Ahmad-S792

Summary

Ahmad-S792 works almost entirely in WebCore, ranging across grid layout, transform math, compositing, and media parsing, with only incidental commits elsewhere. Virtually none of it is classified as security work, but the recurring bug class is one attackers care about: off-by-one bounds checks that fail on exact-fit buffers (AV1 sequence header OBU, RangeResponseGenerator dropping the final byte), uninitialized member reads (`GraphicsLayerCA::m_tileCoverage`), moved-from and self-assignment aliasing (`GridTemplateAreas` move constructor, `TransformState::operator=`), and error codes discarded by storing a signed vImage return in `size_t`. Systematic-variant candidate: the exact-boundary and moved-from patterns, both of which recur across unrelated subsystems here and are unlikely to be exhausted.

Components

Security Fix History

• 2026-04-04 document.open() should not alias the caller's security origin

Hardening Commits

• 2026-09-16 Cross-origin redirect should disable the quirks-mode CSS MIME type sniffing quirk even when the final URL is same-origin
• 2026-09-13 CertificateInfo::containsNonRootSHA1SignedCertificate() bounds the certificate chain loop with a count from a separate S
• 2026-09-03 PrivateClickMeasurement path constants should be ASCIILiteral to avoid unsafeSpan
• 2026-09-02 Capture storedCredentialsPolicy before moving ResourceLoaderOptions in CrossOriginAccessControl
• 2026-08-24 cssCanvasClients() returns a set of raw Element pointers
• 2026-07-24 RecursiveLockAdapter::unlock() has no assertion guarding against underflow or wrong-owner unlock
• 2026-07-16 WTF::divideRoundedUp can overflow for dividends near the type's maximum
• 2026-07-13 Add iteration bounds to SVGSMILElement interval-resolution loops to prevent potential hangs
• 2026-07-11 Scroll To Text Fragment: text directives should only run in text/html and text/plain documents
• 2026-04-16 Replace raw pointer key with SingleThreadWeakRef in LegacyRenderSVGResourceGradient's m_gradientMap

Recent Commits

• 2026-09-18 Avoid per-iteration Vector deep-copies in GridTrackSizingAlgorithm
• 2026-09-18 GridTemplateAreas move constructor reads moved-from map, producing empty implicit named grid lines
• 2026-09-18 Re-triggered overlay scrollbar expansion animation starts from the wrong progress value
• 2026-09-16 Add "track" Media Fragments URI dimension (#track=) for <audio>/<video>
• 2026-09-16 TransformationMatrix::fromProjection(fovy, aspect, ...) loses precision using tanf() in double math
• 2026-09-16 TransformState::operator= is not self-assignment safe and destroys the accumulated transform
• 2026-09-16 Remove dead RenderLayerScrollableArea::needsAnimatedScroll() accessor
• 2026-09-16 Remove unnecessary repeated Frame::page() call in NavigatorWebDriver::isControlledByAutomation()
• 2026-09-16 Cross-origin redirect should disable the quirks-mode CSS MIME type sniffing quirk even when the final URL is same-origin
• 2026-09-16 Number input does not fire a beforeinput event when stepped via arrow keys or spin buttons
• 2026-09-15 getComputedStyle computes wrong grid-template-columns for an empty grid using repeat(auto-fill) with flexible tracks (ga
• 2026-09-15 execCommand() reports empty inputType for backColor, hiliteColor, fontName, and justify commands
• 2026-09-14 FEGaussianBlurSoftwareApplier ignores vImage errors by storing them in size_t
• 2026-09-14 RangeResponseGenerator drops the last byte of a range when the buffer momentarily ends exactly on the range's final inde
• 2026-09-14 ResourceResponseData constructor copies certificateInfo instead of moving it
• 2026-09-14 [AV1] Sequence header OBU that exactly fills the buffer is rejected by an off-by-one bounds check
• 2026-09-14 createBlackPixelBuffer produces super-black instead of legal black for video-range buffers
• 2026-09-14 GraphicsLayerCA::m_tileCoverage is read uninitialized by changeLayerTypeTo()
• 2026-09-14 TransformationMatrix::map4ComponentPoint() ignores w in the identity/translation fast path
• 2026-09-14 TransformationMatrix::operator== hand-rolls a 16-element comparison instead of comparing the underlying arrays
• 2026-09-14 registerFontIfNeeded() leaks the CFErrorRef out-param from CTFontManagerRegisterFontsForURL()
• 2026-09-14 Remove dead Supplement<Navigator> machinery from NavigatorWebDriver
• 2026-09-14 Geolocation::Watchers should not maintain a redundant reverse notifier→id map
• 2026-09-14 Deduplicate observer membership check in ReportingScope::registerReportingObserver()
• 2026-09-14 ResourceResponseBase::setHTTPVersion() copies its rvalue-reference argument instead of moving it
• 2026-09-14 DataURLDecoder::process() has a dead ternary branch computing encodedDataStart
• 2026-09-14 NetworkLoadMetrics constructor copies its String&& protocol argument instead of moving it
• 2026-09-14 ResourceHandle::didReceiveResponse() copies the response URL instead of taking a reference
• 2026-09-14 BlobResourceHandle::readSync() forwards uninitialized buffer tail when blob is shorter than the read buffer
• 2026-09-14 RFC7230::isValidValue() consumes a token's terminating octet without validating it, accepting control characters and DEL
• 2026-09-14 Cookie::operator== and Cookie::hash() build NSHTTPCookie objects on every hash-table operation
• 2026-09-14 convertFloatToHalfFloat() violates strict aliasing with a float*-to-unsigned* reinterpret_cast
• 2026-09-13 interpolateColors() takes its Color arguments by value, ref-churning out-of-line colors in gradient stop loops
• 2026-09-13 Resync `selection` from WPT Upstream
• 2026-09-13 CertificateInfo::containsNonRootSHA1SignedCertificate() bounds the certificate chain loop with a count from a separate S
• 2026-09-13 DrawLinesForText::dump() prints "double" twice and never dumps the stroke style
• 2026-09-13 isSafeRedirectionResponseHeader() lists HTTPHeaderName::ReferrerPolicy twice
• 2026-09-12 Sync `input-events` from WPT Upstream
• 2026-09-12 ResourceRequestBase::upgradeInsecureRequestIfNeeded() evaluates url.host() twice
• 2026-09-12 BlobResourceHandle truncates read length through int for file-backed blob ranges over 2 GB
• 2026-09-11 CredentialStorage::removeCredentialsWithOrigin fails to purge HTTPS credentials with default port
• 2026-09-11 BlobRegistryImpl::registerInternalBlobURLForSlice() redundantly re-looks-up the blob it already holds
