[webkit-changes] [WebKit/WebKit] 9238da: Cherry-pick 256338 at main (1428865fbb25). rdar://101...

Arunsundar Kannan noreply at github.com
Mon Jan 30 17:08:54 PST 2023


  Branch: refs/heads/safari-7615-branch
  Home:   https://github.com/WebKit/WebKit
  Commit: 9238da6bab485f543030f60efbfff8bc6438e939
      https://github.com/WebKit/WebKit/commit/9238da6bab485f543030f60efbfff8bc6438e939
  Author: Jonathan Bedard <jbedard at apple.com>
  Date:   2022-11-10 (Thu, 10 Nov 2022)

  Changed paths:
    M Tools/Scripts/libraries/webkitscmpy/setup.py
    M Tools/Scripts/libraries/webkitscmpy/webkitscmpy/__init__.py
    M Tools/Scripts/libraries/webkitscmpy/webkitscmpy/program/pull_request.py

  Log Message:
  -----------
  Cherry-pick 256338 at main (1428865fbb25). rdar://101932575

    [git-webkit] Improve logging when automatically determining target remote
    https://bugs.webkit.org/show_bug.cgi?id=247459
    rdar://101932575

    Reviewed by Aakash Jain.

    * Tools/Scripts/libraries/webkitscmpy/setup.py: Bump version.
    * Tools/Scripts/libraries/webkitscmpy/webkitscmpy/__init__.py: Ditto.
    * Tools/Scripts/libraries/webkitscmpy/webkitscmpy/program/pull_request.py:
    (PullRequest.pull_request_branch_point):

    Canonical link: https://commits.webkit.org/256338@main

Canonical link: https://commits.webkit.org/252432.805@safari-7614-branch


  Commit: a09205d980f61ca2bc0ee8a5ee14e6d3e67632d9
      https://github.com/WebKit/WebKit/commit/a09205d980f61ca2bc0ee8a5ee14e6d3e67632d9
  Author: Chris Dumez <cdumez at apple.com>
  Date:   2022-11-10 (Thu, 10 Nov 2022)

  Changed paths:
    A LayoutTests/fast/forms/datalist/datalist-idTargetChanged-crash-expected.txt
    A LayoutTests/fast/forms/datalist/datalist-idTargetChanged-crash.html
    M Source/WebCore/html/HTMLInputElement.cpp

  Log Message:
  -----------
  Assertion hit under IdTargetObserverRegistry::notifyObservers()
https://bugs.webkit.org/show_bug.cgi?id=247592
rdar://101454107

Reviewed by Aditya Keerthi, Wenson Hsieh and Geoffrey Garen.

ListAttributeTargetObserver::idTargetChanged() is not safe to re-enter. As a result,
we have an assertion and a runtime check to protect against this. However, it was
still possible to hit this assertion in debug.

ListAttributeTargetObserver::idTargetChanged() would call
TextFieldInputType::dataListMayHaveChanged() which could run script by calling
createDataListDropdownIndicator(). The script could then change the datalist
element's id, which would attempt to re-enter.

This patch addresses the issue by calling dataListMayHaveChanged() asynchronously.

* LayoutTests/fast/forms/datalist/datalist-idTargetChanged-crash-expected.txt: Added.
* LayoutTests/fast/forms/datalist/datalist-idTargetChanged-crash.html: Added.
* Source/WebCore/html/HTMLInputElement.cpp:
(WebCore::ListAttributeTargetObserver::idTargetChanged):

Canonical link: https://commits.webkit.org/252432.806@safari-7614-branch


  Commit: 03faecd515d8b3dc6d43f29794e66620e783ca5c
      https://github.com/WebKit/WebKit/commit/03faecd515d8b3dc6d43f29794e66620e783ca5c
  Author: Chris Dumez <cdumez at apple.com>
  Date:   2022-11-10 (Thu, 10 Nov 2022)

  Changed paths:
    A LayoutTests/fast/workers/terminate-worker-with-event-listener-crash-expected.txt
    A LayoutTests/fast/workers/terminate-worker-with-event-listener-crash.html
    M LayoutTests/imported/w3c/web-platform-tests/workers/WorkerGlobalScope_ErrorEvent_colno-expected.txt
    M Source/WebCore/Modules/indexeddb/IDBDatabase.cpp
    M Source/WebCore/Modules/indexeddb/IDBRequest.cpp
    M Source/WebCore/Modules/indexeddb/IDBTransaction.cpp
    M Source/WebCore/animation/WebAnimation.cpp
    M Source/WebCore/animation/WebAnimation.h
    M Source/WebCore/dom/Document.cpp
    M Source/WebCore/dom/Document.h
    M Source/WebCore/dom/EventTarget.cpp
    M Source/WebCore/dom/ScriptExecutionContext.cpp
    M Source/WebCore/dom/ScriptExecutionContext.h
    M Source/WebCore/history/CachedFrame.cpp
    M Source/WebCore/workers/WorkerGlobalScope.cpp
    M Source/WebCore/workers/WorkerGlobalScope.h
    M Source/WebCore/workers/WorkerOrWorkletGlobalScope.cpp
    M Source/WebCore/workers/service/ServiceWorker.cpp
    M Source/WebCore/workers/service/ServiceWorkerContainer.cpp
    M Source/WebCore/workers/service/ServiceWorkerRegistration.cpp
    M Source/WebCore/workers/service/ServiceWorkerRegistration.h

  Log Message:
  -----------
  Heap use-after-free in DOMWrapperWorld::~DOMWrapperWorld
https://bugs.webkit.org/show_bug.cgi?id=246022
rdar://100763856

Reviewed by Ryosuke Niwa.

DOMWrapperWorld is not expected to outlive its associated JSVMClientData.
There is an assertion inside ~JSVMClientData() to guard against this, which was
getting hit when running the included test.

The reason for this is that the DedicatedWorkerGlobalScope had already prepared
for destruction and cleared its ScriptController. However, a JSEventListener
on a FontFaceSet object was staying around and keeping the DOMWrapperWorld alive
via a strong reference.

We normally try to protect against this by removing event listeners when the
script execution context is preparing for destruction. However, our logic to
do so was only removing event listeners that were easily reachable via the
script execution context and would potentially miss plenty of them (such as
the ones on FontFaceSet objects).

To address the issue, ALL EventTarget objects now register with their
ScriptExecutionContext whenever they have registered event listeners.
When clearing event listeners for the context, we now have a reliable set
of EventTarget objects that we need to clear event listeners on.

* LayoutTests/fast/workers/terminate-worker-with-event-listener-crash-expected.txt: Added.
* LayoutTests/fast/workers/terminate-worker-with-event-listener-crash.html: Added.
* LayoutTests/imported/w3c/web-platform-tests/workers/WorkerGlobalScope_ErrorEvent_colno-expected.txt:
* Source/WebCore/Modules/indexeddb/IDBDatabase.cpp:
(WebCore::IDBDatabase::stop):
* Source/WebCore/Modules/indexeddb/IDBRequest.cpp:
(WebCore::IDBRequest::stop):
* Source/WebCore/Modules/indexeddb/IDBTransaction.cpp:
(WebCore::IDBTransaction::stop):
* Source/WebCore/animation/WebAnimation.cpp:
(WebCore::WebAnimation::stop): Deleted.
* Source/WebCore/animation/WebAnimation.h:
* Source/WebCore/dom/Document.cpp:
(WebCore::Document::~Document):
(WebCore::Document::removeAllEventListenersInContext):
* Source/WebCore/dom/Document.h:
* Source/WebCore/dom/EventTarget.cpp:
(WebCore::EventTarget::addEventListener):
(WebCore::EventTarget::removeEventListener):
(WebCore::EventTarget::removeAllEventListeners):
* Source/WebCore/dom/ScriptExecutionContext.cpp:
(WebCore::ScriptExecutionContext::removeAllEventListenersInContext):
(WebCore::ScriptExecutionContext::addEventTargetWithListener):
(WebCore::ScriptExecutionContext::removeEventTargetWithListener):
* Source/WebCore/dom/ScriptExecutionContext.h:
* Source/WebCore/history/CachedFrame.cpp:
(WebCore::CachedFrame::destroy):
* Source/WebCore/workers/WorkerGlobalScope.cpp:
(WebCore::WorkerGlobalScope::removeAllEventListenersInContext):
(WebCore::WorkerGlobalScope::removeAllEventListeners):
* Source/WebCore/workers/WorkerGlobalScope.h:
* Source/WebCore/workers/WorkerOrWorkletGlobalScope.cpp:
(WebCore::WorkerOrWorkletGlobalScope::prepareForDestruction):
* Source/WebCore/workers/service/ServiceWorker.cpp:
(WebCore::ServiceWorker::stop):
* Source/WebCore/workers/service/ServiceWorkerContainer.cpp:
(WebCore::ServiceWorkerContainer::stop):
* Source/WebCore/workers/service/ServiceWorkerRegistration.cpp:
(WebCore::ServiceWorkerRegistration::stop): Deleted.
* Source/WebCore/workers/service/ServiceWorkerRegistration.h:

Canonical link: https://commits.webkit.org/252432.807@safari-7614-branch


  Commit: b6d2a12d8d70fefa96e6d02ee9908d4b727fc126
      https://github.com/WebKit/WebKit/commit/b6d2a12d8d70fefa96e6d02ee9908d4b727fc126
  Author: Wenson Hsieh <wenson_hsieh at apple.com>
  Date:   2022-11-10 (Thu, 10 Nov 2022)

  Changed paths:
    M Source/WebKit/UIProcess/mac/WebContextMenuProxyMac.mm

  Log Message:
  -----------
  [macOS] WebContextMenuProxy use-after-free when triggering context menu presentation using IPC
https://bugs.webkit.org/show_bug.cgi?id=247590
rdar://102049265

Reviewed by Aditya Keerthi.

Replace these raw pointers with `WeakPtr` to avoid accessing invalid memory, in the case where a
compromised web process triggers context menu presentation on macOS by sending an out-of-band
`WebPageProxy::ShowContextMenu` IPC message.

* Source/WebKit/UIProcess/mac/WebContextMenuProxyMac.mm:
(-[WKMenuTarget menuProxy]):
(-[WKMenuTarget forwardContextMenuAction:]):

Canonical link: https://commits.webkit.org/252432.808@safari-7614-branch


  Commit: b25c50a4df75bcd0efba280e7c2ac5b90502114a
      https://github.com/WebKit/WebKit/commit/b25c50a4df75bcd0efba280e7c2ac5b90502114a
  Author: Matthew Finkel <sysrqb at apple.com>
  Date:   2022-11-11 (Fri, 11 Nov 2022)

  Changed paths:
    M Source/WebCore/loader/FrameLoader.cpp

  Log Message:
  -----------
  Correctly handle loading subframes in WebArchives
https://bugs.webkit.org/show_bug.cgi?id=247292
rdar://101776770

Reviewed by Chris Dumez.

When WebArchives are loaded, the URL associated with each resource has
"webarchive+" prepended on its scheme. This ensures cross-origin isolation
between the document loaded from a WebArchive and an externally loaded
document. This prefixed-scheme is affecting iframe loading because it results
in an unrecognized scheme that can't be handled. Now we obtain the original
scheme by stripping the prefix, and we use this modified scheme in the request
URL.

