Branch: refs/heads/webkitglib/2.52
Home: https://github.com/WebKit/WebKit
Commit: 605a2257bdee33195d47f23a61eefb610118f519
https://github.com/WebKit/WebKit/commit/605a2257bdee33195d47f23a61eefb610118f519
Author: Youenn Fablet <[email protected]>
Date: 2026-08-10 (Mon, 10 Aug 2026)
Changed paths:
M
Source/ThirdParty/libwebrtc/Source/third_party/libvpx/source/libvpx/test/encode_api_test.cc
M
Source/ThirdParty/libwebrtc/Source/third_party/libvpx/source/libvpx/vpx/src/vpx_encoder.c
Log Message:
-----------
Cherry-pick [email protected] (5256fb491a2b).
https://bugs.webkit.org/show_bug.cgi?id=316410
Potential 'out-of-bounds' issue committed to upstream libwebrtc
rdar://177498569
Reviewed by Jean-Yves Avenard.
Cherry-pick of
https://github.com/webmproject/libvpx/commit/63aad2761655ab788be64966ad462c98e2bce327.
* test/encode_api_test.cc:
* vpx/src/vpx_encoder.c:
(vpx_codec_encode):
Identifier: [email protected]
Canonical link: https://commits.webkit.org/305877.1084@webkitglib/2.52
Commit: e4dda9dc223c446ce50432f17b9b117fa46e3281
https://github.com/WebKit/WebKit/commit/e4dda9dc223c446ce50432f17b9b117fa46e3281
Author: Ryosuke Niwa <[email protected]>
Date: 2026-08-10 (Mon, 10 Aug 2026)
Changed paths:
M Source/WebCore/Modules/mediasource/SourceBuffer.cpp
M Source/WebCore/Modules/mediasource/SourceBuffer.h
M Source/WebCore/Sources.txt
M Source/WebCore/WebCore.xcodeproj/project.pbxproj
A Source/WebCore/bindings/js/JSHTMLMediaElementCustom.cpp
M Source/WebCore/html/HTMLMediaElement.cpp
M Source/WebCore/html/HTMLMediaElement.h
M Source/WebCore/html/HTMLMediaElement.idl
M Source/WebCore/html/track/TextTrackList.cpp
M Source/WebCore/html/track/TextTrackList.h
M Source/WebCore/html/track/TrackBase.cpp
M Source/WebCore/html/track/TrackBase.h
M Source/WebCore/html/track/TrackListBase.cpp
M Source/WebCore/html/track/TrackListBase.h
A Source/WebCore/html/track/TrackOpaqueRoot.h
Log Message:
-----------
Cherry-pick [email protected] (3cbf2f5adfe0).
https://bugs.webkit.org/show_bug.cgi?id=311800
Data race in TrackBase::opaqueRoot during GC leading to use-after-free
https://bugs.webkit.org/show_bug.cgi?id=311800
rdar://176058579
Reviewed by Geoffrey Garen.
To fix the data race, we introduce SourceBuffer and HTMLMediaElement as
opaque roots for Track* classes
and *TrackList classes instead of using the root node of HTMLMediaElement
which can change over time.
We introduce TrackOpaqueRoot, which is a thin ThreadSafeRefCounted wrapper
around WebCoreOpaqueRoot,
and initialize it with WebCoreOpaqueRoot pointing to SourceBuffer or
HTMLMediaElement.
Each Track and TrackList class will have RefPtr<TrackOpaqueRoot> and reads
the opaque root directly
from a GC thread without relying on any pointer indirections.
No new tests since there is no reliable way to test this data race.
* Source/WebCore/Modules/mediasource/SourceBuffer.cpp:
(WebCore::SourceBuffer::SourceBuffer):
(WebCore::SourceBuffer::~SourceBuffer):
(WebCore::SourceBuffer::videoTracks):
(WebCore::SourceBuffer::audioTracks):
(WebCore::SourceBuffer::textTracks):
(WebCore::m_logIdentifier): Deleted.
