Star0
12
代码
代码
Issues378
Pull Requests19
项目讨论
Wiki
分析
Star0
12
已开启
update to version 2.54.0, drop upstreamed CVE patches #182
Funda Wang创建于 5 天前
update to version 2.54.0, drop upstreamed CVE patches #182
已开启
Funda Wang创建于 5 天前
从fundawang/webkitgtkmaster合入到src-openeuler/webkitgtkmaster
共 5 个文件变更+57-645
Dbackport-CVE-2026-78376.patch+0-575
@@ -1,575 +0,0 @@
1-From e471f9743fad09955c8d60aabadae310a1088591 Mon Sep 17 00:00:00 2001
2-From: Justin Michaud <jmichaud@igalia.com>
3-Date: Mon, 31 Aug 2026 01:34:34 -0700
4-Subject: [PATCH] Cherry-pick 319867@main (9fa946d9a72f).
5- https://bugs.webkit.org/show_bug.cgi?id=322290
6- 
7- Clean up jsObjectCall style
8- https://bugs.webkit.org/show_bug.cgi?id=322290
9- 
10- Reviewed by Claudio Saavedra.
11- 
12- This was bugging me while I was looking at it, little drive-by cleanup.
13- 
14- Canonical link: https://commits.webkit.org/319867@main
15- 
16-Canonical link: https://commits.webkit.org/305877.1128@webkitglib/2.52
17----
18- .../JavaScriptCore/API/APICallbackFunction.h | 21 +--
19- .../API/JSCallbackObjectFunctions.h | 20 ++-
20- Source/JavaScriptCore/API/glib/JSCValue.cpp | 31 ++--
21- Source/JavaScriptCore/API/tests/testapi.cpp | 126 ++++++++++++++++
22- .../Tests/JavaScriptCore/glib/TestJSC.cpp | 142 ++++++++++++++++++
23- 5 files changed, 314 insertions(+), 26 deletions(-)
24- 
25-diff --git a/Source/JavaScriptCore/API/APICallbackFunction.h b/Source/JavaScriptCore/API/APICallbackFunction.h
26-index 05ee14101da0..82d1f03216e0 100644
27---- a/Source/JavaScriptCore/API/APICallbackFunction.h
28-+++ b/Source/JavaScriptCore/API/APICallbackFunction.h
29-@@ -1,5 +1,6 @@
30- /*
31- * Copyright (C) 2013-2020 Apple Inc. All rights reserved.
32-+ * Copyright (C) 2026 Igalia S.L.
33- *
34- * Redistribution and use in source and binary forms, with or without
35- * modification, are permitted provided that the following conditions
36-@@ -30,7 +31,7 @@
37- #include "Error.h"
38- #include "JSCallbackConstructor.h"
39- #include "JSLock.h"
40--#include <wtf/Vector.h>
41-+#include "MarkedJSValueRefArray.h"
42-
43- namespace JSC {
44-
45-@@ -49,15 +50,16 @@ EncodedJSValue APICallbackFunction::callImpl(JSGlobalObject* globalObject, CallF
46- JSObjectRef thisObjRef = toRef(jsCast<JSObject*>(callFrame->thisValue().toThis(globalObject, ECMAMode::sloppy())));
47-
48- int argumentCount = static_cast<int>(callFrame->argumentCount());
49-- Vector<JSValueRef, 16> arguments(argumentCount, [&](size_t i) {
50-- return toRef(globalObject, callFrame->uncheckedArgument(i));
51-- });
52-+ MarkedJSValueRefArray arguments(toGlobalRef(globalObject), static_cast<unsigned>(argumentCount));
53-+ for (unsigned i = 0; i < arguments.size(); ++i)
54-+ arguments[i] = toRef(globalObject, callFrame->uncheckedArgument(i));
55-+ ASSERT(static_cast<size_t>(argumentCount) == arguments.size());
56-
57- JSValueRef exception = nullptr;
58- JSValueRef result;
59- {
60- JSLock::DropAllLocks dropAllLocks(globalObject);
61-- result = jsCast<T*>(toJS(functionRef))->functionCallback()(execRef, functionRef, thisObjRef, argumentCount, arguments.span().data(), &exception);
62-+ result = jsCast<T*>(toJS(functionRef))->functionCallback()(execRef, functionRef, thisObjRef, arguments.size(), arguments.data(), &exception);
63- }
64- if (exception) {
65- throwException(globalObject, scope, toJS(globalObject, exception));
66-@@ -92,15 +94,16 @@ EncodedJSValue APICallbackFunction::constructImpl(JSGlobalObject* globalObject,
67- }
68-
69- size_t argumentCount = callFrame->argumentCount();
70-- Vector<JSValueRef, 16> arguments(argumentCount, [&](size_t i) {
71-- return toRef(globalObject, callFrame->uncheckedArgument(i));
72-- });
73-+ MarkedJSValueRefArray arguments(toGlobalRef(globalObject), static_cast<unsigned>(argumentCount));
74-+ for (unsigned i = 0; i < arguments.size(); ++i)
75-+ arguments[i] = toRef(globalObject, callFrame->uncheckedArgument(i));
76-+ ASSERT(static_cast<size_t>(argumentCount) == arguments.size());
77-
78- JSValueRef exception = nullptr;
79- JSObjectRef result;
80- {
81- JSLock::DropAllLocks dropAllLocks(globalObject);
82-- result = callback(ctx, constructorRef, argumentCount, arguments.span().data(), &exception);
83-+ result = callback(ctx, constructorRef, arguments.size(), arguments.data(), &exception);
84- }
85-
86- if (exception) {
87-diff --git a/Source/JavaScriptCore/API/JSCallbackObjectFunctions.h b/Source/JavaScriptCore/API/JSCallbackObjectFunctions.h
88-index c7a03104aa77..6241166a3b39 100644
89---- a/Source/JavaScriptCore/API/JSCallbackObjectFunctions.h
90-+++ b/Source/JavaScriptCore/API/JSCallbackObjectFunctions.h
91-@@ -1,6 +1,7 @@
92- /*
93- * Copyright (C) 2006-2020 Apple Inc. All rights reserved.
94- * Copyright (C) 2007 Eric Seidel <eric@webkit.org>
95-+ * Copyright (C) 2026 Igalia S.L.