* Source/WebCore/loader/FrameLoader.cpp:
(WebCore::FrameLoader::loadArchive):

Canonical link: https://commits.webkit.org/252432.809@safari-7614-branch


  Commit: 98af089779858c42f01e6d677c3f27d11fe19d4a
      https://github.com/WebKit/WebKit/commit/98af089779858c42f01e6d677c3f27d11fe19d4a
  Author: Youenn Fablet <youennf at gmail.com>
  Date:   2022-11-14 (Mon, 14 Nov 2022)

  Changed paths:
    A LayoutTests/fast/mediastream/mediastreamtrack-configurationchange-expected.txt
    A LayoutTests/fast/mediastream/mediastreamtrack-configurationchange.html
    M LayoutTests/platform/glib/TestExpectations
    M Source/WebCore/Modules/mediastream/MediaStreamTrack.cpp
    M Source/WebCore/Modules/mediastream/MediaStreamTrack.h
    M Source/WebCore/Modules/mediastream/MediaStreamTrack.idl
    M Source/WebCore/dom/EventNames.h
    M Source/WebCore/platform/mediastream/MediaStreamTrackPrivate.cpp
    M Source/WebCore/platform/mediastream/MediaStreamTrackPrivate.h
    M Source/WebCore/platform/mediastream/RealtimeMediaSource.cpp
    M Source/WebCore/platform/mediastream/RealtimeMediaSource.h
    M Source/WebCore/platform/mediastream/ios/AVAudioSessionCaptureDeviceManager.h
    M Source/WebCore/platform/mediastream/ios/AVAudioSessionCaptureDeviceManager.mm
    M Source/WebCore/platform/mediastream/mac/BaseAudioSharedUnit.cpp
    M Source/WebCore/platform/mediastream/mac/BaseAudioSharedUnit.h
    M Source/WebCore/platform/mediastream/mac/CoreAudioCaptureSource.cpp
    M Source/WebCore/platform/mediastream/mac/CoreAudioCaptureSource.h
    M Source/WebCore/platform/mediastream/mac/RealtimeMediaSourceCenterMac.mm
    M Source/WebCore/platform/mock/MockRealtimeMediaSourceCenter.cpp
    M Source/WebCore/platform/mock/MockRealtimeMediaSourceCenter.h
    M Source/WebKit/GPUProcess/GPUProcess.cpp
    M Source/WebKit/GPUProcess/GPUProcess.h
    M Source/WebKit/GPUProcess/GPUProcess.messages.in
    M Source/WebKit/UIProcess/API/C/WKPage.cpp
    M Source/WebKit/UIProcess/API/C/WKPagePrivate.h
    M Source/WebKit/UIProcess/Cocoa/UserMediaCaptureManagerProxy.cpp
    M Source/WebKit/UIProcess/GPU/GPUProcessProxy.cpp
    M Source/WebKit/UIProcess/GPU/GPUProcessProxy.h
    M Source/WebKit/WebProcess/cocoa/RemoteRealtimeMediaSource.cpp
    M Source/WebKit/WebProcess/cocoa/RemoteRealtimeMediaSource.h
    M Source/WebKit/WebProcess/cocoa/UserMediaCaptureManager.cpp
    M Source/WebKit/WebProcess/cocoa/UserMediaCaptureManager.h
    M Source/WebKit/WebProcess/cocoa/UserMediaCaptureManager.messages.in
    M Tools/WebKitTestRunner/InjectedBundle/Bindings/TestRunner.idl
    M Tools/WebKitTestRunner/InjectedBundle/TestRunner.cpp
    M Tools/WebKitTestRunner/InjectedBundle/TestRunner.h
    M Tools/WebKitTestRunner/TestController.cpp
    M Tools/WebKitTestRunner/TestController.h
    M Tools/WebKitTestRunner/TestInvocation.cpp

  Log Message:
  -----------
  Cherry-pick 78a2a0119f7b. rdar://problem/100335624

    [iOS] Fire configurationchange event in case of switching automatically to another microphone while capturing
    https://bugs.webkit.org/show_bug.cgi?id=244535
    rdar://problem/99331061

    Reviewed by Eric Carlson.

    On iOS, the user may change of audio device through control center, while capturing.
    In that case, the microphone automatically switches to the new device.
    To expose this to the WebPage, we can use configurationchange event.
    The flow is:
    - AVAudioSessionCaptureDeviceManager detects microphone change
    - CoreAudioSharedUnit notifies CoreAudioCaptureSource in GPUProcess.
    - UserMediaCaptureManagerProxy is notified by CoreAudioCaptureSource and notifies UserMediaCaptureManager through IPC.
    - UserMediaCaptureManager in WebProcess notifies its source which notifies its MediaStreamTrack(s).
    - At the same time, settings and capabilities are updated.

    We add a mock API to test this code path.

    Covered by LayoutTests/fast/mediastream/mediastreamtrack-configurationchange.html.

    * LayoutTests/fast/mediastream/mediastreamtrack-configurationchange-expected.txt: Added.
    * LayoutTests/fast/mediastream/mediastreamtrack-configurationchange.html: Added.
    * Source/WebCore/Modules/mediastream/MediaStreamTrack.cpp:
    (WebCore::MediaStreamTrack::trackConfigurationChanged):
    * Source/WebCore/Modules/mediastream/MediaStreamTrack.h:
    * Source/WebCore/Modules/mediastream/MediaStreamTrack.idl:
    * Source/WebCore/dom/EventNames.h:
    * Source/WebCore/platform/mediastream/MediaStreamTrackPrivate.cpp:
    (WebCore::MediaStreamTrackPrivate::sourceConfigurationChanged):
    * Source/WebCore/platform/mediastream/MediaStreamTrackPrivate.h:
    * Source/WebCore/platform/mediastream/RealtimeMediaSource.cpp:
    (WebCore::RealtimeMediaSource::RealtimeMediaSource):
    (WebCore::RealtimeMediaSource::setPersistentId):
    (WebCore::RealtimeMediaSource::initializePersistentId):
    * Source/WebCore/platform/mediastream/RealtimeMediaSource.h:
    * Source/WebCore/platform/mediastream/ios/AVAudioSessionCaptureDeviceManager.h:
    * Source/WebCore/platform/mediastream/ios/AVAudioSessionCaptureDeviceManager.mm:
    (WebCore::AVAudioSessionCaptureDeviceManager::retrieveAudioSessionCaptureDevices const):
    * Source/WebCore/platform/mediastream/mac/BaseAudioSharedUnit.cpp:
    (WebCore::BaseAudioSharedUnit::handleNewCurrentMicrophoneDevice):
    * Source/WebCore/platform/mediastream/mac/BaseAudioSharedUnit.h:
    * Source/WebCore/platform/mediastream/mac/CoreAudioCaptureSource.cpp:
    (WebCore::CoreAudioCaptureSource::handleNewCurrentMicrophoneDevice):
    * Source/WebCore/platform/mediastream/mac/CoreAudioCaptureSource.h:
    * Source/WebCore/platform/mediastream/mac/RealtimeMediaSourceCenterMac.mm:
    (WebCore::RealtimeMediaSourceCenter::shouldInterruptAudioOnPageVisibilityChange):
    * Source/WebCore/platform/mock/MockRealtimeMediaSourceCenter.cpp:
    (WebCore::MockRealtimeMediaSourceCenter::triggerMockMicrophoneConfigurationChange):
    * Source/WebCore/platform/mock/MockRealtimeMediaSourceCenter.h:
    * Source/WebKit/GPUProcess/GPUProcess.cpp:
    (WebKit::GPUProcess::triggerMockMicrophoneConfigurationChange):
    * Source/WebKit/GPUProcess/GPUProcess.h:
    * Source/WebKit/GPUProcess/GPUProcess.messages.in:
    * Source/WebKit/UIProcess/API/C/WKPage.cpp:
    (WKPageTriggerMockMicrophoneConfigurationChange):
    * Source/WebKit/UIProcess/API/C/WKPagePrivate.h:
    * Source/WebKit/UIProcess/Cocoa/UserMediaCaptureManagerProxy.cpp:
    * Source/WebKit/UIProcess/GPU/GPUProcessProxy.cpp:
    (WebKit::GPUProcessProxy::triggerMockMicrophoneConfigurationChange):
    * Source/WebKit/UIProcess/GPU/GPUProcessProxy.h:
    * Source/WebKit/WebProcess/cocoa/RemoteRealtimeMediaSource.cpp:
    (WebKit::RemoteRealtimeMediaSource::configurationChanged):
    * Source/WebKit/WebProcess/cocoa/RemoteRealtimeMediaSource.h:
    * Source/WebKit/WebProcess/cocoa/UserMediaCaptureManager.cpp:
    (WebKit::UserMediaCaptureManager::sourceConfigurationChanged):
    * Source/WebKit/WebProcess/cocoa/UserMediaCaptureManager.h:
    * Source/WebKit/WebProcess/cocoa/UserMediaCaptureManager.messages.in:
    * Tools/WebKitTestRunner/InjectedBundle/Bindings/TestRunner.idl:
    * Tools/WebKitTestRunner/InjectedBundle/TestRunner.cpp:
    (WTR::TestRunner::triggerMockMicrophoneConfigurationChange):
    * Tools/WebKitTestRunner/InjectedBundle/TestRunner.h:
    * Tools/WebKitTestRunner/TestController.cpp:
    (WTR::TestController::triggerMockMicrophoneConfigurationChange):
    * Tools/WebKitTestRunner/TestController.h:
    * Tools/WebKitTestRunner/TestInvocation.cpp:
    (WTR::TestInvocation::didReceiveSynchronousMessageFromInjectedBundle):

    Canonical link: https://commits.webkit.org/254035@main

Canonical link: https://commits.webkit.org/252432.810@safari-7614-branch


  Commit: 81e8ed48cd4d5c22a906bdbd15818289745ae730
      https://github.com/WebKit/WebKit/commit/81e8ed48cd4d5c22a906bdbd15818289745ae730
  Author: Philippe Normand <philn at igalia.com>
  Date:   2022-11-14 (Mon, 14 Nov 2022)

  Changed paths:
    M Source/WebCore/platform/mediastream/RealtimeMediaSource.h
    M Source/WebCore/platform/mediastream/gstreamer/GStreamerMediaStreamSource.cpp
    M Source/WebCore/platform/mediastream/gstreamer/RealtimeIncomingAudioSourceGStreamer.cpp
    M Source/WebCore/platform/mediastream/gstreamer/RealtimeIncomingAudioSourceGStreamer.h
    M Source/WebCore/platform/mediastream/gstreamer/RealtimeIncomingSourceGStreamer.cpp
    M Source/WebCore/platform/mediastream/gstreamer/RealtimeIncomingSourceGStreamer.h
    M Source/WebCore/platform/mediastream/gstreamer/RealtimeIncomingVideoSourceGStreamer.cpp
    M Source/WebCore/platform/mediastream/gstreamer/RealtimeIncomingVideoSourceGStreamer.h

  Log Message:
  -----------
  Cherry-pick e6b4012424bf. rdar://problem/100335624

    [GStreamer][WebRTC] Events forwarding between end-point and its consumers
    https://bugs.webkit.org/show_bug.cgi?id=247126

    Reviewed by Xabier Rodriguez-Calvar.

    We need to relay upstream events coming from depayloaders to webrtcbin and we also need to relay
    downstream events from webrtcbin to the incoming media sources. This should help improving RTP
    retransmission, for instance.

    RealtimeIncomingSourceGStreamer now directly inherits from RealtimeMediaSource in order to avoid
    duplication of the downstream event handling in each sub-class.

    * Source/WebCore/platform/mediastream/RealtimeMediaSource.h:
    * Source/WebCore/platform/mediastream/gstreamer/GStreamerMediaStreamSource.cpp:
    * Source/WebCore/platform/mediastream/gstreamer/RealtimeIncomingAudioSourceGStreamer.cpp:
    (WebCore::RealtimeIncomingAudioSourceGStreamer::RealtimeIncomingAudioSourceGStreamer):
    * Source/WebCore/platform/mediastream/gstreamer/RealtimeIncomingAudioSourceGStreamer.h:
    * Source/WebCore/platform/mediastream/gstreamer/RealtimeIncomingSourceGStreamer.cpp:
    (WebCore::RealtimeIncomingSourceGStreamer::RealtimeIncomingSourceGStreamer):
    (WebCore::RealtimeIncomingSourceGStreamer::registerClient):
    (WebCore::RealtimeIncomingSourceGStreamer::handleUpstreamEvent):
    (WebCore::RealtimeIncomingSourceGStreamer::handleDownstreamEvent):
    * Source/WebCore/platform/mediastream/gstreamer/RealtimeIncomingSourceGStreamer.h:

    Canonical link: https://commits.webkit.org/256149@main

Canonical link: https://commits.webkit.org/252432.811@safari-7614-branch


  Commit: e4e7b0ac707b420ef4485a568ce9fba2fcb65739
      https://github.com/WebKit/WebKit/commit/e4e7b0ac707b420ef4485a568ce9fba2fcb65739
  Author: Youenn Fablet <youennf at gmail.com>
  Date:   2022-11-14 (Mon, 14 Nov 2022)

  Changed paths:
    M Source/WebKit/UIProcess/UserMediaPermissionRequestManagerProxy.cpp
    M Source/WebKit/UIProcess/UserMediaPermissionRequestManagerProxy.h
    M Tools/TestWebKitAPI/Tests/WebKit/GetUserMedia.mm
    M Tools/TestWebKitAPI/Tests/WebKit/getUserMedia.html

  Log Message:
  -----------
  Cherry-pick 3142453d3762. rdar://problem/100335624

    enumerateDevices may return filtered devices even if page is capturing
    https://bugs.webkit.org/show_bug.cgi?id=244713
    rdar://problem/99484964

    Reviewed by Eric Carlson.

    Stop using m_grantedRequests for enumerateDevices since it might be reset to ask for prompting again.
    Instead, manage a HashSet<FrameID> to store whether a particular document can get access to the whole information.
    We still reset this hash set in case we are ordered to stop capture.