• 2026-09-11 DNSResolveQueueCFNet::updateIsUsingProxy() dereferences null CFArray from CFNetworkCopyProxiesForURL
• 2026-09-11 DataTransferItemList.clear() ignores the drag data store mode
• 2026-09-11 makeStringByJoining() drops separators preceding the first non-empty string
• 2026-09-11 Adopt Vector::moveTo in TextTrackCueList::updateCueIndex
• 2026-09-10 DataTransferItem.kind should return the empty string for an item in the disabled mode
• 2026-09-09 <mo> operator dictionary should only be consulted when the element contains only text content
• 2026-09-09 PrivateClickMeasurement destination secret token errors are logged with the wrong "source" label
• 2026-09-07 SVGLength resolves 'ex' by rounding the font's x-height up to a whole pixel
• 2026-09-07 Canvas 2D context is permanently poisoned after a transient backing-store allocation failure
• 2026-09-07 [ShapeDetection] BarcodeDetector/TextDetector copy each result String instead of moving it
• 2026-09-07 AudioSampleDataSource does an extra full-quantum memcpy per render when mixing a source at less-than-unity gain
• 2026-09-07 InheritedFlags exceeds 8 bytes on Windows after ENABLE_TEXT_AUTOSIZING removal
• 2026-09-07 [Canvas] Modernize CanvasRenderingContext2DBase/HTMLCanvasElement constants to constexpr
• 2026-09-07 CanvasRenderingContext::updateMemoryCost() reports absolute cost instead of the delta, inflating GC pressure
• 2026-09-07 JSON displayed with wrong encoding when loaded in a frame (browser default instead of UTF-8)
• 2026-09-07 [Canvas] Reduce redundant state() and refcount churn in CanvasRenderingContext2DBase
• 2026-09-07 DOMCache::queryCache() re-fetches scriptExecutionContext() after caching it
• 2026-09-04 ScrollingStateTree::insertNode does redundant work reordering children on pages with many sibling scrolling nodes
• 2026-09-04 Cache.delete() and Cache.keys() swallow exceptions thrown while constructing a Request from a URL string
• 2026-09-04 [Canvas] parseColor() constructs CSSParserContext(HTMLStandardMode) twice
• 2026-09-04 CanvasNoiseInjection misclassifies the bottom-left pixel due to an off-by-one in the bottom-row check
• 2026-09-04 Avoid redundant PasteboardCustomData copies when writing clipboard items
• 2026-09-04 Remove duplicate Blink-imported tests that are byte-identical to existing WebKit tests
• 2026-09-04 Modernize isValidPathSegment() to use a range-based for loop over code units
• 2026-09-04 Resync `cookies` from WPT Upstream
• 2026-09-04 Simplify icon "purpose" parsing in ApplicationManifestParser
• 2026-09-04 Deduplicate identical image/png and image/svg+xml read branches in Clipboard::getType
• 2026-09-04 Use WTF::switchOn for the BufferOrString variant in ClipboardItemBindingsDataSource
• 2026-09-04 DOMAudioSession::type() redundantly tests the document twice against the same fallback
• 2026-09-04 Add early-return to `SVGAElement::isKeyboardFocusable` and drop redundant `isFocusable()` checks
• 2026-09-04 Avoid per-item String and Ref<DOMPromise> copies in ClipboardItemBindingsDataSource::collectDataForWriting()
• 2026-09-04 Remove dead reportingObservers local in ReportingScope::notifyReportObservers()
• 2026-09-04 Negative z-index layer inside stacking context fails to composite when overlapping external composited layer
• 2026-09-03 Remove dead declared-but-undefined member functions from ResourceMonitorThrottler
• 2026-09-03 MediaSession::setActionHandler() looks up the document multiple times and shadows a local
• 2026-09-03 SpeculationRules::parseSingleRule rebuilds its allowed-keys HashSet on every call
• 2026-09-03 Remove dead code in FrameLoader::SubframeLoader::loadSubframe()
• 2026-09-03 PrivateClickMeasurement token URL getters should return std::optional<URL> instead of const std::optional<const URL>
• 2026-09-03 Replace typedef with using in loader classes
• 2026-09-03 PrivateClickMeasurement path constants should be ASCIILiteral to avoid unsafeSpan
• 2026-09-02 Second CSS Highlight sharing a Range with an already-registered Highlight never paints
• 2026-09-02 CSS.highlights iterates in hash order instead of registration order after its wrapper is garbage collected
• 2026-09-02 [MathML Core] Non-MathML children of <annotation> and <annotation-xml> are not rendered
• 2026-09-02 MathML rowspan="0" is incorrectly clamped to 1
• 2026-09-02 ResourceLoadNotifier::dispatchWillSendRequest re-reads m_frame instead of the cached frame local
• 2026-09-02 LegacyWebArchive iframe wrapper for copied framesets emits literal "98%%" width/height
• 2026-09-02 NavigationAction::m_type is left uninitialized by the default constructor
• 2026-09-02 Capture storedCredentialsPolicy before moving ResourceLoaderOptions in CrossOriginAccessControl
• 2026-09-02 Reduce sizeof(DocumentThreadableLoader) by grouping its one-byte members
• 2026-09-02 PolicyChecker.cpp has a dead #undef and leaks five macros into the unified build
• 2026-09-02 FormSubmission::boundary() returns String by value, forcing a copy
• 2026-09-01 An animation attached to a view timeline's scroll range is not updated when the scroll container's scrollable overflow c
• 2026-09-01 SVG conditional processing attributes on clipPath, mask and pattern wrongly prevent the resource from being referenced
• 2026-08-31 [SVG] Additive color animations lose precision from per-layer 8-bit rounding
• 2026-08-31 Resync `webaudio` from WPT Upstream
• 2026-08-29 Simplify SVGLengthValue::setValueAsString() whitespace handling
• 2026-08-28 background-size: cover paints nothing for an SVG image with an extreme natural aspect ratio
• 2026-08-27 background-size: contain/cover and auto sizing ignore SVG images with one intrinsic dimension and no aspect ratio
• 2026-08-27 [Test Coverage] [SVG2] Allow leading and trailing whitespace in svg attributes using <angle>
• 2026-08-26 Resync `svg` from WPT Upstream
• 2026-08-26 CanvasNoiseInjection lowerAndUpperBound mishandles neighbor ordering when component1 > component3
• 2026-08-26 Adopt CSS parser machinery for parsing SVGAngleValue
• 2026-08-26 HighlightRegistry::addAnnotationHighlightWithRange() does redundant atom table and hash lookups
• 2026-08-26 Avoid quadratic duplicate detection in Cache.addAll()
• 2026-08-25 Remove dead autoPictureInPicture/disablePictureInPicture accessors in HTMLVideoElementPictureInPicture
• 2026-08-25 Field ordering in Geolocation wastes 8 bytes of padding per instance
