Upgrade to WebKit 39d4ce1f12ea

[sosukesuzuki]

Merge upstream WebKit 39d4ce1f12ea into the Bun fork (~422 commits since 49d2e914a4cc).

Notable JSC changes from upstream

• JSAsyncFunctionGenerator split out of JSGenerator (e0704d3127d5) — async functions now use a dedicated generator class with the Context field; sizeof(JSGenerator) shrinks from 64 to 48 bytes. Adds JSAsyncFunctionGeneratorType to the JSType enum.
• JSPromise::performPromiseThenWithInternalMicrotask signature changed (8f742098b444): the JSValue promise argument became JSCell* cell; the inline-microtask reaction now stores the cell in m_packed separately from the context in m_slot.
• import.defer() semantics (7f062965e945): JSModuleLoader::loadModule takes OptionSet<ModuleLoadFlag> instead of three bool arguments; the moduleLoaderImportModule host hook gained a bool deferred parameter.
• JSHeapInt32 / JSHeapDouble removed (3bb4fc93fb37); HeapDoubleType / HeapInt32Type removed from the JSType enum.
• Symbol::description() now takes VM& and returns a (cached) JSString*; Symbol::toString(JSGlobalObject*) added.
• Promise.all / Promise.allSettled / Promise.any no longer allocate a per-element JSPromiseCombinatorsContext (0f6a35669fa8).

Fork-side fixups

• BunV8HeapSnapshotBuilder reads SymbolImpl directly instead of Symbol::description(VM&) so heap snapshot traversal does not allocate.
• AbstractModuleRecord::estimatedSize approximates from OrderedHashMap::capacity() since byteSize() is gone.
• JSModuleLoader::loadModuleSync (Bun's require(esm) path) now passes { ModuleLoadFlag::Evaluate }.
• runInternalMicrotask's AsyncFunctionResume BUN_JSC_ADDITIONS branch unwraps JSAsyncFunctionGenerator from the InternalFieldTuple async-context wrapper.
• JSAsyncFunctionGenerator.h exported as a forwarding header so embedders can include it.

[coderabbitai]

[coderabbitai]

Actionable comments posted: 28

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@JSTests/modules/import-defer-dynamic-syntax.js`:
- Around line 16-23: The test must distinguish synchronous throws from returned
rejected promises: call import.defer({ toString() { throw new
Error("specifier"); } }) and capture its return in a variable (e.g., promise) to
ensure the call itself does not throw synchronously, then await that promise and
assert the rejection message; update the block around the import.defer
invocation so the call is assigned to a promise variable (or wrapped to fail if
it throws synchronously) and only then use await and shouldBe(rejected.message,
"specifier") to validate the error.

In `@JSTests/stress/perform-promise-then-one-handler.js`:
- Line 1: This test calls $vm.* intrinsics (used in PerformPromiseThenOneHandler
paths) but doesn't enable DollarVM; add the standard DollarVM enable directive
at the top of the file so $vm is defined before any calls (place the directive
before the first $vm.* usage), e.g. insert the test harness directive used
across other JSTests to enable DollarVM intrinsics (so the $vm.* calls at the
spots referenced will not throw ReferenceError).

In `@JSTests/stress/string-prototype-match-watchpoint-invalidation.js`:
- Around line 113-117: The tests set up valueOfCount and install re.lastIndex
with a valueOf that increments it but never assert the counter; add explicit
assertions to verify lastIndex.valueOf was invoked in both coercion-path
scenarios by checking valueOfCount equals the expected number after the call to
match("a1b2c3", re) (and after the second scenario around lines 168-176), and
reset valueOfCount between scenarios so each path's coercion is independently
validated (use the existing symbols valueOfCount, re.lastIndex and the
match(...) invocations to locate where to insert the assertions).

In `@JSTests/wasm/stress/resources/pglite/jsc-harness.js`:
- Around line 97-101: The loop trusts len and computes bodyStart/bodyEnd without
bounds checks, allowing dv.getInt32 or subsequent body reads to go
out-of-bounds; before calling dv.getInt32 and before parsing the body or setting
i = bodyEnd, validate that (i + 1 + 4) and (i + 1 + len) are within bytes.length
(and that len is non-negative and reasonable), and if invalid, handle the
truncated/malformed frame (e.g., log/skip/abort the harness) in the same loop
that processes tag, len, bodyStart, bodyEnd; apply the same boundary checks to
the other parsing site referenced (around lines 142-143) so both dv.getInt32 and
body slicing never read past bytes.length.
- Around line 47-50: The current PGProtocol.cstr(s) and various response parsers
use single-byte charCodeAt/fromCharCode which truncates non-ASCII; replace these
with a UTF-8 TextEncoder/TextDecoder approach: create a shared TextEncoder
instance and have cstr(s) return encoder.encode(s) plus a null terminator
instead of masking with &0xff, and in the parsers for message types T (field
names), D (row column values), C (command tags), and E (error message parts) use
a TextDecoder to decode the byte subarray up to the 0 byte into a UTF-8 string
(rather than String.fromCharCode per byte). Ensure you handle the null
terminator removal consistently and reuse encoder/decoder instances for
performance.

In `@LayoutTests/accessibility/dialog-focus-on-open.html`:
- Around line 36-45: The awaited expectAsync call can throw and prevent cleanup;
wrap the async block started by setTimeout in try/catch/finally so that
showButton.press and await expectAsync/expect run inside try, any error is
captured in catch (append error text to output), and
accessibilityController.removeNotificationListener() plus debug(output) and
finishJSTest() are executed in finally; reference the existing symbols
showButton.press(), expectAsync("window.focusedAtNotificationTime"...),
expect("accessibilityController.focusedElement.domIdentifier"...),
accessibilityController.removeNotificationListener(), debug(output), and
finishJSTest() when making the change.

In
`@LayoutTests/accessibility/dynamic-subtree-replacement-with-stale-parent-children.html`:
- Around line 26-62: Wrap the async block body that starts with creating
makePageDirty and performs awaited operations (including the role change,
innerHTML swap, awaiting accessibilityController.accessibleElementById,
expectAsync, waitForElementById loops, and any other awaits) in a try/finally so
that clearInterval(makePageDirty) and finishJSTest() always run; specifically,
create the interval (makePageDirty) before the try, move all subsequent logic
into the try block, and place clearInterval(makePageDirty) and finishJSTest()
inside the finally block (optionally also calling debug(output) there) to
guarantee teardown even if awaits like expectAsync or waitForElementById reject.

In `@LayoutTests/applicationmanifest/developer-warnings.html`:
- Around line 6-10: The async IIFE currently awaits
testRunner.getApplicationManifest() but if that promise rejects
testRunner.notifyDone() is never called; wrap the await call in a try/finally
inside the same async IIFE so that testRunner.notifyDone() is invoked in the
finally block (and preserve the success alert inside the try, optionally handle
errors in a catch before the finally) to guarantee notifyDone always runs.

In `@LayoutTests/applicationmanifest/multiple-links.html`:
- Around line 11-15: The async IIFE currently awaits
testRunner.getApplicationManifest() and calls testRunner.notifyDone() only on
success, so thrown/rejected errors can skip notifyDone(); wrap the await call in
a try/finally: call testRunner.getApplicationManifest() inside try (optionally
set outputdiv in try or catch), and ensure testRunner.notifyDone() is invoked in
the finally block so the harness is always notified even on error; reference
testRunner.getApplicationManifest and testRunner.notifyDone when locating the
code to change.

In `@LayoutTests/fast/canvas/webgl/data-view-test-expected.txt`:
- Around line 32-33: Update the mismatched section label so it reflects the
actual assertion: change the heading string "Test for constructor wrong length
exception takes precedence over wrong byteoffset exception" to state that the
byteOffset error takes precedence (for example: "Test for constructor wrong
byteOffset exception takes precedence over wrong length exception") to match the
assertion shown by the failing construction of new Int32Array(... ) which throws
the RangeError about byteOffset modulo TypedArray.BYTES_PER_ELEMENT.

In `@LayoutTests/fast/repaint/blur-change.html`:
- Line 34: Update the test description string passed to description(...) so it
references blur rather than drop-shadow (e.g., "Test repaint rects when the blur
filter property changes" or mention blur(...)); locate the description(...) call
in the file and replace the misleading text so test messaging/fixtures match the
actual blur(...) behavior being tested.

In `@LayoutTests/fast/repaint/drop-shadow-writing-modes.html`:
- Around line 29-33: After mutating styles with
document.body.classList.add('changed'), force a rendering/layout/paint sync
before calling window.internals.repaintRectsAsText() to avoid racing with paint
commit; insert a flush such as reading a layout/paint-dependent property (e.g.,
document.body.offsetWidth or
window.getComputedStyle(document.body).getPropertyValue(...)) between the
mutation and the calls to window.internals.repaintRectsAsText() and
internals.stopTrackingRepaints() so the repaint rects are read after the browser
has applied the style change.

In
`@LayoutTests/http/tests/resourceLoadStatistics/third-party-cookie-blocking-about-blank-popup.html`:
- Around line 50-53: The current check treats any response lacking cookieName as
success, which counts fetch errors like the "ERROR: ..." payload as PASS; update
the logic around result and cookieName so that you first detect and fail on
fetch errors (e.g., if result startsWith or contains the "ERROR:" prefix) and
call testFailed with that error payload, otherwise proceed to check
result.indexOf(cookieName) === -1 to decide pass/fail; refer to the variables
cookieName, result and the testPassed/testFailed calls to locate and change the
conditional.

In `@LayoutTests/http/tests/security/cross-origin-blob-transfer.html`:
- Around line 11-15: Guard the message handler in the
window.addEventListener("message", t.step_func(...)) callback by verifying the
sender before processing: first check e.origin (e.g., e.origin ===
location.origin) or e.source if comparing to a known window, and also verify
e.data is a Blob if appropriate; only then call
e.data.text().then(t.step_func_done(...)) and assert_equals(text, "Blob
content"). This prevents handling unrelated messages and keeps the existing
t.step_func/t.step_func_done flow (refer to the message event callback,
e.data.text(), t.step_func_done, and assert_equals).

In `@LayoutTests/http/tests/security/cross-origin-iframe-fetch-after-crash.html`:
- Around line 15-31: The message handler attached with
window.addEventListener("message", ...) currently trusts any message and may act
on external senders; update the handler to first validate the sender (e.g.,
ensure event.source === document.querySelector("iframe").contentWindow and/or
check event.origin against the expected origin) before handling the
"pre-crash-ok" and "post-crash-ok" event.data values or calling testRunner. Keep
the existing branches for "pre-crash-ok" and "post-crash-ok" but bail out early
if the sender/origin check fails.
- Around line 34-41: The polling helper waitForNetworkProcessToRelaunch()
currently retries forever; add a bounded retry policy (e.g., maxAttempts or a
deadline timestamp) and ensure it fails explicitly after the limit by rejecting
the promise and calling notifyDone() (or otherwise signalling test failure)
instead of looping endlessly; update the function signature (e.g., add an
attempts parameter or check Date.now() against a deadline), use the existing
waitTime backoff logic, and when the cap is reached log the failure and call
notifyDone() so the test cannot hang indefinitely.

In `@LayoutTests/http/tests/security/cross-origin-indexeddb.html`:
- Around line 16-31: The message handler attached via
window.addEventListener("message", ...) does not validate the sender, so
unrelated postMessage events can trigger the stored/TRANSIENT/PERSISTENT logic;
update the listener in this file to early-return unless event.origin and/or
event.source match the expected iframe origin/source (e.g., compare event.origin
to the iframe's known origin or keep a saved reference to the
iframe.contentWindow and compare event.source), then only process messages and
call testRunner.notifyDone()/terminateNetworkProcess() for validated senders.

In
`@LayoutTests/http/tests/site-isolation/open-panel-in-cross-origin-iframe.html`:
- Around line 12-18: The message event handler registered with
window.addEventListener("message", async (event) => { ... }) accepts messages
from any sender which can make the test flaky; update the handler to only
process events that originate from the test iframe by checking event.source ===
iframe.contentWindow (and optionally verify event.origin matches the expected
origin) before reading event.data and proceeding with setting window.chosenFile,
calling shouldBeEqualToString, or finishJSTest; apply the same gated check to
the other message listener around the same payload handling.

In `@LayoutTests/http/tests/site-isolation/resources/file-input-iframe.html`:
- Around line 15-24: Restrict the message handler to only accept events from the
embedding parent by checking event.source === window.parent before processing;
inside the existing window.addEventListener("message", ...) callback,
early-return if event.source !== window.parent (while keeping the existing
event.data.type === "getInputRect" check), then compute rect via
input.getBoundingClientRect() and post the response to window.parent as before
using window.parent.postMessage; this change touches the message handler around
window.addEventListener, the event object check, and the existing getInputRect
handling.

In
`@LayoutTests/http/tests/site-isolation/resources/validation-message-iframe.html`:
- Around line 30-35: The message handler registered via
window.addEventListener("message", ...) accepts any sender; update the handler
to also verify event.source === window.parent before acting so only the harness
parent frame can trigger submission; keep the existing check for event.data ===
"submit" and then call document.getElementById("submit").click() and
requestAnimationFrame(() => parent.postMessage("submitted", "*")) only when both
conditions match.

In
`@LayoutTests/http/tests/site-isolation/validation-message-cross-origin-iframe.html`:
- Around line 43-47: The message handler currently resolves on any "submitted"
message from any source; update the window.addEventListener("message", ...)
callback to verify that event.data === "submitted" AND event.source ===
iframe.contentWindow before calling resolve so only messages from the target
iframe trigger completion; keep the once: true option and leave
iframe.contentWindow.postMessage("submit", "*") as-is.

In
`@LayoutTests/http/wpt/content-security-policy/sandbox-manifest-blocked-cross-origin.sub.html`:
- Around line 10-15: The async IIFE directly dereferences testRunner (calls
testRunner.getApplicationManifest() and testRunner.notifyDone()) which will
throw if the file runs outside the test harness; guard those calls by checking
testRunner exists and the needed methods exist before invoking them (e.g.,
verify typeof testRunner !== 'undefined' and typeof
testRunner.getApplicationManifest === 'function' and typeof
testRunner.notifyDone === 'function'), only call getApplicationManifest() and
notifyDone() when those checks pass, and otherwise skip or provide a safe
fallback; reference testRunner, getApplicationManifest, and notifyDone when
locating where to add these guards.

In `@LayoutTests/http/wpt/content-security-policy/sandbox-manifest-blocked.html`:
- Around line 8-13: The async IIFE uses testRunner.getApplicationManifest() and
testRunner.notifyDone() without checking for testRunner; add a presence guard at
the top of the IIFE (e.g. verify testRunner exists and that
getApplicationManifest is a function) and early-return or skip those calls when
absent so the code won’t throw outside the test harness—apply the guard to the
calls referencing testRunner (getApplicationManifest and notifyDone) in the
async function that queries the link element.

In `@LayoutTests/imported/w3c/web-platform-tests/beacon/resources/url-echo.py`:
- Around line 8-14: The handler reads cmd and id via request.GET.first and then
calls request.server.stash.put/take which can use None as a key; before touching
request.server.stash (e.g., before stash.put and stash.take), validate that both
cmd and id are present and if either is missing respond with a 400 error; update
the branches that use cmd and id (the cmd == b"store"/b"stat" checks and calls
to request.server.stash.put/take and request.url_parts.query) to only run after
this existence check so no stash operations occur with a null key.

In
`@LayoutTests/imported/w3c/web-platform-tests/close-watcher/iframes/dialog-same-origin-nn.html`:
- Around line 22-27: The awaitEvent-based listener in iframeDialogIsOpen
currently races on any window "message"; update iframeDialogIsOpen to only
accept message events coming from the target iframe by validating event.source
=== iframe.contentWindow (and event.origin if needed). If awaitEvent supports a
predicate, pass a filter that checks event.source === iframe.contentWindow (and
event.origin match), otherwise replace with an explicit addEventListener that
ignores messages from other sources before resolving and removes the listener
after use; keep the rest of the logic (postMessage "dialog_open", error check,
return data.open) unchanged.

