WebCore/accessibility/AccessibilityRenderObject.cpp:
(WebCore::AccessibilityRenderObject::boundingBoxRect const):
Canonical link: https://commits.webkit.org/309380@main
Canonical link: https://commits.webkit.org/305877.211@webkitglib/2.52
Commit: 603b8e373f5a83385a444eed2c761641236eeef7
https://github.com/WebKit/WebKit/commit/603b8e373f5a83385a444eed2c761641236eeef7
Author: Yijia Huang <[email protected]>
Date: 2026-03-17 (Tue, 17 Mar 2026)
Changed paths:
A JSTests/stress/ftl-osr-exit-stack-overflow-phantom-array.js
M Source/JavaScriptCore/ftl/FTLOperations.cpp
Log Message:
-----------
Cherry-pick 309377@main (0dbabc018f3f).
https://bugs.webkit.org/show_bug.cgi?id=309232
[JSC] Crash when PhantomNewArrayWithButterfly handles exception
https://bugs.webkit.org/show_bug.cgi?id=309232
rdar://172350200
Reviewed by Yusuke Suzuki.
When a stack overflow is caught by try/catch inside an FTL-compiled
function,
the GenericUnwind OSR exit stub runs operationPopulateObjectInOSR to
materialize
phantom array allocations before transferring control to the catch handler.
At this point vm.exception() is already set to the StackOverflow exception,
causing
assertNoExceptionExceptTermination() after putDirectIndex to falsely fire
on the
pre-existing exception rather than a new one from putDirectIndex itself.
Fix by adding SuspendExceptionScope before the putDirectIndex loop in the
PhantomNewArrayWithButterfly case. This temporarily nullifies
vm.exception() so
the assertion correctly guards only new exceptions, then restores it on
scope exit
so the catch handler can consume the original exception.
Test: JSTests/stress/ftl-osr-exit-stack-overflow-phantom-array.js
Canonical link: https://commits.webkit.org/309377@main
Canonical link: https://commits.webkit.org/305877.212@webkitglib/2.52
Commit: 2860b1b3b3edb8b3b0a529e6488bad73ee80cfb0
https://github.com/WebKit/WebKit/commit/2860b1b3b3edb8b3b0a529e6488bad73ee80cfb0
Author: Lily Spiniolas <[email protected]>
Date: 2026-03-17 (Tue, 17 Mar 2026)
Changed paths:
A LayoutTests/fast/forms/number/number-l10n-input-visible-text-expected.txt
A LayoutTests/fast/forms/number/number-l10n-input-visible-text.html
M Source/WebCore/html/NumberInputType.cpp
M Source/WebCore/platform/text/PlatformLocale.cpp
M Source/WebCore/platform/text/PlatformLocale.h
Log Message:
-----------
Cherry-pick 309366@main (84c604759752).
https://bugs.webkit.org/show_bug.cgi?id=309725
REGRESSION (298613@main): Number inputs fail to display localized numbers
https://bugs.webkit.org/show_bug.cgi?id=309725
rdar://172112320
Reviewed by Wenson Hsieh, Aditya Keerthi, and Abrar Rahman Protyasha.
Before 298613@main, any text could be entered inside number inputs. If it
was a valid number, we would convert it according to the user's locale
into a standardized number format specified by the HTML spec.
Starting in 298613@main, characters can only be entered into number inputs
if they would not cause the value to become invalid. If the user's number
format uses commas instead of decimals as the decimal separator, and the
user types a number with a comma such as "1,2", we would correctly update
the value of the input to "1.2", but we would also display "1.2" instead of
displaying the localized number.
Now, if the user's locale indicates a non-period decimal separator, we allow
either the localized separator or a period to be entered AND displayed as
the
separator (since using a period may still be desirable in certain contexts
such as mathematics).
In the presence of two potential separators, we use whatever comes last
since
the first separators may indicate group separators rather than decimal
separators.
Test: fast/forms/number/number-l10n-input-visible-text.html
*
LayoutTests/fast/forms/number/number-l10n-input-visible-text-expected.txt:
Added.
* LayoutTests/fast/forms/number/number-l10n-input-visible-text.html: Added.
* Source/WebCore/html/NumberInputType.cpp:
(WebCore::NumberInputType::handleBeforeTextInsertedEvent):
* Source/WebCore/platform/text/PlatformLocale.cpp:
(WebCore::Locale::localizeNumberCharacters):
* Source/WebCore/platform/text/PlatformLocale.h:
Canonical link: https://commits.webkit.org/309366@main
Canonical link: https://commits.webkit.org/305877.213@webkitglib/2.52
Commit: a5c1d0f61624f588a8b0be9871d65368a2f7be4d
https://github.com/WebKit/WebKit/commit/a5c1d0f61624f588a8b0be9871d65368a2f7be4d
Author: Philippe Normand <[email protected]>
Date: 2026-03-17 (Tue, 17 Mar 2026)
Changed paths:
M Source/WebCore/Modules/mediastream/gstreamer/GStreamerIceAgent.cpp
Log Message:
-----------
Cherry-pick 309311@main (1298b68972d9).
https://bugs.webkit.org/show_bug.cgi?id=306098
[Rice] Build issues due to API break in version 0.3.0
https://bugs.webkit.org/show_bug.cgi?id=306098
<rdar://problem/169254926>
Reviewed by Xabier Rodriguez-Calvar.
Use UDP as allocation transport, this is a new parameter for
rice_turn_config_new() added in librice
0.3.0.
* Source/WebCore/Modules/mediastream/gstreamer/GStreamerIceAgent.cpp:
(webkitGstWebRTCIceAgentAddRiceTurnServer):
Canonical link: https://commits.webkit.org/309311@main
Canonical link: https://commits.webkit.org/305877.214@webkitglib/2.52
Commit: f2763de1f24ef68c0ef48dfe2ba3f4aa989bf2c4
https://github.com/WebKit/WebKit/commit/f2763de1f24ef68c0ef48dfe2ba3f4aa989bf2c4
Author: Simon Pena <[email protected]>
Date: 2026-03-17 (Tue, 17 Mar 2026)
Changed paths:
M Source/WebCore/platform/audio/glib/MediaSessionGLib.cpp
M Source/WebCore/platform/audio/glib/MediaSessionGLib.h
Log Message:
-----------
Cherry-pick 309395@main (1a109d5e2873).
https://bugs.webkit.org/show_bug.cgi?id=310033
[GLib] Stop retrying D-Bus connection for MPRIS after initial failure
https://bugs.webkit.org/show_bug.cgi?id=310033
Reviewed by Philippe Normand.
MPRIS session creation unconditionally attempts to connect to D-Bus,
even after previous attempts have failed. On devices where D-Bus is not
available or the right environment is not configured, this will continue
generating warnings. This keeps track of the failure and avoids
re-attempting.
Tested after unsetting the D-Bus session address.
* Source/WebCore/platform/audio/glib/MediaSessionGLib.cpp:
(WebCore::MediaSessionGLib::create):
* Source/WebCore/platform/audio/glib/MediaSessionGLib.h:
Canonical link: https://commits.webkit.org/309395@main
Canonical link: https://commits.webkit.org/305877.215@webkitglib/2.52
Compare: https://github.com/WebKit/WebKit/compare/9ae71a48e749...f2763de1f24e
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