    * Source/WebKit/UIProcess/UserMediaPermissionRequestManagerProxy.cpp:
    (WebKit::UserMediaPermissionRequestManagerProxy::grantRequest):
    (WebKit::UserMediaPermissionRequestManagerProxy::resetAccess):
    (WebKit::UserMediaPermissionRequestManagerProxy::searchForGrantedRequest const):
    (WebKit::UserMediaPermissionRequestManagerProxy::updateStoredRequests):
    (WebKit::UserMediaPermissionRequestManagerProxy::processUserMediaPermissionInvalidRequest):
    (WebKit::UserMediaPermissionRequestManagerProxy::shouldChangeDeniedToPromptForCamera const):
    (WebKit::UserMediaPermissionRequestManagerProxy::shouldChangeDeniedToPromptForMicrophone const):
    (WebKit::UserMediaPermissionRequestManagerProxy::wasGrantedVideoOrAudioAccess):
    (WebKit::UserMediaPermissionRequestManagerProxy::enumerateMediaDevicesForFrame):
    (WebKit::UserMediaPermissionRequestManagerProxy::captureStateChanged):
    (WebKit::UserMediaPermissionRequestManagerProxy::watchdogTimerFired):
    * Source/WebKit/UIProcess/UserMediaPermissionRequestManagerProxy.h:
    * Tools/TestWebKitAPI/Tests/WebKit/GetUserMedia.mm:
    * Tools/TestWebKitAPI/Tests/WebKit/getUserMedia.html:

    Canonical link: https://commits.webkit.org/254165@main

Canonical link: https://commits.webkit.org/252432.812@safari-7614-branch


  Commit: 412678090df6fedf601441f06f193783f6628c12
      https://github.com/WebKit/WebKit/commit/412678090df6fedf601441f06f193783f6628c12
  Author: Eric Carlson <eric.carlson at apple.com>
  Date:   2022-11-14 (Mon, 14 Nov 2022)

  Changed paths:
    A LayoutTests/http/tests/media/media-stream/enumerate-devices-ephemeral-id-expected.txt
    A LayoutTests/http/tests/media/media-stream/enumerate-devices-ephemeral-id.html
    A LayoutTests/http/tests/media/media-stream/resources/enumerate-devices-ephemeral-id-iframe.html
    M Source/WTF/wtf/PlatformHave.h
    M Source/WebCore/Headers.cmake
    M Source/WebCore/Modules/mediastream/CanvasCaptureMediaStreamTrack.cpp
    A Source/WebCore/Modules/mediastream/MediaDeviceHashSalts.h
    M Source/WebCore/Modules/mediastream/MediaDevices.cpp
    M Source/WebCore/Modules/mediastream/MediaDevices.h
    M Source/WebCore/Modules/mediastream/UserMediaClient.h
    M Source/WebCore/Modules/mediastream/UserMediaController.cpp
    M Source/WebCore/Modules/mediastream/UserMediaController.h
    M Source/WebCore/Modules/mediastream/UserMediaRequest.cpp
    M Source/WebCore/Modules/mediastream/UserMediaRequest.h
    M Source/WebCore/Modules/speech/SpeechRecognitionCaptureSource.cpp
    M Source/WebCore/Modules/webaudio/MediaStreamAudioSource.cpp
    M Source/WebCore/WebCore.xcodeproj/project.pbxproj
    M Source/WebCore/platform/mediastream/CaptureDevice.h
    M Source/WebCore/platform/mediastream/RealtimeIncomingAudioSource.cpp
    M Source/WebCore/platform/mediastream/RealtimeIncomingVideoSource.cpp
    M Source/WebCore/platform/mediastream/RealtimeMediaSource.cpp
    M Source/WebCore/platform/mediastream/RealtimeMediaSource.h
    M Source/WebCore/platform/mediastream/RealtimeMediaSourceCenter.cpp
    M Source/WebCore/platform/mediastream/RealtimeMediaSourceCenter.h
    M Source/WebCore/platform/mediastream/RealtimeMediaSourceFactory.h
    M Source/WebCore/platform/mediastream/RealtimeVideoCaptureSource.cpp
    M Source/WebCore/platform/mediastream/RealtimeVideoCaptureSource.h
    M Source/WebCore/platform/mediastream/RealtimeVideoSource.cpp
    M Source/WebCore/platform/mediastream/cocoa/DisplayCaptureSourceCocoa.cpp
    M Source/WebCore/platform/mediastream/cocoa/DisplayCaptureSourceCocoa.h
    M Source/WebCore/platform/mediastream/gstreamer/GStreamerAudioCaptureSource.cpp
    M Source/WebCore/platform/mediastream/gstreamer/GStreamerAudioCaptureSource.h
    M Source/WebCore/platform/mediastream/gstreamer/GStreamerCaptureDeviceManager.h
    M Source/WebCore/platform/mediastream/gstreamer/GStreamerDisplayCaptureDeviceManager.cpp
    M Source/WebCore/platform/mediastream/gstreamer/GStreamerVideoCaptureSource.cpp
    M Source/WebCore/platform/mediastream/gstreamer/GStreamerVideoCaptureSource.h
    M Source/WebCore/platform/mediastream/gstreamer/MockRealtimeAudioSourceGStreamer.cpp
    M Source/WebCore/platform/mediastream/gstreamer/MockRealtimeAudioSourceGStreamer.h
    M Source/WebCore/platform/mediastream/gstreamer/MockRealtimeVideoSourceGStreamer.cpp
    M Source/WebCore/platform/mediastream/gstreamer/MockRealtimeVideoSourceGStreamer.h
    M Source/WebCore/platform/mediastream/gstreamer/RealtimeIncomingAudioSourceGStreamer.cpp
    M Source/WebCore/platform/mediastream/gstreamer/RealtimeIncomingSourceGStreamer.cpp
    M Source/WebCore/platform/mediastream/gstreamer/RealtimeIncomingSourceGStreamer.h
    M Source/WebCore/platform/mediastream/gstreamer/RealtimeIncomingVideoSourceGStreamer.cpp
    M Source/WebCore/platform/mediastream/ios/CoreAudioCaptureSourceIOS.h
    M Source/WebCore/platform/mediastream/ios/CoreAudioCaptureSourceIOS.mm
    M Source/WebCore/platform/mediastream/mac/AVCaptureDeviceManager.mm
    M Source/WebCore/platform/mediastream/mac/AVVideoCaptureSource.h
    M Source/WebCore/platform/mediastream/mac/AVVideoCaptureSource.mm
    M Source/WebCore/platform/mediastream/mac/CoreAudioCaptureSource.cpp
    M Source/WebCore/platform/mediastream/mac/CoreAudioCaptureSource.h
    M Source/WebCore/platform/mediastream/mac/MockAudioSharedUnit.mm
    M Source/WebCore/platform/mediastream/mac/MockRealtimeVideoSourceMac.h
    M Source/WebCore/platform/mediastream/mac/MockRealtimeVideoSourceMac.mm
    M Source/WebCore/platform/mediastream/mac/RealtimeMediaSourceCenterMac.cpp
    M Source/WebCore/platform/mock/MockMediaDevice.h
    M Source/WebCore/platform/mock/MockRealtimeAudioSource.cpp
    M Source/WebCore/platform/mock/MockRealtimeAudioSource.h
    M Source/WebCore/platform/mock/MockRealtimeMediaSourceCenter.cpp
    M Source/WebCore/platform/mock/MockRealtimeMediaSourceCenter.h
    M Source/WebCore/platform/mock/MockRealtimeVideoSource.cpp
    M Source/WebCore/platform/mock/MockRealtimeVideoSource.h
    M Source/WebKit/GPUProcess/GPUProcess.cpp
    M Source/WebKit/GPUProcess/GPUProcess.h
    M Source/WebKit/GPUProcess/GPUProcess.messages.in
    M Source/WebKit/UIProcess/API/C/WKMockMediaDevice.cpp
    M Source/WebKit/UIProcess/API/C/WKMockMediaDevice.h
    M Source/WebKit/UIProcess/Cocoa/UserMediaCaptureManagerProxy.cpp
    M Source/WebKit/UIProcess/Cocoa/UserMediaCaptureManagerProxy.h
    M Source/WebKit/UIProcess/Cocoa/UserMediaCaptureManagerProxy.messages.in
    M Source/WebKit/UIProcess/GPU/GPUProcessProxy.cpp
    M Source/WebKit/UIProcess/GPU/GPUProcessProxy.h
    M Source/WebKit/UIProcess/SpeechRecognitionRemoteRealtimeMediaSource.cpp
    M Source/WebKit/UIProcess/UserMediaPermissionRequestManagerProxy.cpp
    M Source/WebKit/UIProcess/UserMediaPermissionRequestManagerProxy.h
    M Source/WebKit/UIProcess/UserMediaPermissionRequestProxy.h
    M Source/WebKit/UIProcess/WebPageProxy.cpp
    M Source/WebKit/UIProcess/WebPageProxy.h
    M Source/WebKit/UIProcess/WebPageProxy.messages.in
    M Source/WebKit/UIProcess/WebProcessPool.cpp
    M Source/WebKit/UIProcess/WebProcessPool.h
    M Source/WebKit/UIProcess/glib/UserMediaPermissionRequestManagerProxyGLib.cpp
    M Source/WebKit/WebProcess/MediaStream/UserMediaPermissionRequestManager.cpp
    M Source/WebKit/WebProcess/MediaStream/UserMediaPermissionRequestManager.h
    M Source/WebKit/WebProcess/WebCoreSupport/WebUserMediaClient.cpp
    M Source/WebKit/WebProcess/WebCoreSupport/WebUserMediaClient.h
    M Source/WebKit/WebProcess/WebPage/WebPage.cpp
    M Source/WebKit/WebProcess/WebPage/WebPage.h
    M Source/WebKit/WebProcess/WebPage/WebPage.messages.in
    M Source/WebKit/WebProcess/WebProcess.cpp
    M Source/WebKit/WebProcess/WebProcess.h
    M Source/WebKit/WebProcess/WebProcess.messages.in
    M Source/WebKit/WebProcess/cocoa/RemoteRealtimeAudioSource.cpp
    M Source/WebKit/WebProcess/cocoa/RemoteRealtimeAudioSource.h
    M Source/WebKit/WebProcess/cocoa/RemoteRealtimeMediaSource.cpp
    M Source/WebKit/WebProcess/cocoa/RemoteRealtimeMediaSource.h
    M Source/WebKit/WebProcess/cocoa/RemoteRealtimeMediaSourceProxy.cpp
    M Source/WebKit/WebProcess/cocoa/RemoteRealtimeMediaSourceProxy.h
    M Source/WebKit/WebProcess/cocoa/RemoteRealtimeVideoSource.cpp
    M Source/WebKit/WebProcess/cocoa/RemoteRealtimeVideoSource.h
    M Source/WebKit/WebProcess/cocoa/UserMediaCaptureManager.cpp
    M Source/WebKit/WebProcess/cocoa/UserMediaCaptureManager.h
    M Source/WebKit/WebProcess/glib/UserMediaCaptureManager.cpp
    M Source/WebKit/WebProcess/glib/UserMediaCaptureManager.h
    M Source/WebKit/WebProcess/glib/UserMediaCaptureManager.messages.in
    M Tools/WebKitTestRunner/InjectedBundle/Bindings/TestRunner.idl
    M Tools/WebKitTestRunner/InjectedBundle/TestRunner.cpp
    M Tools/WebKitTestRunner/InjectedBundle/TestRunner.h
    M Tools/WebKitTestRunner/TestController.cpp
    M Tools/WebKitTestRunner/TestController.h
    M Tools/WebKitTestRunner/TestInvocation.cpp

  Log Message:
  -----------
  Cherry-pick 0ee91ab89adb. rdar://problem/100335624

    Use an ephemeral device ID for the Continuity camera when it is not the system preferred
    https://bugs.webkit.org/show_bug.cgi?id=247208
    rdar://100335624

    Reviewed by Jer Noble.

    A "Continuity Camera", an iPhone used as a camera for a Macintosh, is listed as an
    AVCaptureDevice whenever it is in close enough to the Macintosh to be used, but it is only
    the "system preferred camera" when it is in an appropriate position and orientation to be
    used as a camera for the device. This means that a script may remember the device ID when
    a user has set up the phone to be used as a camera, and then pass it to getUserMedia later
    when the phone is near the Macintosh but not usable as a camera - e.g. in the user's pocket.

    To prevent this problem, use a device ID that is only valid for the lifetime of the
    current frame when a Continuity Camera is available but is not the system preferred camera.

    * LayoutTests/http/tests/media/media-stream/enumerate-devices-ephemeral-id-expected.txt: Added.
    * LayoutTests/http/tests/media/media-stream/enumerate-devices-ephemeral-id.html: Added.
    * LayoutTests/http/tests/media/media-stream/resources/enumerate-devices-ephemeral-id-iframe.html: Added.

    * Source/WTF/wtf/PlatformHave.h: Define HAVE_CONTINUITY_CAMEARA

    * Source/WebCore/Modules/mediastream/CanvasCaptureMediaStreamTrack.cpp:
    (WebCore::CanvasCaptureMediaStreamTrack::Source::Source): Update for RealtimeMediaSource constructor
    changes.
    * Source/WebCore/Modules/mediastream/MediaDevices.cpp:
    (WebCore::MediaDevices::exposeDevices): Take a MediaDeviceHashSalts instead of a String
    because there are now two hash salts.
    (WebCore::MediaDevices::enumerateDevices): Ditto.
    * Source/WebCore/Modules/mediastream/MediaDevices.h:

    * Source/WebCore/Modules/mediastream/UserMediaClient.h: Ditto.
    * Source/WebCore/Modules/mediastream/UserMediaController.cpp:
    * Source/WebCore/Modules/mediastream/UserMediaController.h:
    (WebCore::UserMediaController::enumerateMediaDevices): Ditto.

