Branch: refs/heads/webkitglib/2.52
Home: https://github.com/WebKit/WebKit
Commit: e42c6e5dbcf8337db28f6a2e5791c8ae8ea41b33
https://github.com/WebKit/WebKit/commit/e42c6e5dbcf8337db28f6a2e5791c8ae8ea41b33
Author: Youenn Fablet <[email protected]>
Date: 2026-09-07 (Mon, 07 Sep 2026)
Changed paths:
M Source/WebCore/html/FileInputType.cpp
M Source/WebCore/page/Chrome.cpp
M Source/WebCore/page/Chrome.h
M Source/WebCore/page/ChromeClient.cpp
M Source/WebCore/page/ChromeClient.h
M Source/WebCore/platform/graphics/ImageUtilities.h
M Source/WebCore/platform/graphics/cg/ImageUtilitiesCG.cpp
M Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.cpp
M Source/WebKit/UIProcess/WebPageProxy.cpp
M Source/WebKit/UIProcess/WebPageProxy.h
M Source/WebKit/UIProcess/WebPageProxy.messages.in
M Source/WebKit/WebProcess/WebCoreSupport/WebChromeClient.cpp
M Source/WebKit/WebProcess/WebCoreSupport/WebChromeClient.h
Log Message:
-----------
Cherry-pick [email protected] (1c3f0755c46a).
https://bugs.webkit.org/show_bug.cgi?id=317270
Incomplete replacementPath validation in
NetworkConnectionToWebProcess::registerInternalFileBlobURL
rdar://176890926
Reviewed by Chris Dumez.
We cannot easily validate that a sandbox extension is valid or related to a
specific file.
We thus stop validating the sandbox extension and only rely on the allowed
file path check.
This ensures that a web process can only create blobs from a file that the
UIProcess deemed appropriate (via direct UIProcess/NetworkProcess IPC).
Two code paths need to be updated to not break existing functionality:
1. Image transcoding for files dropped on <input type=file> was previoulsy
done in WebProcess.
We move this to UIProcess via ChromeClient::transcodeChosenFiles, with a
default implementation
that preserves the previous in-WebProcess behavior by dispatching to the
shared transcoding queue.
WebChromeClient is implementing out-of-process transcoding by asking
WebPageProxy via IPC to do the work.
WebPageProxy does this and makes sure to notify network process that the
transcoded files can be accessed.
2. WebPageProxy::didChooseFilesForOpenPanelWithImageTranscoding needs to
make sure to allow access of these files
from the network process. Once this is done, it notifies the WebProcess
of the result as before.
We do a small refactoring by factoring the queue dispatch + main-thread hop
into transcodeImagesInBackgroundQueue.
Call sites like the default ChromeClient implementation and
WebPageProxy::transcodeChosenFiles no longer manage cross-thread copies.
Manually tested.
* Source/WebCore/html/FileInputType.cpp:
(WebCore::FileInputType::receiveDroppedFilesWithImageTranscoding):
* Source/WebCore/page/Chrome.cpp:
(WebCore::Chrome::transcodeChosenFiles):
* Source/WebCore/page/Chrome.h:
* Source/WebCore/page/ChromeClient.cpp:
(WebCore::ChromeClient::transcodeChosenFiles):
* Source/WebCore/page/ChromeClient.h:
* Source/WebCore/platform/graphics/ImageUtilities.h:
* Source/WebCore/platform/graphics/cg/ImageUtilitiesCG.cpp:
(WebCore::transcodeImages):
(WebCore::transcodeImagesInBackgroundQueue):
* Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.cpp:
(WebKit::NetworkConnectionToWebProcess::registerInternalFileBlobURL):
* Source/WebKit/UIProcess/WebPageProxy.cpp:
(WebKit::WebPageProxy::didChooseFilesForOpenPanelWithImageTranscoding):
(WebKit::WebPageProxy::transcodeChosenFiles):
* Source/WebKit/UIProcess/WebPageProxy.h:
* Source/WebKit/UIProcess/WebPageProxy.messages.in:
* Source/WebKit/WebProcess/WebCoreSupport/WebChromeClient.cpp:
(WebKit::WebChromeClient::transcodeChosenFiles):
* Source/WebKit/WebProcess/WebCoreSupport/WebChromeClient.h:
Identifier: [email protected]
Canonical link: https://commits.webkit.org/305877.1149@webkitglib/2.52
Commit: 1fc4157004126e2ca466fda70ed03b87de81a1cd
https://github.com/WebKit/WebKit/commit/1fc4157004126e2ca466fda70ed03b87de81a1cd
Author: Yusuke Suzuki <[email protected]>
Date: 2026-09-07 (Mon, 07 Sep 2026)
Changed paths:
A JSTests/stress/object-create-check-insertion.js
M Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp
Log Message:
-----------
Cherry-pick [email protected] (ac9e40a7195b).