96- *
97- * Redistribution and use in source and binary forms, with or without
98- * modification, are permitted provided that the following conditions
99-@@ -35,6 +36,7 @@
100- #include "JSLock.h"
101- #include "JSObjectRef.h"
102- #include "JSString.h"
103-+#include "MarkedJSValueRefArray.h"
104- #include "OpaqueJSString.h"
105- #include "PropertyNameArray.h"
106- #include <wtf/Vector.h>
107-@@ -479,14 +481,15 @@ EncodedJSValue JSCallbackObject<Parent>::constructImpl(JSGlobalObject* globalObj
108- for (JSClassRef jsClass = jsCast<JSCallbackObject<Parent>*>(constructor)->classRef(); jsClass; jsClass = jsClass->parentClass) {
109- if (JSObjectCallAsConstructorCallback callAsConstructor = jsClass->callAsConstructor) {
110- size_t argumentCount = callFrame->argumentCount();
111-- Vector<JSValueRef, 16> arguments(argumentCount, [&](size_t i) {
112-- return toRef(globalObject, callFrame->uncheckedArgument(i));
113-- });
114-+ MarkedJSValueRefArray arguments(toGlobalRef(globalObject), static_cast<unsigned>(argumentCount));
115-+ for (unsigned i = 0; i < arguments.size(); ++i)
116-+ arguments[i] = toRef(globalObject, callFrame->uncheckedArgument(i));
117-+ ASSERT(static_cast<size_t>(argumentCount) == arguments.size());
118- JSValueRef exception = nullptr;
119- JSObject* result;
120- {
121- JSLock::DropAllLocks dropAllLocks(globalObject);
122-- result = toJS(callAsConstructor(execRef, constructorRef, argumentCount, arguments.span().data(), &exception));
123-+ result = toJS(callAsConstructor(execRef, constructorRef, arguments.size(), arguments.data(), &exception));
124- }
125- if (exception) {
126- throwException(globalObject, scope, toJS(globalObject, exception));
127-@@ -557,15 +560,16 @@ EncodedJSValue JSCallbackObject<Parent>::callImpl(JSGlobalObject* globalObject,
128- for (JSClassRef jsClass = jsCast<JSCallbackObject<Parent>*>(toJS(functionRef))->classRef(); jsClass; jsClass = jsClass->parentClass) {
129- if (JSObjectCallAsFunctionCallback callAsFunction = jsClass->callAsFunction) {
130- size_t argumentCount = callFrame->argumentCount();
131-- Vector<JSValueRef, 16> arguments(argumentCount, [&](size_t i) {
132-- return toRef(globalObject, callFrame->uncheckedArgument(i));
133-- });
134-+ MarkedJSValueRefArray arguments(toGlobalRef(globalObject), static_cast<unsigned>(argumentCount));
135-+ for (unsigned i = 0; i < arguments.size(); ++i)
136-+ arguments[i] = toRef(globalObject, callFrame->uncheckedArgument(i));
137-+ ASSERT(static_cast<size_t>(argumentCount) == arguments.size());
138-
139- JSValueRef exception = nullptr;
140- JSValue result;
141- {
142- JSLock::DropAllLocks dropAllLocks(globalObject);
143-- result = toJS(globalObject, callAsFunction(execRef, functionRef, thisObjRef, argumentCount, arguments.span().data(), &exception));
144-+ result = toJS(globalObject, callAsFunction(execRef, functionRef, thisObjRef, arguments.size(), arguments.data(), &exception));
145- }
146- if (exception) {
147- throwException(globalObject, scope, toJS(globalObject, exception));
148-diff --git a/Source/JavaScriptCore/API/glib/JSCValue.cpp b/Source/JavaScriptCore/API/glib/JSCValue.cpp
149-index b0842ff369f6..40f48a956492 100644
150---- a/Source/JavaScriptCore/API/glib/JSCValue.cpp
151-+++ b/Source/JavaScriptCore/API/glib/JSCValue.cpp
152-@@ -31,6 +31,7 @@
153- #include "JSRetainPtr.h"
154- #include "JSTypedArray.h"
155- #include "LiteralParser.h"
156-+#include "MarkedJSValueRefArray.h"
157- #include "OpaqueJSString.h"
158- #include "TypedArrayType.h"
159- #include <array>
160-@@ -873,16 +874,16 @@ char** jsc_value_object_enumerate_properties(JSCValue* value)
161- return result.leakSpan().data();
162- }
163-
164--static JSValueRef jsObjectCall(JSGlobalContextRef jsContext, JSObjectRef function, JSC::JSCCallbackFunction::Type functionType, JSObjectRef thisObject, const Vector<JSValueRef>& arguments, JSValueRef* exception)
165-+static JSValueRef jsObjectCall(JSGlobalContextRef jsContext, JSObjectRef function, JSC::JSCCallbackFunction::Type functionType, JSObjectRef thisObject, std::span<const JSValueRef> arguments, JSValueRef* exception)
166- {
167- switch (functionType) {
168- case JSC::JSCCallbackFunction::Type::Constructor:
169-- return JSObjectCallAsConstructor(jsContext, function, arguments.size(), arguments.span().data(), exception);
170-+ return JSObjectCallAsConstructor(jsContext, function, arguments.size(), arguments.data(), exception);
171- case JSC::JSCCallbackFunction::Type::Method:
172- ASSERT(thisObject);
173- [[fallthrough]];
174- case JSC::JSCCallbackFunction::Type::Function:
175-- return JSObjectCallAsFunction(jsContext, function, thisObject, arguments.size(), arguments.span().data(), exception);
176-+ return JSObjectCallAsFunction(jsContext, function, thisObject, arguments.size(), arguments.data(), exception);
177- }
178- RELEASE_ASSERT_NOT_REACHED();
179- }
180-@@ -895,7 +896,8 @@ static GRefPtr<JSCValue> jscValueCallFunction(JSCValue* value, JSObjectRef funct
181- JSC::JSLockHolder locker(globalObject);
182-
183- JSValueRef exception = nullptr;
184-- Vector<JSValueRef> arguments;
185-+ // Converting a parameter allocates, so the values converted so far need a buffer the collector marks.
186-+ JSC::MarkedArgumentBuffer parameters;
187- GType parameterType = firstParameterType;
188- while (parameterType != G_TYPE_NONE) {
189- GValue parameter;
190-@@ -914,11 +916,22 @@ static GRefPtr<JSCValue> jscValueCallFunction(JSCValue* value, JSObjectRef funct
191- if (jscContextHandleExceptionIfNeeded(priv->context.get(), exception))
192- return jscContextGetOrCreateValue(priv->context.get(), jsValue);
193-
194-- arguments.append(jsValue);
195-+ parameters.append(toJS(globalObject, jsValue));
196- parameterType = va_arg(args, GType);
197- }
198-+ if (parameters.hasOverflowed()) {
199-+ exception = toRef(JSC::createOutOfMemoryError(globalObject));
200-+ jscContextHandleExceptionIfNeeded(priv->context.get(), exception);
201-+ return adoptGRef(jsc_value_new_undefined(priv->context.get()));
202-+ }
203-+
204-+ // Where a JSValue does not fit in a pointer toRef() allocates a wrapper cell, so the JSValueRefs
205-+ // need marking as well.