In
`@LayoutTests/imported/w3c/web-platform-tests/close-watcher/iframes/dialog-same-origin-ynn.html`:
- Line 34: Await the promise returned by test_driver.bless() before any
subsequent activation steps to avoid a race with test_driver.send_keys();
specifically, update the call sites in dialog-same-origin-ynn.html (the
test_driver.bless() before the await test_driver.send_keys(...)) and the two
analogous call sites in dialog-same-origin-ynyn.html to use await
test_driver.bless() so the blessing/click completes before sending keys.

In
`@LayoutTests/imported/w3c/web-platform-tests/close-watcher/iframes/resources/dialog-prevents-close.html`:
- Line 14: The message event handler is using the global/implicit name `event`
instead of the callback parameter `e`, which can fail in some environments;
update the listener callback to reference the passed-in argument (use `e.data`
instead of `event.data`) wherever the handler checks or accesses the message
payload (the function registered for "message" that currently declares `e`).
- Around line 5-6: Remove the duplicate script include for
"/resources/testdriver.js" so the file is only loaded once; locate the two
identical <script src="/resources/testdriver.js"></script> entries and delete
the redundant one (keep a single include) to avoid double-initializing the test
harness.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: b1f52604-a6a0-4a85-8bed-d0a92ec9a580

📥 Commits

Reviewing files that changed from the base of the PR and between 01ecc4e and e54e803.

⛔ Files ignored due to path filters (3)

• JSTests/wasm/stress/resources/pglite/pglite.wasm is excluded by !**/*.wasm
• LayoutTests/imported/w3c/web-platform-tests/close-watcher/iframes/resources/w3c-import.log is excluded by !**/*.log
• LayoutTests/imported/w3c/web-platform-tests/close-watcher/iframes/w3c-import.log is excluded by !**/*.log

📒 Files selected for processing (297)

• .submitproject
• .submitproject-append
• .wkdev-sdk-version
• CMakeLists.txt
• CMakePresets.json
• Configurations/CommonBase.xcconfig
• Configurations/Version.xcconfig
• Configurations/WebKitProjectPaths.xcconfig
• JSTests/microbenchmarks/array-includes-string-8bit-long.js
• JSTests/microbenchmarks/array-indexof-string-8bit-long.js
• JSTests/microbenchmarks/array-indexof-string-8bit-short.js
• JSTests/microbenchmarks/await-object-literal.js
• JSTests/microbenchmarks/date-now-elapsed.js
• JSTests/microbenchmarks/date-now.js
• JSTests/microbenchmarks/promise-all-non-thenable-object.js
• JSTests/microbenchmarks/promise-all-non-thenable.js
• JSTests/microbenchmarks/promise-all-settled-non-thenable.js
• JSTests/microbenchmarks/promise-race-non-thenable.js
• JSTests/microbenchmarks/promise-resolve-non-thenable-object.js
• JSTests/microbenchmarks/promise-resolve-object-literal.js
• JSTests/microbenchmarks/promise-then-chain-object-literal.js
• JSTests/microbenchmarks/regexp-match-digit-cached.js
• JSTests/microbenchmarks/regexp-match-digit-literal.js
• JSTests/microbenchmarks/string-match-digit-short.js
• JSTests/microbenchmarks/string-match-letter-short.js
• JSTests/modules/import-defer-dynamic-evaluation.js
• JSTests/modules/import-defer-dynamic-rejects.js
• JSTests/modules/import-defer-dynamic-syntax.js
• JSTests/modules/import-defer-dynamic-tla.js
• JSTests/modules/import-defer-dynamic.js
• JSTests/modules/indirect-export-error.js
• JSTests/modules/indirect-export-error/indirect-export-source-order-2.js
• JSTests/modules/indirect-export-error/indirect-export-source-order.js
• JSTests/stress/array-indexof-includes-string-word-compare.js
• JSTests/stress/array-shift-intrinsic.js
• JSTests/stress/array-sort-inline-ai-cell-butterfly-validation.js
• JSTests/stress/array-sort-inline-isnan-comparator-cps.js
• JSTests/stress/array-sort-inline-nested-in-comparator.js
• JSTests/stress/array-unshift-intrinsic-ftl.js
• JSTests/stress/array-unshift-intrinsic.js
• JSTests/stress/asynciterator-prototype-symbol-async-dispose-return-argument.js
• JSTests/stress/date-now-jit.js
• JSTests/stress/dfg-perform-promise-then-one-handler-exit-ok.js
• JSTests/stress/dfg-promise-resolve-fulfilled-object.js
• JSTests/stress/dynamic-import-inline-microtask-result-promise.js
• JSTests/stress/ftl-multigetbyoffset-constant-numberuse.js
• JSTests/stress/iterator-prototype-flatMap-return-no-arguments.js
• JSTests/stress/megamorphic-ic-symbol.js
• JSTests/stress/object-define-property-fields-spilled-arg.js
• JSTests/stress/perform-promise-then-one-handler.js
• JSTests/stress/promise-combinator-non-thenable-element.js
• JSTests/stress/promise-resolve-non-thenable-structure-cache-cross-realm.js
• JSTests/stress/promise-resolve-non-thenable-structure-cache-dictionary.js
• JSTests/stress/promise-resolve-non-thenable-structure-cache.js
• JSTests/stress/spread-set-own-symbol-iterator-side-effects.js
• JSTests/stress/string-prototype-match-edge-cases.js
• JSTests/stress/string-prototype-match-strength-reduction.js
• JSTests/stress/string-prototype-match-watchpoint-invalidation.js
• JSTests/stress/string-substr-strength-reduction.js
• JSTests/stress/string-substr.js
• JSTests/stress/symbol-prototype-to-string-intrinsic.js
• JSTests/stress/typedarray-constructor-allocatetypedarray-before-isdetachedbuffer-prototype-getter-detach.js
• JSTests/stress/typedarray-constructor-allocatetypedarray-before-isdetachedbuffer.js
• JSTests/stress/typedarray-constructor-allocatetypedarray-before-toindex-byteoffset.js
• JSTests/stress/typedarray-constructor-allocatetypedarray-before-toindex-length.js
• JSTests/stress/typedarray-constructor-byteoffset-modulo-elementsize-before-isdetachedbuffer-weird-byteoffset.js
• JSTests/stress/typedarray-constructor-byteoffset-modulo-elementsize-before-isdetachedbuffer.js
• JSTests/stress/typedarray-constructor-byteoffset-modulo-elementsize-before-toindex-length.js
• JSTests/stress/typedarray-constructor-isdetachbuffer-before-bufferbytelength-modulo-elementsize-weird-byteoffset-detach.js
• JSTests/stress/typedarray-constructor-isdetachbuffer-before-bufferbytelength-modulo-elementsize.js
• JSTests/stress/typedarray-constructor-isdetachbuffer-before-newbytelength-lt-0-weird-byteoffset.js
• JSTests/stress/typedarray-constructor-isdetachbuffer-before-newbytelength-lt-0.js
• JSTests/stress/typedarray-constructor-isdetachbuffer-before-offset+newbytelength-gt-bufferbytelength-byteoffset-too-large.js
• JSTests/stress/typedarray-constructor-isdetachbuffer-before-offset+newbytelength-gt-bufferbytelength-length-too-large.js
• JSTests/stress/typedarray-constructor-toindex-byteoffset-before-isdetachedbuffer-weird-byteoffset-detach.js
• JSTests/stress/typedarray-constructor-toindex-byteoffset-before-isdetachedbuffer.js
• JSTests/stress/typedarray-constructor-toindex-byteoffset-detach-buffer.js
• JSTests/stress/typedarray-constructor-toindex-length-before-isdetachedbuffer-weird-byteoffset-detach.js
• JSTests/stress/typedarray-constructor-toindex-length-before-isdetachedbuffer-weird-length-detach.js
• JSTests/stress/typedarray-constructor-toindex-length-before-isdetachedbuffer.js
• JSTests/stress/typedarray-constructor-toindex-length-detach-buffer.js
• JSTests/test262/config.yaml
• JSTests/test262/expectations.yaml
• JSTests/wasm/stress/lazy-table-copy-preserves-laziness.js
• JSTests/wasm/stress/lazy-table-cross-instance.js
• JSTests/wasm/stress/lazy-table-identity-across-paths.js
• JSTests/wasm/stress/lazy-table-wrappers.js
• JSTests/wasm/stress/pglite.js
• JSTests/wasm/stress/resources/pglite/LICENSE.Emscripten
• JSTests/wasm/stress/resources/pglite/LICENSE.PostgreSQL
• JSTests/wasm/stress/resources/pglite/LICENSE.pglite
• JSTests/wasm/stress/resources/pglite/README.md
• JSTests/wasm/stress/resources/pglite/jsc-harness.js
• JSTests/wasm/stress/resources/pglite/pglite.data
• JSTests/wasm/stress/resources/pglite/pglite.js
• JSTests/wasm/stress/resources/pglite/psql.js
• LayoutTests/TestExpectations
• LayoutTests/accessibility/dialog-focus-on-open-expected.txt
• LayoutTests/accessibility/dialog-focus-on-open.html
• LayoutTests/accessibility/dynamic-subtree-replacement-with-stale-parent-children-expected.txt
• LayoutTests/accessibility/dynamic-subtree-replacement-with-stale-parent-children.html
• LayoutTests/applicationmanifest/developer-warnings.html
• LayoutTests/applicationmanifest/multiple-links-expected.txt
• LayoutTests/applicationmanifest/multiple-links.html
• LayoutTests/compositing/filters/sw-nested-shadow-overlaps-hw-nested-shadow-expected.txt
• LayoutTests/compositing/geometry/bounds-with-filters-expected.txt
• LayoutTests/compositing/geometry/bounds-with-filters.html
• LayoutTests/compositing/geometry/frame-clipping-layer-with-bottom-right-inset-expected.txt
• LayoutTests/compositing/geometry/frame-clipping-layer-with-bottom-right-inset.html
• LayoutTests/compositing/geometry/frame-clipping-layer-with-top-left-inset-expected.txt
• LayoutTests/compositing/geometry/frame-clipping-layer-with-top-left-inset.html
• LayoutTests/css3/filters/backdrop/backdrop-blur-and-subsequent-elements-expected.html
• LayoutTests/css3/filters/backdrop/backdrop-blur-and-subsequent-elements.html
• LayoutTests/css3/filters/drop-shadow-target-clipped.html
• LayoutTests/editing/pasteboard/cjk-line-height-expected.txt
• LayoutTests/fast/canvas/webgl/data-view-test-expected.txt
• LayoutTests/fast/css/container-query-orientation-modal-dialog-crash-expected.txt
• LayoutTests/fast/css/container-query-orientation-modal-dialog-crash.html
• LayoutTests/fast/css/css-typed-om-typeerror-coalescing-pair-expected.txt
• LayoutTests/fast/css/css-typed-om-typeerror-coalescing-pair.html
• LayoutTests/fast/css/css-typed-om/css-builder-converter-initial-letter-crash-expected.txt
• LayoutTests/fast/css/css-typed-om/css-builder-converter-initial-letter-crash.html
• LayoutTests/fast/css/css-typed-om/css-typed-om-typeerror-associated-property-mismatch-expected.txt
• LayoutTests/fast/css/css-typed-om/css-typed-om-typeerror-associated-property-mismatch.html
• LayoutTests/fast/css/cssom-border-image-width-crash.html
• LayoutTests/fast/css/cssom-mask-border-width-crash-expected.txt
• LayoutTests/fast/css/cssom-mask-border-width-crash.html
• LayoutTests/fast/css/cssom-translate-crash-expected.txt
• LayoutTests/fast/css/cssom-translate-crash.html
• LayoutTests/fast/css/getComputedStyle/computed-style-font-family-expected.txt
• LayoutTests/fast/css/getComputedStyle/font-family-fallback-reset-expected.txt
• LayoutTests/fast/css/getComputedStyle/font-family-fallback-reset.html
• LayoutTests/fast/css/serialization-with-double-quotes-expected.txt
• LayoutTests/fast/css/serialization-with-double-quotes.html
• LayoutTests/fast/css/stylepropertymap-append-not-checking-for-variablereferencevalue-expected.txt
• LayoutTests/fast/css/stylepropertymap-append-not-checking-for-variablereferencevalue.html
• LayoutTests/fast/dom/StyleSheet/css-font-variation-settings-crash.html
• LayoutTests/fast/dom/navigator-detached-no-crash-expected.txt
• LayoutTests/fast/flexbox/preferred-width-empty-inline-block-expected.txt
• LayoutTests/fast/flexbox/preferred-width-empty-inline-block.html
• LayoutTests/fast/forms/ios/form-control-refresh/button/identical-buttons-have-same-corner-radius-expected.html
• LayoutTests/fast/forms/ios/form-control-refresh/button/identical-buttons-have-same-corner-radius.html
• LayoutTests/fast/forms/ios/select-menulist-text-align-chevron-padding-expected.txt
• LayoutTests/fast/forms/ios/select-menulist-text-align-chevron-padding.html
• LayoutTests/fast/forms/label/label-click-event-dispatch-untrusted-expected.txt
• LayoutTests/fast/forms/label/label-click-event-dispatch-untrusted.html
• LayoutTests/fast/grid/grid-item-block-content-size-suggestion-crash-expected.txt
• LayoutTests/fast/grid/grid-item-block-content-size-suggestion-crash.html
• LayoutTests/fast/hidpi/filters-drop-shadow.html
• LayoutTests/fast/images/stopped-animation-deleted-image.html
• LayoutTests/fast/overflow/intrinsic-width-container-with-scrollable-descendant-expected.html
• LayoutTests/fast/overflow/intrinsic-width-container-with-scrollable-descendant.html
• LayoutTests/fast/overflow/min-intrinsic-width-container-with-scrollable-descendant-expected.html
• LayoutTests/fast/overflow/min-intrinsic-width-container-with-scrollable-descendant.html
• LayoutTests/fast/repaint/blur-change-expected.txt
• LayoutTests/fast/repaint/blur-change.html
• LayoutTests/fast/repaint/drop-shadow-box-change-expected.txt
• LayoutTests/fast/repaint/drop-shadow-box-change.html
• LayoutTests/fast/repaint/drop-shadow-change-expected.txt
• LayoutTests/fast/repaint/drop-shadow-change.html
• LayoutTests/fast/repaint/drop-shadow-writing-modes-expected.txt
• LayoutTests/fast/repaint/drop-shadow-writing-modes.html
• LayoutTests/fast/repaint/select-option-background-color-tracked.html
• LayoutTests/fast/scrolling/ios/fixed-position-in-vertical-rl-expected.html
• LayoutTests/fast/scrolling/ios/fixed-position-in-vertical-rl.html
• LayoutTests/fast/scrolling/ios/iframe-scroll-into-view.html
• LayoutTests/fast/shadow-dom/style-invalidation-slotted-element-with-author-shadow-root-crash-expected.txt
• LayoutTests/fast/shadow-dom/style-invalidation-slotted-element-with-author-shadow-root-crash.html
• LayoutTests/fast/text-extraction/contenteditable-text-extraction-expected.txt
• LayoutTests/fast/text-extraction/contenteditable-text-extraction.html
• LayoutTests/fast/text-extraction/max-recursion-depth-cap-expected.html
• LayoutTests/fast/text-extraction/max-recursion-depth-cap.html
• LayoutTests/fast/text-extraction/text-extraction-scroll-fallback-to-large-container-expected.txt
• LayoutTests/fast/text-extraction/text-extraction-scroll-fallback-to-large-container.html
• LayoutTests/fast/text/font-face-family-expected.txt
• LayoutTests/fast/text/font-face-family.html
• LayoutTests/fast/text/font-stretch-parse-expected.txt
• LayoutTests/fast/text/font-stretch-parse.html
• LayoutTests/fast/text/font-style-parse-expected.txt
• LayoutTests/fast/text/font-style-parse.html
• LayoutTests/fast/text/font-weight-parse-expected.txt
• LayoutTests/fast/text/font-weight-parse.html
• LayoutTests/http/tests/cache/partitioned-cache-iframe.html
• LayoutTests/http/tests/cache/partitioned-cache.html
• LayoutTests/http/tests/cache/resources/partitioned-cache-loader.html
• LayoutTests/http/tests/css/filters-on-iframes-transform.html
• LayoutTests/http/tests/css/filters-on-iframes.html
• LayoutTests/http/tests/css/resources/references-external-green.html
• LayoutTests/http/tests/css/resources/references-external-red.html
• LayoutTests/http/tests/navigation/page-cache-pending-image-load-cache-partition.html
• LayoutTests/http/tests/navigation/pushstate-at-unique-origin-denied-expected.txt
• LayoutTests/http/tests/navigation/pushstate-at-unique-origin-denied.py
• LayoutTests/http/tests/resourceLoadStatistics/third-party-cookie-blocking-about-blank-popup-expected.txt
• LayoutTests/http/tests/resourceLoadStatistics/third-party-cookie-blocking-about-blank-popup.html
• LayoutTests/http/tests/security/contentSecurityPolicy/manifest-src-allowed-expected.txt
• LayoutTests/http/tests/security/contentSecurityPolicy/manifest-src-allowed.html
• LayoutTests/http/tests/security/contentSecurityPolicy/manifest-src-blocked-expected.txt
• LayoutTests/http/tests/security/contentSecurityPolicy/manifest-src-blocked.html
• LayoutTests/http/tests/security/contentSecurityPolicy/path-traversal-bypass-with-percent-encoding-expected.txt
• LayoutTests/http/tests/security/contentSecurityPolicy/path-traversal-bypass-with-percent-encoding.html
• LayoutTests/http/tests/security/credentials-iframes.html
• LayoutTests/http/tests/security/credentials-main-resource.html
• LayoutTests/http/tests/security/cross-origin-blob-transfer-expected.txt
• LayoutTests/http/tests/security/cross-origin-blob-transfer.html
• LayoutTests/http/tests/security/cross-origin-iframe-fetch-after-crash-expected.txt
• LayoutTests/http/tests/security/cross-origin-iframe-fetch-after-crash.html
• LayoutTests/http/tests/security/cross-origin-indexeddb-expected.txt
• LayoutTests/http/tests/security/cross-origin-indexeddb.html
• LayoutTests/http/tests/security/cross-origin-local-storage-allowed.html
• LayoutTests/http/tests/security/cross-origin-local-storage.html
• LayoutTests/http/tests/security/cross-origin-session-storage-third-party-blocked.html
• LayoutTests/http/tests/security/cross-origin-websql.html
• LayoutTests/http/tests/security/cross-origin-worker-indexeddb.html
• LayoutTests/http/tests/security/history-pushState-replaceState-from-sandboxed-iframe-expected.txt
• LayoutTests/http/tests/security/resources/cross-origin-iframe-fetch-after-crash-iframe.html
• LayoutTests/http/tests/security/resources/cross-origin-iframe-for-indexeddb-transience.html
• LayoutTests/http/tests/security/resources/document-for-cross-origin-worker-indexeddb.html
• LayoutTests/http/tests/security/resources/history-pushState-replaceState-from-sandboxed-iframe.html
• LayoutTests/http/tests/security/resources/load-local-storage.html
• LayoutTests/http/tests/security/same-origin-document-domain-storage-allowed.html
• LayoutTests/http/tests/security/same-origin-storage-blocked.html
• LayoutTests/http/tests/security/same-origin-websql-blocked.html
• LayoutTests/http/tests/security/sync-xhr-partition.html
• LayoutTests/http/tests/site-isolation/inspector/network/cross-origin-iframe-request-id-uniqueness-expected.txt
• LayoutTests/http/tests/site-isolation/inspector/network/cross-origin-iframe-request-id-uniqueness.html
• LayoutTests/http/tests/site-isolation/open-panel-in-cross-origin-iframe-expected.txt
• LayoutTests/http/tests/site-isolation/open-panel-in-cross-origin-iframe.html
• LayoutTests/http/tests/site-isolation/resources/file-input-iframe.html
• LayoutTests/http/tests/site-isolation/resources/validation-message-iframe.html
• LayoutTests/http/tests/site-isolation/validation-message-cross-origin-iframe-expected.txt
• LayoutTests/http/tests/site-isolation/validation-message-cross-origin-iframe.html
• LayoutTests/http/tests/ssl/media-stream/resources/get-user-media-frame.html
• LayoutTests/http/tests/webgpu/webgpu/shader/validation/expression/binary/short_circuiting_and_or-expected.txt
• LayoutTests/http/tests/webgpu/webgpu/shader/validation/parse/identifiers-expected.txt
• LayoutTests/http/wpt/content-security-policy/sandbox-manifest-blocked-cross-origin.sub-expected.txt
• LayoutTests/http/wpt/content-security-policy/sandbox-manifest-blocked-cross-origin.sub.html
• LayoutTests/http/wpt/content-security-policy/sandbox-manifest-blocked-expected.txt
• LayoutTests/http/wpt/content-security-policy/sandbox-manifest-blocked.html
• LayoutTests/imported/w3c/resources/import-expectations.json
• LayoutTests/imported/w3c/resources/resource-files.json
• LayoutTests/imported/w3c/web-platform-tests/beacon/beacon-url-encoding-euc-kr.https-expected.txt
• LayoutTests/imported/w3c/web-platform-tests/beacon/beacon-url-encoding-euc-kr.https.html
• LayoutTests/imported/w3c/web-platform-tests/beacon/resources/url-echo.py
• LayoutTests/imported/w3c/web-platform-tests/close-watcher/META.yml
• LayoutTests/imported/w3c/web-platform-tests/close-watcher/basic-expected.txt
• LayoutTests/imported/w3c/web-platform-tests/close-watcher/iframes/dialog-same-origin-nn.html
• LayoutTests/imported/w3c/web-platform-tests/close-watcher/iframes/dialog-same-origin-ynn.html
• LayoutTests/imported/w3c/web-platform-tests/close-watcher/iframes/dialog-same-origin-ynyn.html
• LayoutTests/imported/w3c/web-platform-tests/close-watcher/iframes/resources/dialog-prevents-close.html
• LayoutTests/imported/w3c/web-platform-tests/close-watcher/inside-event-listeners-expected.txt
• LayoutTests/imported/w3c/web-platform-tests/common/reftest-wait.js
• LayoutTests/imported/w3c/web-platform-tests/css/CSS2/box-display/block-in-inline-at-start-with-margin-top-collapses-with-parent-expected.html
• LayoutTests/imported/w3c/web-platform-tests/css/CSS2/box-display/block-in-inline-at-start-with-margin-top-collapses-with-parent-ref.html
• LayoutTests/imported/w3c/web-platform-tests/css/CSS2/box-display/block-in-inline-at-start-with-margin-top-collapses-with-parent.html
• LayoutTests/imported/w3c/web-platform-tests/css/CSS2/box-display/block-in-inline-followed-by-empty-span-expected.html
• LayoutTests/imported/w3c/web-platform-tests/css/CSS2/box-display/block-in-inline-followed-by-empty-span-ref.html
• LayoutTests/imported/w3c/web-platform-tests/css/CSS2/box-display/block-in-inline-followed-by-empty-span.html
• LayoutTests/imported/w3c/web-platform-tests/css/CSS2/box-display/block-in-inline-followed-by-line-break-and-text-expected.html
• LayoutTests/imported/w3c/web-platform-tests/css/CSS2/box-display/block-in-inline-followed-by-line-break-and-text-ref.html
• LayoutTests/imported/w3c/web-platform-tests/css/CSS2/box-display/block-in-inline-followed-by-line-break-and-text.html
• LayoutTests/imported/w3c/web-platform-tests/css/CSS2/box-display/block-in-inline-large-margin-bottom-expected.html
• LayoutTests/imported/w3c/web-platform-tests/css/CSS2/box-display/block-in-inline-large-margin-bottom-ref.html
• LayoutTests/imported/w3c/web-platform-tests/css/CSS2/box-display/block-in-inline-large-margin-bottom.html
• LayoutTests/imported/w3c/web-platform-tests/css/CSS2/box-display/block-in-inline-margin-bottom-with-trailing-block-expected.html
• LayoutTests/imported/w3c/web-platform-tests/css/CSS2/box-display/block-in-inline-margin-bottom-with-trailing-block-ref.html
• LayoutTests/imported/w3c/web-platform-tests/css/CSS2/box-display/block-in-inline-margin-bottom-with-trailing-block.html
• LayoutTests/imported/w3c/web-platform-tests/css/CSS2/box-display/block-in-inline-margin-collapses-through-intervening-float-expected.html
• LayoutTests/imported/w3c/web-platform-tests/css/CSS2/box-display/block-in-inline-margin-collapses-through-intervening-float-ref.html
• LayoutTests/imported/w3c/web-platform-tests/css/CSS2/box-display/block-in-inline-margin-collapses-through-intervening-float.html
• LayoutTests/imported/w3c/web-platform-tests/css/CSS2/box-display/block-in-inline-margin-collapses-through-multiple-floats-expected.html
• LayoutTests/imported/w3c/web-platform-tests/css/CSS2/box-display/block-in-inline-margin-collapses-through-multiple-floats-ref.html
• LayoutTests/imported/w3c/web-platform-tests/css/CSS2/box-display/block-in-inline-margin-collapses-through-multiple-floats.html
• LayoutTests/imported/w3c/web-platform-tests/css/CSS2/box-display/block-in-inline-margin-collapses-with-parent-bottom-expected.html
• LayoutTests/imported/w3c/web-platform-tests/css/CSS2/box-display/block-in-inline-margin-collapses-with-parent-bottom-ref.html
• LayoutTests/imported/w3c/web-platform-tests/css/CSS2/box-display/block-in-inline-margin-collapses-with-parent-bottom.html
• LayoutTests/imported/w3c/web-platform-tests/css/CSS2/box-display/block-in-inline-margin-with-leading-and-trailing-text-expected.html
• LayoutTests/imported/w3c/web-platform-tests/css/CSS2/box-display/block-in-inline-margin-with-leading-and-trailing-text-ref.html
• LayoutTests/imported/w3c/web-platform-tests/css/CSS2/box-display/block-in-inline-margin-with-leading-and-trailing-text.html
• LayoutTests/imported/w3c/web-platform-tests/css/CSS2/box-display/block-in-inline-margin-with-leading-text-expected.html
• LayoutTests/imported/w3c/web-platform-tests/css/CSS2/box-display/block-in-inline-margin-with-leading-text-ref.html
• LayoutTests/imported/w3c/web-platform-tests/css/CSS2/box-display/block-in-inline-margin-with-leading-text.html
• LayoutTests/imported/w3c/web-platform-tests/css/CSS2/box-display/block-in-inline-margin-with-line-break-then-block-in-inline-expected.html
• LayoutTests/imported/w3c/web-platform-tests/css/CSS2/box-display/block-in-inline-margin-with-line-break-then-block-in-inline-ref.html
• LayoutTests/imported/w3c/web-platform-tests/css/CSS2/box-display/block-in-inline-margin-with-line-break-then-block-in-inline.html
• LayoutTests/imported/w3c/web-platform-tests/css/CSS2/box-display/block-in-inline-margin-with-multi-line-text-after-expected.html
• LayoutTests/imported/w3c/web-platform-tests/css/CSS2/box-display/block-in-inline-margin-with-multi-line-text-after-ref.html
• LayoutTests/imported/w3c/web-platform-tests/css/CSS2/box-display/block-in-inline-margin-with-multi-line-text-after.html
• LayoutTests/imported/w3c/web-platform-tests/css/CSS2/box-display/block-in-inline-margin-with-multi-line-text-before-expected.html
• LayoutTests/imported/w3c/web-platform-tests/css/CSS2/box-display/block-in-inline-margin-with-multi-line-text-before-ref.html
• LayoutTests/imported/w3c/web-platform-tests/css/CSS2/box-display/block-in-inline-margin-with-multi-line-text-before.html
• LayoutTests/imported/w3c/web-platform-tests/css/CSS2/box-display/block-in-inline-margin-with-text-then-block-in-inline-expected.html
• LayoutTests/imported/w3c/web-platform-tests/css/CSS2/box-display/block-in-inline-margin-with-text-then-block-in-inline-ref.html
• LayoutTests/imported/w3c/web-platform-tests/css/CSS2/box-display/block-in-inline-margin-with-text-then-block-in-inline.html
• LayoutTests/imported/w3c/web-platform-tests/css/CSS2/box-display/block-in-inline-margins-collapse-with-trailing-block-expected.html
• LayoutTests/imported/w3c/web-platform-tests/css/CSS2/box-display/block-in-inline-margins-collapse-with-trailing-block-ref.html
• LayoutTests/imported/w3c/web-platform-tests/css/CSS2/box-display/block-in-inline-margins-collapse-with-trailing-block.html
• LayoutTests/imported/w3c/web-platform-tests/css/CSS2/box-display/block-in-inline-negative-margin-bottom-with-trailing-block-expected.html