    * Source/WebCore/Modules/mediastream/UserMediaRequest.cpp:
    (WebCore::UserMediaRequest::allow): Ditto.
    * Source/WebCore/Modules/mediastream/UserMediaRequest.h:

    * Source/WebCore/Modules/speech/SpeechRecognitionCaptureSource.cpp:
    (WebCore::SpeechRecognitionCaptureSource::createRealtimeMediaSource): Update for
    RealtimeMediaSource constructor changes.

    * Source/WebCore/Modules/webaudio/MediaStreamAudioSource.cpp:
    (WebCore::MediaStreamAudioSource::MediaStreamAudioSource): Ditto.

    * Source/WebCore/WebCore.xcodeproj/project.pbxproj:

    * Source/WebCore/platform/mediastream/CaptureDevice.h:
    (WebCore::CaptureDevice::CaptureDevice): Add `isEphemeral` parameter.
    (WebCore::CaptureDevice::setPersistentId):
    (WebCore::CaptureDevice::setLabel):
    (WebCore::CaptureDevice::isEphemeral const):
    (WebCore::CaptureDevice::setIsEphemeral):
    (WebCore::CaptureDevice::encode const):
    (WebCore::CaptureDevice::decode):
    (WebCore::CaptureDevice::isolatedCopy):

    * Source/WebCore/platform/mediastream/RealtimeIncomingAudioSource.cpp:
    (WebCore::RealtimeIncomingAudioSource::RealtimeIncomingAudioSource): Update for
    RealtimeMediaSource constructor changes.

    * Source/WebCore/platform/mediastream/RealtimeIncomingVideoSource.cpp:
    (WebCore::RealtimeIncomingVideoSource::RealtimeIncomingVideoSource): Ditto.

    * Source/WebCore/platform/mediastream/RealtimeMediaSource.cpp:
    (WebCore::toSourceType):
    (WebCore::RealtimeMediaSource::RealtimeMediaSource): Take a CaptureDevice instead of a
    type, name, and device ID. Take a MediaDeviceHashSalts instead of a String for the salts.
    (WebCore::RealtimeMediaSource::setPersistentId):
    (WebCore::RealtimeMediaSource::initializePersistentId): Calculate persistent and ephemeral
    hashed IDs.
    (WebCore::RealtimeMediaSource::fitnessDistance): m_hashedID -> hashedID()
    (WebCore::RealtimeMediaSource::hashedId const): Consider ephemeral state.
    (WebCore::RealtimeMediaSource::deviceIDHashSalts const):
    (WebCore::RealtimeMediaSource::setLogger):
    (WebCore::RealtimeMediaSource::deviceIDHashSalt const): Deleted.
    * Source/WebCore/platform/mediastream/RealtimeMediaSource.h:

    * Source/WebCore/platform/mediastream/RealtimeMediaSourceCenter.cpp:
    (WebCore::RealtimeMediaSourceCenter::createMediaStream): Take MediaDeviceHashSalts with the
    hash salts.
    (WebCore::RealtimeMediaSourceCenter::getDisplayMediaDevices): Ditto.
    (WebCore::RealtimeMediaSourceCenter::getUserMediaDevices): Ditto.
    (WebCore::RealtimeMediaSourceCenter::validateRequestConstraints): Ditto.
    (WebCore::RealtimeMediaSourceCenter::validateRequestConstraintsAfterEnumeration): Ditto.
    * Source/WebCore/platform/mediastream/RealtimeMediaSourceCenter.h:

    * Source/WebCore/platform/mediastream/RealtimeMediaSourceFactory.h: Ditto.
    * Source/WebCore/platform/mediastream/RealtimeMediaSourceSettings.h: Ditto.

    * Source/WebCore/platform/mediastream/RealtimeVideoCaptureSource.cpp:
    (WebCore::RealtimeVideoCaptureSource::RealtimeVideoCaptureSource): Update for RealtimeMediaSource
    constructor changes.
    * Source/WebCore/platform/mediastream/RealtimeVideoCaptureSource.h:

    * Source/WebCore/platform/mediastream/RealtimeVideoSource.cpp:
    (WebCore::RealtimeVideoSource::RealtimeVideoSource): Ditto.

    * Source/WebCore/platform/mediastream/cocoa/DisplayCaptureSourceCocoa.cpp:
    (WebCore::DisplayCaptureSourceCocoa::create): Ditto.
    (WebCore::DisplayCaptureSourceCocoa::DisplayCaptureSourceCocoa): Ditto.
    * Source/WebCore/platform/mediastream/cocoa/DisplayCaptureSourceCocoa.h:

    * Source/WebCore/platform/mediastream/ios/CoreAudioCaptureSourceIOS.h:
    * Source/WebCore/platform/mediastream/ios/CoreAudioCaptureSourceIOS.mm:
    (WebCore::CoreAudioCaptureSourceFactoryIOS::createAudioCaptureSource): Ditto.

    * Source/WebCore/platform/mediastream/mac/AVCaptureDeviceManager.mm:
    (WebCore::AVCaptureDeviceManager::updateCachedAVCaptureDevices):
    (WebCore::toCaptureDevice): Make Continuity Camera ephemeral when it is not the system
    preferred camera.
    (WebCore::AVCaptureDeviceManager::retrieveCaptureDevices):

    * Source/WebCore/platform/mediastream/mac/AVVideoCaptureSource.h:
    * Source/WebCore/platform/mediastream/mac/AVVideoCaptureSource.mm:
    (WebCore::AVVideoCaptureSource::create): Update for RealtimeMediaSource constructor changes.
    (WebCore::AVVideoCaptureSource::AVVideoCaptureSource): Ditto.

    * Source/WebCore/platform/mediastream/mac/CoreAudioCaptureSource.cpp:
    (WebCore::CoreAudioCaptureSource::create): Ditto.
    (WebCore::CoreAudioCaptureSource::createForTesting): Ditto.
    (WebCore::CoreAudioCaptureSource::CoreAudioCaptureSource): Ditto.
    * Source/WebCore/platform/mediastream/mac/CoreAudioCaptureSource.h:
    (WebCore::CoreAudioCaptureSourceFactory::createAudioCaptureSource):

    * Source/WebCore/platform/mediastream/mac/MockAudioSharedUnit.mm:
    (WebCore::MockRealtimeAudioSource::create): Ditto.

    * Source/WebCore/platform/mediastream/mac/MockRealtimeVideoSourceMac.h:
    * Source/WebCore/platform/mediastream/mac/MockRealtimeVideoSourceMac.mm:
    (WebCore::MockRealtimeVideoSource::create): Ditto.
    (WebCore::MockRealtimeVideoSourceMac::createForMockDisplayCapturer): Ditto.
    (WebCore::MockRealtimeVideoSourceMac::MockRealtimeVideoSourceMac): Ditto.

    * Source/WebCore/platform/mediastream/mac/RealtimeMediaSourceCenterMac.cpp:
    * Source/WebCore/platform/mock/MockMediaDevice.h:
    (WebCore::MockMediaDevice::captureDevice const): Allow to be ephemeral .
    (WebCore::MockMediaDevice::encode const):
    (WebCore::MockMediaDevice::decodeMockMediaDevice):
    (WebCore::MockMediaDevice::decode):

    * Source/WebCore/platform/mock/MockRealtimeAudioSource.cpp:
    (WebCore::MockRealtimeAudioSource::create): Update for RealtimeMediaSource constructor changes.
    (WebCore::MockRealtimeAudioSource::MockRealtimeAudioSource): Ditto.
    * Source/WebCore/platform/mock/MockRealtimeAudioSource.h:

    * Source/WebCore/platform/mock/MockRealtimeMediaSourceCenter.cpp:
    (WebCore::defaultDevices): No devices are ephemeral by default.
    (WebCore::MockDisplayCapturer::MockDisplayCapturer): Update for RealtimeMediaSource constructor
    changes.
    (WebCore::MockRealtimeMediaSourceCenter::setDeviceIsEphemeral):
    * Source/WebCore/platform/mock/MockRealtimeMediaSourceCenter.h:

    * Source/WebCore/platform/mock/MockRealtimeVideoSource.cpp:
    (WebCore::MockRealtimeVideoSource::create): Ditto.
    (WebCore::MockRealtimeVideoSource::MockRealtimeVideoSource): Ditto.
    * Source/WebCore/platform/mock/MockRealtimeVideoSource.h:

    * Source/WebKit/GPUProcess/GPUProcess.cpp:
    (WebKit::GPUProcess::setMockMediaDeviceIsEphemeral): Added for testing.
    * Source/WebKit/GPUProcess/GPUProcess.h:
    * Source/WebKit/GPUProcess/GPUProcess.messages.in:
    * Source/WebKit/UIProcess/API/C/WKMockMediaDevice.cpp:
    (WKAddMockMediaDevice):
    (WKSetMockMediaDeviceIsEphemeral):
    * Source/WebKit/UIProcess/API/C/WKMockMediaDevice.h:

    * Source/WebKit/UIProcess/Cocoa/UserMediaCaptureManagerProxy.cpp:
    (WebKit::UserMediaCaptureManagerProxy::createMicrophoneSource):
    (WebKit::UserMediaCaptureManagerProxy::createCameraSource):
    (WebKit::UserMediaCaptureManagerProxy::createMediaSourceForCaptureDeviceWithConstraints):
    * Source/WebKit/UIProcess/Cocoa/UserMediaCaptureManagerProxy.h:
    * Source/WebKit/UIProcess/Cocoa/UserMediaCaptureManagerProxy.messages.in:
    * Source/WebKit/UIProcess/GPU/GPUProcessProxy.cpp:
    (WebKit::GPUProcessProxy::setMockMediaDeviceIsEphemeral):
    * Source/WebKit/UIProcess/GPU/GPUProcessProxy.h:
    * Source/WebKit/UIProcess/SpeechRecognitionRemoteRealtimeMediaSource.cpp:
    (WebKit::SpeechRecognitionRemoteRealtimeMediaSource::SpeechRecognitionRemoteRealtimeMediaSource):
    (): Deleted.
    * Source/WebKit/UIProcess/UserMediaPermissionRequestManagerProxy.cpp:
    (WebKit::UserMediaPermissionRequestManagerProxy::finishGrantingRequest): Take MediaDeviceHashSalts
    for hash salts.
    (WebKit::UserMediaPermissionRequestManagerProxy::didCommitLoadForFrame): Clear ephemeral
    salt for a frame.
    (WebKit::UserMediaPermissionRequestManagerProxy::resetAccess): Ditto.
    (WebKit::UserMediaPermissionRequestManagerProxy::ephemeralDeviceHashSaltForFrame): Calculate
    or lookup an ephemeral salt for a frame.
    (WebKit::UserMediaPermissionRequestManagerProxy::processUserMediaPermissionRequest): Use
    MediaDeviceHashSalts.
    (WebKit::UserMediaPermissionRequestManagerProxy::platformValidateUserMediaRequestConstraints): Ditto.
    (WebKit::UserMediaPermissionRequestManagerProxy::processUserMediaPermissionValidRequest): Ditto.
    (WebKit::UserMediaPermissionRequestManagerProxy::enumerateMediaDevicesForFrame): Ditto.
    * Source/WebKit/UIProcess/UserMediaPermissionRequestManagerProxy.h:

    * Source/WebKit/UIProcess/UserMediaPermissionRequestProxy.h:
    (WebKit::UserMediaPermissionRequestProxy::setDeviceIdentifierHashSalts): *HashSalt -> *HashSalts
    (WebKit::UserMediaPermissionRequestProxy::deviceIdentifierHashSalts const): Ditto
    (WebKit::UserMediaPermissionRequestProxy::setDeviceIdentifierHashSalt): Deleted.
    (WebKit::UserMediaPermissionRequestProxy::deviceIdentifierHashSalt const): Deleted.