* Source/WebCore/Modules/mediasource/SourceBuffer.h:
* Source/WebCore/Sources.txt:
* Source/WebCore/WebCore.xcodeproj/project.pbxproj:
* Source/WebCore/bindings/js/JSHTMLMediaElementCustom.cpp: Added.
(WebCore::JSHTMLMediaElement::visitAdditionalChildren):
* Source/WebCore/html/HTMLMediaElement.cpp:
(WebCore::m_trackOpaqueRoot):
(WebCore::HTMLMediaElement::~HTMLMediaElement):
(WebCore::HTMLMediaElement::ensureAudioTracks):
(WebCore::HTMLMediaElement::ensureTextTracks):
(WebCore::HTMLMediaElement::ensureVideoTracks):
(WebCore::m_opaqueRootProvider): Deleted.
* Source/WebCore/html/HTMLMediaElement.h:
(WebCore::HTMLMediaElement::trackOpaqueRoot):
* Source/WebCore/html/HTMLMediaElement.idl:
* Source/WebCore/html/track/TextTrackList.cpp:
(WebCore::TextTrackList::setOpaqueRoot):
* Source/WebCore/html/track/TextTrackList.h:
* Source/WebCore/html/track/TrackBase.cpp:
(WebCore::TrackBase::setOpaqueRoot):
(WebCore::TrackBase::opaqueRoot):
(WebCore::TrackBase::setTrackList):
(WebCore::TrackBase::clearTrackList):
* Source/WebCore/html/track/TrackBase.h:
* Source/WebCore/html/track/TrackListBase.cpp:
(WebCore::TrackListBase::setOpaqueRoot):
(WebCore::TrackListBase::opaqueRoot):
* Source/WebCore/html/track/TrackListBase.h:
(WebCore::TrackListBase::trackOpaqueRoot):
(WebCore::TrackListBase::setOpaqueRootObserver): Deleted.
* Source/WebCore/html/track/TrackOpaqueRoot.h: Added.
(WebCore::TrackOpaqueRoot::create):
(WebCore::TrackOpaqueRoot::opaqueRoot const):
(WebCore::TrackOpaqueRoot::clear):
(WebCore::TrackOpaqueRoot::TrackOpaqueRoot):
Identifier: [email protected]
Canonical link: https://commits.webkit.org/305877.1085@webkitglib/2.52
Commit: 786415d2064a36aea7a26677990e0949cac5245e
https://github.com/WebKit/WebKit/commit/786415d2064a36aea7a26677990e0949cac5245e
Author: Simon Fraser <[email protected]>
Date: 2026-08-10 (Mon, 10 Aug 2026)
Changed paths:
M Source/WebCore/page/LargestContentfulPaintData.cpp
Log Message:
-----------
Cherry-pick 315022@main (52cacff4c9e7).
https://bugs.webkit.org/show_bug.cgi?id=316827
Unreviewed backport.
LCP `renderTime` should have 4ms granularity
https://bugs.webkit.org/show_bug.cgi?id=316827
rdar://173015796
Reviewed by Matthew Finkel.
Follow Blink in coarsening `renderTime` for images in LCP to 4ms:
https://chromestatus.com/feature/5128261284397056
https://docs.google.com/document/d/1VxgMf1wlWzB4ViAW4ohkOe3AT0wQZKk7hC3IVq-cuw0/
A future change will adopt ReducedResolutionSeconds here
(webkit.org/b/316824).
* Source/WebCore/page/LargestContentfulPaintData.cpp:
(WebCore::LargestContentfulPaintData::potentiallyAddLargestContentfulPaintEntry):
Canonical link: https://commits.webkit.org/315022@main
Canonical link: https://commits.webkit.org/305877.1086@webkitglib/2.52
Compare: https://github.com/WebKit/WebKit/compare/8dc28fa584c1...786415d2064a
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