💤 Files with no reviewable changes (18)

• LayoutTests/fast/css/cssom-translate-crash.html
• LayoutTests/fast/dom/StyleSheet/css-font-variation-settings-crash.html
• LayoutTests/fast/css/css-typed-om/css-builder-converter-initial-letter-crash-expected.txt
• LayoutTests/fast/css/cssom-mask-border-width-crash-expected.txt
• LayoutTests/fast/flexbox/preferred-width-empty-inline-block.html
• LayoutTests/http/tests/security/cross-origin-local-storage-allowed.html
• LayoutTests/fast/css/css-typed-om/css-builder-converter-initial-letter-crash.html
• LayoutTests/fast/css/css-typed-om-typeerror-coalescing-pair-expected.txt
• LayoutTests/fast/css/cssom-translate-crash-expected.txt
• LayoutTests/fast/css/cssom-border-image-width-crash.html
• LayoutTests/http/tests/security/resources/load-local-storage.html
• LayoutTests/fast/css/cssom-mask-border-width-crash.html
• LayoutTests/fast/css/stylepropertymap-append-not-checking-for-variablereferencevalue.html
• LayoutTests/fast/flexbox/preferred-width-empty-inline-block-expected.txt
• LayoutTests/fast/css/css-typed-om-typeerror-coalescing-pair.html
• LayoutTests/fast/css/stylepropertymap-append-not-checking-for-variablereferencevalue-expected.txt
• JSTests/test262/config.yaml
• JSTests/test262/expectations.yaml

[coderabbitai]

⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

🧩 Analysis chain

🌐 Web query:

In current ECMAScript semantics for dynamic import-like operations, if converting the module specifier via ToString throws, is the result required to be a rejected Promise rather than a synchronous throw?

💡 Result:

Yes. In current ECMAScript semantics for the dynamic import expression, if evaluating the specifier part via ToString throws an exception, the dynamic import result is required to be a rejected Promise (i.e., no synchronous throw escapes from import). Authoritative support: - The ECMAScript specification’s abstract operation EvaluateImportCall produces either a Promise (normal completion) or an abrupt completion; if it later determines the module loading step produced an abrupt completion, it explicitly calls promiseCapability.[[Reject]] with the abrupt value (i.e., rejecting the promise rather than throwing) [1]. - In practice and in normative user-facing documentation, import “never synchronously throws an error” and failures (including errors during evaluation/loading) instead result in promise rejection [2]. Therefore, when ToString of the provided specifier expression throws, the import expression itself should result in a Promise that is rejected with that thrown value, not a synchronous throw from import.