    * Source/WebKit/UIProcess/WebPageProxy.cpp:
    (WebKit::WebPageProxy::didCommitLoadForFrame): Let UserMediaPermissionRequestManager know the
    frame has reloaded so it can clear the ephemeral salt ID.
    (WebKit::WebPageProxy::enumerateMediaDevicesForFrame):
    * Source/WebKit/UIProcess/WebPageProxy.h:
    * Source/WebKit/UIProcess/WebPageProxy.messages.in:

    * Source/WebKit/UIProcess/WebProcessPool.cpp:
    (WebKit::WebProcessPool::setMockMediaDeviceIsEphemeral):
    * Source/WebKit/UIProcess/WebProcessPool.h:

    * Source/WebKit/WebProcess/MediaStream/UserMediaPermissionRequestManager.cpp:
    (WebKit::UserMediaPermissionRequestManager::userMediaAccessWasGranted):
    (WebKit::UserMediaPermissionRequestManager::enumerateMediaDevices):
    * Source/WebKit/WebProcess/MediaStream/UserMediaPermissionRequestManager.h:

    * Source/WebKit/WebProcess/WebCoreSupport/WebUserMediaClient.cpp:
    (WebKit::WebUserMediaClient::enumerateMediaDevices):
    * Source/WebKit/WebProcess/WebCoreSupport/WebUserMediaClient.h:

    * Source/WebKit/WebProcess/WebPage/WebPage.cpp:
    (WebKit::WebPage::userMediaAccessWasGranted):
    * Source/WebKit/WebProcess/WebPage/WebPage.h:
    * Source/WebKit/WebProcess/WebPage/WebPage.messages.in:

    * Source/WebKit/WebProcess/WebProcess.cpp:
    (WebKit::WebProcess::setMockMediaDeviceIsEphemeral):
    * Source/WebKit/WebProcess/WebProcess.h:
    * Source/WebKit/WebProcess/WebProcess.messages.in:

    * Source/WebKit/WebProcess/cocoa/RemoteRealtimeAudioSource.cpp:
    (WebKit::RemoteRealtimeAudioSource::create): Update for RealtimeMediaSource constructor change.
    (WebKit::RemoteRealtimeAudioSource::RemoteRealtimeAudioSource): Ditto.
    * Source/WebKit/WebProcess/cocoa/RemoteRealtimeAudioSource.h:

    * Source/WebKit/WebProcess/cocoa/RemoteRealtimeMediaSource.cpp:
    (WebKit::RemoteRealtimeMediaSource::RemoteRealtimeMediaSource): Ditto.
    (WebKit::RemoteRealtimeMediaSource::createRemoteMediaSource): Ditto.
    (WebKit::toSourceType): Deleted.
    (WebKit::m_manager): Deleted.
    * Source/WebKit/WebProcess/cocoa/RemoteRealtimeMediaSource.h:

    * Source/WebKit/WebProcess/cocoa/RemoteRealtimeMediaSourceProxy.cpp:
    (WebKit::RemoteRealtimeMediaSourceProxy::createRemoteMediaSource): Ditto.
    * Source/WebKit/WebProcess/cocoa/RemoteRealtimeMediaSourceProxy.h:

    * Source/WebKit/WebProcess/cocoa/RemoteRealtimeVideoSource.cpp:
    (WebKit::RemoteRealtimeVideoSource::create): Ditto.
    (WebKit::RemoteRealtimeVideoSource::RemoteRealtimeVideoSource): Ditto.
    (WebKit::RemoteRealtimeVideoSource::clone): Ditto.
    * Source/WebKit/WebProcess/cocoa/RemoteRealtimeVideoSource.h:

    * Source/WebKit/WebProcess/cocoa/UserMediaCaptureManager.cpp:
    (WebKit::UserMediaCaptureManager::AudioFactory::createAudioCaptureSource): Ditto.
    (WebKit::UserMediaCaptureManager::VideoFactory::createVideoCaptureSource): Ditto.
    (WebKit::UserMediaCaptureManager::DisplayFactory::createDisplayCaptureSource): Ditto.
    * Source/WebKit/WebProcess/cocoa/UserMediaCaptureManager.h:

    * Tools/WebKitTestRunner/InjectedBundle/Bindings/TestRunner.idl: Add setMockMediaDeviceIsEphemeral.
    * Tools/WebKitTestRunner/InjectedBundle/TestRunner.cpp:
    (WTR::TestRunner::setMockMediaDeviceIsEphemeral):
    * Tools/WebKitTestRunner/InjectedBundle/TestRunner.h:

    * Tools/WebKitTestRunner/TestController.cpp:
    (WTR::TestController::setMockMediaDeviceIsEphemeral):
    * Tools/WebKitTestRunner/TestController.h:

    * Tools/WebKitTestRunner/TestInvocation.cpp:
    (WTR::TestInvocation::didReceiveSynchronousMessageFromInjectedBundle):

    Canonical link: https://commits.webkit.org/256161@main

Canonical link: https://commits.webkit.org/252432.813@safari-7614-branch


  Commit: 232c36e80d3d4a6bfe9a2c0ce858b1f5b07439fd
      https://github.com/WebKit/WebKit/commit/232c36e80d3d4a6bfe9a2c0ce858b1f5b07439fd
  Author: Eric Carlson <eric.carlson at apple.com>
  Date:   2022-11-14 (Mon, 14 Nov 2022)

  Changed paths:
    M Source/WebKit/UIProcess/WebPageProxy.cpp

  Log Message:
  -----------
  Cherry-pick ff70798d7add. rdar://problem/100335624

    REGRESSION (256161 at main): [ macOS Debug ] TestWebKitAPI.GPUProcess.OnlyLaunchesGPUProcessWhenNecessaryMediaFeatureDetection is a consistent failure
    https://bugs.webkit.org/show_bug.cgi?id=247775
    rdar://102221029

    Reviewed by Darin Adler and John Wilander.

    * Source/WebKit/UIProcess/WebPageProxy.cpp:
    (WebKit::WebPageProxy::didCommitLoadForFrame): Use `m_userMediaPermissionRequestManager`
    instead of `userMediaPermissionRequestManager()`` so we don't create the manager, and thus
    the GPU process, if it doesn't already exist.

    Canonical link: https://commits.webkit.org/256591@main

Canonical link: https://commits.webkit.org/252432.814@safari-7614-branch


  Commit: 39ea2ef85ef01a06a975061de1b739e24b9d4384
      https://github.com/WebKit/WebKit/commit/39ea2ef85ef01a06a975061de1b739e24b9d4384
  Author: Alan Coon <alancoon at apple.com>
  Date:   2022-11-14 (Mon, 14 Nov 2022)

  Changed paths:
    M Source/WebKit/UIProcess/UserMediaPermissionRequestManagerProxy.cpp

  Log Message:
  -----------
  Cherry-pick 082f404b4d5a. rdar://problem/100335624

    Apply build fix. rdar://problem/100335624

    Source/WebKit/UIProcess/UserMediaPermissionRequestManagerProxy.cpp:316:39: error: no member named 'object' in 'WTF::ObjectIdentifier<WebCore::FrameIdentifierType>'

    Canonical link: https://commits.webkit.org/252432.818@safari-7614.3.7.0-branch

Canonical link: https://commits.webkit.org/252432.815@safari-7614-branch


  Commit: fa17c4664715128538e30232be4e1669ff26a5e8
      https://github.com/WebKit/WebKit/commit/fa17c4664715128538e30232be4e1669ff26a5e8
  Author: Ryosuke Niwa <rniwa at webkit.org>
  Date:   2022-11-14 (Mon, 14 Nov 2022)

  Changed paths:
    A LayoutTests/editing/selection/modify-extend-iframe-orphan-expected.txt
    A LayoutTests/editing/selection/modify-extend-iframe-orphan.html
    M Source/WebCore/editing/FrameSelection.cpp

  Log Message:
  -----------
  ASSERTION FAILED: !document().selection().selection().isOrphan() in ContainerNode::removeNodeWithScriptAssertion
https://bugs.webkit.org/show_bug.cgi?id=247781
rdar://101497964

Reviewed by Wenson Hsieh, Darin Adler and Geoffrey Garen.

The bug was caused by VisibleSelection::setBase setting selection ends to point to nodes
in a wrong document as a side effect of calling VisibleSelection::validate when m_anchor
isn't cleared due to a node removal when live range selection is disabled.

* LayoutTests/editing/selection/modify-extend-iframe-orphan-expected.txt: Added.
* LayoutTests/editing/selection/modify-extend-iframe-orphan.html: Added.
* Source/WebCore/editing/FrameSelection.cpp:
(WebCore::selectionIsOrphanedOrBelongsToWrongDocument):
(WebCore::FrameSelection::willBeModified):

Canonical link: https://commits.webkit.org/252432.816@safari-7614-branch


  Commit: 205c3c9599393a95e4fbc7569a5633bb452d9e30
      https://github.com/WebKit/WebKit/commit/205c3c9599393a95e4fbc7569a5633bb452d9e30
  Author: Alan Coon <alancoon at apple.com>
  Date:   2022-11-15 (Tue, 15 Nov 2022)

  Changed paths:
    M Source/WebKit/NetworkProcess/storage/SQLiteStorageArea.cpp
    M Source/WebKit/NetworkProcess/storage/SQLiteStorageArea.h

  Log Message:
  -----------
  Revert 0297f1253a4f. rdar://problem/101927216

Canonical link: https://commits.webkit.org/252432.816@safari-7614-branch


  Commit: cf21e709f64879d9ff44c391d31c742cc92c98ce
      https://github.com/WebKit/WebKit/commit/cf21e709f64879d9ff44c391d31c742cc92c98ce
  Author: Youenn Fablet <youennf at gmail.com>
  Date:   2022-11-15 (Tue, 15 Nov 2022)

  Changed paths:
    M Source/WebCore/Modules/mediastream/RTCNetworkManager.h
    M Source/WebCore/dom/Document.cpp
    M Source/WebKit/WebProcess/Network/webrtc/LibWebRTCNetworkManager.cpp
    M Source/WebKit/WebProcess/Network/webrtc/LibWebRTCNetworkManager.h

  Log Message:
  -----------
  Cherry-pick f394e0a05ff1. rdar://problem/99799545

    Explicitly close a document RTCNetworkManager on document teardown
    https://bugs.webkit.org/show_bug.cgi?id=247413
    rdar://99799545

    Reviewed by Eric Carlson.

    The combination of keeping a WeakPtr of a ThreadSafeRefCounted is problematic,
    as we might have lost the last Ref/RefPtr (hence the object is scheduled to be deleted)
    but we still have a non null reference via a WeakPtr, which we could potentially create a new Ref on it.
    We fix the particular issue here by closing explicitly LibWebRTCNetworkManager
    which will remove the LibWebRTCNetworkManager from the WebRTCMonitor WeakHashSet.
    Add ASSERTs to ensure close is called before destroying LibWebRTCNetworkManager.

    * Source/WebCore/Modules/mediastream/RTCNetworkManager.h:
    * Source/WebCore/dom/Document.cpp:
    (WebCore::Document::commonTeardown):
    * Source/WebKit/WebProcess/Network/webrtc/LibWebRTCNetworkManager.cpp:
    (WebKit::LibWebRTCNetworkManager::getOrCreate):
    (WebKit::LibWebRTCNetworkManager::LibWebRTCNetworkManager):
    (WebKit::LibWebRTCNetworkManager::~LibWebRTCNetworkManager):
    (WebKit::LibWebRTCNetworkManager::close):

    Canonical link: https://commits.webkit.org/256319@main

Canonical link: https://commits.webkit.org/252432.817@safari-7614-branch


  Commit: c3f151631ec4d7cd015dc3a1276d82e56813d038
      https://github.com/WebKit/WebKit/commit/c3f151631ec4d7cd015dc3a1276d82e56813d038
  Author: Jer Noble <jer.noble at apple.com>
  Date:   2022-11-15 (Tue, 15 Nov 2022)

  Changed paths:
    M LayoutTests/media/video-object-fit.html
    M LayoutTests/platform/mac/TestExpectations
    M Source/WebCore/platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.cpp
    M Source/WebKit/GPUProcess/media/RemoteMediaPlayerProxy.cpp
    M Source/WebKit/GPUProcess/media/RemoteMediaPlayerProxy.h
    M Source/WebKit/GPUProcess/media/RemoteMediaPlayerProxy.messages.in
    M Source/WebKit/GPUProcess/media/cocoa/RemoteMediaPlayerProxyCocoa.mm
    M Source/WebKit/GPUProcess/media/gstreamer/RemoteMediaPlayerProxyGStreamer.cpp
    M Source/WebKit/GPUProcess/media/playstation/RemoteMediaPlayerProxyPlayStation.cpp
    M Source/WebKit/GPUProcess/media/win/RemoteMediaPlayerProxyWin.cpp
    M Source/WebKit/WebProcess/GPU/media/MediaPlayerPrivateRemote.cpp
    M Source/WebKit/WebProcess/GPU/media/MediaPlayerPrivateRemote.h
    M Source/WebKit/WebProcess/GPU/media/MediaPlayerPrivateRemote.messages.in
    M Source/WebKit/WebProcess/GPU/media/cocoa/MediaPlayerPrivateRemoteCocoa.mm

  Log Message:
  -----------
  Cherry-pick 5c28999a8939. rdar://problem/101298592

    REGRESSION?(255635 at main): [ iOS ] media/video-object-fit.html is a constant failure
    https://bugs.webkit.org/show_bug.cgi?id=246698
    rdar://101298592

    Reviewed by Eric Carlson.

    Refactor the test to rely on rVFC(), rather than `canplaythrough`.