206-+ JSC::MarkedJSValueRefArray arguments(jsContext, static_cast<unsigned>(parameters.size()));
207-+ for (unsigned i = 0; i < arguments.size(); ++i)
208-+ arguments[i] = toRef(globalObject, parameters.at(i));
209-
210-- auto result = jsObjectCall(jsContext, function, functionType, thisObject, arguments, &exception);
211-+ auto result = jsObjectCall(jsContext, function, functionType, thisObject, unsafeMakeSpan(arguments.data(), arguments.size()), &exception);
212- if (jscContextHandleExceptionIfNeeded(priv->context.get(), exception))
213- return adoptGRef(jsc_value_new_undefined(priv->context.get()));
214-
215-@@ -1017,7 +1030,7 @@ JSCValue* jsc_value_object_invoke_methodv(JSCValue* value, const char* name, uns
216- return jscValueGetJSValue(parametersSpan[i]);
217- });
218-
219-- auto result = jsObjectCall(jsContext, function, JSC::JSCCallbackFunction::Type::Method, object, arguments, &exception);
220-+ auto result = jsObjectCall(jsContext, function, JSC::JSCCallbackFunction::Type::Method, object, arguments.span(), &exception);
221- if (jscContextHandleExceptionIfNeeded(priv->context.get(), exception))
222- return jsc_value_new_undefined(priv->context.get());
223-
224-@@ -1368,7 +1381,7 @@ JSCValue* jsc_value_function_callv(JSCValue* value, unsigned parametersCount, JS
225- return jscValueGetJSValue(parametersSpan[i]);
226- });
227-
228-- auto result = jsObjectCall(jsContext, function, JSC::JSCCallbackFunction::Type::Function, nullptr, arguments, &exception);
229-+ auto result = jsObjectCall(jsContext, function, JSC::JSCCallbackFunction::Type::Function, nullptr, arguments.span(), &exception);
230- if (jscContextHandleExceptionIfNeeded(priv->context.get(), exception))
231- return jsc_value_new_undefined(priv->context.get());
232-
233-@@ -1452,7 +1465,7 @@ JSCValue* jsc_value_constructor_callv(JSCValue* value, unsigned parametersCount,
234- return jscValueGetJSValue(parametersSpan[i]);
235- });
236-
237-- auto result = jsObjectCall(jsContext, function, JSC::JSCCallbackFunction::Type::Constructor, nullptr, arguments, &exception);
238-+ auto result = jsObjectCall(jsContext, function, JSC::JSCCallbackFunction::Type::Constructor, nullptr, arguments.span(), &exception);
239- if (jscContextHandleExceptionIfNeeded(priv->context.get(), exception))
240- return jsc_value_new_undefined(priv->context.get());
241-
242-diff --git a/Source/JavaScriptCore/API/tests/testapi.cpp b/Source/JavaScriptCore/API/tests/testapi.cpp
243-index fda67f51221a..158fef96500c 100644
244---- a/Source/JavaScriptCore/API/tests/testapi.cpp
245-+++ b/Source/JavaScriptCore/API/tests/testapi.cpp
246-@@ -1,5 +1,6 @@
247- /*
248- * Copyright (C) 2017-2024 Apple Inc. All rights reserved.
249-+ * Copyright (C) 2026 Igalia S.L.
250- *
251- * Redistribution and use in source and binary forms, with or without
252- * modification, are permitted provided that the following conditions
253-@@ -38,6 +39,7 @@
254- #include <wtf/NumberOfCores.h>
255- #include <wtf/Vector.h>
256- #include <wtf/text/MakeString.h>
257-+#include <wtf/text/StringBuilder.h>
258- #include <wtf/text/StringCommon.h>
259-
260- #if PLATFORM(COCOA)
261-@@ -159,6 +161,10 @@ class TestAPI {
262- void promiseDrainDoesNotEatExceptions();
263- void topCallFrameAccess();
264- void markedJSValueArrayAndGC();
265-+ void functionCallbackArgumentsAndGC();
266-+ void constructorCallbackArgumentsAndGC();
267-+ void classCallAsFunctionArgumentsAndGC();
268-+ void classCallAsConstructorArgumentsAndGC();
269- void classDefinitionWithJSSubclass();
270- void proxyReturnedWithJSSubclassing();
271- void testJSObjectSetOnGlobalObjectSubclassDefinition();
272-@@ -676,6 +682,122 @@ void TestAPI::markedJSValueArrayAndGC()
273- testMarkedJSValueArray(1000);
274- }
275-
276-+// Above MarkedJSValueRefArray's inline capacity, where a stack buffer would be found by conservative
277-+// scanning whether or not the collector knows about it.
278-+static constexpr unsigned manyArgumentCount = 32;
279-+static constexpr double recycledArgumentValue = 987654321;
280-+
281-+static bool argumentsSurviveCollectionInCallback(JSContextRef ctx, size_t argumentCount, const JSValueRef arguments[])
282-+{
283-+ if (argumentCount != manyArgumentCount)
284-+ return false;
285-+
286-+ {
287-+ auto* globalObject = toJS(ctx);
288-+ JSC::VM& vm = globalObject->vm();
289-+ JSC::JSLockHolder locker(vm);
290-+ JSC::sanitizeStackForVM(vm);
291-+ vm.heap.collectNow(JSC::Sync, JSC::CollectionScope::Full);
292-+ }
293-+
294-+ // Where a JSValue does not fit in a pointer a JSValueRef for a number is a JSAPIValueWrapper cell,
295-+ // so these allocations recycle the wrappers that a dangling argument still points at.
