Branch: refs/heads/webkitglib/2.50
Home: https://github.com/WebKit/WebKit
Commit: a2716adbaae52613aa7c4ad828acd429f32162d6
https://github.com/WebKit/WebKit/commit/a2716adbaae52613aa7c4ad828acd429f32162d6
Author: Nipun Shukla <[email protected]>
Date: 2025-10-06 (Mon, 06 Oct 2025)
Changed paths:
M LayoutTests/media/track/track-cue-css.html
A LayoutTests/media/track/webvtt-parser-does-not-leak-expected.txt
A LayoutTests/media/track/webvtt-parser-does-not-leak.html
M Source/WebCore/html/track/WebVTTParser.cpp
M Source/WebCore/html/track/WebVTTParser.h
Log Message:
-----------
Cherry-pick 300881@main (417f208ec5d8).
https://bugs.webkit.org/show_bug.cgi?id=299220
[World Leaks] Investigate leaks in
LayoutTests/imported/w3c/web-platform-tests/webvtt/
https://bugs.webkit.org/show_bug.cgi?id=299220
rdar://160965639
Reviewed by Jer Noble.
WebVTTParser holds a strong const Ref<Document>. Changing this to a WeakRef
fixes approximately 300 leaky tests.
Test: media/track/webvtt-parser-does-not-leak.html
Test: media/track/webvtt-parser-does-not-leak.html
* LayoutTests/media/track/track-cue-css.html:
* LayoutTests/media/track/webvtt-parser-does-not-leak-expected.txt: Added.
* LayoutTests/media/track/webvtt-parser-does-not-leak.html: Added.
* Source/WebCore/html/track/WebVTTParser.cpp:
(WebCore::WebVTTParser::checkAndCreateRegion):
* Source/WebCore/html/track/WebVTTParser.h:
Canonical link: https://commits.webkit.org/300881@main
Canonical link: https://commits.webkit.org/298234.168@webkitglib/2.50
Commit: 0f998c29256ffd15652a12e8b136e543e187c4f7
https://github.com/WebKit/WebKit/commit/0f998c29256ffd15652a12e8b136e543e187c4f7
Author: Nipun Shukla <[email protected]>
Date: 2025-10-06 (Mon, 06 Oct 2025)
Changed paths:
A
LayoutTests/fast/css/css-anchor-position/anchor-position-does-not-leak-expected.txt
A
LayoutTests/fast/css/css-anchor-position/anchor-position-does-not-leak.html
M LayoutTests/fast/css/css-anchor-position/anchor-size-page-zoom.html
M Source/WebCore/style/AnchorPositionEvaluator.cpp
M Source/WebCore/style/AnchorPositionEvaluator.h
M Source/WebCore/style/StyleTreeResolver.cpp
Log Message:
-----------
Cherry-pick 300880@main (b710a47a6e53).
https://bugs.webkit.org/show_bug.cgi?id=298733
[World Leaks] - Investigate leaks in
LayoutTests/imported/w3c/web-platform-tests/css/css-anchor-position/
https://bugs.webkit.org/show_bug.cgi?id=298733
rdar://160328982
Reviewed by Ryan Reno and Antti Koivisto.
This leak was found to be caused by
WebCore::Style::Scope::m_anchorPositionedToAnchorMap,
which contains AnchorPositionedToAnchorEntry as its value.
AnchorPositionedToAnchorEntry
is a struct which holds AnchorPositionedKey as a member, which itself holds
RefPtr<const Element>. Because Element holds a strong reference to
Document, which holds
a strong reference to Style::Scope through Document::m_styleScope, we have
a reference cycle.
This change breaks the cycle by changing the definition of
AnchorPositionedToAnchorEntry so
that it no longer holds AnchorPositionedKey. This change should fix leaks
in approximately
270 tests in
LayoutTests/imported/w3c/web-platform-tests/css/css-anchor-position/.