• 2026-08-25 Remove stale UNUSED_PARAM(name) in WebLockManager::request()
• 2026-08-25 Avoid redundant URL copies on Cache API query paths
• 2026-08-25 [canvas] transformAreaToDevice() walks the path twice
• 2026-08-25 CanvasBase::postProcessPixelBufferResults() takes an rvalue Ref<PixelBuffer> it never moves
• 2026-08-24 documentElement.focus() should move focus to the viewport instead of doing nothing
• 2026-08-24 CanvasNoiseInjection dirty rect is never cleared when the dirty region is fully transparent
• 2026-08-24 cssCanvasClients() returns a set of raw Element pointers
• 2026-08-24 2D canvas beginLayer() resets shadowColor to opaque black and re-parses constant strings
• 2026-08-23 canDrawText() refs both the fill and stroke gradient when only one is used
• 2026-08-22 dialog close() restores focus unconditionally instead of only when focus is inside the dialog or it was modal
• 2026-08-21 Typing a space in editable content inside <summary> or <button> also activates it
• 2026-08-21 Canvas 2D hit testing and transform mutations should not require the canvas bitmap
• 2026-08-21 [Canvas] CanvasRenderingContext2DBase::normalizeSpaces() widens Latin-1 text to UTF-16 and copies it twice
• 2026-08-21 Aborting a dead key composition fires no compositionend event, or one with empty data
• 2026-08-21 IntSize::area() and IntSize::unclampedArea() invoke undefined behavior via std::abs(INT_MIN)
• 2026-08-21 Pair reportExtraMemoryAllocated with reportExtraMemoryVisited for SourceBuffer, collection index caches and ImageData
• 2026-08-21 Trailing whitespace is not trimmed when setting a value containing var() through the CSSOM
• 2026-08-20 Choosing a spelling suggestion from the context menu fires inputType 'insertText' instead of 'insertReplacementText'
• 2026-08-20 Align HTMLCanvasElement interface with HTML spec for toDataURL() and toBlob()
• 2026-08-20 Remove unused `tryAllocateBuffer` from `Vector.h`
• 2026-08-20 [Canvas] Reorder CanvasRenderingContext2DBase::State to remove 24 bytes of padding
• 2026-08-20 Avoid copying CSSParserContext on every canvas fillStyle/strokeStyle assignment
• 2026-08-19 CORS preflight fetch hangs indefinitely when the OPTIONS response body never terminates
• 2026-08-19 [web-animations] Animations targeting ::picker-icon and ::-webkit-scrollbar have the wrong composite order
• 2026-08-19 Location::ancestorOrigins() should build its cached list through a local Ref
• 2026-08-19 A zero-length animation attachment range produces infinite computed keyframe offsets
• 2026-08-19 [scroll-animations] An unresolved progress-based timeline current time is treated as a progress timeline boundary
• 2026-08-18 KeyframeEffect::animatesProperty() scans keyframe property keys instead of hashing them
• 2026-08-18 [scroll-animations] View timeline range boundaries discard subpixel sticky adjustments
• 2026-08-18 BlendingKeyframe copy constructor drops m_hasPropertiesWithRevertRuleOrLayer, so keyframes using revert-layer/revert-rul
• 2026-08-18 [web-animations] An animation of width or height is incorrectly accelerated when only some keyframes have a size-depende
• 2026-08-18 FrameRateAligner aligns a newly-encountered frame rate with the lowest compatible frame rate instead of the highest
• 2026-08-17 [WebGPU] drawIndirect/drawIndexedIndirect clamp into a single per-Buffer scratch slot, racing every other indirect draw
• 2026-08-17 Convert SkipEmptySectionsValue to a scoped enum class
• 2026-08-17 Deduplicate the collapsed-border painting pass loop between paintObject() and paintCollapsedBordersForRow()
• 2026-08-17 getComputedStyle is stale in a display:none shadow tree after an inherited change on the host
• 2026-08-17 BlockGroup-wrapped WebM Blocks get compounding presentation times
• 2026-08-17 [WTF] StringImpl::replace(char16_t, char16_t) scans for the target with a scalar loop instead of SIMD find()
• 2026-08-17 [WTF] Base64 encode/decode maps are copied by value on every call
• 2026-08-17 DataTransfer.getData("url") returns the whole text/uri-list instead of its first URL
• 2026-08-17 NonSharedCharacterBreakIterator and NonSharedSentenceBreakIterator leak their UBreakIterator when setting the text fails
• 2026-08-17 Changing href on an <image> referenced by <use> does not update the use instances
• 2026-08-17 IOSurface::convertToFormat leaks the completion callback and destination surface when the accelerator fails
• 2026-08-17 DataTransferItemList's indexed property getter should be anonymous and length should be unsigned long
• 2026-08-16 Web Inspector: selecting a CDATA section in the DOM tree throws "node.truncateEnd is not a function"
• 2026-08-15 [css-ui] outline-offset computed value should be snapped as a line width
• 2026-08-15 Resync `html/rendering/non-replaced-elements/tables` from WPT Upstream
• 2026-08-15 Remove empty `WYHash.h` file
• 2026-08-15 [Navigation API] navigateerror is not fired for a navigation started from a navigateerror handler
• 2026-08-15 [css-contain] element.scroll()/scrollTo() does not scroll inside a content-visibility: hidden subtree
• 2026-08-15 [Navigation API] navigation.activation.from should be null when navigating away from the initial about:blank
• 2026-08-14 [text shaping] Arabic letters in adjacent inline boxes are not joined when the content is followed by simple code path t
• 2026-08-12 [Navigation API] navigateEvent.scroll() does not scroll to the beginning of the document when the fragment does not exis
• 2026-08-12 NavigationHistoryEntry url/key/id should return the empty string, not null, when the document is not fully active
• 2026-08-11 <animateMotion> ignores a zero-length motion path
• 2026-08-11 [Test Coverage] Add tests for parsing the interactive-widget viewport meta argument
• 2026-08-11 Remove the dead NeedsVP9FullRangeFlagQuirk
• 2026-08-10 testdriver-vendor.js rejects action sequences containing a pause in a key source
• 2026-08-10 Resync `webaudio` from WPT Upstream
• 2026-08-10 [Legacy SVG] CSS clip-path basic-shape is mispositioned on a rotated or scaled SVG element
• 2026-08-10 [Legacy SVG] CSS clip-path basic-shape is mispositioned on a foreignObject with non-zero x/y
• 2026-08-10 [SVG] animateMotion walks the animation path up to 4 times per frame
• 2026-08-10 Background image is not repainted when only the URL fragment identifier changes
• 2026-08-10 Setting ConvolverNode.buffer to null does not release the impulse response
