Branch: refs/heads/webkitglib/2.54
Home: https://github.com/WebKit/WebKit
Commit: 74f81b88700bb398bacadf0b4c94e9cbde62b9c1
https://github.com/WebKit/WebKit/commit/74f81b88700bb398bacadf0b4c94e9cbde62b9c1
Author: Youenn Fablet <[email protected]>
Date: 2026-09-08 (Tue, 08 Sep 2026)
Changed paths:
M Source/WebCore/html/FileInputType.cpp
M Source/WebCore/page/Chrome.cpp
M Source/WebCore/page/Chrome.h
M Source/WebCore/page/ChromeClient.cpp
M Source/WebCore/page/ChromeClient.h
M Source/WebCore/platform/graphics/ImageUtilities.h
M Source/WebCore/platform/graphics/cg/ImageUtilitiesCG.cpp
M Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.cpp
M Source/WebKit/UIProcess/WebPageProxy.cpp
M Source/WebKit/UIProcess/WebPageProxy.h
M Source/WebKit/UIProcess/WebPageProxy.messages.in
M Source/WebKit/WebProcess/WebCoreSupport/WebChromeClient.cpp
M Source/WebKit/WebProcess/WebCoreSupport/WebChromeClient.h
Log Message:
-----------
Cherry-pick [email protected] (1c3f0755c46a).
https://bugs.webkit.org/show_bug.cgi?id=317270
Incomplete replacementPath validation in
NetworkConnectionToWebProcess::registerInternalFileBlobURL
rdar://176890926
Reviewed by Chris Dumez.
We cannot easily validate that a sandbox extension is valid or related to a
specific file.
We thus stop validating the sandbox extension and only rely on the allowed
file path check.
This ensures that a web process can only create blobs from a file that the
UIProcess deemed appropriate (via direct UIProcess/NetworkProcess IPC).
Two code paths need to be updated to not break existing functionality:
1. Image transcoding for files dropped on <input type=file> was previoulsy
done in WebProcess.
We move this to UIProcess via ChromeClient::transcodeChosenFiles, with a
default implementation
that preserves the previous in-WebProcess behavior by dispatching to the
shared transcoding queue.
WebChromeClient is implementing out-of-process transcoding by asking
WebPageProxy via IPC to do the work.
WebPageProxy does this and makes sure to notify network process that the
transcoded files can be accessed.
2. WebPageProxy::didChooseFilesForOpenPanelWithImageTranscoding needs to
make sure to allow access of these files
from the network process. Once this is done, it notifies the WebProcess
of the result as before.
We do a small refactoring by factoring the queue dispatch + main-thread hop
into transcodeImagesInBackgroundQueue.
Call sites like the default ChromeClient implementation and
WebPageProxy::transcodeChosenFiles no longer manage cross-thread copies.
Manually tested.
* Source/WebCore/html/FileInputType.cpp:
(WebCore::FileInputType::receiveDroppedFilesWithImageTranscoding):
* Source/WebCore/page/Chrome.cpp:
(WebCore::Chrome::transcodeChosenFiles):
* Source/WebCore/page/Chrome.h:
* Source/WebCore/page/ChromeClient.cpp:
(WebCore::ChromeClient::transcodeChosenFiles):
* Source/WebCore/page/ChromeClient.h:
* Source/WebCore/platform/graphics/ImageUtilities.h:
* Source/WebCore/platform/graphics/cg/ImageUtilitiesCG.cpp:
(WebCore::transcodeImages):
(WebCore::transcodeImagesInBackgroundQueue):
* Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.cpp:
(WebKit::NetworkConnectionToWebProcess::registerInternalFileBlobURL):
* Source/WebKit/UIProcess/WebPageProxy.cpp:
(WebKit::WebPageProxy::didChooseFilesForOpenPanelWithImageTranscoding):
(WebKit::WebPageProxy::transcodeChosenFiles):
* Source/WebKit/UIProcess/WebPageProxy.h:
* Source/WebKit/UIProcess/WebPageProxy.messages.in:
* Source/WebKit/WebProcess/WebCoreSupport/WebChromeClient.cpp:
(WebKit::WebChromeClient::transcodeChosenFiles):
* Source/WebKit/WebProcess/WebCoreSupport/WebChromeClient.h:
Identifier: [email protected]
Canonical link: https://commits.webkit.org/317695.223@webkitglib/2.54
Commit: f1f7e4ea82cd1ac9b21c2ed633e7fe7656daed1c
https://github.com/WebKit/WebKit/commit/f1f7e4ea82cd1ac9b21c2ed633e7fe7656daed1c
Author: Kimmo Kinnunen <[email protected]>
Date: 2026-09-08 (Tue, 08 Sep 2026)
Changed paths:
M Source/ThirdParty/ANGLE/src/libANGLE/VertexArray.cpp
M Source/ThirdParty/ANGLE/src/tests/gl_tests/VertexAttributeTest.cpp
Log Message:
-----------
Cherry-pick [email protected] (3320c0a36383).
https://bugs.webkit.org/show_bug.cgi?id=317294
ANGLE: Element limit not updated after format only VertexAttribPointer
change
https://bugs.webkit.org/show_bug.cgi?id=317294
rdar://176813568
Reviewed by Dan Glastonbury.
Before, changing the type of a vertex attrib would not cause recomputation
of how many elements can be drawn. The type size affects this, as
last attrib of the buffer accesses only the type size amount of data, not
the stride amount of data.
Example buffer size == 32:
- type size == 1, stride == 28 --> buffer fits 2 elements.
- type size == 16, stride == 28 --> buffer fits 1 element.
Fix by recomputing the element count also in case the type changes.
* Source/ThirdParty/ANGLE/src/libANGLE/VertexArray.cpp:
(gl::VertexArray::bindVertexBufferImpl):
(gl::VertexArray::bindVertexBuffer):
(gl::VertexArray::setVertexAttribPointerImpl):
* Source/ThirdParty/ANGLE/src/tests/gl_tests/VertexAttributeTest.cpp:
Identifier: [email protected]
Canonical link: https://commits.webkit.org/317695.224@webkitglib/2.54
Commit: 1f304d139908dfa7152a8da8a94b7bf90ecc4c58
https://github.com/WebKit/WebKit/commit/1f304d139908dfa7152a8da8a94b7bf90ecc4c58
Author: Kai Tamkun <[email protected]>
Date: 2026-09-08 (Tue, 08 Sep 2026)
Changed paths:
A JSTests/wasm/regress/try-catch-result-type.js
M Source/JavaScriptCore/wasm/WasmFunctionParser.h
Log Message:
-----------
Cherry-pick 319979@main (8f229fb72961).
https://bugs.webkit.org/show_bug.cgi?id=317450
[JSC] WebAssembly try/catch result-type confusion omits optimized reference
checks
https://bugs.webkit.org/show_bug.cgi?id=317450
rdar://179017779
Reviewed by Yusuke Suzuki.
This patch expands an expression stack check to force the signature
in all cases, not just for if/else.
Test: JSTests/wasm/regress/try-catch-result-type.js
* JSTests/wasm/regress/try-catch-result-type.js: Added.
* Source/JavaScriptCore/wasm/WasmFunctionParser.h:
(JSC::Wasm::FunctionParser<Context>::parseExpression):
Originally-landed-as: [email protected] (39a1fcf84d47).
rdar://185368910
Canonical link: https://commits.webkit.org/319979@main
Canonical link: https://commits.webkit.org/317695.225@webkitglib/2.54
Compare: https://github.com/WebKit/WebKit/compare/b0e7c826df35...1f304d139908
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