Test: fast/css/css-anchor-position/anchor-position-does-not-leak.html
*
LayoutTests/fast/css/css-anchor-position/anchor-position-does-not-leak-expected.txt:
Added.
*
LayoutTests/fast/css/css-anchor-position/anchor-position-does-not-leak.html:
Added.
* LayoutTests/fast/css/css-anchor-position/anchor-size-page-zoom.html:
* Source/WebCore/style/AnchorPositionEvaluator.cpp:
(WebCore::Style::AnchorPositionEvaluator::updateAnchorPositioningStatesAfterInterleavedLayout):
* Source/WebCore/style/AnchorPositionEvaluator.h:
* Source/WebCore/style/StyleTreeResolver.cpp:
(WebCore::Style::TreeResolver::resolve):
Canonical link: https://commits.webkit.org/300880@main
Canonical link: https://commits.webkit.org/298234.169@webkitglib/2.50
Commit: b3db64120f3eaeac7857e255a79bb711beccead3
https://github.com/WebKit/WebKit/commit/b3db64120f3eaeac7857e255a79bb711beccead3
Author: Kimmo Kinnunen <[email protected]>
Date: 2025-10-06 (Mon, 06 Oct 2025)
Changed paths:
A LayoutTests/fast/images/imagebitmap-memory-expected.html
A LayoutTests/fast/images/imagebitmap-memory.html
M Source/WebCore/html/ImageBitmap.cpp
M Source/WebCore/html/ImageBitmap.h
Log Message:
-----------
Cherry-pick 300870@main (6d1a61fa69df).
https://bugs.webkit.org/show_bug.cgi?id=295618
REGRESSION (273213@main): ImageBitmap fails to report memory cost
https://bugs.webkit.org/show_bug.cgi?id=295618
rdar://155563791
Reviewed by Matt Woodrow.
GC would not be triggered when many or large ImageBitmaps were
allocated.
Update ImageBitmap::m_memoryCost when creating the instance. This will
be used by bindings ReportExtraMemoryCost feature to report
the extra memory cost to the JS heap when the binding object is created
and visited.
Test: fast/images/imagebitmap-memory.html
* LayoutTests/fast/images/imagebitmap-memory-expected.html: Added.
* LayoutTests/fast/images/imagebitmap-memory.html: Added.
* Source/WebCore/html/ImageBitmap.cpp:
(WebCore::ImageBitmap::detach):
(WebCore::ImageBitmap::ImageBitmap):
(WebCore::ImageBitmap::~ImageBitmap):
(WebCore::ImageBitmap::takeImageBuffer):
(WebCore::ImageBitmap::memoryCost const):
(WebCore::ImageBitmap::updateMemoryCost): Deleted.
* Source/WebCore/html/ImageBitmap.h:
Canonical link: https://commits.webkit.org/300870@main
Canonical link: https://commits.webkit.org/298234.170@webkitglib/2.50
Commit: e7d1bd181a0c73bf9eb172e1bac5260e0411905a
https://github.com/WebKit/WebKit/commit/e7d1bd181a0c73bf9eb172e1bac5260e0411905a
Author: Matt Oestreich <[email protected]>
Date: 2025-10-06 (Mon, 06 Oct 2025)
Changed paths:
A JSTests/stress/math-random-inline-vs-non-inline-paths.js
M Source/JavaScriptCore/jit/AssemblyHelpers.cpp
Log Message:
-----------
Cherry-pick 300785@main (cf0e17e68442).
https://bugs.webkit.org/show_bug.cgi?id=299242
[JSC] Math.random JIT path uses arithmetic instead of logical right shifts
https://bugs.webkit.org/show_bug.cgi?id=299242
Reviewed by Justin Michaud.
--SUMMARY--
This report concerns Math.random output when taking the JIT path.
Currently, state advancement in emitRandomThunkImpl uses arithmetic
right shifts (rshift64), whereas all other advancement paths use logical
right shifts.
[Source]: Source/JavaScriptCore/jit/AssemblyHelpers.cpp, line 847.