• 2026-08-10 Reverse playback of buffers longer than 2^23 frames extrapolates outside the source samples
• 2026-08-10 Zero-duration exponentialRampToValueAtTime() at a non-frame-aligned time renders NaN
• 2026-08-10 BaseAudioContext::clear() leaks AudioNodes marked for deletion during uninitialize()
• 2026-08-10 Resync `css/CSS2/normal-flow` from WPT Upstream
• 2026-08-09 Resync `css-link-params` from WPT Upstream
• 2026-08-09 Remove non-standard `percentage` value from `-webkit-line-clamp`
• 2026-08-09 Sync `html/semantics/scripting-1/the-script-element/module` from WPT Upstream
• 2026-08-07 REGRESSION(283572@main): Canvas ctx.font keywords larger and smaller scale by 1.02 instead of ~1.2
• 2026-08-07 ctx.font does not re-resolve relative font sizes when set to the same string after the canvas element's style changed
• 2026-08-06 Open a color input with display:none via a label
• 2026-08-06 Fire resize event when iframe viewport transitions from display:none to visible
• 2026-08-06 LibWebRTCAudioModule can use the audio transport after it is unregistered and destroyed
• 2026-08-06 Nested @scope with :has(:scope ...) in <scope-start> picks scoping roots outside the outer scope
• 2026-08-06 [Web Audio] Reduce padding in ParamEvent, AutomationState, AudioNode and RealtimeAnalyser
• 2026-08-06 Multicol column height ignores min-height when min-height exceeds max-height
• 2026-08-06 Resync `css/CSS2/tables` from WPT Upstream
• 2026-08-06 requestPictureInPicture() does not consume the user activation
• 2026-08-05 CSS clip on a child is ignored when determining whether an ancestor's background is obscured
• 2026-08-05 Resync `scroll-animations` from WPT Upstream
• 2026-08-04 `<link rel=preload as>` keywords should be matched ASCII case-insensitively
• 2026-08-04 Use default member initializers for uninitialized data members in WebCore/svg
• 2026-08-04 <animateMotion> ignores a numeric 'rotate' value
• 2026-08-04 Resync `svg` from WPT Upstream
• 2026-08-04 <svg:image> 'auto' sizing should follow the CSS default sizing algorithm
• 2026-08-04 imagesrcset does not override href for <link rel="preload" as="image">
• 2026-08-04 Remove duplicate m_exceptionCode assignment in XMLHttpRequest::didReachTimeout()
• 2026-08-04 Remove unreachable null check in XMLHttpRequestUpload::scriptExecutionContext()
• 2026-08-04 Avoid unnecessary Region copies when returning RegionFixedPair from Document
• 2026-08-03 Use a default member initializer for MathMLOperatorDictionary::Property::form
• 2026-08-03 Sync `tools/lint` from WPT Upstream
• 2026-08-03 Use default member initializers for XMLHttpRequest's bitfields
• 2026-08-03 Resync `mathml` from WPT Upstream
• 2026-08-03 SpaceSplitStringData::create() leaks a table entry for every distinct whitespace-only class attribute value
• 2026-08-03 XMLHttpRequest.send(URLSearchParams) sets a Content-Type request header on GET and HEAD requests
• 2026-08-03 SMILTime::operator== is inconsistent with spaceship operator for the unresolved and indefinite values
• 2026-08-03 XMLHttpRequest::memoryCost() ignores binary response data
• 2026-08-03 SMILTimeContainer::updateAnimations() copies the scheduled animations map twice per frame
• 2026-08-02 Sync `css/CSS2/reference` from WPT Upstream
• 2026-08-02 Resync `css/CSS2/abspos` from WPT Upstream
• 2026-08-01 Sync `css/CSS2/css1` from WPT Upstream
• 2026-08-01 Use char16_t instead of UChar in MathMLOperatorElement
• 2026-07-31 [CSS Scroll Snap] Re-snap should prefer the block-axis box when the two axes conflict
• 2026-07-31 Reduce sizeof(ViewportArguments) and stop copying it into computeViewportAttributes()
• 2026-07-31 [MathML] Remove duplicated mathvariant invalidation from MathMLMathElement::attributeChanged
• 2026-07-31 Take a StringView in MathMLPresentationElement::parseMathMLLength
• 2026-07-31 [MathML] MathMLOperatorElement::OperatorProperties::flags is read uninitialized
• 2026-07-31 [MathML] Use SpaceSplitString to parse the <menclose> notation attribute instead of a hand-rolled tokenizer
• 2026-07-31 MathML and SVG elements do not reset tabIndex when tabindex is changed to an invalid value
• 2026-07-31 MathMLOperatorElement::parseOperatorChar() needlessly allocates a String when trimming whitespace
• 2026-07-31 [XHR] Final response charset is recomputed for every received data chunk
• 2026-07-30 Reduce sizeof(SelectorFragment) by eliminating struct padding in the CSS JIT
• 2026-07-30 CSS JIT serializes the full selector text on every compile even when disassembly dumping is disabled
• 2026-07-30 [cssjit] Use WTF::compactMap in generateElementIsNthChildOf
• 2026-07-30 XMLHttpRequest.responseURL still returns the aborted request's URL after abort()
• 2026-07-30 [CSS] Deduplicate the identical CSSSelector::Match::Set case in SelectorCompiler
• 2026-07-30 XMLHttpRequest.getAllResponseHeaders() returns the previous response's headers when the object is reused
• 2026-07-28 Split the start/end block in FrameSelection::respondToNodeModification onto its own line
• 2026-07-28 AudioParam::finalValue() returns an uninitialized float when calculateFinalValues() bails out
• 2026-07-28 makeStringByReplacingAll() uses a scalar scan instead of SIMD-accelerated find()
• 2026-07-28 RealtimeIncomingAudioSourceCocoa::OnData rescales the frame counter against the already-updated sample rate, making it a
• 2026-07-28 DisplayCaptureSourceCocoa::generateFrame() first switchOn takes Variant alternatives by value
• 2026-07-28 MediaStreamPrivate constructor copies the tracks vector instead of moving it
• 2026-07-28 LibWebRTCAudioModule has a data race on m_isPlaying and m_audioTransport
• 2026-07-28 NumericConstraint::valueForCapabilityRange() ignores a valid current value when both min and max constraints are set
• 2026-07-28 [Web Inspector] resource data for non-buffered resources leaks across navigations
• 2026-07-27 Subgrid with large column-gap overflows max-width-constrained parent
• 2026-07-27 REGRESSION (iOS 27 beta): AudioContext.decodeAudioData() fails with EncodingError on valid AAC/M4A file containing an ed
• 2026-07-27 [CSS Scroll Snap] Aligned snap targets are not selected in tree order
• 2026-07-27 AudioNode::scriptExecutionContext() uses const_cast despite a const context() overload existing
• 2026-07-27 Remove unused AudioNodeOutput::InputsIterator typedef
• 2026-07-27 Redundant shadowed fillToFrameTrunc computation in AudioParamTimeline::processLinearRamp()