https://bugs.webkit.org/show_bug.cgi?id=317570
[JSC] ObjectCreate folding should emit checks
https://bugs.webkit.org/show_bug.cgi?id=317570
rdar://178248992
Reviewed by Yijia Huang.
When folding ObjectCreate(with-edge-checks), we are not emitting these
checks and converting it to NewObject. As a result, we missed the edge
filters and the subsequent code may rely on that. This patch correctly
inserts these checks.
Test: JSTests/stress/object-create-check-insertion.js
* JSTests/stress/object-create-check-insertion.js: Added.
(bitsToDouble):
(enforce):
(getKey):
(getK2):
(caller):
(trainGetKey):
(trainCaller):
(trainGetK2):
(ramp):
* Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp:
(JSC::DFG::ConstantFoldingPhase::foldConstants):
Identifier: [email protected]
Canonical link: https://commits.webkit.org/305877.1150@webkitglib/2.52
Commit: df44255ce578f6932e1f2d3fa2913317475aa268
https://github.com/WebKit/WebKit/commit/df44255ce578f6932e1f2d3fa2913317475aa268
Author: Dan Hecht <[email protected]>
Date: 2026-09-07 (Mon, 07 Sep 2026)
Changed paths:
A JSTests/wasm/gc/backwards-graph-multi-backedge-licm.js
M Source/JavaScriptCore/b3/B3Procedure.h
M Source/JavaScriptCore/b3/testb3.h
M Source/JavaScriptCore/b3/testb3_1.cpp
M Source/JavaScriptCore/b3/testb3_7.cpp
M Source/WTF/wtf/BackwardsGraph.h
Log Message:
-----------
Cherry-pick [email protected] (dec21f1baf1f).
https://bugs.webkit.org/show_bug.cgi?id=317603
[JSC] Fix BackwardsGraph for loops with multiple back-edge sources
https://bugs.webkit.org/show_bug.cgi?id=317603
rdar://178735697
Reviewed by Marcus Plutowski.
The addRootSuccessor lambda in WTF::BackwardsGraph used a single
GraphNodeWorklist both to decide synthetic-root membership and to drive
the predecessor-coverage flood. Depending on the order that back-edges
were processed, this would cause some back-edge sources to not be
included as backwards root successors.
B3::BackwardsDominators, built on the resulting incomplete reverse CFG, can
then report that a block post-dominates the loop pre-header even though a
potentially-infinite loop between them means the block may never execute.
B3HoistLoopInvariantValues uses post-dominators to conclude a
control-dependent
value always runs once the loop is entered, and hoists it into the
pre-header,
so the value can execute on paths where it should not.
Decouple the two roles: addRootSuccessor now records every distinct
back-edge
source and terminal in m_rootSuccessorSet unconditionally, and uses the
worklist only to bound the predecessor flood.
Tests: JSTests/wasm/gc/backwards-graph-multi-backedge-licm.js
Source/JavaScriptCore/b3/testb3_1.cpp
Source/JavaScriptCore/b3/testb3_7.cpp
* JSTests/wasm/gc/backwards-graph-multi-backedge-licm.js: Added.
(catch):
* Source/JavaScriptCore/b3/B3Procedure.h:
* Source/JavaScriptCore/b3/testb3.h:
* Source/JavaScriptCore/b3/testb3_1.cpp:
(run):
* Source/JavaScriptCore/b3/testb3_7.cpp:
(testBackwardsDominatorsWithMultipleBackEdges):
* Source/WTF/wtf/BackwardsGraph.h:
(WTF::BackwardsGraph::BackwardsGraph):
Identifier: [email protected]
Canonical link: https://commits.webkit.org/305877.1151@webkitglib/2.52
Compare: https://github.com/WebKit/WebKit/compare/08279e6ba1d6...df44255ce578
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