--REFERENCE IMPLEMENTATION--
WeakRandom::nextState uses the >> operator on a uint64_t, which performs
a logical shift.
[Source]: Source/WTF/wtf/WeakRandom.h, line 109.
--FTL LOWERING PATH--
compileArithRandom uses lShr (logical shift right).
[Source]: Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp, line 3501.
--JIT PATH ((problem))--
emitRandomThunkImpl calls jit.rshift64, which emits SAR (arithmetic shift).
[Source]: Source/JavaScriptCore/assembler/MacroAssemblerX86_64.h, line 5311.
By contrast, urshift64 emits SHR (logical shift), this matches the intended
semantics.
[Source]: Source/JavaScriptCore/assembler/MacroAssemblerX86_64.h, line 5350.
--IMPACT--
This discrepancy means that, when given the same seed, Math.random produces
different output depending on whether the JIT path is taken. The bug is not
immediately obvious because both arithmetic and logical right shifts still
generate values within the expected [0, 1) range, and the distribution may
look
reasonable at a glance. However, the underlying state advancement diverges
from
the intended algorithm, which leads to inconsistent and incorrect behavior
compared to other code paths.
Test: JSTests/stress/math-random-inline-vs-non-inline-paths.js
Test: JSTests/stress/math-random-inline-vs-non-inline-paths.js
* JSTests/stress/math-random-inline-vs-non-inline-paths.js: Added.
(isEqualArr):
* Source/JavaScriptCore/jit/AssemblyHelpers.cpp:
(JSC::emitRandomThunkImpl):
[JSC] Math.random JIT path uses arithmetic instead of logical right shifts
https://bugs.webkit.org/show_bug.cgi?id=299242
Reviewed by Justin Michaud.
--SUMMARY--
This report concerns Math.random output when taking the JIT path.
Currently, state advancement in emitRandomThunkImpl uses arithmetic
right shifts (rshift64), whereas all other advancement paths use logical
right shifts.
[Source]: Source/JavaScriptCore/jit/AssemblyHelpers.cpp, line 847.
--REFERENCE IMPLEMENTATION--
WeakRandom::nextState uses the >> operator on a uint64_t, which performs
a logical shift.
[Source]: Source/WTF/wtf/WeakRandom.h, line 109.
--FTL LOWERING PATH--
compileArithRandom uses lShr (logical shift right).
[Source]: Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp, line 3501.
--JIT PATH ((problem))--
emitRandomThunkImpl calls jit.rshift64, which emits SAR (arithmetic shift).
[Source]: Source/JavaScriptCore/assembler/MacroAssemblerX86_64.h, line 5311.
By contrast, urshift64 emits SHR (logical shift), this matches the intended
semantics.
[Source]: Source/JavaScriptCore/assembler/MacroAssemblerX86_64.h, line 5350.
--IMPACT--
This discrepancy means that, when given the same seed, Math.random produces
different output depending on whether the JIT path is taken. The bug is not
immediately obvious because both arithmetic and logical right shifts still
generate values within the expected [0, 1) range, and the distribution may
look
reasonable at a glance. However, the underlying state advancement diverges
from
the intended algorithm, which leads to inconsistent and incorrect behavior
compared to other code paths.
* JSTests/stress/math-random-inline-vs-non-inline-paths.js:
Canonical link: https://commits.webkit.org/300785@main
Canonical link: https://commits.webkit.org/298234.171@webkitglib/2.50
Commit: ac1d24c9f7ebe941c7682b098f87faf574e2b00c
https://github.com/WebKit/WebKit/commit/ac1d24c9f7ebe941c7682b098f87faf574e2b00c
Author: Philippe Normand <[email protected]>
Date: 2025-10-06 (Mon, 06 Oct 2025)
Changed paths:
M Source/WebCore/platform/graphics/gstreamer/GStreamerCommon.cpp
M Source/WebCore/platform/graphics/gstreamer/GStreamerCommon.h
Log Message:
-----------
Cherry-pick 300744@main (61a456e19153).