296-+ for (unsigned index = 0; index < 8192; ++index)
297-+ JSValueMakeNumber(ctx, recycledArgumentValue);
298-+
299-+ for (unsigned index = 0; index < argumentCount; ++index) {
300-+ if (!JSValueIsNumber(ctx, arguments[index]))
301-+ return false;
302-+ if (JSValueToNumber(ctx, arguments[index], nullptr) != index)
303-+ return false;
304-+ }
305-+ return true;
306-+}
307-+
308-+static CString scriptCallingWithManyArguments(ASCIILiteral prefix, ASCIILiteral suffix)
309-+{
310-+ StringBuilder builder;
311-+ builder.append(prefix);
312-+ for (unsigned index = 0; index < manyArgumentCount; ++index) {
313-+ if (index)
314-+ builder.append(", "_s);
315-+ builder.append(index);
316-+ }
317-+ builder.append(suffix);
318-+ return builder.toString().utf8();
319-+}
320-+
321-+static JSValueRef checkArgumentsAsFunctionCallback(JSContextRef ctx, JSObjectRef, JSObjectRef, size_t argumentCount, const JSValueRef arguments[], JSValueRef*)
322-+{
323-+ return JSValueMakeBoolean(ctx, argumentsSurviveCollectionInCallback(ctx, argumentCount, arguments));
324-+}
325-+
326-+static JSObjectRef checkArgumentsAsConstructorCallback(JSContextRef ctx, JSObjectRef, size_t argumentCount, const JSValueRef arguments[], JSValueRef*)
327-+{
328-+ bool survived = argumentsSurviveCollectionInCallback(ctx, argumentCount, arguments);
329-+ JSObjectRef result = JSObjectMake(ctx, nullptr, nullptr);
330-+ JSObjectSetProperty(ctx, result, APIString("ok"), JSValueMakeBoolean(ctx, survived), kJSPropertyAttributeNone, nullptr);
331-+ return result;
332-+}
333-+
334-+void TestAPI::functionCallbackArgumentsAndGC()
335-+{
336-+ APIString name("functionWithManyArguments");
337-+ JSObjectRef function = JSObjectMakeFunctionWithCallback(context, name, checkArgumentsAsFunctionCallback);
338-+ JSObjectSetProperty(context, JSContextGetGlobalObject(context), name, function, kJSPropertyAttributeNone, nullptr);
339-+
340-+ auto script = scriptCallingWithManyArguments("functionWithManyArguments("_s, ")"_s);
341-+ ScriptResult result = evaluateScript(script.data());
342-+ check(!!result && JSValueToBoolean(context, result.value()), "JSObjectMakeFunctionWithCallback arguments should survive a collection inside the callback.");
343-+}
344-+
345-+void TestAPI::constructorCallbackArgumentsAndGC()
346-+{
347-+ JSClassDefinition definition = kJSClassDefinitionEmpty;
348-+ JSClassRef jsClass = JSClassCreate(&definition);
349-+ APIString name("ConstructorWithManyArguments");
350-+ JSObjectRef constructor = JSObjectMakeConstructor(context, jsClass, checkArgumentsAsConstructorCallback);
351-+ JSObjectSetProperty(context, JSContextGetGlobalObject(context), name, constructor, kJSPropertyAttributeNone, nullptr);
352-+
353-+ auto script = scriptCallingWithManyArguments("new ConstructorWithManyArguments("_s, ").ok"_s);
354-+ ScriptResult result = evaluateScript(script.data());
355-+ check(!!result && JSValueToBoolean(context, result.value()), "JSObjectMakeConstructor arguments should survive a collection inside the callback.");
356-+
357-+ JSClassRelease(jsClass);
358-+}
359-+
360-+void TestAPI::classCallAsFunctionArgumentsAndGC()
361-+{
362-+ JSClassDefinition definition = kJSClassDefinitionEmpty;
363-+ definition.className = "CallableWithManyArguments";
364-+ definition.callAsFunction = checkArgumentsAsFunctionCallback;
365-+ JSClassRef jsClass = JSClassCreate(&definition);
366-+ APIString name("callableWithManyArguments");
367-+ JSObjectSetProperty(context, JSContextGetGlobalObject(context), name, JSObjectMake(context, jsClass, nullptr), kJSPropertyAttributeNone, nullptr);
368-+
369-+ auto script = scriptCallingWithManyArguments("callableWithManyArguments("_s, ")"_s);
370-+ ScriptResult result = evaluateScript(script.data());
371-+ check(!!result && JSValueToBoolean(context, result.value()), "JSClassDefinition::callAsFunction arguments should survive a collection inside the callback.");
372-+
373-+ JSClassRelease(jsClass);
374-+}
375-+
376-+void TestAPI::classCallAsConstructorArgumentsAndGC()
377-+{
378-+ JSClassDefinition definition = kJSClassDefinitionEmpty;
379-+ definition.className = "ConstructibleWithManyArguments";
380-+ definition.callAsConstructor = checkArgumentsAsConstructorCallback;
381-+ JSClassRef jsClass = JSClassCreate(&definition);
382-+ APIString name("ConstructibleWithManyArguments");
383-+ JSObjectSetProperty(context, JSContextGetGlobalObject(context), name, JSObjectMake(context, jsClass, nullptr), kJSPropertyAttributeNone, nullptr);
384-+
385-+ auto script = scriptCallingWithManyArguments("new ConstructibleWithManyArguments("_s, ").ok"_s);
386-+ ScriptResult result = evaluateScript(script.data());
387-+ check(!!result && JSValueToBoolean(context, result.value()), "JSClassDefinition::callAsConstructor arguments should survive a collection inside the callback.");
388-+
389-+ JSClassRelease(jsClass);
390-+}
391-+
392- void TestAPI::classDefinitionWithJSSubclass()
393- {
394- const static JSClassDefinition definition = kJSClassDefinitionEmpty;
395-@@ -1241,6 +1363,10 @@ int testCAPIViaCpp(const char* filter)
396- RUN(promiseDrainDoesNotEatExceptions());
397- RUN(promiseEarlyHandledRejections());
398- RUN(markedJSValueArrayAndGC());
399-+ RUN(functionCallbackArgumentsAndGC());
400-+ RUN(constructorCallbackArgumentsAndGC());
401-+ RUN(classCallAsFunctionArgumentsAndGC());
402-+ RUN(classCallAsConstructorArgumentsAndGC());
403- RUN(classDefinitionWithJSSubclass());
404- RUN(proxyReturnedWithJSSubclassing());
405- RUN(testJSObjectSetOnGlobalObjectSubclassDefinition());
406-diff --git a/Tools/TestWebKitAPI/Tests/JavaScriptCore/glib/TestJSC.cpp b/Tools/TestWebKitAPI/Tests/JavaScriptCore/glib/TestJSC.cpp
407-index 60149cbd52e2..1534abe6ed27 100644
408---- a/Tools/TestWebKitAPI/Tests/JavaScriptCore/glib/TestJSC.cpp
409-+++ b/Tools/TestWebKitAPI/Tests/JavaScriptCore/glib/TestJSC.cpp
410-@@ -27,6 +27,7 @@
411- #include <JavaScriptCore/JSContextRef.h>
412- #include <jsc/jsc.h>
413- #include <wtf/HashSet.h>
414-+#include <wtf/MainThread.h>
415- #include <wtf/Threading.h>
416- #include <wtf/Vector.h>
417- #include <wtf/glib/GRefPtr.h>
418-@@ -4819,9 +4820,147 @@ static void testJSCJSON()
419- }
420- }
421-
422-+static constexpr unsigned varargsParameterCount = 16;
423-+static constexpr unsigned varargsParameterLength = 512 * 1024;
424-+
425-+// Each parameter reports half a megabyte against a one megabyte smallHeapSize(), so the collector runs
426-+// partway through the conversion loop, when only the argument Vector refers to the earlier parameters.