Citations:

• 1: https://tc39.es/ecma262/multipage/ecmascript-language-expressions.html
• 2: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Operators/import

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail
ls -la
FILE="JSTests/modules/import-defer-dynamic-syntax.js"
if [ -f "$FILE" ]; then
  nl -ba "$FILE" | sed -n '1,120p' | sed -n '1,60p'
  nl -ba "$FILE" | sed -n '1,120p' | sed -n '10,40p'
else
  echo "Missing $FILE"
fi

Repository: oven-sh/WebKit

Length of output: 3896

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail
FILE="JSTests/modules/import-defer-dynamic-syntax.js"
python3 - <<'PY'
from pathlib import Path
p = Path("JSTests/modules/import-defer-dynamic-syntax.js")
if not p.exists():
    raise SystemExit(f"Missing {p}")
lines = p.read_text(encoding="utf-8", errors="replace").splitlines()
start, end = 10, 40
for i in range(start, min(end, len(lines))):
    print(f"{i+1:4d}: {lines[i]}")
PY

Repository: oven-sh/WebKit

Length of output: 707

---

Split sync-throw vs promise-rejection checks for import.defer specifier toString() errors.

The current test only catches the error from await, so it would pass whether import.defer(...) throws synchronously or returns a rejected promise. Assert that the import.defer(...) call itself doesn’t throw before awaiting.

Proposed fix

 // Specifier ToString abrupt completion rejects (instead of throwing synchronously).
-let rejected;
-try {
-    await import.defer({ toString() { throw new Error("specifier"); } });
-} catch (error) {
-    rejected = error;
-}
+let syncThrow;
+let promise;
+try {
+    promise = import.defer({ toString() { throw new Error("specifier"); } });
+} catch (error) {
+    syncThrow = error;
+}
+shouldBe(syncThrow, undefined);
+
+let rejected;
+try {
+    await promise;
+} catch (error) {
+    rejected = error;
+}
 shouldBe(rejected.message, "specifier");

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	// Specifier ToString abrupt completion rejects (instead of throwing synchronously).
	let rejected;
	try {
	await import.defer({ toString() { throw new Error("specifier"); } });
	} catch (error) {
	rejected = error;
	}
	shouldBe(rejected.message, "specifier");
	// Specifier ToString abrupt completion rejects (instead of throwing synchronously).
	let syncThrow;
	let promise;
	try {
	promise = import.defer({ toString() { throw new Error("specifier"); } });
	} catch (error) {
	syncThrow = error;
	}
	shouldBe(syncThrow, undefined);
	let rejected;
	try {
	await promise;
	} catch (error) {
	rejected = error;
	}
	shouldBe(rejected.message, "specifier");

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@JSTests/modules/import-defer-dynamic-syntax.js` around lines 16 - 23, The
test must distinguish synchronous throws from returned rejected promises: call
import.defer({ toString() { throw new Error("specifier"); } }) and capture its
return in a variable (e.g., promise) to ensure the call itself does not throw
synchronously, then await that promise and assert the rejection message; update
the block around the import.defer invocation so the call is assigned to a
promise variable (or wrapped to fail if it throws synchronously) and only then
use await and shouldBe(rejected.message, "specifier") to validate the error.

[coderabbitai]

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Enable $vm intrinsics explicitly for this test file.

Line 147, Line 156, and Line 166 call $vm.*, but the file does not enable DollarVM. This can fail early with ReferenceError in configurations where it is off by default.

Suggested fix

+//@ requireOptions("--useDollarVM=1")
+
 // Exercises both the converted (PerformPromiseThenOneHandler) and non-converted
 // (PerformPromiseThen) paths produced by DFGConstantFoldingPhase. Each test
 // function is noInline'd and run in a hot loop so DFG/FTL tier-up is forced.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@JSTests/stress/perform-promise-then-one-handler.js` at line 1, This test
calls $vm.* intrinsics (used in PerformPromiseThenOneHandler paths) but doesn't
enable DollarVM; add the standard DollarVM enable directive at the top of the
file so $vm is defined before any calls (place the directive before the first
$vm.* usage), e.g. insert the test harness directive used across other JSTests
to enable DollarVM intrinsics (so the $vm.* calls at the spots referenced will
not throw ReferenceError).

[coderabbitai]

⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Assert lastIndex.valueOf is actually observed in the two coercion-path scenarios.

Both scenarios track valueOfCount but never validate it. That makes the tests pass even if the engine skips the intended coercion path.

Suggested patch

@@
     var valueOfCount = 0;
     re.lastIndex = { valueOf() { valueOfCount++; return 0; } };
     shouldBe(match("a1b2c3", re), ["1", "2", "3"]);
+    if (!valueOfCount)
+        throw new Error("expected lastIndex.valueOf to be observed");
     // The slow path is hit after this since the compiled fast path bailed out.
@@
     shouldBe(String.prototype.match.call(receiver, re), ["a"]);
+    if (!valueOfCount)
+        throw new Error("expected lastIndex.valueOf to be observed");
 })();

Also applies to: 168-176

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@JSTests/stress/string-prototype-match-watchpoint-invalidation.js` around
lines 113 - 117, The tests set up valueOfCount and install re.lastIndex with a
valueOf that increments it but never assert the counter; add explicit assertions
to verify lastIndex.valueOf was invoked in both coercion-path scenarios by
checking valueOfCount equals the expected number after the call to
match("a1b2c3", re) (and after the second scenario around lines 168-176), and
reset valueOfCount between scenarios so each path's coercion is independently
validated (use the existing symbols valueOfCount, re.lastIndex and the
match(...) invocations to locate where to insert the assertions).

[coderabbitai]

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🌐 Web query:

In PostgreSQL frontend/backend protocol, are SQL/query strings and text field payloads transmitted as UTF-8 bytes (not Latin-1 / single-byte char truncation)?

💡 Result:

Yes. In PostgreSQL’s frontend/backend wire protocol, messages are length-delimited byte streams, and the “query string” (simple query) and “text” representations are transmitted as raw bytes representing the client/driver’s encoded string data (UTF-8 bytes when the client is using UTF-8). The protocol does not operate in a Latin-1/single-byte-per-character way that would truncate multibyte UTF-8. Evidence: - The protocol specification defines that the message framing uses an Int32 byte length (“Length of message contents in bytes…”) and that fields like the query string are part of message “contents” with explicit byte counts, i.e., byte-oriented framing rather than character-counting or single-byte assumptions. For example, the simple Query message includes “Length of message contents in bytes” followed by “The query string itself” [1]. - For “text” values, the transmitted representation is based on the input/output conversion functions (“The text representation of values is whatever strings are produced and accepted by the input/output conversion functions…”) and the transmitted text format has no trailing null character [2]. This implies the protocol carries the encoded bytes produced by those conversions, not single-byte character truncation. - PostgreSQL explicitly supports UTF-8 as a character set/encoding for client-visible character data (“UTF-8” is listed among supported encodings) [3], and the protocol has a parameter for client_encoding in the startup/session parameter flow [4]. So, if a client sets client encoding to UTF-8 (typical for libpq/most drivers configured with UTF-8), then the SQL text and “text” field payloads travel over the wire as the corresponding UTF-8 byte sequences, with lengths in bytes ensuring multibyte characters are carried correctly (they may increase the byte length, but won’t be truncated as Latin-1 would).

Citations:

• 1: https://www.postgresql.org/docs/17/protocol-message-formats.html
• 2: https://www.postgresql.org/docs/17/protocol-overview.html
• 3: https://www.postgresql.org/docs/current/multibyte.html
• 4: https://www.postgresql.org/docs/current/protocol-flow.html

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

FILE="JSTests/wasm/stress/resources/pglite/jsc-harness.js"

# Show the referenced region (around 47-50) plus a bit more context
nl -ba "$FILE" | sed -n '35,90p'

# Also show other places mentioned by the original comment (106-107, 120-121, 126-127, 133-134)
nl -ba "$FILE" | sed -n '95,145p'

Repository: oven-sh/WebKit

Length of output: 101

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

FILE="JSTests/wasm/stress/resources/pglite/jsc-harness.js"

# region around 47-50 (use cat -n since nl isn't available)
cat -n "$FILE" | sed -n '35,90p'

# other mentioned locations
cat -n "$FILE" | sed -n '95,145p'

Repository: oven-sh/WebKit

Length of output: 5596

---

Fix protocol text handling to use UTF-8 encoding/decoding (avoid byte truncation).

cstr(s) encodes strings with charCodeAt(i) & 0xff, and the response parsing reconstructs text via String.fromCharCode(bytes[q]) (effectively Latin-1/single-byte). This will corrupt any non-ASCII characters in SQL/query strings, named fields, text params, row values, command tags, and PostgreSQL error messages.

Locations:

• PGProtocol.cstr(s) (47-50)
• Parsing: field names (T, 106-107), row column values (D, 120-121), command tags (C, 126-127), error message parts (E, 133-134)

💡 Proposed fix

+const textEncoder = new TextEncoder();
+const textDecoder = new TextDecoder("utf-8");

 const PGProtocol = {
@@
     cstr(s) {
-        const out = new Uint8Array(s.length + 1);
-        for (let i = 0; i < s.length; i++) out[i] = s.charCodeAt(i) & 0xff;
+        const encoded = textEncoder.encode(s);
+        const out = new Uint8Array(encoded.length + 1);
+        out.set(encoded);
         return out;
     },
@@
-                let name = ""; for (let q = p; q < end; q++) name += String.fromCharCode(bytes[q]);
+                const name = textDecoder.decode(bytes.subarray(p, end));
@@
-                let s = ""; for (let q = p; q < p + colLen; q++) s += String.fromCharCode(bytes[q]);
+                const s = textDecoder.decode(bytes.subarray(p, p + colLen));
@@
-            let s = ""; for (let q = bodyStart; q < bodyEnd && bytes[q] !== 0; q++) s += String.fromCharCode(bytes[q]);
+            const end = bytes.indexOf(0, bodyStart);
+            const s = textDecoder.decode(bytes.subarray(bodyStart, end === -1 ? bodyEnd : Math.min(end, bodyEnd)));
@@
-                let v = ""; for (let q = p; q < end; q++) v += String.fromCharCode(bytes[q]);
+                const v = textDecoder.decode(bytes.subarray(p, end));

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@JSTests/wasm/stress/resources/pglite/jsc-harness.js` around lines 47 - 50,
The current PGProtocol.cstr(s) and various response parsers use single-byte
charCodeAt/fromCharCode which truncates non-ASCII; replace these with a UTF-8
TextEncoder/TextDecoder approach: create a shared TextEncoder instance and have
cstr(s) return encoder.encode(s) plus a null terminator instead of masking with
&0xff, and in the parsers for message types T (field names), D (row column
values), C (command tags), and E (error message parts) use a TextDecoder to
decode the byte subarray up to the 0 byte into a UTF-8 string (rather than
String.fromCharCode per byte). Ensure you handle the null terminator removal
consistently and reuse encoder/decoder instances for performance.

[coderabbitai]

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Validate backend frame boundaries before parsing message bodies.

len is trusted immediately. A malformed/truncated frame can drive out-of-bounds reads or broken cursor progression (i = bodyEnd), which can hang/fail the harness.

🛡️ Proposed fix

     while (i < bytes.length) {
+        if (i + 5 > bytes.length)
+            throw new Error(`Truncated backend message header at offset ${i}`);
         const tag = String.fromCharCode(bytes[i]);
         const len = dv.getInt32(i + 1, false);
         const bodyStart = i + 5, bodyEnd = i + 1 + len;
+        if (len < 4 || bodyEnd > bytes.length || bodyEnd <= i)
+            throw new Error(`Malformed backend message frame at offset ${i} (tag=${tag}, len=${len})`);

Also applies to: 142-143

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@JSTests/wasm/stress/resources/pglite/jsc-harness.js` around lines 97 - 101,
The loop trusts len and computes bodyStart/bodyEnd without bounds checks,
allowing dv.getInt32 or subsequent body reads to go out-of-bounds; before
calling dv.getInt32 and before parsing the body or setting i = bodyEnd, validate
that (i + 1 + 4) and (i + 1 + len) are within bytes.length (and that len is
non-negative and reasonable), and if invalid, handle the truncated/malformed
frame (e.g., log/skip/abort the harness) in the same loop that processes tag,
len, bodyStart, bodyEnd; apply the same boundary checks to the other parsing
site referenced (around lines 142-143) so both dv.getInt32 and body slicing
never read past bytes.length.

[coderabbitai]

⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Require cmd and id before touching stash.

Line 8 and Line 9 can produce None, and Line 12/Line 14 would then read/write under a shared null key. That can cause cross-test interference. Return 400 when either parameter is missing.

Suggested patch

     cmd = request.GET.first(b"cmd")
     id = request.GET.first(b"id")
+    if cmd is None or id is None:
+        response.status = 400
+        return
 
     if cmd == b"store":
         request.server.stash.put(id, request.url_parts.query)

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	cmd = request.GET.first(b"cmd")
	id = request.GET.first(b"id")
	if cmd == b"store":
	request.server.stash.put(id, request.url_parts.query)
	elif cmd == b"stat":
	stored = request.server.stash.take(id)
	cmd = request.GET.first(b"cmd")
	id = request.GET.first(b"id")
	if cmd is None or id is None:
	response.status = 400
	return
	if cmd == b"store":
	request.server.stash.put(id, request.url_parts.query)
	elif cmd == b"stat":
	stored = request.server.stash.take(id)

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@LayoutTests/imported/w3c/web-platform-tests/beacon/resources/url-echo.py`
around lines 8 - 14, The handler reads cmd and id via request.GET.first and then
calls request.server.stash.put/take which can use None as a key; before touching
request.server.stash (e.g., before stash.put and stash.take), validate that both
cmd and id are present and if either is missing respond with a 400 error; update
the branches that use cmd and id (the cmd == b"store"/b"stat" checks and calls
to request.server.stash.put/take and request.url_parts.query) to only run after
this existence check so no stash operations occur with a null key.

[coderabbitai]

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Filter message events to the target iframe.

Line 23 currently accepts the first message on window without validating event.source/event.origin. That can race with unrelated messages and misreport dialog state.

Suggested patch

     async function iframeDialogIsOpen(iframe, signal) {
-      const reply = awaitEvent(window, "message", signal);
+      const reply = new Promise((resolve) => {
+        const onMessage = (event) => {
+          if (event.source !== iframe.contentWindow || event.origin !== location.origin)
+            return;
+          window.removeEventListener("message", onMessage);
+          resolve(event);
+        };
+        window.addEventListener("message", onMessage, { signal });
+      });
       iframe.contentWindow.postMessage("dialog_open", "*");
       const {data} = (await reply);
       if (data.error) throw new Error(data.error);
       return data.open;
     }

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In
`@LayoutTests/imported/w3c/web-platform-tests/close-watcher/iframes/dialog-same-origin-nn.html`
around lines 22 - 27, The awaitEvent-based listener in iframeDialogIsOpen
currently races on any window "message"; update iframeDialogIsOpen to only
accept message events coming from the target iframe by validating event.source
=== iframe.contentWindow (and event.origin if needed). If awaitEvent supports a
predicate, pass a filter that checks event.source === iframe.contentWindow (and
event.origin match), otherwise replace with an explicit addEventListener that
ignores messages from other sources before resolving and removes the listener
after use; keep the rest of the logic (postMessage "dialog_open", error check,
return data.open) unchanged.