https://bugs.webkit.org/show_bug.cgi?id=299656
[GStreamer] Build broken when using GStreamer 1.27.2 built from tarballs
https://bugs.webkit.org/show_bug.cgi?id=299656
Reviewed by Xabier Rodriguez-Calvar.
gst_pad_probe_info_set_buffer() will ship in GStreamer 1.27.3 which hasn't
been released yet. So
when building against 1.27.2 use our internal implementation. Also make
sure builds against current
GStreamer git main still work, by checking the full (including nano)
version.
* Source/WebCore/platform/graphics/gstreamer/GStreamerCommon.cpp:
* Source/WebCore/platform/graphics/gstreamer/GStreamerCommon.h:
Canonical link: https://commits.webkit.org/300744@main
Canonical link: https://commits.webkit.org/298234.172@webkitglib/2.50
Commit: 8a15d38b5e5a49f3125a163fd37423075ba1681a
https://github.com/WebKit/WebKit/commit/8a15d38b5e5a49f3125a163fd37423075ba1681a
Author: Adrian Perez de Castro <[email protected]>
Date: 2025-10-06 (Mon, 06 Oct 2025)
Changed paths:
M Source/ThirdParty/unifdef/CMakeLists.txt
Log Message:
-----------
Cherry-pick 300574@main (e33b18bc59d6).
https://bugs.webkit.org/show_bug.cgi?id=299589
[JSC][Flatpak SDK] Error building unifdef with GCC 15.x
https://bugs.webkit.org/show_bug.cgi?id=299589
Reviewed by Fujii Hironori.
Change the CMake build system to compile the bundled unifdef in C99
mode. This allows its usage of "constexpr" as a variable name, fixing
the build.
* Source/ThirdParty/unifdef/CMakeLists.txt:
Canonical link: https://commits.webkit.org/300574@main
Canonical link: https://commits.webkit.org/298234.173@webkitglib/2.50
Commit: 006cc4e7b50a84758935fdb7cdcbf0f5b5a5d244
https://github.com/WebKit/WebKit/commit/006cc4e7b50a84758935fdb7cdcbf0f5b5a5d244
Author: Said Abou-Hallawa <[email protected]>
Date: 2025-10-06 (Mon, 06 Oct 2025)
Changed paths:
A LayoutTests/svg/as-image/resources/circle-pattern-embeded-image.svg
A LayoutTests/svg/as-image/svg-as-image-pattern-scale-expected.html
A LayoutTests/svg/as-image/svg-as-image-pattern-scale.html
M Source/WebCore/rendering/svg/legacy/LegacyRenderSVGResourcePattern.cpp
Log Message:
-----------
Cherry-pick 300357@main (1cc5b31eb1ca).
https://bugs.webkit.org/show_bug.cgi?id=298753
SVG patterns might get blurred and pixellated when zooming in
https://bugs.webkit.org/show_bug.cgi?id=298753
rdar://159202567
Reviewed by Simon Fraser.
When drawing an SVG pattern, a tileImage is created from the referenced
element.
This tileImage is currently scaled by the patternTransform only. So
although the
referenced element might be an SVG image or a large bitmap image, the
resulted
tileImage will not be scaled well when the coordinate system is scaled like
zoom
in or printing for example.
Although the tileImage of the pattern should be scaled by patternTransform,
it has
to be scaled by at least GraphicsContext.scaleFactor. This ensures the
tileImage
scales properly with the scaled coordinate system.
Test: svg/as-image/svg-as-image-pattern-scale.html
* LayoutTests/svg/as-image/resources/circle-pattern-embeded-image.svg:
Added.
* LayoutTests/svg/as-image/svg-as-image-pattern-scale-expected.html: Added.
* LayoutTests/svg/as-image/svg-as-image-pattern-scale.html: Added.