427-+static void testJSCFunctionCallParameterLifetime()
428-+{
429-+ LeakChecker checker;
430-+ GRefPtr<JSCContext> context = adoptGRef(jsc_context_new());
431-+ checker.watch(context.get());
432-+ ExceptionHandler exceptionHandler(context.get());
433-+
434-+ GRefPtr<JSCValue> function = adoptGRef(jsc_context_evaluate(context.get(),
435-+ "(function() {\n"
436-+ " for (var i = 0; i < arguments.length; i++) {\n"
437-+ " if (arguments[i] !== String.fromCharCode(65 + i).repeat(524288))\n"
438-+ " return 'parameter ' + i + ' did not survive';\n"
439-+ " }\n"
440-+ " return 'ok';\n"
441-+ "})", -1));
442-+ checker.watch(function.get());
443-+ g_assert_true(jsc_value_is_function(function.get()));
444-+
445-+ GUniquePtr<char> parameters[varargsParameterCount];
446-+ for (unsigned i = 0; i < varargsParameterCount; ++i)
447-+ parameters[i].reset(g_strnfill(varargsParameterLength, static_cast<char>('A' + i)));
448-+
449-+#define STRING_PARAMETER(index) G_TYPE_STRING, parameters[index].get()
450-+ GRefPtr<JSCValue> result = adoptGRef(jsc_value_function_call(function.get(),
451-+ STRING_PARAMETER(0), STRING_PARAMETER(1), STRING_PARAMETER(2), STRING_PARAMETER(3),
452-+ STRING_PARAMETER(4), STRING_PARAMETER(5), STRING_PARAMETER(6), STRING_PARAMETER(7),
453-+ STRING_PARAMETER(8), STRING_PARAMETER(9), STRING_PARAMETER(10), STRING_PARAMETER(11),
454-+ STRING_PARAMETER(12), STRING_PARAMETER(13), STRING_PARAMETER(14), STRING_PARAMETER(15),
455-+ G_TYPE_NONE));
456-+#undef STRING_PARAMETER
457-+
458-+ checker.watch(result.get());
459-+ GUniquePtr<char> resultString(jsc_value_to_string(result.get()));
460-+ g_assert_cmpstr(resultString.get(), ==, "ok");
461-+}
462-+
463-+// Above the argument array's inline capacity, where a stack buffer would be found by conservative
464-+// scanning whether or not the collector knows about it.
465-+static constexpr unsigned manyArgumentCount = 32;
466-+static constexpr double recycledArgumentValue = 987654321;
467-+
468-+// Called from the toString() of the first argument, which JSC calls while it is still converting the
469-+// remaining arguments of the function being invoked.
470-+static void collectAndRecycleValues(int)
471-+{
472-+ JSCContext* context = jsc_context_get_current();
473-+ jscContextGarbageCollect(context, true);
474-+
475-+ // Where a JSValue does not fit in a pointer a JSValueRef for a number is a JSAPIValueWrapper cell,
476-+ // so these allocations recycle the wrappers that a dangling argument still points at. The unref
477-+ // only unprotects the cell; it stays allocated until the next collection.
478-+ for (unsigned i = 0; i < 4096; ++i)
479-+ g_object_unref(jsc_value_new_number(context, recycledArgumentValue));
480-+}
481-+
482-+static GRefPtr<JSCValue> collectFunction(JSCContext* context)
483-+{
484-+ return adoptGRef(jsc_value_new_function(context, "collect", G_CALLBACK(collectAndRecycleValues), nullptr, nullptr, G_TYPE_NONE, 1, G_TYPE_INT));
485-+}
486-+
487-+// Converting the first argument to G_TYPE_STRING calls its toString(), so "collect(0)" runs before
488-+// JSC converts the second argument.
489-+static GUniquePtr<char> scriptCallingWithManyArguments(const char* callee)
490-+{
491-+ GString* script = g_string_new(callee);
492-+ g_string_append(script, "({ toString: function() { collect(0); return 'trigger'; } }, 42");
493-+ for (unsigned i = 2; i < manyArgumentCount; ++i)
494-+ g_string_append_printf(script, ", %u", i);
495-+ g_string_append(script, ")");
496-+ return GUniquePtr<char>(g_string_free(script, FALSE));
497-+}
498-+
499-+static double s_secondArgument;
500-+
501-+static void recordSecondArgument(const char*, double second)
502-+{
503-+ s_secondArgument = second;
504-+}
505-+
506-+static void testJSCCallbackArgumentLifetime()
507-+{
508-+ LeakChecker checker;
509-+ GRefPtr<JSCContext> context = adoptGRef(jsc_context_new());
510-+ checker.watch(context.get());
511-+ ExceptionHandler exceptionHandler(context.get());
512-+
513-+ GRefPtr<JSCValue> collect = collectFunction(context.get());
514-+ checker.watch(collect.get());
515-+ jsc_context_set_value(context.get(), "collect", collect.get());
516-+
517-+ GRefPtr<JSCValue> function = adoptGRef(jsc_value_new_function(context.get(), "check", G_CALLBACK(recordSecondArgument), nullptr, nullptr, G_TYPE_NONE, 2, G_TYPE_STRING, G_TYPE_DOUBLE));
518-+ checker.watch(function.get());
519-+ jsc_context_set_value(context.get(), "check", function.get());
520-+
521-+ s_secondArgument = 0;
522-+ GUniquePtr<char> script = scriptCallingWithManyArguments("check");
523-+ GRefPtr<JSCValue> result = adoptGRef(jsc_context_evaluate(context.get(), script.get(), -1));
524-+ checker.watch(result.get());
525-+ g_assert_cmpfloat(s_secondArgument, ==, 42);
526-+}
527-+
528-+static Foo* fooCreateRecordingSecondArgument(const char*, double second)
529-+{
530-+ s_secondArgument = second;
531-+ return fooCreate();
532-+}
533-+
534-+static void testJSCConstructorArgumentLifetime()
535-+{
536-+ LeakChecker checker;
537-+ GRefPtr<JSCContext> context = adoptGRef(jsc_context_new());
538-+ checker.watch(context.get());
539-+ ExceptionHandler exceptionHandler(context.get());
540-+
541-+ GRefPtr<JSCValue> collect = collectFunction(context.get());
542-+ checker.watch(collect.get());
543-+ jsc_context_set_value(context.get(), "collect", collect.get());
544-+
545-+ JSCClass* jscClass = jsc_context_register_class(context.get(), "Foo", nullptr, nullptr, reinterpret_cast<GDestroyNotify>(fooFree));
546-+ checker.watch(jscClass);
547-+ GRefPtr<JSCValue> constructor = adoptGRef(jsc_class_add_constructor(jscClass, nullptr, G_CALLBACK(fooCreateRecordingSecondArgument), nullptr, nullptr,
548-+ G_TYPE_POINTER, 2, G_TYPE_STRING, G_TYPE_DOUBLE));
549-+ checker.watch(constructor.get());
550-+ jsc_context_set_value(context.get(), jsc_class_get_name(jscClass), constructor.get());
551-+
552-+ s_secondArgument = 0;
553-+ GUniquePtr<char> script = scriptCallingWithManyArguments("new Foo");
554-+ GRefPtr<JSCValue> result = adoptGRef(jsc_context_evaluate(context.get(), script.get(), -1));
555-+ checker.watch(result.get());
556-+ g_assert_cmpfloat(s_secondArgument, ==, 42);
557-+}
558-+
559- int main(int argc, char** argv)
560- {
561- g_test_init(&argc, &argv, nullptr);
562-+ WTF::initializeMainThread();
563-
564- // options should always be the first test, since changing options
565- // is not allowed after the first VM instance is created.