    * LayoutTests/media/video-object-fit.html:
    * LayoutTests/platform/ios-wk2/TestExpectations:
    * LayoutTests/platform/mac/TestExpectations:

    Because isReadyForVideoSetup() relies on m_readyState, make sure to check it
    _after_ the ready state is changed, not before.

    * Source/WebCore/platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.cpp:
    (WebCore::MediaPlayerPrivateAVFoundation::updateStates):

    When PrepareForPlayback() is sent, the RemoteMediaPlayerProxy will create a remote
    layer hosting context, and in the callback, MediaPlayerPrivateRemote will create a
    layer. However this happens _way_ before the remote player is actually ready to display
    content, and _way_ before the remote player has a valid naturalSize. So the initial
    layout will place the remotely hosted layer assuming a default replaced size of
    300x150, which leads to a weird layout change when the true naturalSize change occurs.

    Only create a layer hosting context when the remote player says that it has a layer
    to display. This guarantees that the initial layer layout of the video content happens
    _after_ the naturalSize is known and sizes the layer correctly.

    * Source/WebKit/GPUProcess/media/RemoteMediaPlayerProxy.cpp:
    (WebKit::RemoteMediaPlayerProxy::prepareForPlayback):
    * Source/WebKit/GPUProcess/media/RemoteMediaPlayerProxy.h:
    * Source/WebKit/GPUProcess/media/RemoteMediaPlayerProxy.messages.in:
    * Source/WebKit/GPUProcess/media/cocoa/RemoteMediaPlayerProxyCocoa.mm:
    (WebKit::RemoteMediaPlayerProxy::setVideoInlineSizeIfPossible):
    (WebKit::RemoteMediaPlayerProxy::mediaPlayerRenderingModeChanged):
    (WebKit::RemoteMediaPlayerProxy::setVideoInlineSizeFenced):
    (WebKit::RemoteMediaPlayerProxy::prepareForPlayback): Deleted.
    * Source/WebKit/GPUProcess/media/gstreamer/RemoteMediaPlayerProxyGStreamer.cpp:
    (WebKit::RemoteMediaPlayerProxy::prepareForPlayback): Deleted.
    * Source/WebKit/GPUProcess/media/playstation/RemoteMediaPlayerProxyPlayStation.cpp:
    (WebKit::RemoteMediaPlayerProxy::prepareForPlayback): Deleted.
    * Source/WebKit/GPUProcess/media/win/RemoteMediaPlayerProxyWin.cpp:
    (WebKit::RemoteMediaPlayerProxy::prepareForPlayback): Deleted.
    * Source/WebKit/WebProcess/GPU/media/MediaPlayerPrivateRemote.cpp:
    (WebKit::MediaPlayerPrivateRemote::prepareForPlayback):
    * Source/WebKit/WebProcess/GPU/media/MediaPlayerPrivateRemote.h:
    * Source/WebKit/WebProcess/GPU/media/MediaPlayerPrivateRemote.messages.in:
    * Source/WebKit/WebProcess/GPU/media/cocoa/MediaPlayerPrivateRemoteCocoa.mm:
    (WebKit::MediaPlayerPrivateRemote::layerHostingContextIdChanged):

    Canonical link: https://commits.webkit.org/256320@main

Canonical link: https://commits.webkit.org/252432.818@safari-7614-branch


  Commit: 9b6cab637a1ae4a22c3deed0a27211dcdc5abba5
      https://github.com/WebKit/WebKit/commit/9b6cab637a1ae4a22c3deed0a27211dcdc5abba5
  Author: Myles C. Maxfield <mmaxfield at apple.com>
  Date:   2022-11-15 (Tue, 15 Nov 2022)

  Changed paths:
    A LayoutTests/imported/w3c/web-platform-tests/encoding/resources/unsupported-labels.window.js
    A LayoutTests/imported/w3c/web-platform-tests/encoding/unsupported-labels-expected.txt
    A LayoutTests/imported/w3c/web-platform-tests/encoding/unsupported-labels.html
    A LayoutTests/platform/gtk/imported/w3c/web-platform-tests/encoding/unsupported-labels-expected.txt
    M Source/WebCore/PAL/pal/text/TextCodecICU.cpp

  Log Message:
  -----------
  Cherry-pick 996fc9db28be. rdar://problem/100893154

    The EUC-TW encoding doesn't have a canonical name
    https://bugs.webkit.org/show_bug.cgi?id=246242
    rdar://100893154

    Reviewed by Alex Christensen.

    ucnv_getCanonicalName("EUC-TW", "IANA") is returning nullptr, which is causing
    us to memcmp(nullptr, ...). This patch reorganizes the file to call ucnv_getName()
    in the situations where ucnv_getCanonicalName() is returning nullptr, thereby
    elliminating the need for all the special cases.

    Test: imported/w3c/web-platform-tests/encoding/unsupported-labels.html

    * Source/WebCore/PAL/pal/text/TextCodecICU.cpp:
    (PAL::TextCodecICU::registerCodecs):
    (PAL::TextCodecICU::TextCodecICU):

    Canonical link: https://commits.webkit.org/256438@main

Canonical link: https://commits.webkit.org/252432.819@safari-7614-branch


  Commit: 14199aa385ec3b86b01a801f96b83655fc6fb574
      https://github.com/WebKit/WebKit/commit/14199aa385ec3b86b01a801f96b83655fc6fb574
  Author: J Pascoe <j_pascoe at apple.com>
  Date:   2022-11-15 (Tue, 15 Nov 2022)

  Changed paths:
    M Source/WebKit/UIProcess/Cocoa/SOAuthorization/NavigationSOAuthorizationSession.h
    M Source/WebKit/UIProcess/Cocoa/SOAuthorization/NavigationSOAuthorizationSession.mm
    M Source/WebKit/UIProcess/Cocoa/SOAuthorization/PopUpSOAuthorizationSession.h
    M Source/WebKit/UIProcess/Cocoa/SOAuthorization/PopUpSOAuthorizationSession.mm
    M Source/WebKit/UIProcess/Cocoa/SOAuthorization/RedirectSOAuthorizationSession.h
    M Source/WebKit/UIProcess/Cocoa/SOAuthorization/RedirectSOAuthorizationSession.mm
    M Source/WebKit/UIProcess/Cocoa/SOAuthorization/SOAuthorizationCoordinator.mm
    M Source/WebKit/UIProcess/Cocoa/SOAuthorization/SOAuthorizationSession.h
    M Source/WebKit/UIProcess/Cocoa/SOAuthorization/SOAuthorizationSession.mm
    M Source/WebKit/UIProcess/Cocoa/SOAuthorization/SubFrameSOAuthorizationSession.h
    M Source/WebKit/UIProcess/Cocoa/SOAuthorization/SubFrameSOAuthorizationSession.mm
    M Source/WebKit/UIProcess/Cocoa/SOAuthorization/WKSOAuthorizationDelegate.mm

  Log Message:
  -----------
  Cherry-pick 5d4cfd0b4223. rdar://problem/101836775

    Set SOAuthorization's delegate after creation
    https://bugs.webkit.org/show_bug.cgi?id=247585
    rdar://101836775

    Reviewed by Brent Fulgham.

    The previous process for changing the SOAuthorizationSession and setting the SOAuthorizationDelegate
    can lead to a race where the ssesion is set multiple times in a very short period. The session swap
    logic in [WKSOAuthorizationDelegate setSession] can set the delegate to null which can end up cancelling
    the new request. This patch restores setting SOAuthorization when initializing the session.

    Covered by existing SOAuthorization tests.

    * Source/WebKit/UIProcess/Cocoa/SOAuthorization/NavigationSOAuthorizationSession.h:
    * Source/WebKit/UIProcess/Cocoa/SOAuthorization/NavigationSOAuthorizationSession.mm:
    (WebKit::NavigationSOAuthorizationSession::NavigationSOAuthorizationSession):
    * Source/WebKit/UIProcess/Cocoa/SOAuthorization/PopUpSOAuthorizationSession.h:
    * Source/WebKit/UIProcess/Cocoa/SOAuthorization/PopUpSOAuthorizationSession.mm:
    (WebKit::PopUpSOAuthorizationSession::create):
    (WebKit::PopUpSOAuthorizationSession::PopUpSOAuthorizationSession):
    * Source/WebKit/UIProcess/Cocoa/SOAuthorization/RedirectSOAuthorizationSession.h:
    * Source/WebKit/UIProcess/Cocoa/SOAuthorization/RedirectSOAuthorizationSession.mm:
    (WebKit::RedirectSOAuthorizationSession::create):
    (WebKit::RedirectSOAuthorizationSession::RedirectSOAuthorizationSession):
    * Source/WebKit/UIProcess/Cocoa/SOAuthorization/SOAuthorizationCoordinator.mm:
    (WebKit::SOAuthorizationCoordinator::tryAuthorize):
    * Source/WebKit/UIProcess/Cocoa/SOAuthorization/SOAuthorizationSession.h:
    * Source/WebKit/UIProcess/Cocoa/SOAuthorization/SOAuthorizationSession.mm:
    (WebKit::SOAuthorizationSession::SOAuthorizationSession):
    (WebKit::SOAuthorizationSession::setSOAuthorizationDelegate): Deleted.
    * Source/WebKit/UIProcess/Cocoa/SOAuthorization/SubFrameSOAuthorizationSession.h:
    * Source/WebKit/UIProcess/Cocoa/SOAuthorization/SubFrameSOAuthorizationSession.mm:
    (WebKit::SubFrameSOAuthorizationSession::create):
    (WebKit::SubFrameSOAuthorizationSession::SubFrameSOAuthorizationSession):
    * Source/WebKit/UIProcess/Cocoa/SOAuthorization/WKSOAuthorizationDelegate.mm:
    (-[WKSOAuthorizationDelegate setSession:]):

    Canonical link: https://commits.webkit.org/256460@main

Canonical link: https://commits.webkit.org/252432.820@safari-7614-branch


  Commit: dec61a1beb90a233df240e34b421444ffaa11b89
      https://github.com/WebKit/WebKit/commit/dec61a1beb90a233df240e34b421444ffaa11b89
  Author: David Degazio <d_degazio at apple.com>
  Date:   2022-11-15 (Tue, 15 Nov 2022)

  Changed paths:
    A JSTests/stress/intl-locale-invalid-hourCycles.js
    M Source/JavaScriptCore/runtime/IntlLocale.cpp

  Log Message:
  -----------
  Cherry-pick 86fbeb6fcd63. rdar://problem/102031379

    Intl.Locale.prototype.hourCycles leaks empty JSValue to script
    https://bugs.webkit.org/show_bug.cgi?id=247562
    rdar://102031379

    Reviewed by Mark Lam.

    We currently don't check if IntlLocale::hourCycles returns a null JSArray, which allows it
    to be encoded as an empty JSValue and exposed to user code. This patch throws a TypeError
    when udatpg_open returns a failed status.

    * JSTests/stress/intl-locale-invalid-hourCycles.js: Added.
    (main):
    * Source/JavaScriptCore/runtime/IntlLocale.cpp:
    (JSC::IntlLocale::hourCycles):

    Canonical link: https://commits.webkit.org/256473@main

Canonical link: https://commits.webkit.org/252432.821@safari-7614-branch


  Commit: 1b30336865220056fcfd6436d01f5e88b8be88b9
      https://github.com/WebKit/WebKit/commit/1b30336865220056fcfd6436d01f5e88b8be88b9
  Author: Wenson Hsieh <wenson_hsieh at apple.com>
  Date:   2022-11-15 (Tue, 15 Nov 2022)

  Changed paths:
    A LayoutTests/fast/viewport/ios/adjust-fixed-width-and-initial-scale-to-avoid-excessive-zooming-expected.txt
    A LayoutTests/fast/viewport/ios/adjust-fixed-width-and-initial-scale-to-avoid-excessive-zooming.html
    M Source/WebCore/page/ViewportConfiguration.cpp
    M Source/WebCore/page/ViewportConfiguration.h
    M Source/WebKit/WebProcess/WebPage/WebPage.cpp

  Log Message:
  -----------
  Cherry-pick 36ed6c6840cc. rdar://problem/99448942

    [iPadOS] Wikipedia pages are excessively zoomed in when viewed in an external display
    https://bugs.webkit.org/show_bug.cgi?id=247636
    rdar://99448942

    Reviewed by Tim Horton.

    When loading Wikipedia articles in an external display connected to iPad, the page dynamically sets
    the meta viewport content string to `width=1000, initial-scale=3.6` (where the initial scale depends
    on how wide the display is — in this example, 3600px wide). This leads to the contents of the
    article being excessively zoomed, and difficult to read.

    To mitigate this, we add a viewport sizing heuristic to cap the maximum initial scale of the page to
    a much more reasonable value (somewhat arbitrarily chosen to be 1.2) in the case where both the
    initial scale and viewport width are explicitly set. To keep this fixed-width viewport consistent
    with the new initial scale, we also adjust the explicitly-specified viewport width as needed.