* Source/WebCore/rendering/svg/legacy/LegacyRenderSVGResourcePattern.cpp:
(WebCore::LegacyRenderSVGResourcePattern::createTileImage const):
Canonical link: https://commits.webkit.org/300357@main
Canonical link: https://commits.webkit.org/298234.174@webkitglib/2.50
Commit: a9433331baf872692e7043f5ab4de4cc876810de
https://github.com/WebKit/WebKit/commit/a9433331baf872692e7043f5ab4de4cc876810de
Author: Shu-yu Guo <[email protected]>
Date: 2025-10-06 (Mon, 06 Oct 2025)
Changed paths:
M Source/JavaScriptCore/assembler/MacroAssemblerX86_64.h
M Source/JavaScriptCore/assembler/testmasm.cpp
Log Message:
-----------
Cherry-pick 300245@main (e8e09d0cc146).
https://bugs.webkit.org/show_bug.cgi?id=298099
[JSC] Do not elide atomic and with -1 on x86
https://bugs.webkit.org/show_bug.cgi?id=298099
rdar://159443883
Reviewed by Yusuke Suzuki.
Seq-cst and with -1 cannot be optimized out on x86. Seq-cst stores must
exist
for the seq-cst ordering guarantee. This PR disables the microoptimization
if
the bitwise and is atomic.
This also fixes an issue with generating a dangling LOCK prefix.
Test: Source/JavaScriptCore/assembler/testmasm.cpp
Canonical link: https://commits.webkit.org/300245@main
Canonical link: https://commits.webkit.org/298234.175@webkitglib/2.50
Commit: d28c495ae3d92840c50da6d981a18d3d95b2a2ac
https://github.com/WebKit/WebKit/commit/d28c495ae3d92840c50da6d981a18d3d95b2a2ac
Author: Chris Dumez <[email protected]>
Date: 2025-10-06 (Mon, 06 Oct 2025)
Changed paths:
M Source/WTF/wtf/text/StringImpl.h
Log Message:
-----------
Cherry-pick 300207@main (3a34ff002af1).
https://bugs.webkit.org/show_bug.cgi?id=298835
[WTF] Span debug iterator asserts in StringImpl::removeCharactersImpl under
parseCacheControlDirectives
https://bugs.webkit.org/show_bug.cgi?id=298835
rdar://160862926
Reviewed by Geoffrey Garen and Ryosuke Niwa.
Avoid subtracting iterators from different spans as it may trip debug
assertions
in the span iterator. Instead, we now substract addresses since we're only
interested in an offset and one of the spans is a subspan of the other.
* Source/WTF/wtf/text/StringImpl.h:
(WTF::StringImpl::removeCharactersImpl):
Canonical link: https://commits.webkit.org/300207@main
Canonical link: https://commits.webkit.org/298234.176@webkitglib/2.50
Commit: d1078e536e47fce4ffc5b08bf0eed6cd078d54d2
https://github.com/WebKit/WebKit/commit/d1078e536e47fce4ffc5b08bf0eed6cd078d54d2
Author: Philippe Normand <[email protected]>
Date: 2025-10-06 (Mon, 06 Oct 2025)
Changed paths:
M Source/WebCore/Modules/mediastream/RTCPeerConnection.cpp
M Source/WebCore/Modules/mediastream/RTCPeerConnection.h
M
Source/WebCore/Modules/mediastream/gstreamer/GStreamerDtlsTransportBackend.cpp
M Source/WebCore/Modules/mediastream/gstreamer/GStreamerMediaEndpoint.cpp
M
Source/WebCore/Modules/mediastream/gstreamer/GStreamerPeerConnectionBackend.cpp
M
Source/WebCore/Modules/mediastream/gstreamer/GStreamerRtpReceiverBackend.cpp
M Source/WebCore/Modules/mediastream/gstreamer/GStreamerRtpReceiverBackend.h
M Source/WebCore/Modules/mediastream/gstreamer/GStreamerRtpSenderBackend.cpp
M
Source/WebCore/platform/mediastream/gstreamer/RealtimeIncomingSourceGStreamer.cpp
M
Source/WebCore/platform/mediastream/gstreamer/RealtimeIncomingSourceGStreamer.h
Log Message:
-----------
Cherry-pick 300145@main (8cf7c05ce072).