[coderabbitai]

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Verify bless API shape in local WPT resources.
fd -i 'testdriver.js' | xargs -r rg -n 'function\s+bless\s*\(|\bbless\s*:\s*function\b|\bbless\s*\('

# Verify un-awaited bless call sites in these iframe tests.
rg -nP '\btest_driver\.bless\s*\(' \
  LayoutTests/imported/w3c/web-platform-tests/close-watcher/iframes/dialog-same-origin-ynn.html \
  LayoutTests/imported/w3c/web-platform-tests/close-watcher/iframes/dialog-same-origin-ynyn.html

Repository: oven-sh/WebKit

Length of output: 704

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Inspect bless implementation in testdriver.js
sed -n '1010,1080p' LayoutTests/imported/w3c/web-platform-tests/resources/testdriver.js | cat -n

# Find other call sites and whether they await/chain bless()
rg -nP 'await\s+test_driver\.bless\s*\(' LayoutTests/imported/w3c/web-platform-tests -S || true
rg -nP 'test_driver\.bless\s*\(\s*\)\s*;' LayoutTests/imported/w3c/web-platform-tests/close-watcher/iframes -S || true
rg -nP 'test_driver\.bless\s*\(' LayoutTests/imported/w3c/web-platform-tests -S || true

Repository: oven-sh/WebKit

Length of output: 50371

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Show surrounding code for the bless calls in the specific iframe tests
sed -n '1,120p' LayoutTests/imported/w3c/web-platform-tests/close-watcher/iframes/dialog-same-origin-ynn.html | cat -n
echo "----"
sed -n '1,140p' LayoutTests/imported/w3c/web-platform-tests/close-watcher/iframes/dialog-same-origin-ynyn.html | cat -n

Repository: oven-sh/WebKit

Length of output: 5539

---

Await test_driver.bless() before dispatching test_driver.send_keys().
test_driver.bless() returns a Promise (resolved after the bless “click”), but dialog-same-origin-ynn.html calls it without await and then proceeds to await test_driver.send_keys(...), so activation setup can race. Same pattern exists in dialog-same-origin-ynyn.html (two call sites).

Suggested patch

-      test_driver.bless();
+      await test_driver.bless();

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	test_driver.bless();
	await test_driver.bless();

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In
`@LayoutTests/imported/w3c/web-platform-tests/close-watcher/iframes/dialog-same-origin-ynn.html`
at line 34, Await the promise returned by test_driver.bless() before any
subsequent activation steps to avoid a race with test_driver.send_keys();
specifically, update the call sites in dialog-same-origin-ynn.html (the
test_driver.bless() before the await test_driver.send_keys(...)) and the two
analogous call sites in dialog-same-origin-ynyn.html to use await
test_driver.bless() so the blessing/click completes before sending keys.

[coderabbitai]

⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Remove duplicate testdriver.js include.

Line 6 duplicates Line 5. Loading it twice is unnecessary and can introduce test harness side effects.

Proposed fix

 <script src="/resources/testdriver.js"></script>
-<script src="/resources/testdriver.js"></script>
 <script src="/resources/testdriver-vendor.js"></script>

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In
`@LayoutTests/imported/w3c/web-platform-tests/close-watcher/iframes/resources/dialog-prevents-close.html`
around lines 5 - 6, Remove the duplicate script include for
"/resources/testdriver.js" so the file is only loaded once; locate the two
identical <script src="/resources/testdriver.js"></script> entries and delete
the redundant one (keep a single include) to avoid double-initializing the test
harness.

[coderabbitai]

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Use the listener argument instead of implicit global event.

Line 14 checks event.data, but the callback argument is e. This can mis-handle messages or throw in environments where event is not set.

Proposed fix

-      if (event.data == "dialog_open") {
+      if (e.data === "dialog_open") {

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	if (event.data == "dialog_open") {
	if (e.data === "dialog_open") {

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In
`@LayoutTests/imported/w3c/web-platform-tests/close-watcher/iframes/resources/dialog-prevents-close.html`
at line 14, The message event handler is using the global/implicit name `event`
instead of the callback parameter `e`, which can fail in some environments;
update the listener callback to reference the passed-in argument (use `e.data`
instead of `event.data`) wherever the handler checks or accesses the message
payload (the function registered for "message" that currently declares `e`).

[github-actions]

Preview Builds

Commit	Release	Date
d0bc4acd	autobuild-preview-pr-236-d0bc4acd	2026-05-21 16:57:21 UTC
e54e803f	autobuild-preview-pr-236-e54e803f	2026-05-21 08:08:07 UTC

[coderabbitai]

Actionable comments posted: 6

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

LayoutTests/imported/w3c/web-platform-tests/common/reftest-wait.js (1)

34-38: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Handle readyState === "complete" in failure path.

Line 34 currently only handles "interactive" immediately; when state is "complete", Line 37 registers DOMContentLoaded too late and fail() never runs.

Proposed fix

-  if (!condition) {
-    if (document.readyState == "interactive") {
-      fail();
-    } else {
-      document.addEventListener("DOMContentLoaded", fail, false);
-    }
+  if (!condition) {
+    if (document.readyState === "loading") {
+      document.addEventListener("DOMContentLoaded", fail, { once: true });
+    } else {
+      fail();
+    }
     return false;
   }

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@LayoutTests/imported/w3c/web-platform-tests/common/reftest-wait.js` around
lines 34 - 38, The current logic only triggers fail() immediately when
document.readyState === "interactive" but misses the "complete" state, so change
the condition in the block around document.readyState and DOMContentLoaded to
treat both "interactive" and "complete" as immediate failure: if
document.readyState is "interactive" or "complete" then call fail()
synchronously; otherwise keep registering
document.addEventListener("DOMContentLoaded", fail, false). Update checks
referencing document.readyState and the use of fail and DOMContentLoaded
accordingly.

♻️ Duplicate comments (10)

LayoutTests/http/tests/site-isolation/resources/validation-message-iframe.html (1)

30-35: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Filter message events by sender to avoid unintended submissions.

The message handler accepts event.data === "submit" from any sender. This should be restricted to event.source === window.parent so only the test harness frame can trigger submission.

🔒 Proposed fix to validate message source

 window.addEventListener("message", (event) => {
-    if (event.data === "submit") {
+    if (event.source === window.parent && event.data === "submit") {
         document.getElementById("submit").click();
         requestAnimationFrame(() => parent.postMessage("submitted", "*"));
     }
 });

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In
`@LayoutTests/http/tests/site-isolation/resources/validation-message-iframe.html`
around lines 30 - 35, The message handler currently accepts any postMessage with
event.data === "submit" and triggers the form submit via
document.getElementById("submit").click() and parent.postMessage("submitted",
"*"); restrict the handler to only react when event.source === window.parent
(and optionally check event.origin if needed) before calling
document.getElementById("submit").click() and posting back, so only the parent
test harness can trigger the submission.

LayoutTests/http/tests/site-isolation/validation-message-cross-origin-iframe.html (1)

43-45: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Bind the "submitted" message to the target iframe.

Line 44 currently accepts "submitted" from any window; gate it by event.source === iframe.contentWindow.

Proposed fix

         window.addEventListener("message", (event) => {
-            if (event.data === "submitted")
+            if (event.source === iframe.contentWindow && event.data === "submitted")
                 resolve();
         }, { once: true });

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In
`@LayoutTests/http/tests/site-isolation/validation-message-cross-origin-iframe.html`
around lines 43 - 45, The message handler currently treats any "submitted"
message as valid; update the listener registered in
window.addEventListener("message", ...) to additionally check that event.source
=== iframe.contentWindow before calling resolve(), so only messages originating
from the target iframe (identified by the iframe variable and its contentWindow)
are accepted.

LayoutTests/applicationmanifest/developer-warnings.html (1)

6-10: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Call notifyDone() in a finally block.

If Line 7 throws/rejects, completion is never signaled.

Proposed fix

     (async () => {
-        await testRunner.getApplicationManifest();
-        alert("Pass");
-        testRunner.notifyDone();
+        try {
+            await testRunner.getApplicationManifest();
+            alert("Pass");
+        } finally {
+            testRunner.notifyDone();
+        }
     })();

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@LayoutTests/applicationmanifest/developer-warnings.html` around lines 6 - 10,
The current async IIFE calls await testRunner.getApplicationManifest() and then
testRunner.notifyDone(), but if the await rejects notifyDone() is never called;
wrap the await call in a try/finally (or try/catch/finally) so that
testRunner.notifyDone() is invoked from the finally block (keeping the
alert("Pass") on success inside try and optionally alert an error inside catch)
to guarantee completion is always signaled for the async IIFE that invokes
testRunner.getApplicationManifest().

LayoutTests/fast/canvas/webgl/data-view-test-expected.txt (1)

32-33: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Fix heading/assertion precedence mismatch.

Line 32 says wrong length precedence, but Line 33 expects byteOffset precedence.

Proposed fix

-Test for constructor wrong length exception takes precedence over wrong byteoffset exception
+Test for constructor wrong byteoffset exception takes precedence over wrong length exception

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@LayoutTests/fast/canvas/webgl/data-view-test-expected.txt` around lines 32 -
33, The test heading/assertion is mismatched: the heading says "wrong length
exception takes precedence" but the expected assertion shows a byteOffset error
for the expression view = new Int32Array(new ArrayBuffer(100), 1, 101). Update
the expected output for the expression "view = new Int32Array(new
ArrayBuffer(100), 1, 101)" to assert the RangeError corresponding to the wrong
length (the length/byteLength overflow error) instead of the byteOffset modulo
error so the message and assertion precedence align with the heading.

LayoutTests/imported/w3c/web-platform-tests/close-watcher/iframes/dialog-same-origin-ynn.html (1)

34-34: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Await test_driver.bless() before dispatching keys.

Without await, activation setup can race send_keys(...).

Proposed fix

-      test_driver.bless();
+      await test_driver.bless();

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In
`@LayoutTests/imported/w3c/web-platform-tests/close-watcher/iframes/dialog-same-origin-ynn.html`
at line 34, The call to test_driver.bless() is not awaited, which can race with
subsequent send_keys(...) calls; change the invocation in this file to await
test_driver.bless() (i.e., ensure the surrounding scope is async or otherwise
awaits the promise) before dispatching any key events so activation/setup
completes first.

LayoutTests/http/wpt/content-security-policy/sandbox-manifest-blocked.html (1)

8-13: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Guard async manifest calls when testRunner is absent.

The IIFE directly dereferences testRunner while setup uses optional chaining.

Proposed fix

     (async () => {
+        if (!window.testRunner || typeof testRunner.getApplicationManifest !== "function")
+            return;
         const success = await testRunner.getApplicationManifest();
         const elem = document.querySelector("link");
         outputdiv.innerHTML = `Fetched manifest: ${elem.href}, success: ${success}`;
         testRunner.notifyDone();
     })();

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@LayoutTests/http/wpt/content-security-policy/sandbox-manifest-blocked.html`
around lines 8 - 13, The IIFE currently dereferences testRunner directly; before
calling testRunner.getApplicationManifest() and testRunner.notifyDone(), guard
against a missing testRunner (e.g., if (!testRunner) or using optional chaining)
and handle the fallback path: set a sensible default for success, still resolve
elem via document.querySelector("link") and update outputdiv.innerHTML with a
message that includes the fetched manifest href and the fallback success value,
then only call testRunner.notifyDone() when testRunner is present; update
references in this block (the IIFE, testRunner.getApplicationManifest,
testRunner.notifyDone, elem, outputdiv.innerHTML) accordingly.

LayoutTests/accessibility/dialog-focus-on-open.html (1)

36-45: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Guarantee cleanup and finishJSTest() on async failure.

A thrown/rejected expectAsync(...) can bypass teardown and leave this test hanging.

Proposed fix

     setTimeout(async function() {
-        showButton.press();
-
-        output += await expectAsync("window.focusedAtNotificationTime", "'heading'");
-        output += expect("accessibilityController.focusedElement.domIdentifier", "'heading'");
-
-        accessibilityController.removeNotificationListener();
-        debug(output);
-        finishJSTest();
+        try {
+            showButton.press();
+            output += await expectAsync("window.focusedAtNotificationTime", "'heading'");
+            output += expect("accessibilityController.focusedElement.domIdentifier", "'heading'");
+        } catch (e) {
+            output += `\nError: ${e}`;
+        } finally {
+            accessibilityController.removeNotificationListener();
+            debug(output);
+            finishJSTest();
+        }
     }, 0);

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@LayoutTests/accessibility/dialog-focus-on-open.html` around lines 36 - 45,
The async callback can throw and skip teardown; wrap the body of the setTimeout
handler in a try/catch/finally (or attach a .catch/.finally) so that
accessibilityController.removeNotificationListener() and finishJSTest() always
run; keep showButton.press() and the await
expectAsync("window.focusedAtNotificationTime", "'heading'")/expect(...) logic,
append to output as before, call debug(output) in the try or finally as
appropriate, and perform cleanup and finishJSTest() in the finally block to
guarantee teardown even on rejection.

LayoutTests/http/tests/security/cross-origin-indexeddb.html (1)

16-31: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Validate message sender before processing test state.

Unfiltered messages can incorrectly trigger stored / TRANSIENT / PERSISTENT paths.

Proposed fix

 window.addEventListener("message", event => {
+    const iframeWindow = document.querySelector("iframe").contentWindow;
+    if (event.origin !== "http://localhost:8000" || event.source !== iframeWindow)
+        return;
+
     if (event.data === "stored") {
         log("Third-party iframe stored data in IndexedDB; terminating network process.");
         if (window.testRunner)
             testRunner.terminateNetworkProcess();

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@LayoutTests/http/tests/security/cross-origin-indexeddb.html` around lines 16
- 31, The message handler registered with window.addEventListener("message",
event => { ... }) must validate the sender before interpreting event.data;
update that handler to ignore messages not from the expected test iframe by
checking the sender (e.g., compare event.source === expectedIframe.contentWindow
or verify event.origin against a known trusted origin) and only then proceed to
handle "stored"/"TRANSIENT"/"PERSISTENT" and call testRunner.notifyDone();
ensure untrusted messages are returned/ignored early.

LayoutTests/applicationmanifest/multiple-links.html (1)

11-15: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Call notifyDone() from finally to avoid harness hangs.

Line 11–15 can miss testRunner.notifyDone() if getApplicationManifest() throws/rejects.

Proposed fix

 if (window.testRunner) {
     (async () => {
-        const success = await testRunner.getApplicationManifest();
-        outputdiv.innerHTML = `manifest fetch success: ${success}`;
-        testRunner.notifyDone();
+        try {
+            const success = await testRunner.getApplicationManifest();
+            outputdiv.innerHTML = `manifest fetch success: ${success}`;
+        } finally {
+            testRunner.notifyDone();
+        }
     })();
 }

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@LayoutTests/applicationmanifest/multiple-links.html` around lines 11 - 15,
The IIFE currently awaits testRunner.getApplicationManifest() and only calls
testRunner.notifyDone() on the success path, so if getApplicationManifest()
rejects the harness can hang; wrap the await in try/catch/finally (or use
.finally()) so that testRunner.notifyDone() is invoked in the finally block
regardless of success or error, preserving the existing outputdiv.innerHTML
update in the try or catch as appropriate and referencing
getApplicationManifest() and testRunner.notifyDone() to locate the change.

LayoutTests/accessibility/dynamic-subtree-replacement-with-stale-parent-children.html (1)

26-62: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Ensure teardown always runs for the async test body.

Line 26–62 can skip clearInterval(makePageDirty) and finishJSTest() if any awaited step fails, which can hang the test.