• 2026-07-27 [Web Inspector] InspectorAuditResourcesObject::getResources() is O(n²) due to linear reverse lookup
• 2026-07-27 Editor::Command::execute() re-entrancy check is a permanent tautology, no longer detects frame changes during layout
• 2026-07-27 createContextualFragment() leaves nested <head>/<body> behind when stripping a stray <html> element
• 2026-07-27 MediaStreamAudioSourceNode::setFormat() sets m_sourceNumberOfChannels twice with no intervening use
• 2026-07-27 AudioNode::connect(AudioParam&, unsigned) acquires the graph lock before asserting main thread
• 2026-07-27 AudioBufferSourceNode output channel count ignores actively-processing state
• 2026-07-27 exponentialRampToValueAtTime() loses precision by accumulating the ramp in single precision
• 2026-07-27 RealtimeAnalyser heap-allocates a temporary FFT buffer on every analysis pass
• 2026-07-27 OscillatorNode with a-rate automation ignores sub-sample start time and begins out of phase
• 2026-07-27 OscillatorNode::m_type has no default member initializer, leaving it uninitialized on exception-return path in create()
• 2026-07-27 DelayDSPKernel::m_desiredDelayFrames is uninitialized, causing undefined behavior in processKRate() when no DelayProcess
• 2026-07-27 OfflineAudioContext noise injection hangs on feedback cycles in the audio graph
• 2026-07-27 std::log2(AudioSession::bufferSize()) invokes undefined behavior when the session buffer size is 0
• 2026-07-27 registerProcessor() error messages report the processor name instead of the offending AudioParam name
• 2026-07-27 Potential crash pasting with no selection due to missing null-check on selectedRange()
• 2026-07-26 webkitpy: Fix NameError in Runner.handle() for unknown messages
• 2026-07-26 scrollIntoView() on an inline element sharing a tall line scrolls to the line box top instead of the element's bounding
• 2026-07-26 Potential crash under WebViewImpl::insertText() with a zero-length attributed string
• 2026-07-25 lint-test-expectations never applies glib-specific TestExpectations override for GTK/WPE ports
• 2026-07-24 LocalAudioMediaStreamTrackRendererInternalUnit::createAudioUnitIfNeeded() leaks an AudioComponentInstance on every post-
• 2026-07-24 MediaFragmentURIParser silently accepts overflowing NPT hours value instead of rejecting the fragment
• 2026-07-24 --print-summary hangs indefinitely due to infinite loop in Manager ancestor-directory walk
• 2026-07-24 RecursiveLockAdapter::unlock() has no assertion guarding against underflow or wrong-owner unlock
• 2026-07-24 ParkingLot::ensureHashtable() has dead always-true check and variable shadowing
• 2026-07-24 charactersToFloat() reports success even when a value fits a double but overflows a float
• 2026-07-24 ScreenCaptureKitCaptureSource::updateStreamConfiguration() uses weakThis instead of protectedThis after null-check
• 2026-07-23 CoreAudioCaptureDeviceManager::refreshAudioCaptureDevices() misses device changes when label or group ID changes
• 2026-07-23 [WebVTT] A cue wrongly inherits a preceding line as its identifier across a REGION or STYLE block
• 2026-07-23 webkitpy: ports_to_forward() checks _websocket_server instead of _websocket_secure_server
• 2026-07-23 CoreAudioCaptureDevice::getDeviceInfo() leaks a CFStringRef when the data source name is empty
• 2026-07-23 Remove dead code in isAllowedRequiredConstraintForDeviceSelection
• 2026-07-23 Merge identical h264/h265 branches in LibWebRTCProvider::videoDecodingCapabilitiesOverride
• 2026-07-22 Web Inspector: add a regression test for clearing the Console across frame targets under site isolation
• 2026-07-22 [WPT import] META: variant= is not expanded into the generated wrapper for .window.js/.worker.js templated tests
• 2026-07-22 WeakPtr::is()/UniqueRef::is() const variadic overloads should be named isAnyOf
• 2026-07-21 IndexedDB: put() that fails a unique index constraint deletes the record it would have overwritten
• 2026-07-21 Wrong ended event fired on HLS live stream when dealing with playbackRate
• 2026-07-21 Web Inspector: URL breakpoints recompile their search pattern on every network request
• 2026-07-21 Fix identifier typos in Layout/LFC inline and integration code
• 2026-07-21 Fix unsigned underflow when adjusting cached box indexes after partial inline layout damage repair
• 2026-07-21 Vector::reverse() should use std::ranges::reverse() instead of at()
• 2026-07-21 ShareableGainMap::applyGainMapToBaseImage passes a null value to a kCFTypeDictionaryValueCallBacks dictionary
• 2026-07-21 Remove dead deleteReleasedWeakBuckets()/isReleasedWeakBucket() from WTF::HashTable
• 2026-07-20 Fix size_t underflow in GridLayoutUtils::totalGuttersSize for empty grids
• 2026-07-20 Web Inspector: DOMStorageManager looks up storage objects with an O(n) Object.shallowEqual scan on every storage event
• 2026-07-20 WTF::saturatingSum variadic overload truncates 3+ argument sums to uint32_t
• 2026-07-20 CrossThreadCopierBase<HashSet<ObjectIdentifierGeneric>> is missing IsNeeded and move-copy overload
• 2026-07-19 Web Inspector: SourcesNavigationSidebarPanel leaks an anonymous WI.SourceCode listener on every panel recreation
• 2026-07-19 Web Inspector: WorkerManager.workerTerminated leaks nested subworkers' Target/map entries
• 2026-07-19 Web Inspector: HeapSnapshotWorkerProxy silently drops pending callback on worker error response, causing callers to hang
• 2026-07-19 Web Inspector: Network table load-time polling interval never backs off from 100ms
• 2026-07-19 [Web Inspector] TimelineOverview leaks TimelineRecording listeners; TimelineOverview.prototype.closed is never called
• 2026-07-19 Web Inspector: HTMLTreeBuilderFormatter dead store to didClose in tbody/tfoot cases
• 2026-07-19 Sync `css-link-params` from WPT Upstream
• 2026-07-18 HeapSnapshot.js allocates unnecessary intermediate arrays before serializing nodes/edges
• 2026-07-18 Web Inspector: InspectorInstrumentation's instrumenting-agents registry manually new/deletes its HashSet
• 2026-07-18 Web Inspector: buildWebSocketMessage() uses magic number 1 instead of WebSocketFrame::OpCodeText
• 2026-07-18 Web Inspector: JSFormatter._isRangeWhitespace should avoid allocating a substring to scan
• 2026-07-18 Deduplicate buildArrayForVector/mapToArray in Inspector canvas recording code
• 2026-07-18 Web Inspector: Uncaught Exception: TypeError: null is not an object (evaluating 'this.target.RuntimeAgent')