https://bugs.webkit.org/show_bug.cgi?id=299006
[GStreamer][WebRTC] Fix several mem leaks reported by the GStreamer leak
tracer
https://bugs.webkit.org/show_bug.cgi?id=299006
Reviewed by Xabier Rodriguez-Calvar.
Clear some more GStreamer-related objects during WebRTC pipeline teardown,
before gst_deinit() is
called so that the leak tracer doesn't account for these as leaked.
* Source/WebCore/Modules/mediastream/RTCPeerConnection.cpp:
(WebCore::RTCPeerConnection::clearTransports):
* Source/WebCore/Modules/mediastream/RTCPeerConnection.h:
*
Source/WebCore/Modules/mediastream/gstreamer/GStreamerDtlsTransportBackend.cpp:
* Source/WebCore/Modules/mediastream/gstreamer/GStreamerMediaEndpoint.cpp:
(WebCore::GStreamerMediaEndpoint::teardownPipeline):
(WebCore::GStreamerMediaEndpoint::connectIncomingTrack):
*
Source/WebCore/Modules/mediastream/gstreamer/GStreamerPeerConnectionBackend.cpp:
(WebCore::GStreamerPeerConnectionBackend::tearDown):
*
Source/WebCore/Modules/mediastream/gstreamer/GStreamerRtpReceiverBackend.cpp:
(WebCore::GStreamerRtpReceiverBackend::tearDown):
*
Source/WebCore/Modules/mediastream/gstreamer/GStreamerRtpReceiverBackend.h:
*
Source/WebCore/Modules/mediastream/gstreamer/GStreamerRtpSenderBackend.cpp:
(WebCore::GStreamerRtpSenderBackend::tearDown):
*
Source/WebCore/platform/mediastream/gstreamer/RealtimeIncomingSourceGStreamer.cpp:
(WebCore::RealtimeIncomingSourceGStreamer::setBin):
(WebCore::RealtimeIncomingSourceGStreamer::tearDown):
(WebCore::RealtimeIncomingSourceGStreamer::handleDownstreamEvent):
*
Source/WebCore/platform/mediastream/gstreamer/RealtimeIncomingSourceGStreamer.h:
Canonical link: https://commits.webkit.org/300145@main
Canonical link: https://commits.webkit.org/298234.177@webkitglib/2.50
Commit: 2ee2ca41ba110e0bb4cc385419532dd2bae0a11b
https://github.com/WebKit/WebKit/commit/2ee2ca41ba110e0bb4cc385419532dd2bae0a11b
Author: Antti Koivisto <[email protected]>
Date: 2025-10-06 (Mon, 06 Oct 2025)
Changed paths:
A
LayoutTests/imported/w3c/web-platform-tests/css/css-anchor-position/pseudo-element-with-slotted-anchor-expected.html
A
LayoutTests/imported/w3c/web-platform-tests/css/css-anchor-position/pseudo-element-with-slotted-anchor-ref.html
A
LayoutTests/imported/w3c/web-platform-tests/css/css-anchor-position/pseudo-element-with-slotted-anchor.html
M Source/WebCore/style/StyleScope.cpp
Log Message:
-----------
Cherry-pick 300086@main (ec6791966b1e).
https://bugs.webkit.org/show_bug.cgi?id=298646
Anchoring a pseudo element to a slotted element in a Shadow DOM causes
browser crash
https://bugs.webkit.org/show_bug.cgi?id=298646
rdar://160291579
Reviewed by Simon Fraser and Alan Baradlay.