Proposed fix

     setTimeout(async function() {
         var notificationCounter = 0;
         var makePageDirty = setInterval(function() {
@@
             document.getElementById("container").setAttribute("aria-atomic", String(notificationCounter++));
         }, 1);
-
-        // Update the role, triggering a full node update.
-        document.getElementById("container").setAttribute("role", "group");
-        var newContents = "";
-        for (var i = 1; i <= buttonCount; i++)
-            newContents += `<button id="q${i}-button">Q${i}</button>`;
-        newContents += `<button id="nav-button">Next</button>`;
-        document.getElementById("container").innerHTML = newContents;
-
-        container = accessibilityController.accessibleElementById("container");
-        output += "\nAfter swap:\n";
-        output += await expectAsync("container.childrenCount", "13");
-
-        reachableButtons = 0;
-        for (var i = 1; i <= buttonCount; i++) {
-            let button = await waitForElementById(`q${i}-button`);
-            if (button)
-                reachableButtons++;
-        }
-        output += expect("reachableButtons", "buttonCount");
-
-        clearInterval(makePageDirty);
-
-        debug(output);
-        finishJSTest();
+        try {
+            // Update the role, triggering a full node update.
+            document.getElementById("container").setAttribute("role", "group");
+            var newContents = "";
+            for (var i = 1; i <= buttonCount; i++)
+                newContents += `<button id="q${i}-button">Q${i}</button>`;
+            newContents += `<button id="nav-button">Next</button>`;
+            document.getElementById("container").innerHTML = newContents;
+
+            container = accessibilityController.accessibleElementById("container");
+            output += "\nAfter swap:\n";
+            output += await expectAsync("container.childrenCount", "13");
+
+            reachableButtons = 0;
+            for (var i = 1; i <= buttonCount; i++) {
+                let button = await waitForElementById(`q${i}-button`);
+                if (button)
+                    reachableButtons++;
+            }
+            output += expect("reachableButtons", "buttonCount");
+        } finally {
+            clearInterval(makePageDirty);
+            debug(output);
+            finishJSTest();
+        }
     }, 0);

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In
`@LayoutTests/accessibility/dynamic-subtree-replacement-with-stale-parent-children.html`
around lines 26 - 62, The async callback passed to setTimeout can exit early on
rejected awaits and skip cleanup (clearInterval(makePageDirty) and
finishJSTest()); wrap the body of that async function in a try/finally (or
ensure a .finally() on Promises) so that clearInterval(makePageDirty) and
finishJSTest() always run regardless of failures; locate the anonymous async
function (the setTimeout handler), the makePageDirty variable, and the calls to
clearInterval(makePageDirty) and finishJSTest() and move/ensure those calls into
a finally block that executes after awaited calls like expectAsync and
waitForElementById.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@JSTests/stress/promise-resolve-non-thenable-structure-cache-dictionary.js`:
- Line 32: Declare and initialize the missing variable testLoopCount near the
top of the file (e.g., immediately after the helper functions) so the for-loops
that reference it (the for (...) using testLoopCount) do not throw a
ReferenceError; set it to an appropriate integer or source it from
configuration/environment if intended to be configurable, and ensure the same
identifier testLoopCount is used consistently across the loops at the locations
where it is currently referenced.

In `@LayoutTests/fast/repaint/drop-shadow-box-change.html`:
- Around line 31-35: After adding the 'changed' class to document.body, wait for
the next rendering frame before calling window.internals.repaintRectsAsText()
and internals.stopTrackingRepaints(); replace the immediate read with a
requestAnimationFrame (or two nested requestAnimationFrame calls) to ensure the
style mutation has been applied and paint/repaint rects are stable before
debugging and stopping tracking.

In `@LayoutTests/fast/repaint/drop-shadow-change.html`:
- Around line 28-33: After adding the 'changed' class to document.body, force a
rendering flush before calling window.internals.repaintRectsAsText() to avoid
capturing stale/empty repaint rects; insert a synchronous layout/paint trigger
(for example, read a layout-affecting property such as
document.body.offsetHeight or window.getComputedStyle(document.body).width)
immediately after document.body.classList.add('changed') and before calling
repaintRectsAsText(), then proceed to call window.internals.repaintRectsAsText()
and internals.stopTrackingRepaints().

In `@LayoutTests/fast/text-extraction/contenteditable-text-extraction.html`:
- Around line 12-22: The test currently awaits UIHelper.requestTextExtraction in
the load event handler and may never call testRunner.notifyDone() if that
promise rejects; wrap the await in a try/finally (or use .catch(...) and a
finally) inside the addEventListener callback so that testRunner.notifyDone() is
always invoked regardless of success or error, referencing the async load
handler, UIHelper.requestTextExtraction, and
testRunner.notifyDone()/testRunner.waitUntilDone()/testRunner.dumpAsText() to
locate where to add the try/finally.

In
`@LayoutTests/http/tests/resourceLoadStatistics/third-party-cookie-blocking-about-blank-popup.html`:
- Around line 46-48: The message handler registered via
window.addEventListener("message", function handler(event) { ... }) should first
verify the message came from the popup before acting; update the handler to
check event.source === popup (or the actual popup variable name used in the
test) and only then inspect event.data.type === "fetch-done" and
removeEventListener("message", handler). This prevents unrelated postMessage
events from being consumed and causing flakes.

In
`@LayoutTests/imported/w3c/web-platform-tests/close-watcher/iframes/dialog-same-origin-ynyn.html`:
- Around line 23-27: The message handler currently accepts the first window
"message" event which can come from the wrong iframe; change the reply
acceptance so it only resolves when event.source === iframe.contentWindow. In
practice update the awaitEvent(window, "message", signal) usage (or the code
that handles its result) to check event.source === iframe.contentWindow and
ignore/continue waiting for other messages until the source matches, then
extract data and proceed (the variables/functions to change are awaitEvent,
reply, and the check before reading data/error).

---

Outside diff comments:
In `@LayoutTests/imported/w3c/web-platform-tests/common/reftest-wait.js`:
- Around line 34-38: The current logic only triggers fail() immediately when
document.readyState === "interactive" but misses the "complete" state, so change
the condition in the block around document.readyState and DOMContentLoaded to
treat both "interactive" and "complete" as immediate failure: if
document.readyState is "interactive" or "complete" then call fail()
synchronously; otherwise keep registering
document.addEventListener("DOMContentLoaded", fail, false). Update checks
referencing document.readyState and the use of fail and DOMContentLoaded
accordingly.

---

Duplicate comments:
In `@LayoutTests/accessibility/dialog-focus-on-open.html`:
- Around line 36-45: The async callback can throw and skip teardown; wrap the
body of the setTimeout handler in a try/catch/finally (or attach a
.catch/.finally) so that accessibilityController.removeNotificationListener()
and finishJSTest() always run; keep showButton.press() and the await
expectAsync("window.focusedAtNotificationTime", "'heading'")/expect(...) logic,
append to output as before, call debug(output) in the try or finally as
appropriate, and perform cleanup and finishJSTest() in the finally block to
guarantee teardown even on rejection.

In
`@LayoutTests/accessibility/dynamic-subtree-replacement-with-stale-parent-children.html`:
- Around line 26-62: The async callback passed to setTimeout can exit early on
rejected awaits and skip cleanup (clearInterval(makePageDirty) and
finishJSTest()); wrap the body of that async function in a try/finally (or
ensure a .finally() on Promises) so that clearInterval(makePageDirty) and
finishJSTest() always run regardless of failures; locate the anonymous async
function (the setTimeout handler), the makePageDirty variable, and the calls to
clearInterval(makePageDirty) and finishJSTest() and move/ensure those calls into
a finally block that executes after awaited calls like expectAsync and
waitForElementById.

In `@LayoutTests/applicationmanifest/developer-warnings.html`:
- Around line 6-10: The current async IIFE calls await
testRunner.getApplicationManifest() and then testRunner.notifyDone(), but if the
await rejects notifyDone() is never called; wrap the await call in a try/finally
(or try/catch/finally) so that testRunner.notifyDone() is invoked from the
finally block (keeping the alert("Pass") on success inside try and optionally
alert an error inside catch) to guarantee completion is always signaled for the
async IIFE that invokes testRunner.getApplicationManifest().

In `@LayoutTests/applicationmanifest/multiple-links.html`:
- Around line 11-15: The IIFE currently awaits
testRunner.getApplicationManifest() and only calls testRunner.notifyDone() on
the success path, so if getApplicationManifest() rejects the harness can hang;
wrap the await in try/catch/finally (or use .finally()) so that
testRunner.notifyDone() is invoked in the finally block regardless of success or
error, preserving the existing outputdiv.innerHTML update in the try or catch as
appropriate and referencing getApplicationManifest() and testRunner.notifyDone()
to locate the change.

In `@LayoutTests/fast/canvas/webgl/data-view-test-expected.txt`:
- Around line 32-33: The test heading/assertion is mismatched: the heading says
"wrong length exception takes precedence" but the expected assertion shows a
byteOffset error for the expression view = new Int32Array(new ArrayBuffer(100),
1, 101). Update the expected output for the expression "view = new
Int32Array(new ArrayBuffer(100), 1, 101)" to assert the RangeError corresponding
to the wrong length (the length/byteLength overflow error) instead of the
byteOffset modulo error so the message and assertion precedence align with the
heading.

In `@LayoutTests/http/tests/security/cross-origin-indexeddb.html`:
- Around line 16-31: The message handler registered with
window.addEventListener("message", event => { ... }) must validate the sender
before interpreting event.data; update that handler to ignore messages not from
the expected test iframe by checking the sender (e.g., compare event.source ===
expectedIframe.contentWindow or verify event.origin against a known trusted
origin) and only then proceed to handle "stored"/"TRANSIENT"/"PERSISTENT" and
call testRunner.notifyDone(); ensure untrusted messages are returned/ignored
early.

In
`@LayoutTests/http/tests/site-isolation/resources/validation-message-iframe.html`:
- Around line 30-35: The message handler currently accepts any postMessage with
event.data === "submit" and triggers the form submit via
document.getElementById("submit").click() and parent.postMessage("submitted",
"*"); restrict the handler to only react when event.source === window.parent
(and optionally check event.origin if needed) before calling
document.getElementById("submit").click() and posting back, so only the parent
test harness can trigger the submission.

In
`@LayoutTests/http/tests/site-isolation/validation-message-cross-origin-iframe.html`:
- Around line 43-45: The message handler currently treats any "submitted"
message as valid; update the listener registered in
window.addEventListener("message", ...) to additionally check that event.source
=== iframe.contentWindow before calling resolve(), so only messages originating
from the target iframe (identified by the iframe variable and its contentWindow)
are accepted.

In `@LayoutTests/http/wpt/content-security-policy/sandbox-manifest-blocked.html`:
- Around line 8-13: The IIFE currently dereferences testRunner directly; before
calling testRunner.getApplicationManifest() and testRunner.notifyDone(), guard
against a missing testRunner (e.g., if (!testRunner) or using optional chaining)
and handle the fallback path: set a sensible default for success, still resolve
elem via document.querySelector("link") and update outputdiv.innerHTML with a
message that includes the fetched manifest href and the fallback success value,
then only call testRunner.notifyDone() when testRunner is present; update
references in this block (the IIFE, testRunner.getApplicationManifest,
testRunner.notifyDone, elem, outputdiv.innerHTML) accordingly.

In
`@LayoutTests/imported/w3c/web-platform-tests/close-watcher/iframes/dialog-same-origin-ynn.html`:
- Line 34: The call to test_driver.bless() is not awaited, which can race with
subsequent send_keys(...) calls; change the invocation in this file to await
test_driver.bless() (i.e., ensure the surrounding scope is async or otherwise
awaits the promise) before dispatching any key events so activation/setup
completes first.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: fa2fe452-159b-47fb-965c-c692f2b84e6b

📥 Commits

Reviewing files that changed from the base of the PR and between 01ecc4e and d0bc4ac.

⛔ Files ignored due to path filters (3)

• JSTests/wasm/stress/resources/pglite/pglite.wasm is excluded by !**/*.wasm
• LayoutTests/imported/w3c/web-platform-tests/close-watcher/iframes/resources/w3c-import.log is excluded by !**/*.log
• LayoutTests/imported/w3c/web-platform-tests/close-watcher/iframes/w3c-import.log is excluded by !**/*.log

📒 Files selected for processing (297)