• 2026-07-18 Web Inspector: InspectorThreadableLoaderClient::m_statusCode is uninitialized
• 2026-07-18 Web Inspector: operator precedence bug in LogContentView range selection deselect check
• 2026-07-18 shrinkToFit() operates on a temporary copy in InlineContent::nonRootInlineBoxIndexesForLayoutBox()
• 2026-07-18 [Grid] oppositeAxisConstraintForTrackSizing() copies the track-sizes Vector for every grid item
• 2026-07-18 [CSS Scroll Snap] Re-snap should ignore a focused snap area that is scrolled out of the snapport
• 2026-07-17 LineLayoutResult::inflowContentType() is computed twice in hasContentfulInlineContent()/isBlockContent()
• 2026-07-17 Avoid redundant copy and double hash lookup in LineBoxBuilder::collectFallbackFonts()
• 2026-07-16 [scroll-animations] View timeline on a transformed SVG element uses the untransformed subject size
• 2026-07-16 [scroll-animations] View timeline sticky adjustment wrong for subject taller than the scrollport
• 2026-07-16 [WTF] IntPairHash::equal and DefaultHash<pair<int, unsigned>> use wrong template arguments
• 2026-07-16 Reduce sizeof Line::Run by reordering members
• 2026-07-16 Dead if in fieldset baseline computation after subpixel-inline-layout cleanup
• 2026-07-16 Reduce sizeof InlineContentCache::InlineItems::ContentAttributes by reordering members
• 2026-07-16 Remove dead no-op fragment-offset shift in RenderBlockFlow::setStaticInlinePositionForChild
• 2026-07-16 ReadableStream byte-source tee: BYOB close steps target the wrong branch
• 2026-07-16 [CSS Scroll Snap] Re-snap should select the snap area aligned in both axes among multiple aligned targets
• 2026-07-16 WTF::divideRoundedUp can overflow for dividends near the type's maximum
• 2026-07-15 [CSS Scroll Snap] Re-snap should select the innermost aligned snap area per axis
• 2026-07-15 [Web Inspector] Avoid redundant String copy of request URL in InspectorNetworkAgent::willSendRequest
• 2026-07-15 Web Inspector: Timeline recording import reports "unsupported version" as a HAR Import Error
• 2026-07-14 Web Inspector: gradient editor drops explicit 0% color stops and mis-parses leading radial color stops
• 2026-07-14 Web Inspector: RemoteObject.getCollectionEntries crashes on protocol error instead of reporting it
• 2026-07-14 Web Inspector: autocompleting a vendor/-apple- prefixed value in Styles duplicates the prefix (e.g. -apple--apple-system
• 2026-07-14 Web Inspector: BoxShadow fails to parse valid lengths like "1.50px", "1e2px", and uppercase units
• 2026-07-14 NotificationData::direction is serialized uninitialized when a NotificationPayload has no options
• 2026-07-14 Web Inspector: HTML pretty-printer mis-nests <canvas> fallback content because "canvas" is wrongly treated as a void ele
• 2026-07-14 [Web Inspector] Heap snapshot collection diff strides previous snapshot by wrong node field count
• 2026-07-14 Web Inspector: HAR export reports a bogus port for remote addresses that have no port
• 2026-07-14 Web Inspector: Table._isRowVisible off-by-one and showColumn throws when the shown column is the only visible column
• 2026-07-14 Web Inspector: column resizer drag offset uses `this` for a static constant, producing `left: NaNpx
• 2026-07-14 Web Inspector: _tokenTrackingControllerHighlightedMarkedExpression tests a leaked loop variable instead of the selected
• 2026-07-14 Web Inspector: parseMIMEType doesn't strip quotes from a quoted charset
• 2026-07-14 Web Inspector: CSSManager has a duplicate get overriddenUserPreferences() that shadows the first
• 2026-07-14 Web Inspector: formatted location string always drops the column number
• 2026-07-13 Web Inspector: probe manager drops probes when a breakpoint has multiple probe actions added or removed at once
• 2026-07-13 Web Inspector: stylesheet resource cache is never invalidated when a resource is added or changes type
• 2026-07-13 Web Inspector: removing a DOM breakpoint deletes sibling breakpoints that share the same URL
• 2026-07-13 Fold uninitialized RenderTable local in RenderTreeBuilder::attachToRenderElement
• 2026-07-13 [WTF] Use std::has_single_bit() instead of open-coded single-bit checks in EnumSet and SmallSet
• 2026-07-13 Simplify HTMLVideoElement::hasAvailableVideoFrame to avoid redundant player() and protect() calls
• 2026-07-13 [WTF] Use std::ranges::fill for the fill loops in StringConcatenate padding/indentation adapters
• 2026-07-13 Web Inspector: crimson named color maps to wrong RGB value
• 2026-07-13 FetchHeaders::appendToHeaderMap does a redundant header-map lookup on every append
• 2026-07-13 Use correct HRTF elevation response for negative elevations
• 2026-07-13 IndexedDB getCount() truncates record counts above INT_MAX
• 2026-07-13 Reorder RenderTreeUpdater::Parent fields to eliminate struct padding
• 2026-07-13 Simplify object-store lookup in IDBTransaction::objectStore()
• 2026-07-13 HTMLFrameSetElement does not correctly update frameborder/noresize state on dynamic attribute changes
• 2026-07-13 [WebVTT] Move WebVTTToken into the out-parameter in WebVTTTokenizer::emitToken instead of copying
• 2026-07-13 Remove redundant pending-fullscreen-element re-check in requestFullscreen
• 2026-07-13 AudioParamTimeline::cancelAndHoldAtTime discards exception from second insertEvent
• 2026-07-13 PODIntervalTree::nextIntervalAfter can return a non-nearest following interval
• 2026-07-13 Add iteration bounds to SVGSMILElement interval-resolution loops to prevent potential hangs
• 2026-07-12 SVGSMILElement instance time lists accumulate duplicate entries from repeated beginElementAt/endElementAt calls
• 2026-07-12 feConvolveMatrix: removing an invalid order attribute leaves the filter permanently disabled
• 2026-07-12 Null-deref of documentElement() when resolving root-font-relative SVG lengths
• 2026-07-12 Avoid repeated protect(mediaElement()) in RenderMedia::styleDidChange
• 2026-07-12 Scroll To Text Fragment: simplify MIME-type gate and add mixed-case coverage
• 2026-07-12 Use a switch in VTTCue::calculateMaximumSize
• 2026-07-12 Web Inspector: crash when inspecting a top-level @scope rule with a bare declaration
• 2026-07-12 Add missing newline between updateShouldPlay() and resetPlaybackSessionState() in HTMLMediaElement.cpp
• 2026-07-12 TextTrackList::getTrackById iterates via length()/item() instead of walking track vectors directly