566-@@ -4846,6 +4985,9 @@ int main(int argc, char** argv)
567- g_test_add_func("/jsc/autocleanups", testsJSCAutocleanups);
568- #endif
569- g_test_add_func("/jsc/json", testJSCJSON);
570-+ g_test_add_func("/jsc/function-call-parameter-lifetime", testJSCFunctionCallParameterLifetime);
571-+ g_test_add_func("/jsc/callback-argument-lifetime", testJSCCallbackArgumentLifetime);
572-+ g_test_add_func("/jsc/constructor-argument-lifetime", testJSCConstructorArgumentLifetime);
573-
574- return g_test_run();
575- }
Dbackport-CVE-2026-83596.patch+0-51
@@ -1,51 +0,0 @@
1-From 9ee9108866ce671f29f6f3913e8ea4578d0439a6 Mon Sep 17 00:00:00 2001
2-From: Han Zheng <hanzheng@google.com>
3-Date: Mon, 31 Aug 2026 10:26:58 -0700
4-Subject: [PATCH] Cherry-pick 320142@main (f095a382daee).
5- https://bugs.webkit.org/show_bug.cgi?id=322969
6- 
7- Validate the full FeatureList array once in OpenTypeVerticalData findFeature
8- https://bugs.webkit.org/show_bug.cgi?id=322969
9- 
10- Reviewed by Carlos Garcia Campos and Adrian Perez de Castro.
11- 
12- FeatureList::findFeature validated only the start of each FeatureRecord
13- before reading its fields, which extend to the start of the following
14- record. Bound the whole array up front by checking the one-past-the-end
15- record, matching the idiom already used by FeatureList::feature,
16- FeatureTable::getGlyphSubstitutions, LangSysTable::feature and
17- ScriptList::script, then iterate. This also hoists the check out of the
18- loop.
19- 
20- * Source/WebCore/platform/graphics/opentype/OpenTypeVerticalData.cpp:
21- (WebCore::OpenType::FeatureList::findFeature const):
22- 
23- Canonical link: https://commits.webkit.org/320142@main
24- 
25-Canonical link: https://commits.webkit.org/305877.1129@webkitglib/2.52
26----
27- .../platform/graphics/opentype/OpenTypeVerticalData.cpp | 9 ++++++---
28- 1 file changed, 6 insertions(+), 3 deletions(-)
29- 
30-diff --git a/Source/WebCore/platform/graphics/opentype/OpenTypeVerticalData.cpp b/Source/WebCore/platform/graphics/opentype/OpenTypeVerticalData.cpp
31-index a1d9360c274c..b6dbffada2a8 100644
32---- a/Source/WebCore/platform/graphics/opentype/OpenTypeVerticalData.cpp
33-+++ b/Source/WebCore/platform/graphics/opentype/OpenTypeVerticalData.cpp
34-@@ -240,11 +240,14 @@ struct FeatureList : TableBase {
35-
36- const FeatureTable* findFeature(OpenType::Tag tag, const SharedBuffer& buffer) const
37- {
38-- for (uint16_t i = 0; i < featureCount; ++i) {
39-- if (isValidEnd(buffer, &features[i]) && features[i].featureTag == tag)
40-+ uint16_t count = featureCount;
41-+ if (!isValidEnd(buffer, &features[count]))
42-+ return nullptr;
43-+ for (uint16_t i = 0; i < count; ++i) {
44-+ if (features[i].featureTag == tag)
45- return validateOffset<FeatureTable>(buffer, features[i].featureOffset);
46- }
47-- return 0;
48-+ return nullptr;
49- }
50- };
51-
Rwebkitgtk-2.52.6.tar.xz→webkitgtk-2.54.0.tar.xz+2-2
@@ -1,3 +1,3 @@
1version https://git-lfs.github.com/spec/v11version https://git-lfs.github.com/spec/v1
2-oid sha256:179a2ea3f8f6edd4be7f31fdc55afc57bd0729f1fba648c61d4181539ac116fc2+oid sha256:846fd19ccedbae1dbfe904f26dbf2d68a800a33a50caf2ad5222c8dcb3f25682
3-size 657460003+size 49710944
Mwebkitgtk.spec+29-10
@@ -1,5 +1,7 @@
1%undefine __cmake_in_source_build1%undefine __cmake_in_source_build
2 2 
3+%global _cmake_module_linker_flags_extra "-fuse-ld=lld"
4+ 
3# Filter out provides for private libraries5# Filter out provides for private libraries
4%global __provides_exclude_from ^(%{_libdir}/webkit2gtk-4\\.1/.*\\.so)$6%global __provides_exclude_from ^(%{_libdir}/webkit2gtk-4\\.1/.*\\.so)$
5 7 
@@ -22,8 +24,8 @@
22%bcond_with gamepad24%bcond_with gamepad
23 25 
