Branch: refs/heads/webkitglib/2.54
  Home:   https://github.com/WebKit/WebKit
  Commit: 06f543c2d0e4b7c0e65194e3c05326c51ec8cf23
      
https://github.com/WebKit/WebKit/commit/06f543c2d0e4b7c0e65194e3c05326c51ec8cf23
  Author: Vitaly Dyachkov <[email protected]>
  Date:   2026-09-11 (Fri, 11 Sep 2026)

  Changed paths:
    M LayoutTests/platform/glib/TestExpectations
    M Source/WebCore/animation/KeyframeEffect.cpp
    M Source/WebCore/platform/graphics/texmap/TextureMapperAnimation.cpp
    M Source/WebCore/platform/graphics/texmap/TextureMapperAnimation.h

  Log Message:
  -----------
  Cherry-pick 320878@main (7b265b345c26). 
https://bugs.webkit.org/show_bug.cgi?id=323852

    [GTK][WPE] `steps()` and `linear()` animations can be accelerated
    https://bugs.webkit.org/show_bug.cgi?id=323852

    Reviewed by Carlos Garcia Campos.

    `steps()` and `linear()` easing functions are currently excluded from
    acceleration on all ports. This restriction only needs to apply to Apple
    ports, because accelerated animations running on the compositor are
    implemented using `CAMediaTimingFunction`, which cannot fully represent
    them. GTK and WPE use `TextureMapperAnimation`, which doesn't have this
    limitation, so these animations can be accelerated there.

    `TextureMapperAnimation` kept a single `m_timingFunction` field for two
    different things — the overall timing function of a Web Animation, and
    the CSS Animation's `animation-timing-function`, which only acts as a
    fallback for keyframes that don't specify their own easing.

    Because of this, that fallback easing could be applied to the whole
    animation progress instead of just to the individual keyframe interval,
    which produces the wrong `steps()`/`linear()` results.

    `TextureMapperAnimation` now keeps the fallback as a separate
    `m_defaultTimingFunctionForKeyframes` field, and a new
    `timingFunctionForKeyframe()` helper applies it only where it's supposed
    to.

    Test: webanimations/transform-animation-with-steps-timing-function.html

    Removed
    * Source/WebCore/animation/KeyframeEffect.cpp:
    (WebCore::KeyframeEffect::canBeAccelerated const):
    (WebCore::KeyframeEffect::updateAcceleratedActions):
    * Source/WebCore/platform/graphics/texmap/TextureMapperAnimation.cpp:
    (WebCore::timingFunctionIsIdentity):
    (WebCore::TextureMapperAnimation::TextureMapperAnimation):
    (WebCore::TextureMapperAnimation::operator=):
    (WebCore::TextureMapperAnimation::apply):
    (WebCore::TextureMapperAnimation::applyTimingFunctionForKeyframe const):
    (WebCore::timingFunctionForAnimationValue): Deleted.
    (WebCore::TextureMapperAnimation::timingFunctionForKeyframe const):
    * Source/WebCore/platform/graphics/texmap/TextureMapperAnimation.h:
    * LayoutTests/platform/glib/TestExpectations:

    Canonical link: https://commits.webkit.org/320878@main

Canonical link: https://commits.webkit.org/317695.289@webkitglib/2.54


  Commit: 2adf15d8b3acb372f854128702f2f2282fb78d6b
      
https://github.com/WebKit/WebKit/commit/2adf15d8b3acb372f854128702f2f2282fb78d6b
  Author: Yusuke Suzuki <[email protected]>
  Date:   2026-09-11 (Fri, 11 Sep 2026)

  Changed paths:
    M Source/JavaScriptCore/runtime/JSObject.cpp
    M Source/JavaScriptCore/runtime/JSObject.h
    M Source/JavaScriptCore/runtime/Structure.cpp

  Log Message:
  -----------
  Cherry-pick 320892@main (f6b9f5b24d8f). 
https://bugs.webkit.org/show_bug.cgi?id=323913

    [JSC] Fix dead-lock in Structure::flattenDictionaryStructure
    https://bugs.webkit.org/show_bug.cgi?id=323913
    rdar://187149098

    Reviewed by Keith Miller.

    It is extremely rare, but

    1. Locker<JSCellLock> cellLocker is holding a cellLock()
    2. GCSafeConcurrentJSLocker takes m_lock
    3. GCSafeConcurrentJSLocker gets destroyed first
    4. Deferred GC happens while we are taking a cellLock() here.

    Then GC will take a cellLock and getting a dead-lock. This patch places
    DeferGC to confirm that we do not do GC.

    * Source/JavaScriptCore/runtime/JSObject.cpp:
    (JSC::JSObject::shiftButterflyAfterFlattening):
    * Source/JavaScriptCore/runtime/JSObject.h:
    * Source/JavaScriptCore/runtime/Structure.cpp:
    (JSC::Structure::flattenDictionaryStructure):

    Canonical link: https://commits.webkit.org/320892@main

Canonical link: https://commits.webkit.org/317695.290@webkitglib/2.54


Compare: https://github.com/WebKit/WebKit/compare/9360440a3d5f...2adf15d8b3ac

To unsubscribe from these emails, change your notification settings at 
https://github.com/WebKit/WebKit/settings/notifications

Reply via email to