• 2026-07-11 Scroll To Text Fragment: text directives should only run in text/html and text/plain documents
• 2026-07-11 Remove redundant shadowing variable in VTTCue::determineTextDirection
• 2026-07-11 Use `using` alias instead of `typedef` in WebVTTToken
• 2026-07-11 Reduce VTTCue size by regrouping m_displayDirection with adjacent small enums
• 2026-07-10 U+2016 (DOUBLE VERTICAL LINE) is missing the symmetric property in the operator dictionary
• 2026-07-10 [MediaFragmentURIParser] Remove two dead branches in parseNPTTime
• 2026-07-08 Node::lastDescendant()/firstDescendant() call lastChild()/firstChild() twice per iteration
• 2026-07-07 [WidthIterator] Avoid redundant Font refcount churn in the per-character advance loop
• 2026-07-07 Use prefix increment for std::set iterators in IndexValueStore
• 2026-07-06 IDBObjectStore.openKeyCursor() with a key value returns a value-carrying cursor instead of a key-only cursor
• 2026-07-06 TextTrackList::invalidateTrackIndexesAfterTrack only invalidates the first track's index
• 2026-07-06 MediaUsageInfo::outsideOfFullscreen is inverted, reporting media inside fullscreen as outside (and vice versa)
• 2026-07-06 Extract duplicated reflection/replica layer update into RenderLayerBacking::updateReflectionLayer()
• 2026-07-06 Tautological self-assignment in HTMLMediaElement::setMutedInternal
• 2026-07-06 PannerNode orientation-only changes don't update the directional cone gain
• 2026-07-06 anchor-center in a vertical writing mode is not scroll-adjusted along the block axis
• 2026-07-05 Remove dead decodeURLEscapeSequences() call in SecurityOrigin::create()
• 2026-07-05 [Web Inspector] DataLoader constructor takes RefPtr<IDBKeyRange> by value instead of by rvalue-reference
• 2026-07-04 Fix incorrect debug-output strings in RenderStyleConstants.cpp operator<< overloads
• 2026-07-04 Remove duplicate #include directives in Source/WebCore
• 2026-07-04 [Web Inspector] Uninitialized bool members in InspectorOverlay Config structs
• 2026-07-04 NullMedia.buffered/played/seekable throw ReferenceError due to unqualified EmptyRanges reference
• 2026-07-04 PlatformKeyboardEvent::syntheticEventFromText fails to synthesize "{" due to trailing space in lookup table key
• 2026-07-04 [Web Inspector] selectorsForCSSStyleRule computes the split-rule list twice
• 2026-07-03 [Web Inspector] Null InspectorStyleSheet dereference in InspectorCSSAgent::setActiveStyleSheetsForDocument when removing
• 2026-07-03 [Web Inspector] didChangeCanvasSize/didChangeCanvasMemory have a vestigial always-true null check on inspectorCanvas
• 2026-07-03 PageRuntimeAgent::didClearWindowObjectInWorld should check m_ignoreDidClearWindowObject before minting a frame identifie
• 2026-07-03 Optimize SVGURIReference::fragmentIdentifierFromIRIString to avoid redundant URL parsing and string allocations
• 2026-07-03 Out-of-bounds read in InspectorAnimationAgent when parsedKeyframes is shorter than blendingKeyframes
• 2026-07-03 SVG SMIL number, integer-optional-integer, number-optional-number and path animations should not apply when from/to/by v
• 2026-07-03 [Web Inspector] Empty std::optional dereference in Page.setCookie when "session" is omitted but "expires" is present
• 2026-07-03 [Web Inspector] Unsigned underflow in power-efficient playback heuristic spuriously reports power efficiency in the DOM
• 2026-07-02 containsPlainText() re-scans the document head and misses matches past the first search-buffer fill
• 2026-07-02 [Web Inspector] adopted (constructable) stylesheets misclassified as User Agent in the per-frame CSS agent
• 2026-07-02 [Web Inspector] Self-canceling ternary in flex overlay cross-axis direction calculation
• 2026-07-02 [Web Inspector] Page.searchInResources silently drops cache-backed resources from search results
• 2026-07-02 [Web Inspector] Inspector color picker always force-converts picked colors to DisplayP3
• 2026-07-02 [Web Inspector] Duplicate invalid CSS declarations both show as Active due to dead has_value() && !has_value() check
• 2026-07-02 Convert two external paintserver tests in svg/custom/ to reftests
• 2026-07-02 SVGAnimatedPropertyPairAccessor::detach() causes needless refcount churn by calling Ref-returning helpers
• 2026-07-02 TimeLabel re-formats on every timeupdate when its value is unchanged
• 2026-07-02 ContentVisibilityDocumentState::updateViewportProximity does a redundant hash lookup
• 2026-07-02 Dynamic orient/markerUnits changes on SVGMarkerElement don't repaint referencing element
• 2026-07-02 DataTransferItemList::didSetStringData recomputes convertToASCIILowercase() instead of reusing cached value
• 2026-07-02 PopoverData::m_popoverState and m_visibilityState are uninitialized
• 2026-07-02 UIEvent::initUIEvent copies RefPtr<WindowProxy>&& viewArg instead of moving it
• 2026-07-01 Remove dead declarations from VTTCue and LoadableTextTrack headers
• 2026-07-01 Use SetForScope for HTMLFrameElementBase::m_openingURLAfterInsertin
• 2026-07-01 Remove stale misspelled forward declaration DataTransferListItem from DataTransferItem.h
• 2026-07-01 Avoid O(n) front-shift when building dictation alternatives Vector
• 2026-07-01 nextLineCandidatePosition ignores editableType parameter and hardcodes ContentIsEditable
• 2026-07-01 Misnamed local static voiceAttr in WebVTTElement::langAttributeName()
• 2026-07-01 Strip SVGStyleElement in ReplaceSelectionCommand
• 2026-07-01 Reduce HTMLAttachmentElement size by 8 bytes via field reordering
• 2026-07-01 Remove dead null check in ReplaceSelectionCommand::doApply
• 2026-07-01 Add missing break statement in ImageDataArray::tryCreate switch
• 2026-07-01 Reduce PreloadRequest size by 8 bytes via field reordering
• 2026-07-01 Padding bits defeat intended HTMLEntityTableEntry size optimization
• 2026-07-01 [MathML] MathOperator::reset() does not re-initialize the m_variantGlyph/m_assembly union
• 2026-06-30 [RenderElement] Consolidate bitfields and move initializers to the header
• 2026-06-30 RenderFlexibleBox::LineState constructor copies FlexLayoutItems instead of moving it
• 2026-06-30 Marked-text highlight pseudo-element fill color is taken from the stroke color
• 2026-06-30 Remove redundant m_renderRange.start() null checks in RenderHighlight::highlightStateForRenderer
• 2026-06-30 Remove duplicate (&layer == &m_owningLayer) condition in RenderLayerBacking::paintIntoLayer
• 2026-06-30 FontCascadeCacheKey has uninitialized fontSelectorId and fontSelectorVersion members
