Branch: refs/heads/webkitglib/2.52
Home: https://github.com/WebKit/WebKit
Commit: d61bb2d07d18a8d4e7480b2b191d60312ee93adf
https://github.com/WebKit/WebKit/commit/d61bb2d07d18a8d4e7480b2b191d60312ee93adf
Author: Dana Estra <[email protected]>
Date: 2026-04-07 (Tue, 07 Apr 2026)
Changed paths:
M Source/WebCore/platform/SharedBuffer.cpp
Log Message:
-----------
Cherry-pick 310642@main (1c2cca8ce869).
https://bugs.webkit.org/show_bug.cgi?id=311351
StabilityTracer: com.apple.WebKit.WebContent at WebCore:
WebCore::SharedMemory::createSendRight
https://bugs.webkit.org/show_bug.cgi?id=311351
rdar://172419434
Reviewed by Jer Noble.
Null-check the refptr returned by SharedMemory::copyBuffer inside the caller
FragmentedSharedBuffer::toIPCData(). In the case that the refptr is null,
fall
back on the segment span copy path.
No new tests.
* Source/WebCore/platform/SharedBuffer.cpp:
(WebCore::FragmentedSharedBuffer::toIPCData const):
Canonical link: https://commits.webkit.org/310642@main
Canonical link: https://commits.webkit.org/305877.365@webkitglib/2.52
Commit: c93a81499da735a729163e75378cfe95d82c0443
https://github.com/WebKit/WebKit/commit/c93a81499da735a729163e75378cfe95d82c0443
Author: Sosuke Suzuki <[email protected]>
Date: 2026-04-07 (Tue, 07 Apr 2026)
Changed paths:
A JSTests/stress/dfg-arith-mul-bitand-negative-mask-unchecked.js
M Source/JavaScriptCore/dfg/DFGBackwardsPropagationPhase.cpp
Log Message:
-----------
Cherry-pick 310678@main (83895848013f).
https://bugs.webkit.org/show_bug.cgi?id=311505
[JSC] `isWithinPowerOfTwo` is unsound for BitAnd with negative mask in DFG
BackwardsPropagation
https://bugs.webkit.org/show_bug.cgi?id=311505
Reviewed by Justin Michaud.
isWithinPowerOfTwo<power>() returned true for `x & c` whenever |c| <
2^power,
but this bound only holds when c is non-negative. A negative mask preserves
the sign bit, so `x & -4` can span the full int32 range. This caused
ArithMul
to drop NodeBytecodeUsesAsNumber and become Arith::Unchecked, producing the
low 32 bits of the exact product instead of the spec-mandated double-rounded
result.
function f(a, b) { return ((a & -4) * b) | 0; }
f(0x7ffffffc, 0x7ffffffc) // LLInt: 0, DFG/FTL: 16
Fix by requiring the BitAnd constant operand to be non-negative. Also remove
isWithinPowerOfTwoNonRecursive() which is now unused.
Test: JSTests/stress/dfg-arith-mul-bitand-negative-mask-unchecked.js
* JSTests/stress/dfg-arith-mul-bitand-negative-mask-unchecked.js: Added.
(testMaskRight):
(testMaskLeft):
(testMaskRightSwappedMul):
* Source/JavaScriptCore/dfg/DFGBackwardsPropagationPhase.cpp:
(JSC::DFG::BackwardsPropagationPhase::isWithinPowerOfTwo):
(JSC::DFG::BackwardsPropagationPhase::isWithinPowerOfTwoNonRecursive):
Deleted.
Canonical link: https://commits.webkit.org/310678@main
Canonical link: https://commits.webkit.org/305877.366@webkitglib/2.52
Commit: d0ee93c557f34def1af9f15dc23297920fbf7070
https://github.com/WebKit/WebKit/commit/d0ee93c557f34def1af9f15dc23297920fbf7070
Author: Ahmad Saleem <[email protected]>
Date: 2026-04-07 (Tue, 07 Apr 2026)
Changed paths:
A
LayoutTests/imported/w3c/web-platform-tests/css/css-variables/variable-reference-perspective-origin-expected.txt
A
LayoutTests/imported/w3c/web-platform-tests/css/css-variables/variable-reference-perspective-origin.html
M Source/WebCore/css/parser/CSSPropertyParserCustom.h
Log Message:
-----------
Cherry-pick 310650@main (cb1338276a4d).
https://bugs.webkit.org/show_bug.cgi?id=276121
perspective-origin fails to resolve var() when used as the second value
https://bugs.webkit.org/show_bug.cgi?id=276121
rdar://131288246
Reviewed by Sam Weinig.
This patch aligns WebKit with Gecko / Firefox and Blink / Chromium.
When parsing `perspective-origin: 50% var(--y)`, consumePositionUnresolved()
successfully parses `50%` as the first component but fails to parse `var()`
as the second. It then falls back to the one-component interpretation,
returning `{50%, center}` and leaving the var() token unconsumed.
consumePerspectiveOriginShorthand() returns true, preventing the
substitution
function fallback in consumeStyleProperty() from ever being reached.
Fix by adding a range.atEnd() check in consumePerspectiveOriginShorthand(),
matching the pattern already used by consumeTransformOriginShorthand().
* Source/WebCore/css/parser/CSSPropertyParserCustom.h:
(WebCore::CSS::PropertyParserCustom::consumePerspectiveOriginShorthand):
*
LayoutTests/imported/w3c/web-platform-tests/css/css-variables/variable-reference-perspective-origin-expected.txt:
Added.
*
LayoutTests/imported/w3c/web-platform-tests/css/css-variables/variable-reference-perspective-origin.html:
Added.
Canonical link: https://commits.webkit.org/310650@main
Canonical link: https://commits.webkit.org/305877.367@webkitglib/2.52
Commit: 9f00ea4b465a61f67bf03bff717418467c44267b
https://github.com/WebKit/WebKit/commit/9f00ea4b465a61f67bf03bff717418467c44267b
Author: Philippe Normand <[email protected]>
Date: 2026-04-07 (Tue, 07 Apr 2026)
Changed paths:
M Source/cmake/GStreamerChecks.cmake
Log Message:
-----------
Cherry-pick 310640@main (c86a02c8c367).
https://bugs.webkit.org/show_bug.cgi?id=311555
[GStreamer][CMake] Remove un-needed check for GstTranscoder library
https://bugs.webkit.org/show_bug.cgi?id=311555
Reviewed by Claudio Saavedra.
Not needed anymore since 297593@main.
* Source/cmake/GStreamerChecks.cmake:
Canonical link: https://commits.webkit.org/310640@main
Canonical link: https://commits.webkit.org/305877.368@webkitglib/2.52
Compare: https://github.com/WebKit/WebKit/compare/ccea61e32355...9f00ea4b465a
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