24Name: webkitgtk26Name: webkitgtk
25-Version: 2.52.627+Version: 2.54.0
26-Release: 228+Release: 1
27Summary: GTK web content engine library29Summary: GTK web content engine library
28License: BSD-3-Clause AND LGPL-2.0-or-later30License: BSD-3-Clause AND LGPL-2.0-or-later
29URL: https://www.webkitgtk.org/31URL: https://www.webkitgtk.org/
@@ -33,13 +35,12 @@ Patch1000: webkitgtk-add-loongarch-and-sw.patch
33# clang 17 has bug on Wunsafe-buffer-usage, disable it for now35# clang 17 has bug on Wunsafe-buffer-usage, disable it for now
34Patch1001: webkitgtk-2.52.0-drop-Wunsafe-buffer-usage.patch36Patch1001: webkitgtk-2.52.0-drop-Wunsafe-buffer-usage.patch
35 37 
36-Patch6000: backport-CVE-2026-78376.patch
37-Patch6001: backport-CVE-2026-83596.patch
38- 
39#Dependency38#Dependency
40BuildRequires: bison39BuildRequires: bison
41BuildRequires: bubblewrap40BuildRequires: bubblewrap
42-BuildRequires: clang41+BuildRequires: llvm-toolset-21
42+BuildRequires: llvm-toolset-21-clang
43+BuildRequires: llvm-toolset-21-lld
43BuildRequires: cmake44BuildRequires: cmake
44BuildRequires: flex45BuildRequires: flex
45BuildRequires: flite-devel >= 2.246BuildRequires: flite-devel >= 2.2
@@ -75,6 +76,7 @@ BuildRequires: pkgconfig(gbm)
75BuildRequires: pkgconfig(glib-2.0)76BuildRequires: pkgconfig(glib-2.0)
76BuildRequires: pkgconfig(gobject-introspection-1.0)77BuildRequires: pkgconfig(gobject-introspection-1.0)
77BuildRequires: pkgconfig(gstreamer-1.0)78BuildRequires: pkgconfig(gstreamer-1.0)
79+BuildRequires: pkgconfig(gstreamer-mpegts-1.0)
78BuildRequires: pkgconfig(gstreamer-plugins-base-1.0)80BuildRequires: pkgconfig(gstreamer-plugins-base-1.0)
79BuildRequires: pkgconfig(gtk+-3.0)81BuildRequires: pkgconfig(gtk+-3.0)
80BuildRequires: pkgconfig(harfbuzz)82BuildRequires: pkgconfig(harfbuzz)
@@ -172,9 +174,12 @@ files for developing applications that use JavaScript engine from webkit2gtk-4.1
172%autosetup -p1 -n webkitgtk-%{version}174%autosetup -p1 -n webkitgtk-%{version}
173 175 
174%build176%build
177+export PATH="/opt/%{_vendor}/llvm-toolset-21/root/usr/bin/:$PATH"
178+%global optflags %(echo %{optflags} | sed 's/-fgcc-compatible//')
175%ifarch aarch64179%ifarch aarch64
176%global optflags %(echo %{optflags} | sed 's/-mbranch-protection=standard /-mbranch-protection=pac-ret /')180%global optflags %(echo %{optflags} | sed 's/-mbranch-protection=standard /-mbranch-protection=pac-ret /')
177%endif181%endif
182+export LDFLAGS="%{build_ldflags} -fuse-ld=lld"
178 183 
179%cmake \184%cmake \
180 -GNinja \185 -GNinja \
@@ -192,13 +197,12 @@ files for developing applications that use JavaScript engine from webkit2gtk-4.1
192 -DENABLE_GAMEPAD=OFF \197 -DENABLE_GAMEPAD=OFF \
193%endif198%endif
194%if 0%{?openEuler}199%if 0%{?openEuler}
195-%ifarch aarch64 200+%ifarch aarch64
196 -DUSE_64KB_PAGE_BLOCK=ON \201 -DUSE_64KB_PAGE_BLOCK=ON \
197%endif202%endif
198-%ifarch riscv64
199- -DENABLE_JIT=OFF \
200- -DUSE_SYSTEM_MALLOC=ON \
201%endif203%endif
204+%ifarch aarch64 loongarch64 riscv64
205+ -DENABLE_JIT=OFF \
202%endif206%endif
203%ifarch loongarch64207%ifarch loongarch64
204 -DCMAKE_C_FLAGS="$RPM_OPT_FLAGS -DSIMDE_FLOAT16_API=1" \208 -DCMAKE_C_FLAGS="$RPM_OPT_FLAGS -DSIMDE_FLOAT16_API=1" \
@@ -211,6 +215,17 @@ files for developing applications that use JavaScript engine from webkit2gtk-4.1
211%install215%install
212%cmake_install216%cmake_install
213 217 
218+# The bundled mimalloc (used by default on aarch64 with 64KB pages and on
219+# riscv64) is linked statically into libbmalloc as an object library, but its
220+# unconditional install() rules spill headers and build-system files into the
221+# buildroot which nothing packages. Drop them.