    In the above example, this would turn the `width=1000, initial-scale=3.6` viewport specified by
    Wikipedia into a `width=3000, initial-scale=1.2` viewport on an external display.

    Test: fast/viewport/ios/adjust-fixed-width-and-initial-scale-to-avoid-excessive-zooming.html

    * Source/WebCore/page/ViewportConfiguration.cpp:
    (WebCore::viewportArgumentValueIsValid):
    (WebCore::adjustViewportArgumentsToAvoidExcessiveZooming):
    (WebCore::ViewportConfiguration::setViewportArguments):

    Adjust viewport arguments after setting them, if needed.

    (WebCore::ViewportConfiguration::description const):
    * Source/WebCore/page/ViewportConfiguration.h:

    Add the new policy bit.

    (WebCore::ViewportConfiguration::setCanIgnoreViewportArgumentsToAvoidExcessiveZoom):
    * Source/WebKit/WebProcess/WebPage/WebPage.cpp:
    (WebKit::WebPage::didCommitLoad):
    (WebKit::WebPage::updateWebsitePolicies):

    Set the above policy bit in the case where we're loading desktop-class content.

    Canonical link: https://commits.webkit.org/256476@main

Canonical link: https://commits.webkit.org/252432.822@safari-7614-branch


  Commit: 127c5a84977f8405fce5ef23ea1d801187594e81
      https://github.com/WebKit/WebKit/commit/127c5a84977f8405fce5ef23ea1d801187594e81
  Author: Alan Bujtas <zalan at apple.com>
  Date:   2022-11-15 (Tue, 15 Nov 2022)

  Changed paths:
    M Source/WebCore/page/FrameView.cpp

  Log Message:
  -----------
  Cherry-pick abb17906be3a. rdar://problem/101652475

    FrameView::m_pendingTextFragmentIndicatorRange may get reset unexpectedly when the render tree is dirty
    https://bugs.webkit.org/show_bug.cgi?id=247687
    <rdar://101652475>

    Reviewed by Wenson Hsieh.

    This is a speculative fix to prevent a crash in TextIterator (via scrollToTextFragmentRange).

    The idea here is to prevent the scrolling code from re-entering layout (through plainText() -> TextIterator -> updateLayoutIgnorePendingStylesheets())
    when the render tree becomes dirty earlier at performPostLayoutTasks.
    When we call plainText() the second time inside scrollToTextFragmentRange, m_pendingTextFragmentIndicatorRange may have already been wiped out
    as the result of re-entering layout through the first plainText() call.

    * Source/WebCore/page/FrameView.cpp:
    (WebCore::FrameView::scrollToTextFragmentRange):
    1. Let's not scroll when the tree is dirty (the subsequent layout will call us again anyway)
    2. cache m_pendingTextFragmentIndicatorRange to preserve the range even through re-entrancy.

    Canonical link: https://commits.webkit.org/256506@main

Canonical link: https://commits.webkit.org/252432.823@safari-7614-branch


  Commit: 08e61e1e2d4c7acfdd7f9d3790af21b3dcc3ca42
      https://github.com/WebKit/WebKit/commit/08e61e1e2d4c7acfdd7f9d3790af21b3dcc3ca42
  Author: Justin Michaud <justin_michaud at apple.com>
  Date:   2022-11-15 (Tue, 15 Nov 2022)

  Changed paths:
    A JSTests/stress/delete-cache-error.js
    A JSTests/stress/get-own-property-slot-cache-error.js
    A JSTests/stress/get-property-cache-error.js
    M Source/JavaScriptCore/runtime/ErrorInstance.cpp
    M Source/JavaScriptCore/runtime/ErrorInstance.h

  Log Message:
  -----------
  Cherry-pick 28686e63de0d. rdar://problem/101906709

    Error() ICs should not cache special properties.
    https://bugs.webkit.org/show_bug.cgi?id=247699

    Reviewed by Yusuke Suzuki.

    HasOwnProperty/DeleteProperty are not always cacheable for special Error()
    properties like column. These special properties are materialized on-demand
    in materializeErrorInfoIfNeeded, but this function's behaviour can be changed
    by Error.stackTraceLimit without causing a structure transition or firing watchpoints.

    That is, we cannot cache property misses, and we cannot assume HasOwnProperty is deterministic
    for a given structure if we are using one of these properties.

    * Source/JavaScriptCore/runtime/ErrorInstance.cpp:
    (JSC::ErrorInstance::deleteProperty):
    * Source/JavaScriptCore/runtime/ErrorInstance.h:

    Canonical link: https://commits.webkit.org/256519@main

Canonical link: https://commits.webkit.org/252432.824@safari-7614-branch


  Commit: baca9afc289ec04ded778c7e5a5868e4c3781e81
      https://github.com/WebKit/WebKit/commit/baca9afc289ec04ded778c7e5a5868e4c3781e81
  Author: Chris Dumez <cdumez at apple.com>
  Date:   2022-11-15 (Tue, 15 Nov 2022)

  Changed paths:
    M Source/WebCore/loader/FrameLoader.cpp
    M Source/WebCore/loader/HistoryController.cpp
    M Tools/TestWebKitAPI/Tests/WebKit/WKBackForwardList.mm

  Log Message:
  -----------
  Properly mark history items added without user gesture
https://bugs.webkit.org/show_bug.cgi?id=247909
rdar://100579077

Reviewed by Geoffrey Garen.

We recently introduced logic to mark history items as "created by JavaScript
without a user gesture" so that those could be skipped when the user navigates
back/forward via the browser UI.

However, which history items we marked with such flag was a little unexpected
and didn't quite match what Chrome did to address the same problem.

In particular, if on URL1 and then calling `pushState(null, null, 'a')` in JS
without a user gesture. We would previously mark the HistoryItem for URL1 as
created without a user gesture, instead of marking the one for URL1#a. URL1#a
is the actual HistoryItem created by JS so it makes more sense to mark this
one (which also matches Chrome's behavior).

* Source/WebCore/loader/FrameLoader.cpp:
(WebCore::FrameLoader::loadInSameDocument):
* Source/WebCore/loader/HistoryController.cpp:
(WebCore::FrameLoader::HistoryController::pushState):
* Tools/TestWebKitAPI/Tests/WebKit/WKBackForwardList.mm:
(TEST):

Canonical link: https://commits.webkit.org/252432.826@safari-7614-branch


  Commit: 029f277138a48259f1a0823d4e22f25c540cbc16
      https://github.com/WebKit/WebKit/commit/029f277138a48259f1a0823d4e22f25c540cbc16
  Author: Robert Jenner <jenner at apple.com>
  Date:   2022-11-16 (Wed, 16 Nov 2022)

  Changed paths:
    M LayoutTests/platform/ios/fast/css/text-overflow-input-expected.txt
    M LayoutTests/platform/mac/fast/css/text-overflow-input-expected.txt

  Log Message:
  -----------
  [Rebaseline] [Regression][ iOS Mac ] fast/css/text-overflow-input.html is a constant failure
<rdar://problem/100048770>

Unreviewed test gardening.

* LayoutTests/platform/ios/fast/css/text-overflow-input-expected.txt:
* LayoutTests/platform/mac/fast/css/text-overflow-input-expected.txt:

Canonical link: https://commits.webkit.org/252432.827@safari-7614-branch


  Commit: 34d509c3106feb7197891ca291e0a46e92a419f3
      https://github.com/WebKit/WebKit/commit/34d509c3106feb7197891ca291e0a46e92a419f3
  Author: Jonathan Bedard <jbedard at apple.com>
  Date:   2022-11-16 (Wed, 16 Nov 2022)

  Changed paths:
    M Tools/Scripts/libraries/webkitscmpy/setup.py
    M Tools/Scripts/libraries/webkitscmpy/webkitscmpy/__init__.py
    M Tools/Scripts/libraries/webkitscmpy/webkitscmpy/program/trace.py
    M Tools/Scripts/libraries/webkitscmpy/webkitscmpy/test/trace_unittest.py

  Log Message:
  -----------
  Cherry-pick 256455 at main (2a5674141114). rdar://102092026

    [git-webkit] Handle double reverts
    https://bugs.webkit.org/show_bug.cgi?id=247621
    rdar://102092026

    Reviewed by Aakash Jain.

    * Tools/Scripts/libraries/webkitscmpy/setup.py: Bump version.
    * Tools/Scripts/libraries/webkitscmpy/webkitscmpy/__init__.py: Ditto.
    * Tools/Scripts/libraries/webkitscmpy/webkitscmpy/program/trace.py:
    (Relationship.parse): Add regexes to search for double reverts.
    * Tools/Scripts/libraries/webkitscmpy/webkitscmpy/test/trace_unittest.py:
    (TestRelationship.test_double_revert):

    Canonical link: https://commits.webkit.org/256455@main

Canonical link: https://commits.webkit.org/252432.828@safari-7614-branch


  Commit: 7cf9c2004005d4f6cebc0d78aa7d389bdaff273c
      https://github.com/WebKit/WebKit/commit/7cf9c2004005d4f6cebc0d78aa7d389bdaff273c
  Author: Jonathan Bedard <jbedard at apple.com>
  Date:   2022-11-16 (Wed, 16 Nov 2022)

  Changed paths:
    M Tools/Scripts/libraries/webkitscmpy/setup.py
    M Tools/Scripts/libraries/webkitscmpy/webkitscmpy/__init__.py
    M Tools/Scripts/libraries/webkitscmpy/webkitscmpy/program/__init__.py

  Log Message:
  -----------
  Cherry-pick 256516 at main (68e00a092301). rdar://101830556

    [git-webkit] Print help when multiple unknown arguments are provided
    https://bugs.webkit.org/show_bug.cgi?id=247342
    rdar://101830556

    Reviewed by Elliott Williams.

    * Tools/Scripts/libraries/webkitscmpy/setup.py: Bump version.
    * Tools/Scripts/libraries/webkitscmpy/webkitscmpy/__init__.py: Ditto.
    * Tools/Scripts/libraries/webkitscmpy/webkitscmpy/program/__init__.py:

    Canonical link: https://commits.webkit.org/256516@main

Canonical link: https://commits.webkit.org/252432.829@safari-7614-branch


  Commit: dbb76fd22c9e7520c0f3b4618e3764c47aed8096
      https://github.com/WebKit/WebKit/commit/dbb76fd22c9e7520c0f3b4618e3764c47aed8096
  Author: Ryosuke Niwa <rniwa at webkit.org>
  Date:   2022-11-16 (Wed, 16 Nov 2022)

  Changed paths:
    M Tools/Scripts/webkitpy/layout_tests/controllers/layout_test_finder_legacy.py
    M Tools/Scripts/webkitpy/layout_tests/controllers/single_test_runner.py
    M Tools/Scripts/webkitpy/layout_tests/models/test.py
    M Tools/Scripts/webkitpy/layout_tests/run_webkit_tests_integrationtest.py
    M Tools/Scripts/webkitpy/port/test.py

  Log Message:
  -----------
  Cherry-pick 252469 at main (b3ec691a75db). rdar://problem/97028312

    Teach run-webkit-tests how to run WPT crash tests
    https://bugs.webkit.org/show_bug.cgi?id=242633

    Reviewed by Youenn Fablet.

    This patch adds the support for WPT crash tests whereby which the output of the test is ignored.
    Instead, run-webkit-tests will check that the test didn't result in a crash or a timeout.

    * Tools/Scripts/webkitpy/layout_tests/controllers/layout_test_finder_legacy.py:
    (LayoutTestFinder.find_tests_by_path): Specify is_wpt_crash_test on a new Test object.
    (LayoutTestFinder._is_wpt_test): Extracted.
    (LayoutTestFinder._is_wpt_crash_test): Added.
    * Tools/Scripts/webkitpy/layout_tests/controllers/single_test_runner.py:
    (SingleTestRunner.run):
    (SingleTestRunner._run_wpt_crash_test): Added. This method implements the core logic for running
    a WPT crash test.
    * Tools/Scripts/webkitpy/layout_tests/models/test.py:
    (Test): Added a new field, is_wpt_crash_test, to indicate whether this is a WPT crash test or not.
    * Tools/Scripts/webkitpy/layout_tests/run_webkit_tests_integrationtest.py:
    (RunTest.serial_test_basic):
    (RunTest.test_wpt_tests): Added.
    (RunTest.test_wpt_tests_rebaseline): Added.
    * Tools/Scripts/webkitpy/port/test.py:
    (TestInstance.__init__):

    Canonical link: https://commits.webkit.org/252469@main

Canonical link: https://commits.webkit.org/252432.830@safari-7614-branch


  Commit: 95d5bbb634bd44343f3831763a2d6f490548c86a
      https://github.com/WebKit/WebKit/commit/95d5bbb634bd44343f3831763a2d6f490548c86a
  Author: Jonathan Bedard <jbedard at apple.com>
  Date:   2022-11-16 (Wed, 16 Nov 2022)

  Changed paths:
    M Tools/Scripts/webkitpy/common/checkout/scm/git.py

  Log Message:
  -----------
  Cherry-pick 256710 at main (10e8d00cbce3). rdar://102376829

    [check-webkit-style] Handle divergent branch state on multiple remotes
    https://bugs.webkit.org/show_bug.cgi?id=247952
    rdar://102376829

    Reviewed by Dewei Zhu.