• 2026-06-29 ImageBuffer constructor should move its Parameters instead of copying
• 2026-06-29 Add missing break in RightToLeft case of fieldset border switch in RenderTreeAsText.cpp
• 2026-06-29 Remove duplicate #include of RuntimeApplicationChecksCocoa.h in RenderTheme.cpp
• 2026-06-29 [CG] gradientOptionsDictionary() can fall off the end of a non-void switch
• 2026-06-29 Use SetForScope in RenderLayerScrollableArea::updateMarqueePosition()
• 2026-06-29 Deduplicate the multi-line nine-piece image strip computation in InlineBoxPainter
• 2026-06-29 Fix typo in RenderFlexibleBox::performFlexLayout(): last-line item count read from first line
• 2026-06-29 [TimeRanges] Add API test coverage for TimeRanges::nearest()
• 2026-06-29 [Event Regions] touchEventTypes set has duplicate MouseMove and is missing MouseUp
• 2026-06-29 Concentric inner-button corner radius check ignores bottom inset for horizontal text controls
• 2026-06-29 colorWithTargetLuminance() passes std::clamp() arguments in the wrong order
• 2026-06-29 Avoid constructing the frame RegistrableDomain twice in Quirks::triggerOptionalStorageAccessIframeQuirk
• 2026-06-29 Cache the registrable domain string and use _s literals in Quirks::needsCustomUserAgentOverride
• 2026-06-29 [SVG] Remove redundant duplicate condition in SVGRenderingContext::prepareToRenderSVGContent
• 2026-06-29 Use an _s literal for the host comparison in Quirks::handleTMobileQuirks
• 2026-06-29 Remove redundant duplicate checks in Quirks embedded YouTube storage access branch
• 2026-06-29 Meta refresh to URL with different fragment identifier should not be treated as a page reload
• 2026-06-29 Avoid foldCase and URL re-parse when consistent query parameter filtering quirk is disabled
• 2026-06-29 Use WTF::roundUpToMultipleOf in BitVector::OutOfLineBits::create
• 2026-06-29 Fix misspelled identifiers in rendering code
• 2026-06-29 Use dynamic_cf_cast<CFBooleanRef> for the FullRangeVideo extension in colorSpaceFromFormatDescription()
• 2026-06-28 Cache deviceScaleFactor in BorderPainter::drawBoxSideFromPath
• 2026-06-28 [AVFoundation] De-duplicate the ARGB color-extraction blocks in processCueAttributes()
• 2026-06-28 GraphicsContext::fillRoundedRect and fillRect clobber an active non-Normal blend mode
• 2026-06-28 ImageBuffer::transferToNewContext() can null-deref backend()
• 2026-06-28 ImageBuffer::hasBackend() should be const
• 2026-06-27 [LegacySVG] Remove no-op const_cast in LegacyRenderSVGRoot::willBeDestroyed()
• 2026-06-27 Remove duplicate #includes in WebCore
• 2026-06-27 [LegacySVG] Drop needless IntPoint() conversion in LegacyRenderSVGForeignObject::paint()
• 2026-06-27 SVG SMIL animations should not apply when from/to/by values fail to parse
• 2026-06-26 [CSS Scroll Snap] Re-snap does not prefer a snap area that contains the focused or fragment-targeted element
• 2026-06-26 [Gardening] Unskip `prefer-targeted-element-both-axes.html` since it is passing reliably
• 2026-06-26 [CSS Scroll Snap] Re-snap does not prefer the focused or fragment-targeted snap area among multiple aligned snap targets
• 2026-06-26 [LegacySVG] Use NeverDestroyed for the shared solid painting resource singleton
• 2026-06-26 Resync `css-scroll-snap` from WPT Upstream
• 2026-06-25 [LegacySVG] Use nullptr instead of 0 for pointers
• 2026-06-25 [LegacySVG] Rename inner loop variable in SVGResourcesCycleSolver
• 2026-06-25 [Test Coverage] CSS outline on an inline <svg> is not repainted when toggled on :hover (appears stale / missing)
• 2026-06-24 ArrayBuffer-backed I420/NV12 VideoFrame with codedHeight larger than visibleRect.height renders chroma offset
• 2026-06-24 <audio> and <video> controls render strangely when rotated
• 2026-06-22 [LegacySVG] legacyIsGraphicsElement() can dereference a null element()
• 2026-06-22 Preloading script from relative path incorrectly requests resource from local origin needlessly
• 2026-06-22 CSS preload scanner fails to preload @import rules that follow an @layer statement rule
• 2026-06-20 [LegacySVG] Nested clip-path (clip-path on a clipPath) ignores zoom
• 2026-06-20 [LegacySVG] Avoid an AffineTransform copy per paint in applyGradientResource()
• 2026-06-20 input[type=hidden] should be display:none !important in the UA stylesheet
• 2026-06-20 Fix typos in comments in legacy SVG rendering code
• 2026-06-19 Scroll snapping selects a snap point that overshoots the destination instead of the closest one in the scroll direction
• 2026-06-18 Interrupting a smooth scroll with a new scrollTo() to a different target fires scrollend at the wrong position
• 2026-06-17 <link rel=preload as=json> should not trigger a preload
• 2026-06-17 [SVG] Non-BMP character before a tspan boundary shifts the x/y value list by one
• 2026-06-17 Resync `svg` from WPT Upstream
• 2026-06-16 Clean up SVGSMILElement::findInstanceTime
• 2026-06-16 Sync `preload` from WPT Upstream
• 2026-06-16 [SVG] getRotationOfChar() returns ~360 instead of 0 for a full-turn rotate
• 2026-06-16 Re-snapping after layout moves away from a valid scroll position when the snap area is larger than the snapport
• 2026-06-15 Element.getBoundingClientRect() on SVG <tspan> returns the whole <text> bounds instead of the tspan's own area
• 2026-06-15 scrollIntoView "nearest" aligns to the far edge for an oversized target before the scrollport
• 2026-06-15 Use default member initializers for legacy SVG renderer data members
• 2026-06-14 [css-values] Math functions produce incorrect signed zero for subtraction, min/max/clamp, and mod()
• 2026-06-14 Resync `dom/events/scrolling` from WPT Upstream
• 2026-06-13 Synthetic bold adds advance width to zero-advance glyphs
• 2026-06-12 SVGFEConvolveMatrixElement should reject invalid order attribute values
• 2026-06-12 [SVG] text-orientation does not affect glyph orientation in SVG <text>
• 2026-06-11 Avoid assignment in condition in RenderTable::offsetWidthForColumn
• 2026-06-11 Use nullptr instead of 0/{} for pointers in RenderTable
• 2026-06-11 [MathML] Use MathML Core fallback values for script layout constants
• 2026-06-10 [MathML] Operators routed through MathOperator are invisible when their glyph only exists in a fallback font
• 2026-06-10 [MathML] Support embellished operator detection through mrow for underover layout
• 2026-06-10 [MathML] Update direction-overall-003.html to match spec-compliant symmetric prescript spacing