222+%ifarch aarch64 riscv64
223+rm -rf %{buildroot}%{_includedir}/mimalloc-*
224+rm -rf %{buildroot}%{_libdir}/mimalloc-*
225+rm -rf %{buildroot}%{_libdir}/cmake/mimalloc-*
226+rm -f %{buildroot}%{_libdir}/pkgconfig/mimalloc.pc
227+%endif
228+ 
214%find_lang WebKitGTK-4.1229%find_lang WebKitGTK-4.1
215 230 
216# Finally, copy over and rename various files for %%license inclusion231# Finally, copy over and rename various files for %%license inclusion
@@ -283,6 +298,10 @@ files for developing applications that use JavaScript engine from webkit2gtk-4.1
283%endif298%endif
284 299 
285%changelog300%changelog
301+* Thu Sep 17 2026 Funda Wang <fundawang@yeah.net> - 2.54.0-1
302+- update to 2.54.0, drop upstreamed CVE-2026-78376 CVE-2026-83596 patches
303+- add gstreamer-mpegts build requirement (required for video since 2.54.0)
304+ 
286* Tue Sep 01 2026 lingsheng <ultra_planet@qq.com> - 2.52.6-2305* Tue Sep 01 2026 lingsheng <ultra_planet@qq.com> - 2.52.6-2
287- fix CVE-2026-78376 CVE-2026-83596306- fix CVE-2026-78376 CVE-2026-83596
288 307 
Mwebkitgtk6_0.spec+26-7
@@ -1,5 +1,7 @@
1%undefine __cmake_in_source_build1%undefine __cmake_in_source_build
2 2 
3+%global _cmake_module_linker_flags_extra "-fuse-ld=lld"
4+ 
3# Filter out provides for private libraries5# Filter out provides for private libraries
4%global __provides_exclude_from ^(%{_libdir}/webkitgtk-6\\.0/.*\\.so)$6%global __provides_exclude_from ^(%{_libdir}/webkitgtk-6\\.0/.*\\.so)$
5 7 
@@ -22,8 +24,8 @@
22%bcond_with gamepad24%bcond_with gamepad
23 25 
24Name: webkitgtk6.026Name: webkitgtk6.0
25-Version: 2.52.627+Version: 2.54.0
26-Release: 228+Release: 1
27Summary: GTK web content engine library29Summary: GTK web content engine library
28License: BSD-3-Clause AND LGPL-2.0-or-later30License: BSD-3-Clause AND LGPL-2.0-or-later
29URL: https://www.webkitgtk.org/31URL: https://www.webkitgtk.org/
@@ -33,13 +35,12 @@ Patch1000: webkitgtk-add-loongarch-and-sw.patch
33# clang 17 has bug on Wunsafe-buffer-usage, disable it for now35# clang 17 has bug on Wunsafe-buffer-usage, disable it for now
34Patch1001: webkitgtk-2.52.0-drop-Wunsafe-buffer-usage.patch36Patch1001: webkitgtk-2.52.0-drop-Wunsafe-buffer-usage.patch
35 37 
36-Patch6000: backport-CVE-2026-78376.patch
37-Patch6001: backport-CVE-2026-83596.patch
38- 
39#Dependency38#Dependency
40BuildRequires: bison39BuildRequires: bison
41BuildRequires: bubblewrap40BuildRequires: bubblewrap
42-BuildRequires: clang41+BuildRequires: llvm-toolset-21
42+BuildRequires: llvm-toolset-21-clang
43+BuildRequires: llvm-toolset-21-lld
43BuildRequires: cmake44BuildRequires: cmake
44BuildRequires: flex45BuildRequires: flex
45BuildRequires: flite-devel >= 2.246BuildRequires: flite-devel >= 2.2
@@ -75,6 +76,7 @@ BuildRequires: pkgconfig(gbm)
75BuildRequires: pkgconfig(glib-2.0)76BuildRequires: pkgconfig(glib-2.0)
76BuildRequires: pkgconfig(gobject-introspection-1.0)77BuildRequires: pkgconfig(gobject-introspection-1.0)
77BuildRequires: pkgconfig(gstreamer-1.0)78BuildRequires: pkgconfig(gstreamer-1.0)
79+BuildRequires: pkgconfig(gstreamer-mpegts-1.0)
78BuildRequires: pkgconfig(gstreamer-plugins-base-1.0)80BuildRequires: pkgconfig(gstreamer-plugins-base-1.0)
79BuildRequires: pkgconfig(gtk4)81BuildRequires: pkgconfig(gtk4)
80BuildRequires: pkgconfig(harfbuzz)82BuildRequires: pkgconfig(harfbuzz)
@@ -170,9 +172,12 @@ files for developing applications that use JavaScript engine from webkitgtk-6.0.
170%autosetup -p1 -n webkitgtk-%{version}172%autosetup -p1 -n webkitgtk-%{version}
171 173 
172%build174%build
175+export PATH="/opt/%{_vendor}/llvm-toolset-21/root/usr/bin/:$PATH"
176+%global optflags %(echo %{optflags} | sed 's/-fgcc-compatible//')
173%ifarch aarch64177%ifarch aarch64
174%global optflags %(echo %{optflags} | sed 's/-mbranch-protection=standard /-mbranch-protection=pac-ret /')178%global optflags %(echo %{optflags} | sed 's/-mbranch-protection=standard /-mbranch-protection=pac-ret /')
175%endif179%endif
180+export LDFLAGS="%{build_ldflags} -fuse-ld=lld"
176 181 
177%cmake \182%cmake \
178 -GNinja \183 -GNinja \
@@ -192,7 +197,6 @@ files for developing applications that use JavaScript engine from webkitgtk-6.0.
192%endif197%endif
193%ifarch aarch64 loongarch64 riscv64198%ifarch aarch64 loongarch64 riscv64
194 -DENABLE_JIT=OFF \199 -DENABLE_JIT=OFF \
195- -DUSE_SYSTEM_MALLOC=ON \
196%endif200%endif
197%if 0%{?openEuler}201%if 0%{?openEuler}
198%ifarch aarch64202%ifarch aarch64
@@ -209,6 +213,17 @@ files for developing applications that use JavaScript engine from webkitgtk-6.0.
209%install213%install
210%cmake_install214%cmake_install
211 215 
216+# The bundled mimalloc (used by default on aarch64 with 64KB pages and on
217+# riscv64) is linked statically into libbmalloc as an object library, but its
218+# unconditional install() rules spill headers and build-system files into the
219+# buildroot which nothing packages. Drop them.
220+%ifarch aarch64 riscv64
221+rm -rf %{buildroot}%{_includedir}/mimalloc-*
222+rm -rf %{buildroot}%{_libdir}/mimalloc-*
223+rm -rf %{buildroot}%{_libdir}/cmake/mimalloc-*
224+rm -f %{buildroot}%{_libdir}/pkgconfig/mimalloc.pc
225+%endif
226+ 
212%find_lang WebKitGTK-6.0227%find_lang WebKitGTK-6.0
213 228 
214# Finally, copy over and rename various files for %%license inclusion229# Finally, copy over and rename various files for %%license inclusion
@@ -275,6 +290,10 @@ files for developing applications that use JavaScript engine from webkitgtk-6.0.
275%endif290%endif
276 291 
277%changelog292%changelog
293+* Thu Sep 17 2026 Funda Wang <fundawang@yeah.net> - 2.54.0-1
294+- update to 2.54.0, drop upstreamed CVE-2026-78376 CVE-2026-83596 patches
295+- add gstreamer-mpegts build requirement (required for video since 2.54.0)
296+ 
278* Tue Sep 01 2026 lingsheng <ultra_planet@qq.com> - 2.52.6-2297* Tue Sep 01 2026 lingsheng <ultra_planet@qq.com> - 2.52.6-2
279- fix CVE-2026-78376 CVE-2026-83596298- fix CVE-2026-78376 CVE-2026-83596
280 299