Tests:
imported/w3c/web-platform-tests/css/css-anchor-position/pseudo-element-with-slotted-anchor-ref.html
imported/w3c/web-platform-tests/css/css-anchor-position/pseudo-element-with-slotted-anchor.html
*
LayoutTests/imported/w3c/web-platform-tests/css/css-anchor-position/pseudo-element-with-slotted-anchor-expected.html:
Added.
*
LayoutTests/imported/w3c/web-platform-tests/css/css-anchor-position/pseudo-element-with-slotted-anchor-ref.html:
Added.
*
LayoutTests/imported/w3c/web-platform-tests/css/css-anchor-position/pseudo-element-with-slotted-anchor.html:
Added.
* Source/WebCore/style/StyleScope.cpp:
(WebCore::Style::Scope::forOrdinal):
For PseudoElements use the scope of the host element.
Canonical link: https://commits.webkit.org/300086@main
Canonical link: https://commits.webkit.org/298234.178@webkitglib/2.50
Commit: badfb49d549de31c5dada005b87c4cc8d2b247f9
https://github.com/WebKit/WebKit/commit/badfb49d549de31c5dada005b87c4cc8d2b247f9
Author: Diego Pino Garcia <[email protected]>
Date: 2025-10-06 (Mon, 06 Oct 2025)
Changed paths:
M LayoutTests/platform/glib/TestExpectations
M
Source/WebCore/platform/graphics/texmap/coordinated/GraphicsLayerCoordinated.cpp
Log Message:
-----------
Cherry-pick 299610@main (1ae6b299f5d2).
https://bugs.webkit.org/show_bug.cgi?id=216539
[GLIB] webanimations/accelerated-animation-easing-and-direction-update.html
is an image failure
https://bugs.webkit.org/show_bug.cgi?id=216539
Reviewed by Carlos Garcia Campos.
This test has been failing for WebKitGTK/WPEWebKit since added in r266834.
Implementing a similar change for WebKitGTK/WPEWebKit makes the test pass.
* LayoutTests/platform/glib/TestExpectations:
*
Source/WebCore/platform/graphics/texmap/coordinated/GraphicsLayerCoordinated.cpp:
(WebCore::GraphicsLayerCoordinated::addAnimation):
Canonical link: https://commits.webkit.org/299610@main
Canonical link: https://commits.webkit.org/298234.179@webkitglib/2.50
Commit: c8495b645d62780ebb525ac4ef06b2652679ce3e
https://github.com/WebKit/WebKit/commit/c8495b645d62780ebb525ac4ef06b2652679ce3e
Author: Simon Fraser <[email protected]>
Date: 2025-10-06 (Mon, 06 Oct 2025)
Changed paths:
A LayoutTests/fast/box-shadow/inset-shadow-large-spread-expected.html
A LayoutTests/fast/box-shadow/inset-shadow-large-spread.html
M Source/WebCore/rendering/BackgroundPainter.cpp
Log Message:
-----------
Cherry-pick 299603@main (f3bffa929090).
https://bugs.webkit.org/show_bug.cgi?id=298341
REGRESSION (291055@main): Buttons with box shadow are broken
https://bugs.webkit.org/show_bug.cgi?id=298341
rdar://159888287
Reviewed by Aditya Keerthi.
The bug occurred with inset shadows that have large spread. The check that
the inner "hole" was empty was failing, because it checked the outer,
instead
of the inner shape on the hole BorderShape.
This regressed with the adoption of BorderShape here (291055@main).
* LayoutTests/fast/box-shadow/inset-shadow-large-spread-expected.html:
Added.
* LayoutTests/fast/box-shadow/inset-shadow-large-spread.html: Added.
* Source/WebCore/rendering/BackgroundPainter.cpp:
(WebCore::BackgroundPainter::paintBoxShadow const):
Canonical link: https://commits.webkit.org/299603@main
Canonical link: https://commits.webkit.org/298234.180@webkitglib/2.50
Compare: https://github.com/WebKit/WebKit/compare/5bb939586a21...c8495b645d62
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