    * Tools/Scripts/webkitpy/common/checkout/scm/git.py:
    (Git.remote_branch_ref): Attempt to only return remote branches which contain the branch point.

    Canonical link: https://commits.webkit.org/256710@main

Canonical link: https://commits.webkit.org/252432.831@safari-7614-branch


  Commit: 186720825a790bbc8902c17bbfedf00e903da646
      https://github.com/WebKit/WebKit/commit/186720825a790bbc8902c17bbfedf00e903da646
  Author: Jonathan Bedard <jbedard at apple.com>
  Date:   2022-11-16 (Wed, 16 Nov 2022)

  Changed paths:
    M Tools/Scripts/webkitpy/layout_tests/controllers/layout_test_runner.py

  Log Message:
  -----------
  Cherry-pick 256514 at main (e07cfdd0e0cb). rdar://102045852

    [run-webkit-tests] Unprefix paths in shards
    https://bugs.webkit.org/show_bug.cgi?id=247575
    rdar://102045852

    Reviewed by Elliott Williams.

    * Tools/Scripts/webkitpy/layout_tests/controllers/layout_test_runner.py:
    (TestShard.__init__): Make class memeber a packed list of TestInput object.
    (TestShard.shorten): Shorten a string based on the shard name.
    (TestShard.expand): Expand a string based on the shard name.
    (TestShard.pack): Reconstruct a TestInput with mutated paths.
    (TestShard.__getstate__): Pack TestShard for serialization.
    (TestShard.__setstate__): Unpack TestShard from serialization.

    Canonical link: https://commits.webkit.org/256514@main

Canonical link: https://commits.webkit.org/252432.832@safari-7614-branch


  Commit: dee12c4ac78d317612dfc861269ef88ffa9b34e6
      https://github.com/WebKit/WebKit/commit/dee12c4ac78d317612dfc861269ef88ffa9b34e6
  Author: Darin Adler <darin at apple.com>
  Date:   2022-11-16 (Wed, 16 Nov 2022)

  Changed paths:
    M Tools/Scripts/libraries/webkitscmpy/webkitscmpy/program/pull_request.py
    M Tools/Scripts/libraries/webkitscmpy/webkitscmpy/test/pull_request_unittest.py

  Log Message:
  -----------
  Cherry-pick 256677 at main (7f88b4fea23b). rdar://102281574

    Don't convert the bugs.webkit.org version to a label when creating a pull request
    https://bugs.webkit.org/show_bug.cgi?id=247850
    rdar://problem/102281574

    Reviewed by Yusuke Suzuki.

    * Tools/Scripts/libraries/webkitscmpy/webkitscmpy/program/pull_request.py:
    (PullRequest.create_pull_request): Removed the code to set the version.

    * Tools/Scripts/libraries/webkitscmpy/webkitscmpy/test/pull_request_unittest.py:
    Removed the assertion that expects a label is set based on the version "Other".

    Canonical link: https://commits.webkit.org/256677@main

Canonical link: https://commits.webkit.org/252432.833@safari-7614-branch


  Commit: 656a964689f24a8947f88dc8ff3d885cb0cb4bfd
      https://github.com/WebKit/WebKit/commit/656a964689f24a8947f88dc8ff3d885cb0cb4bfd
  Author: Alex Christensen <achristensen at webkit.org>
  Date:   2022-11-16 (Wed, 16 Nov 2022)

  Changed paths:
    M Source/WebCore/contentextensions/ContentExtensionParser.cpp

  Log Message:
  -----------
  Cherry-pick 254060 at main (3fdf5bf15440). rdar://102392754

    rdar://99440019 (REGRESSION(254007 at main): [ iOS macOS Debug ] 5X TestWebKitAPI.Content(API tests) are constant crashes (244669))
    https://bugs.webkit.org/show_bug.cgi?id=244673

    Reviewed by Brady Eidson.

    * Source/WebCore/contentextensions/ContentExtensionParser.cpp:
    (WebCore::ContentExtensions::isValidCSSSelector):

    Canonical link: https://commits.webkit.org/254060@main

Canonical link: https://commits.webkit.org/252432.834@safari-7614-branch


  Commit: bb1729e2f7c9b6f4f9fd8578f745094bf8544329
      https://github.com/WebKit/WebKit/commit/bb1729e2f7c9b6f4f9fd8578f745094bf8544329
  Author: Jonathan Bedard <jbedard at apple.com>
  Date:   2022-11-17 (Thu, 17 Nov 2022)

  Changed paths:
    M Tools/Scripts/libraries/webkitscmpy/setup.py
    M Tools/Scripts/libraries/webkitscmpy/webkitscmpy/__init__.py
    M Tools/Scripts/libraries/webkitscmpy/webkitscmpy/mocks/local/git.py
    M Tools/Scripts/libraries/webkitscmpy/webkitscmpy/program/pull_request.py

  Log Message:
  -----------
  Cherry-pick 256711 at main (2dc9f3a6d392). rdar://102214981

    [git-webkit] All source remote branches are production branches
    https://bugs.webkit.org/show_bug.cgi?id=247768
    rdar://102214981

    Reviewed by Dewei Zhu.

    * Tools/Scripts/libraries/webkitscmpy/setup.py: Bump version.
    * Tools/Scripts/libraries/webkitscmpy/webkitscmpy/__init__.py: Ditto.
    * Tools/Scripts/libraries/webkitscmpy/webkitscmpy/mocks/local/git.py:
    (Git): Origin remote shouldn't have mock dev branches.
    * Tools/Scripts/libraries/webkitscmpy/webkitscmpy/program/pull_request.py:
    (PullRequest.pull_request_branch_point): Treat remote branches from the target source
    as production branches.

    Canonical link: https://commits.webkit.org/256711@main

Canonical link: https://commits.webkit.org/252432.835@safari-7614-branch


  Commit: 93cce9335a74364f00db4667c20a752861729cdc
      https://github.com/WebKit/WebKit/commit/93cce9335a74364f00db4667c20a752861729cdc
  Author: Jonathan Bedard <jbedard at apple.com>
  Date:   2022-11-17 (Thu, 17 Nov 2022)

  Changed paths:
    M Tools/Scripts/libraries/webkitbugspy/setup.py
    M Tools/Scripts/libraries/webkitbugspy/webkitbugspy/__init__.py
    M Tools/Scripts/libraries/webkitbugspy/webkitbugspy/bugzilla.py
    M Tools/Scripts/libraries/webkitbugspy/webkitbugspy/github.py
    M Tools/Scripts/libraries/webkitbugspy/webkitbugspy/issue.py
    M Tools/Scripts/libraries/webkitbugspy/webkitbugspy/radar.py
    M Tools/Scripts/libraries/webkitbugspy/webkitbugspy/tests/bugzilla_unittest.py
    M Tools/Scripts/libraries/webkitbugspy/webkitbugspy/tests/github_unittest.py
    M Tools/Scripts/libraries/webkitbugspy/webkitbugspy/tests/radar_unittest.py
    M Tools/Scripts/libraries/webkitbugspy/webkitbugspy/tracker.py
    M Tools/Scripts/libraries/webkitscmpy/setup.py
    M Tools/Scripts/libraries/webkitscmpy/webkitscmpy/__init__.py
    M Tools/Scripts/libraries/webkitscmpy/webkitscmpy/program/pull_request.py
    M Tools/Scripts/libraries/webkitscmpy/webkitscmpy/test/pull_request_unittest.py

  Log Message:
  -----------
  Cherry-pick 256757 at main (e015c5839aca). rdar://101886383

    [git-webkit] Improve logging when redacting PRs due to the associated issue
    https://bugs.webkit.org/show_bug.cgi?id=247391
    rdar://101886383

    Reviewed by Aakash Jain.

    * Tools/Scripts/libraries/webkitbugspy/setup.py: Bump version.
    * Tools/Scripts/libraries/webkitbugspy/webkitbugspy/__init__.py: Ditto.
    * Tools/Scripts/libraries/webkitbugspy/webkitbugspy/bugzilla.py:
    (Tracker): Add NAME.
    * Tools/Scripts/libraries/webkitbugspy/webkitbugspy/github.py:
    (Tracker): Add NAME.
    * Tools/Scripts/libraries/webkitbugspy/webkitbugspy/issue.py:
    (Issue.redacted): Return a Redaction object.
    * Tools/Scripts/libraries/webkitbugspy/webkitbugspy/radar.py:
    (Tracker): Add NAME.
    * Tools/Scripts/libraries/webkitbugspy/webkitbugspy/tests/bugzilla_unittest.py:
    * Tools/Scripts/libraries/webkitbugspy/webkitbugspy/tests/github_unittest.py:
    * Tools/Scripts/libraries/webkitbugspy/webkitbugspy/tests/radar_unittest.py:
    * Tools/Scripts/libraries/webkitbugspy/webkitbugspy/tracker.py:
    (Tracker.Redaction): Instead of just returning 'True' or 'False', include a reason so that callers
    can better explain any behavior derived from redactions.
    * Tools/Scripts/libraries/webkitscmpy/setup.py: Bump version.
    * Tools/Scripts/libraries/webkitscmpy/webkitscmpy/__init__.py: Ditto.
    * Tools/Scripts/libraries/webkitscmpy/webkitscmpy/program/pull_request.py:
    (PullRequest.create_pull_request): Tell the user which issue reference we're considering the primary
    one and explain the reason that issue is redacted.
    * Tools/Scripts/libraries/webkitscmpy/webkitscmpy/test/pull_request_unittest.py:

    Canonical link: https://commits.webkit.org/256757@main

Canonical link: https://commits.webkit.org/252432.836@safari-7614-branch


  Commit: 8dbf19696f489ce709d54d6f44e15eab913bfaba
      https://github.com/WebKit/WebKit/commit/8dbf19696f489ce709d54d6f44e15eab913bfaba
  Author: Aakash Jain <aakash_jain at apple.com>
  Date:   2022-11-18 (Fri, 18 Nov 2022)

  Changed paths:
    M Tools/CISupport/ews-build/steps.py
    M Tools/Scripts/libraries/webkitscmpy/webkitscmpy/program/pull_request.py

  Log Message:
  -----------
  Cherry-pick 256760 at main (57ba798e7aa4). https://bugs.webkit.org/show_bug.cgi?id=247900

    Add support for Skip-EWS GitHub label
    https://bugs.webkit.org/show_bug.cgi?id=247900

    Reviewed by Jonathan Bedard.

    * Tools/CISupport/ews-build/steps.py:
    (GitHubMixin):
    (GitHubMixin._does_pr_has_skip_label): Method to check if pr has skip-ews label.
    (ValidateChange.__init__):
    (ValidateChange):
    (ValidateChange.start):
    (ValidateChange.validate_github):

    Canonical link: https://commits.webkit.org/256760@main

Canonical link: https://commits.webkit.org/252432.837@safari-7614-branch


  Commit: 665170902bfaade326b15bd379ace8cccf4d62e0
      https://github.com/WebKit/WebKit/commit/665170902bfaade326b15bd379ace8cccf4d62e0
  Author: Arunsundar Kannan <arunsundar_kannan at apple.com>
  Date:   2022-11-18 (Fri, 18 Nov 2022)

  Changed paths:
    A LayoutTests/fast/forms/textfield-input-type-crash-onblur-expected.txt
    A LayoutTests/fast/forms/textfield-input-type-crash-onblur.html
    M Source/WebCore/html/HTMLInputElement.cpp
    M Source/WebCore/html/HTMLOptionElement.cpp
    M Source/WebCore/html/TextFieldInputType.cpp

  Log Message:
  -----------
  UAF crash occurs during a style update when an older freed HTMLElement is accessed
https://bugs.webkit.org/show_bug.cgi?id=247389
rdar://101420898

Reviewed by Ryosuke Niwa and Ryan Haddad.

* LayoutTests/fast/forms/textfield-input-type-crash-onblur-expected.txt: Added.
* LayoutTests/fast/forms/textfield-input-type-crash-onblur.html: Added.
* Source/WebCore/html/HTMLInputElement.cpp:
(WebCore::HTMLInputElement::dataListMayHaveChanged):
* Source/WebCore/html/HTMLOptionElement.cpp:
(WebCore::HTMLOptionElement::childrenChanged):
* Source/WebCore/html/TextFieldInputType.cpp:
(WebCore::TextFieldInputType::createDataListDropdownIndicator):
(WebCore::TextFieldInputType::dataListMayHaveChanged):

Canonical link: https://commits.webkit.org/252432.838@safari-7614-branch


Compare: https://github.com/WebKit/WebKit/compare/9238da6bab48%5E...665170902bfa


More information about the webkit-changes mailing list