• .submitproject
• .submitproject-append
• .wkdev-sdk-version
• CMakeLists.txt
• CMakePresets.json
• Configurations/CommonBase.xcconfig
• Configurations/Version.xcconfig
• Configurations/WebKitProjectPaths.xcconfig
• JSTests/microbenchmarks/array-includes-string-8bit-long.js
• JSTests/microbenchmarks/array-indexof-string-8bit-long.js
• JSTests/microbenchmarks/array-indexof-string-8bit-short.js
• JSTests/microbenchmarks/await-object-literal.js
• JSTests/microbenchmarks/date-now-elapsed.js
• JSTests/microbenchmarks/date-now.js
• JSTests/microbenchmarks/promise-all-non-thenable-object.js
• JSTests/microbenchmarks/promise-all-non-thenable.js
• JSTests/microbenchmarks/promise-all-settled-non-thenable.js
• JSTests/microbenchmarks/promise-race-non-thenable.js
• JSTests/microbenchmarks/promise-resolve-non-thenable-object.js
• JSTests/microbenchmarks/promise-resolve-object-literal.js
• JSTests/microbenchmarks/promise-then-chain-object-literal.js
• JSTests/microbenchmarks/regexp-match-digit-cached.js
• JSTests/microbenchmarks/regexp-match-digit-literal.js
• JSTests/microbenchmarks/string-match-digit-short.js
• JSTests/microbenchmarks/string-match-letter-short.js
• JSTests/modules/import-defer-dynamic-evaluation.js
• JSTests/modules/import-defer-dynamic-rejects.js
• JSTests/modules/import-defer-dynamic-syntax.js
• JSTests/modules/import-defer-dynamic-tla.js
• JSTests/modules/import-defer-dynamic.js
• JSTests/modules/indirect-export-error.js
• JSTests/modules/indirect-export-error/indirect-export-source-order-2.js
• JSTests/modules/indirect-export-error/indirect-export-source-order.js
• JSTests/stress/array-indexof-includes-string-word-compare.js
• JSTests/stress/array-shift-intrinsic.js
• JSTests/stress/array-sort-inline-ai-cell-butterfly-validation.js
• JSTests/stress/array-sort-inline-isnan-comparator-cps.js
• JSTests/stress/array-sort-inline-nested-in-comparator.js
• JSTests/stress/array-unshift-intrinsic-ftl.js
• JSTests/stress/array-unshift-intrinsic.js
• JSTests/stress/asynciterator-prototype-symbol-async-dispose-return-argument.js
• JSTests/stress/date-now-jit.js
• JSTests/stress/dfg-perform-promise-then-one-handler-exit-ok.js
• JSTests/stress/dfg-promise-resolve-fulfilled-object.js
• JSTests/stress/dynamic-import-inline-microtask-result-promise.js
• JSTests/stress/ftl-multigetbyoffset-constant-numberuse.js
• JSTests/stress/iterator-prototype-flatMap-return-no-arguments.js
• JSTests/stress/megamorphic-ic-symbol.js
• JSTests/stress/object-define-property-fields-spilled-arg.js
• JSTests/stress/perform-promise-then-one-handler.js
• JSTests/stress/promise-combinator-non-thenable-element.js
• JSTests/stress/promise-resolve-non-thenable-structure-cache-cross-realm.js
• JSTests/stress/promise-resolve-non-thenable-structure-cache-dictionary.js
• JSTests/stress/promise-resolve-non-thenable-structure-cache.js
• JSTests/stress/spread-set-own-symbol-iterator-side-effects.js
• JSTests/stress/string-prototype-match-edge-cases.js
• JSTests/stress/string-prototype-match-strength-reduction.js
• JSTests/stress/string-prototype-match-watchpoint-invalidation.js
• JSTests/stress/string-substr-strength-reduction.js
• JSTests/stress/string-substr.js
• JSTests/stress/symbol-prototype-to-string-intrinsic.js
• JSTests/stress/typedarray-constructor-allocatetypedarray-before-isdetachedbuffer-prototype-getter-detach.js
• JSTests/stress/typedarray-constructor-allocatetypedarray-before-isdetachedbuffer.js
• JSTests/stress/typedarray-constructor-allocatetypedarray-before-toindex-byteoffset.js
• JSTests/stress/typedarray-constructor-allocatetypedarray-before-toindex-length.js
• JSTests/stress/typedarray-constructor-byteoffset-modulo-elementsize-before-isdetachedbuffer-weird-byteoffset.js
• JSTests/stress/typedarray-constructor-byteoffset-modulo-elementsize-before-isdetachedbuffer.js
• JSTests/stress/typedarray-constructor-byteoffset-modulo-elementsize-before-toindex-length.js
• JSTests/stress/typedarray-constructor-isdetachbuffer-before-bufferbytelength-modulo-elementsize-weird-byteoffset-detach.js
• JSTests/stress/typedarray-constructor-isdetachbuffer-before-bufferbytelength-modulo-elementsize.js
• JSTests/stress/typedarray-constructor-isdetachbuffer-before-newbytelength-lt-0-weird-byteoffset.js
• JSTests/stress/typedarray-constructor-isdetachbuffer-before-newbytelength-lt-0.js
• JSTests/stress/typedarray-constructor-isdetachbuffer-before-offset+newbytelength-gt-bufferbytelength-byteoffset-too-large.js
• JSTests/stress/typedarray-constructor-isdetachbuffer-before-offset+newbytelength-gt-bufferbytelength-length-too-large.js
• JSTests/stress/typedarray-constructor-toindex-byteoffset-before-isdetachedbuffer-weird-byteoffset-detach.js
• JSTests/stress/typedarray-constructor-toindex-byteoffset-before-isdetachedbuffer.js
• JSTests/stress/typedarray-constructor-toindex-byteoffset-detach-buffer.js
• JSTests/stress/typedarray-constructor-toindex-length-before-isdetachedbuffer-weird-byteoffset-detach.js
• JSTests/stress/typedarray-constructor-toindex-length-before-isdetachedbuffer-weird-length-detach.js
• JSTests/stress/typedarray-constructor-toindex-length-before-isdetachedbuffer.js
• JSTests/stress/typedarray-constructor-toindex-length-detach-buffer.js
• JSTests/test262/config.yaml
• JSTests/test262/expectations.yaml
• JSTests/wasm/stress/lazy-table-copy-preserves-laziness.js
• JSTests/wasm/stress/lazy-table-cross-instance.js
• JSTests/wasm/stress/lazy-table-identity-across-paths.js
• JSTests/wasm/stress/lazy-table-wrappers.js
• JSTests/wasm/stress/pglite.js
• JSTests/wasm/stress/resources/pglite/LICENSE.Emscripten
• JSTests/wasm/stress/resources/pglite/LICENSE.PostgreSQL
• JSTests/wasm/stress/resources/pglite/LICENSE.pglite
• JSTests/wasm/stress/resources/pglite/README.md
• JSTests/wasm/stress/resources/pglite/jsc-harness.js
• JSTests/wasm/stress/resources/pglite/pglite.data
• JSTests/wasm/stress/resources/pglite/pglite.js
• JSTests/wasm/stress/resources/pglite/psql.js
• LayoutTests/TestExpectations
• LayoutTests/accessibility/dialog-focus-on-open-expected.txt
• LayoutTests/accessibility/dialog-focus-on-open.html
• LayoutTests/accessibility/dynamic-subtree-replacement-with-stale-parent-children-expected.txt
• LayoutTests/accessibility/dynamic-subtree-replacement-with-stale-parent-children.html
• LayoutTests/applicationmanifest/developer-warnings.html
• LayoutTests/applicationmanifest/multiple-links-expected.txt
• LayoutTests/applicationmanifest/multiple-links.html
• LayoutTests/compositing/filters/sw-nested-shadow-overlaps-hw-nested-shadow-expected.txt
• LayoutTests/compositing/geometry/bounds-with-filters-expected.txt
• LayoutTests/compositing/geometry/bounds-with-filters.html
• LayoutTests/compositing/geometry/frame-clipping-layer-with-bottom-right-inset-expected.txt
• LayoutTests/compositing/geometry/frame-clipping-layer-with-bottom-right-inset.html
• LayoutTests/compositing/geometry/frame-clipping-layer-with-top-left-inset-expected.txt
• LayoutTests/compositing/geometry/frame-clipping-layer-with-top-left-inset.html
• LayoutTests/css3/filters/backdrop/backdrop-blur-and-subsequent-elements-expected.html
• LayoutTests/css3/filters/backdrop/backdrop-blur-and-subsequent-elements.html
• LayoutTests/css3/filters/drop-shadow-target-clipped.html
• LayoutTests/editing/pasteboard/cjk-line-height-expected.txt
• LayoutTests/fast/canvas/webgl/data-view-test-expected.txt
• LayoutTests/fast/css/container-query-orientation-modal-dialog-crash-expected.txt
• LayoutTests/fast/css/container-query-orientation-modal-dialog-crash.html
• LayoutTests/fast/css/css-typed-om-typeerror-coalescing-pair-expected.txt
• LayoutTests/fast/css/css-typed-om-typeerror-coalescing-pair.html
• LayoutTests/fast/css/css-typed-om/css-builder-converter-initial-letter-crash-expected.txt
• LayoutTests/fast/css/css-typed-om/css-builder-converter-initial-letter-crash.html
• LayoutTests/fast/css/css-typed-om/css-typed-om-typeerror-associated-property-mismatch-expected.txt
• LayoutTests/fast/css/css-typed-om/css-typed-om-typeerror-associated-property-mismatch.html
• LayoutTests/fast/css/cssom-border-image-width-crash.html
• LayoutTests/fast/css/cssom-mask-border-width-crash-expected.txt
• LayoutTests/fast/css/cssom-mask-border-width-crash.html
• LayoutTests/fast/css/cssom-translate-crash-expected.txt
• LayoutTests/fast/css/cssom-translate-crash.html
• LayoutTests/fast/css/getComputedStyle/computed-style-font-family-expected.txt
• LayoutTests/fast/css/getComputedStyle/font-family-fallback-reset-expected.txt
• LayoutTests/fast/css/getComputedStyle/font-family-fallback-reset.html
• LayoutTests/fast/css/serialization-with-double-quotes-expected.txt
• LayoutTests/fast/css/serialization-with-double-quotes.html
• LayoutTests/fast/css/stylepropertymap-append-not-checking-for-variablereferencevalue-expected.txt
• LayoutTests/fast/css/stylepropertymap-append-not-checking-for-variablereferencevalue.html
• LayoutTests/fast/dom/StyleSheet/css-font-variation-settings-crash.html
• LayoutTests/fast/dom/navigator-detached-no-crash-expected.txt
• LayoutTests/fast/flexbox/preferred-width-empty-inline-block-expected.txt
• LayoutTests/fast/flexbox/preferred-width-empty-inline-block.html
• LayoutTests/fast/forms/ios/form-control-refresh/button/identical-buttons-have-same-corner-radius-expected.html
• LayoutTests/fast/forms/ios/form-control-refresh/button/identical-buttons-have-same-corner-radius.html
• LayoutTests/fast/forms/ios/select-menulist-text-align-chevron-padding-expected.txt
• LayoutTests/fast/forms/ios/select-menulist-text-align-chevron-padding.html
• LayoutTests/fast/forms/label/label-click-event-dispatch-untrusted-expected.txt
• LayoutTests/fast/forms/label/label-click-event-dispatch-untrusted.html
• LayoutTests/fast/grid/grid-item-block-content-size-suggestion-crash-expected.txt
• LayoutTests/fast/grid/grid-item-block-content-size-suggestion-crash.html
• LayoutTests/fast/hidpi/filters-drop-shadow.html
• LayoutTests/fast/images/stopped-animation-deleted-image.html
• LayoutTests/fast/overflow/intrinsic-width-container-with-scrollable-descendant-expected.html
• LayoutTests/fast/overflow/intrinsic-width-container-with-scrollable-descendant.html
• LayoutTests/fast/overflow/min-intrinsic-width-container-with-scrollable-descendant-expected.html
• LayoutTests/fast/overflow/min-intrinsic-width-container-with-scrollable-descendant.html
• LayoutTests/fast/repaint/blur-change-expected.txt
• LayoutTests/fast/repaint/blur-change.html
• LayoutTests/fast/repaint/drop-shadow-box-change-expected.txt
• LayoutTests/fast/repaint/drop-shadow-box-change.html
• LayoutTests/fast/repaint/drop-shadow-change-expected.txt
• LayoutTests/fast/repaint/drop-shadow-change.html
• LayoutTests/fast/repaint/drop-shadow-writing-modes-expected.txt
• LayoutTests/fast/repaint/drop-shadow-writing-modes.html
• LayoutTests/fast/repaint/select-option-background-color-tracked.html
• LayoutTests/fast/scrolling/ios/fixed-position-in-vertical-rl-expected.html
• LayoutTests/fast/scrolling/ios/fixed-position-in-vertical-rl.html
• LayoutTests/fast/scrolling/ios/iframe-scroll-into-view.html
• LayoutTests/fast/shadow-dom/style-invalidation-slotted-element-with-author-shadow-root-crash-expected.txt
• LayoutTests/fast/shadow-dom/style-invalidation-slotted-element-with-author-shadow-root-crash.html
• LayoutTests/fast/text-extraction/contenteditable-text-extraction-expected.txt
• LayoutTests/fast/text-extraction/contenteditable-text-extraction.html
• LayoutTests/fast/text-extraction/max-recursion-depth-cap-expected.html
• LayoutTests/fast/text-extraction/max-recursion-depth-cap.html
• LayoutTests/fast/text-extraction/text-extraction-scroll-fallback-to-large-container-expected.txt
• LayoutTests/fast/text-extraction/text-extraction-scroll-fallback-to-large-container.html
• LayoutTests/fast/text/font-face-family-expected.txt
• LayoutTests/fast/text/font-face-family.html
• LayoutTests/fast/text/font-stretch-parse-expected.txt
• LayoutTests/fast/text/font-stretch-parse.html
• LayoutTests/fast/text/font-style-parse-expected.txt
• LayoutTests/fast/text/font-style-parse.html
• LayoutTests/fast/text/font-weight-parse-expected.txt
• LayoutTests/fast/text/font-weight-parse.html
• LayoutTests/http/tests/cache/partitioned-cache-iframe.html
• LayoutTests/http/tests/cache/partitioned-cache.html
• LayoutTests/http/tests/cache/resources/partitioned-cache-loader.html
• LayoutTests/http/tests/css/filters-on-iframes-transform.html
• LayoutTests/http/tests/css/filters-on-iframes.html
• LayoutTests/http/tests/css/resources/references-external-green.html
• LayoutTests/http/tests/css/resources/references-external-red.html
• LayoutTests/http/tests/navigation/page-cache-pending-image-load-cache-partition.html
• LayoutTests/http/tests/navigation/pushstate-at-unique-origin-denied-expected.txt
• LayoutTests/http/tests/navigation/pushstate-at-unique-origin-denied.py
• LayoutTests/http/tests/resourceLoadStatistics/third-party-cookie-blocking-about-blank-popup-expected.txt
• LayoutTests/http/tests/resourceLoadStatistics/third-party-cookie-blocking-about-blank-popup.html
• LayoutTests/http/tests/security/contentSecurityPolicy/manifest-src-allowed-expected.txt
• LayoutTests/http/tests/security/contentSecurityPolicy/manifest-src-allowed.html
• LayoutTests/http/tests/security/contentSecurityPolicy/manifest-src-blocked-expected.txt
• LayoutTests/http/tests/security/contentSecurityPolicy/manifest-src-blocked.html
• LayoutTests/http/tests/security/contentSecurityPolicy/path-traversal-bypass-with-percent-encoding-expected.txt
• LayoutTests/http/tests/security/contentSecurityPolicy/path-traversal-bypass-with-percent-encoding.html
• LayoutTests/http/tests/security/credentials-iframes.html
• LayoutTests/http/tests/security/credentials-main-resource.html
• LayoutTests/http/tests/security/cross-origin-blob-transfer-expected.txt
• LayoutTests/http/tests/security/cross-origin-blob-transfer.html
• LayoutTests/http/tests/security/cross-origin-iframe-fetch-after-crash-expected.txt
• LayoutTests/http/tests/security/cross-origin-iframe-fetch-after-crash.html
• LayoutTests/http/tests/security/cross-origin-indexeddb-expected.txt
• LayoutTests/http/tests/security/cross-origin-indexeddb.html
• LayoutTests/http/tests/security/cross-origin-local-storage-allowed.html
• LayoutTests/http/tests/security/cross-origin-local-storage.html
• LayoutTests/http/tests/security/cross-origin-session-storage-third-party-blocked.html
• LayoutTests/http/tests/security/cross-origin-websql.html
• LayoutTests/http/tests/security/cross-origin-worker-indexeddb.html
• LayoutTests/http/tests/security/history-pushState-replaceState-from-sandboxed-iframe-expected.txt
• LayoutTests/http/tests/security/resources/cross-origin-iframe-fetch-after-crash-iframe.html
• LayoutTests/http/tests/security/resources/cross-origin-iframe-for-indexeddb-transience.html
• LayoutTests/http/tests/security/resources/document-for-cross-origin-worker-indexeddb.html
• LayoutTests/http/tests/security/resources/history-pushState-replaceState-from-sandboxed-iframe.html
• LayoutTests/http/tests/security/resources/load-local-storage.html
• LayoutTests/http/tests/security/same-origin-document-domain-storage-allowed.html
• LayoutTests/http/tests/security/same-origin-storage-blocked.html
• LayoutTests/http/tests/security/same-origin-websql-blocked.html
• LayoutTests/http/tests/security/sync-xhr-partition.html
• LayoutTests/http/tests/site-isolation/inspector/network/cross-origin-iframe-request-id-uniqueness-expected.txt
• LayoutTests/http/tests/site-isolation/inspector/network/cross-origin-iframe-request-id-uniqueness.html
• LayoutTests/http/tests/site-isolation/open-panel-in-cross-origin-iframe-expected.txt
• LayoutTests/http/tests/site-isolation/open-panel-in-cross-origin-iframe.html
• LayoutTests/http/tests/site-isolation/resources/file-input-iframe.html
• LayoutTests/http/tests/site-isolation/resources/validation-message-iframe.html
• LayoutTests/http/tests/site-isolation/validation-message-cross-origin-iframe-expected.txt
• LayoutTests/http/tests/site-isolation/validation-message-cross-origin-iframe.html
• LayoutTests/http/tests/ssl/media-stream/resources/get-user-media-frame.html
• LayoutTests/http/tests/webgpu/webgpu/shader/validation/expression/binary/short_circuiting_and_or-expected.txt
• LayoutTests/http/tests/webgpu/webgpu/shader/validation/parse/identifiers-expected.txt
• LayoutTests/http/wpt/content-security-policy/sandbox-manifest-blocked-cross-origin.sub-expected.txt
• LayoutTests/http/wpt/content-security-policy/sandbox-manifest-blocked-cross-origin.sub.html
• LayoutTests/http/wpt/content-security-policy/sandbox-manifest-blocked-expected.txt
• LayoutTests/http/wpt/content-security-policy/sandbox-manifest-blocked.html
• LayoutTests/imported/w3c/resources/import-expectations.json
• LayoutTests/imported/w3c/resources/resource-files.json
• LayoutTests/imported/w3c/web-platform-tests/beacon/beacon-url-encoding-euc-kr.https-expected.txt
• LayoutTests/imported/w3c/web-platform-tests/beacon/beacon-url-encoding-euc-kr.https.html
• LayoutTests/imported/w3c/web-platform-tests/beacon/resources/url-echo.py
• LayoutTests/imported/w3c/web-platform-tests/close-watcher/META.yml
• LayoutTests/imported/w3c/web-platform-tests/close-watcher/basic-expected.txt
• LayoutTests/imported/w3c/web-platform-tests/close-watcher/iframes/dialog-same-origin-nn.html
• LayoutTests/imported/w3c/web-platform-tests/close-watcher/iframes/dialog-same-origin-ynn.html
• LayoutTests/imported/w3c/web-platform-tests/close-watcher/iframes/dialog-same-origin-ynyn.html
• LayoutTests/imported/w3c/web-platform-tests/close-watcher/iframes/resources/dialog-prevents-close.html
• LayoutTests/imported/w3c/web-platform-tests/close-watcher/inside-event-listeners-expected.txt
• LayoutTests/imported/w3c/web-platform-tests/common/reftest-wait.js
• LayoutTests/imported/w3c/web-platform-tests/css/CSS2/box-display/block-in-inline-at-start-with-margin-top-collapses-with-parent-expected.html
• LayoutTests/imported/w3c/web-platform-tests/css/CSS2/box-display/block-in-inline-at-start-with-margin-top-collapses-with-parent-ref.html
• LayoutTests/imported/w3c/web-platform-tests/css/CSS2/box-display/block-in-inline-at-start-with-margin-top-collapses-with-parent.html
• LayoutTests/imported/w3c/web-platform-tests/css/CSS2/box-display/block-in-inline-followed-by-empty-span-expected.html
• LayoutTests/imported/w3c/web-platform-tests/css/CSS2/box-display/block-in-inline-followed-by-empty-span-ref.html
• LayoutTests/imported/w3c/web-platform-tests/css/CSS2/box-display/block-in-inline-followed-by-empty-span.html
• LayoutTests/imported/w3c/web-platform-tests/css/CSS2/box-display/block-in-inline-followed-by-line-break-and-text-expected.html
• LayoutTests/imported/w3c/web-platform-tests/css/CSS2/box-display/block-in-inline-followed-by-line-break-and-text-ref.html
• LayoutTests/imported/w3c/web-platform-tests/css/CSS2/box-display/block-in-inline-followed-by-line-break-and-text.html
• LayoutTests/imported/w3c/web-platform-tests/css/CSS2/box-display/block-in-inline-large-margin-bottom-expected.html
• LayoutTests/imported/w3c/web-platform-tests/css/CSS2/box-display/block-in-inline-large-margin-bottom-ref.html
• LayoutTests/imported/w3c/web-platform-tests/css/CSS2/box-display/block-in-inline-large-margin-bottom.html
• LayoutTests/imported/w3c/web-platform-tests/css/CSS2/box-display/block-in-inline-margin-bottom-with-trailing-block-expected.html
• LayoutTests/imported/w3c/web-platform-tests/css/CSS2/box-display/block-in-inline-margin-bottom-with-trailing-block-ref.html
• LayoutTests/imported/w3c/web-platform-tests/css/CSS2/box-display/block-in-inline-margin-bottom-with-trailing-block.html
• LayoutTests/imported/w3c/web-platform-tests/css/CSS2/box-display/block-in-inline-margin-collapses-through-intervening-float-expected.html
• LayoutTests/imported/w3c/web-platform-tests/css/CSS2/box-display/block-in-inline-margin-collapses-through-intervening-float-ref.html
• LayoutTests/imported/w3c/web-platform-tests/css/CSS2/box-display/block-in-inline-margin-collapses-through-intervening-float.html
• LayoutTests/imported/w3c/web-platform-tests/css/CSS2/box-display/block-in-inline-margin-collapses-through-multiple-floats-expected.html
• LayoutTests/imported/w3c/web-platform-tests/css/CSS2/box-display/block-in-inline-margin-collapses-through-multiple-floats-ref.html
• LayoutTests/imported/w3c/web-platform-tests/css/CSS2/box-display/block-in-inline-margin-collapses-through-multiple-floats.html
• LayoutTests/imported/w3c/web-platform-tests/css/CSS2/box-display/block-in-inline-margin-collapses-with-parent-bottom-expected.html
• LayoutTests/imported/w3c/web-platform-tests/css/CSS2/box-display/block-in-inline-margin-collapses-with-parent-bottom-ref.html
• LayoutTests/imported/w3c/web-platform-tests/css/CSS2/box-display/block-in-inline-margin-collapses-with-parent-bottom.html
• LayoutTests/imported/w3c/web-platform-tests/css/CSS2/box-display/block-in-inline-margin-with-leading-and-trailing-text-expected.html
• LayoutTests/imported/w3c/web-platform-tests/css/CSS2/box-display/block-in-inline-margin-with-leading-and-trailing-text-ref.html
• LayoutTests/imported/w3c/web-platform-tests/css/CSS2/box-display/block-in-inline-margin-with-leading-and-trailing-text.html
• LayoutTests/imported/w3c/web-platform-tests/css/CSS2/box-display/block-in-inline-margin-with-leading-text-expected.html
• LayoutTests/imported/w3c/web-platform-tests/css/CSS2/box-display/block-in-inline-margin-with-leading-text-ref.html
• LayoutTests/imported/w3c/web-platform-tests/css/CSS2/box-display/block-in-inline-margin-with-leading-text.html
• LayoutTests/imported/w3c/web-platform-tests/css/CSS2/box-display/block-in-inline-margin-with-line-break-then-block-in-inline-expected.html
• LayoutTests/imported/w3c/web-platform-tests/css/CSS2/box-display/block-in-inline-margin-with-line-break-then-block-in-inline-ref.html
• LayoutTests/imported/w3c/web-platform-tests/css/CSS2/box-display/block-in-inline-margin-with-line-break-then-block-in-inline.html
• LayoutTests/imported/w3c/web-platform-tests/css/CSS2/box-display/block-in-inline-margin-with-multi-line-text-after-expected.html
• LayoutTests/imported/w3c/web-platform-tests/css/CSS2/box-display/block-in-inline-margin-with-multi-line-text-after-ref.html
• LayoutTests/imported/w3c/web-platform-tests/css/CSS2/box-display/block-in-inline-margin-with-multi-line-text-after.html
• LayoutTests/imported/w3c/web-platform-tests/css/CSS2/box-display/block-in-inline-margin-with-multi-line-text-before-expected.html
• LayoutTests/imported/w3c/web-platform-tests/css/CSS2/box-display/block-in-inline-margin-with-multi-line-text-before-ref.html
• LayoutTests/imported/w3c/web-platform-tests/css/CSS2/box-display/block-in-inline-margin-with-multi-line-text-before.html
• LayoutTests/imported/w3c/web-platform-tests/css/CSS2/box-display/block-in-inline-margin-with-text-then-block-in-inline-expected.html
• LayoutTests/imported/w3c/web-platform-tests/css/CSS2/box-display/block-in-inline-margin-with-text-then-block-in-inline-ref.html
• LayoutTests/imported/w3c/web-platform-tests/css/CSS2/box-display/block-in-inline-margin-with-text-then-block-in-inline.html
• LayoutTests/imported/w3c/web-platform-tests/css/CSS2/box-display/block-in-inline-margins-collapse-with-trailing-block-expected.html
• LayoutTests/imported/w3c/web-platform-tests/css/CSS2/box-display/block-in-inline-margins-collapse-with-trailing-block-ref.html
• LayoutTests/imported/w3c/web-platform-tests/css/CSS2/box-display/block-in-inline-margins-collapse-with-trailing-block.html
• LayoutTests/imported/w3c/web-platform-tests/css/CSS2/box-display/block-in-inline-negative-margin-bottom-with-trailing-block-expected.html

💤 Files with no reviewable changes (18)

• LayoutTests/fast/css/cssom-translate-crash-expected.txt
• LayoutTests/fast/flexbox/preferred-width-empty-inline-block.html
• LayoutTests/fast/dom/StyleSheet/css-font-variation-settings-crash.html
• LayoutTests/fast/css/cssom-mask-border-width-crash.html
• LayoutTests/fast/css/stylepropertymap-append-not-checking-for-variablereferencevalue.html
• LayoutTests/fast/css/cssom-mask-border-width-crash-expected.txt
• LayoutTests/fast/css/css-typed-om-typeerror-coalescing-pair.html
• LayoutTests/fast/flexbox/preferred-width-empty-inline-block-expected.txt
• LayoutTests/fast/css/stylepropertymap-append-not-checking-for-variablereferencevalue-expected.txt
• LayoutTests/fast/css/css-typed-om/css-builder-converter-initial-letter-crash-expected.txt
• LayoutTests/fast/css/cssom-border-image-width-crash.html
• JSTests/test262/config.yaml
• LayoutTests/http/tests/security/resources/load-local-storage.html
• LayoutTests/http/tests/security/cross-origin-local-storage-allowed.html
• LayoutTests/fast/css/css-typed-om/css-builder-converter-initial-letter-crash.html
• LayoutTests/fast/css/css-typed-om-typeerror-coalescing-pair-expected.txt
• JSTests/test262/expectations.yaml
• LayoutTests/fast/css/cssom-translate-crash.html

[coderabbitai]

⚠️ Potential issue | 🔴 Critical | ⚡ Quick win

Undefined variable testLoopCount.

The variable testLoopCount is referenced on lines 32, 51, 68, and 82 but is never declared or defined in this file. This will cause a ReferenceError at runtime.

🐛 Proposed fix

Add the variable declaration near the top of the file, after the helper functions:

 }
 
+const testLoopCount = 10000;
+
 // --- 1. CacheableDictionary: add `then` in place after warm-up ---
 asyncTest(async function cacheableDictionaryGainsThen() {

Also applies to: 51-51, 68-68, 82-82

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@JSTests/stress/promise-resolve-non-thenable-structure-cache-dictionary.js` at
line 32, Declare and initialize the missing variable testLoopCount near the top
of the file (e.g., immediately after the helper functions) so the for-loops that
reference it (the for (...) using testLoopCount) do not throw a ReferenceError;
set it to an appropriate integer or source it from configuration/environment if
intended to be configurable, and ensure the same identifier testLoopCount is
used consistently across the loops at the locations where it is currently
referenced.

[coderabbitai]

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Wait for a rendering update after the style mutation before reading repaint rects.

At Line 31, the class change is applied, but repaint rectangles are read immediately on Line 34. This can race and cause flaky output.

Proposed fix

             document.body.classList.add('changed');
+            await UIHelper.renderingUpdate();
 
             if (window.internals) {
                 debug(window.internals.repaintRectsAsText());
                 internals.stopTrackingRepaints();
             }

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	document.body.classList.add('changed');
	if (window.internals) {
	debug(window.internals.repaintRectsAsText());
	internals.stopTrackingRepaints();
	document.body.classList.add('changed');
	await UIHelper.renderingUpdate();
	if (window.internals) {
	debug(window.internals.repaintRectsAsText());
	internals.stopTrackingRepaints();

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@LayoutTests/fast/repaint/drop-shadow-box-change.html` around lines 31 - 35,
After adding the 'changed' class to document.body, wait for the next rendering
frame before calling window.internals.repaintRectsAsText() and
internals.stopTrackingRepaints(); replace the immediate read with a
requestAnimationFrame (or two nested requestAnimationFrame calls) to ensure the
style mutation has been applied and paint/repaint rects are stable before
debugging and stopping tracking.

[coderabbitai]

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Flush rendering before reading repaint rects.

repaintRectsAsText() is read immediately after the style mutation at Line 28. Add a rendering update before Line 31 to avoid stale/empty repaint captures and flaky expectations.

Proposed fix

             document.body.classList.add('changed');
+            await UIHelper.renderingUpdate();
 
             if (window.internals) {
                 debug(window.internals.repaintRectsAsText());
                 internals.stopTrackingRepaints();
             }

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	document.body.classList.add('changed');
	if (window.internals) {
	debug(window.internals.repaintRectsAsText());
	internals.stopTrackingRepaints();
	}
	document.body.classList.add('changed');
	await UIHelper.renderingUpdate();
	if (window.internals) {
	debug(window.internals.repaintRectsAsText());
	internals.stopTrackingRepaints();
	}

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@LayoutTests/fast/repaint/drop-shadow-change.html` around lines 28 - 33, After
adding the 'changed' class to document.body, force a rendering flush before
calling window.internals.repaintRectsAsText() to avoid capturing stale/empty
repaint rects; insert a synchronous layout/paint trigger (for example, read a
layout-affecting property such as document.body.offsetHeight or
window.getComputedStyle(document.body).width) immediately after
document.body.classList.add('changed') and before calling repaintRectsAsText(),
then proceed to call window.internals.repaintRectsAsText() and
internals.stopTrackingRepaints().

[coderabbitai]

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Ensure notifyDone() is always reached.

If Line 18 rejects, the test never calls testRunner.notifyDone() and can timeout.

Proposed fix

 addEventListener("load", async () => {
     if (!window.testRunner)
         return;

     testRunner.dumpAsText();
     testRunner.waitUntilDone();
-    document.body.textContent = await UIHelper.requestTextExtraction({
-        mergeParagraphs: true
-    });
-    testRunner.notifyDone();
+    try {
+        document.body.textContent = await UIHelper.requestTextExtraction({
+            mergeParagraphs: true
+        });
+    } finally {
+        testRunner.notifyDone();
+    }
 });

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	addEventListener("load", async () => {
	if (!window.testRunner)
	return;
	testRunner.dumpAsText();
	testRunner.waitUntilDone();
	document.body.textContent = await UIHelper.requestTextExtraction({
	mergeParagraphs: true
	});
	testRunner.notifyDone();
	});
	addEventListener("load", async () => {
	if (!window.testRunner)
	return;
	testRunner.dumpAsText();
	testRunner.waitUntilDone();
	try {
	document.body.textContent = await UIHelper.requestTextExtraction({
	mergeParagraphs: true
	});
	} finally {
	testRunner.notifyDone();
	}
	});

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@LayoutTests/fast/text-extraction/contenteditable-text-extraction.html` around
lines 12 - 22, The test currently awaits UIHelper.requestTextExtraction in the
load event handler and may never call testRunner.notifyDone() if that promise
rejects; wrap the await in a try/finally (or use .catch(...) and a finally)
inside the addEventListener callback so that testRunner.notifyDone() is always
invoked regardless of success or error, referencing the async load handler,
UIHelper.requestTextExtraction, and
testRunner.notifyDone()/testRunner.waitUntilDone()/testRunner.dumpAsText() to
locate where to add the try/finally.

[coderabbitai]

⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Filter postMessage events by popup source before evaluating result.

Without validating event.source, unrelated messages can be consumed by this handler and cause flaky outcomes.

Suggested fix

-                window.addEventListener("message", function handler(event) {
-                    if (event.data && event.data.type === "fetch-done") {
+                window.addEventListener("message", function handler(event) {
+                    if (event.source !== popup)
+                        return;
+                    if (event.data && event.data.type === "fetch-done") {
                         window.removeEventListener("message", handler);
                         var result = event.data.result;

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	window.addEventListener("message", function handler(event) {
	if (event.data && event.data.type === "fetch-done") {
	window.removeEventListener("message", handler);
	window.addEventListener("message", function handler(event) {
	if (event.source !== popup)
	return;
	if (event.data && event.data.type === "fetch-done") {
	window.removeEventListener("message", handler);

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In
`@LayoutTests/http/tests/resourceLoadStatistics/third-party-cookie-blocking-about-blank-popup.html`
around lines 46 - 48, The message handler registered via
window.addEventListener("message", function handler(event) { ... }) should first
verify the message came from the popup before acting; update the handler to
check event.source === popup (or the actual popup variable name used in the
test) and only then inspect event.data.type === "fetch-done" and
removeEventListener("message", handler). This prevents unrelated postMessage
events from being consumed and causing flakes.

[coderabbitai]

⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Filter message replies by iframe source.

Line 23 resolves on the first message event from window; with two iframes, a reply from the non-target iframe can be consumed by mistake. Gate on event.source === iframe.contentWindow before accepting the reply.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In
`@LayoutTests/imported/w3c/web-platform-tests/close-watcher/iframes/dialog-same-origin-ynyn.html`
around lines 23 - 27, The message handler currently accepts the first window
"message" event which can come from the wrong iframe; change the reply
acceptance so it only resolves when event.source === iframe.contentWindow. In
practice update the awaitEvent(window, "message", signal) usage (or the code
that handles its result) to check event.source === iframe.contentWindow and
ignore/continue waiting for other messages until the source matches, then
extract data and proceed (the variables/functions to change are awaitEvent,
reply, and the check before reading data/error).