Merge upstream/main (46525dbf2abb) — adopt libpas Windows is_symmetric

[Jarred-Sumner]

Merges 264 upstream commits (aac4aed4..46525dbf).

libpas Windows consolidation (WebKit#63762)

Adopts upstream's is_symmetric page-allocation design and pthread-stub hardening; drops our overlapping patches. Kept on top:

• is_exiting flag (FLS destructor ordering — upstream's FlsAlloc change re-exposes the (void*)1 sentinel deref otherwise)
• RtlDllShutdownInProgress guard (ExitProcess scavenger-lock hang)
• pas_thread_suspender / embedder_thread_handle plumbing
• decommit_allocator_range widened to LINUX/WINDOWS (upstream still Darwin-only)
• compact-heap lazy-commit (~120 MB Windows startup commit-charge save)
• static BOOL WINAPI on once_init_runner

JSC

• JSPromiseReaction split into JSSlim/JSFull — adapted BUN async-context path to use upstream's slim selection when no context is captured; when carrying context, normalize non-callable handlers to jsUndefined() at creation (tag-check at dispatch instead of isCallable()).
• Module loader: kept iterative innerModuleLoading drain; adopted upstream's hostLoadImportedModule(..., state, ...) shape and setStatus() rename.
• 12 trivial include-order conflicts resolved in our quoted-include style.

Bun PR: oven-sh/bun (jarred/webkit-upgrade-46525dbf2abb)

[coderabbitai]

Walkthrough

Moves a mac preset option into the hidden mac base preset and adds a mac debug-O3 preset; bumps a version constant; adjusts Xcode project paths; adds many JS microbenchmarks, stress and Wasm tests; and introduces extensive LayoutTests (new tests and expectation updates), imported WPT additions, and numerous test-harness timing/synchronization tweaks.

Changes

Cohort / File(s)	Summary
Build & Xcode configs CMakePresets.json, Configurations/Version.xcconfig, Configurations/WebKitProjectPaths.xcconfig	Moves ENABLE_EXPERIMENTAL_FEATURES=OFF to hidden mac preset; adds mac-dev-debug-o3 configure/build presets; updates binaryDir and C/C++ debug flags; bumps TINY_VERSION 14→16; adjusts WEBCORE_TEST_SUPPORT_DIR_Engineering.
Source example Introduction.md	Replaces jsCast<JSStyleSheet*> with downcast<JSStyleSheet> in example.
JS microbenchmarks JSTests/microbenchmarks/*.js	Adds multiple microbenchmarks (Map/Set iteration, Intl constructors, String.padEnd, Object.create, etc.).
JS stress tests JSTests/stress/*.js	Adds many stress/regression tests covering iterators, optional chaining, regexp v-flag, object-create edge cases, and other DFG/DFG-fast-path scenarios.
Wasm stress tests JSTests/wasm/stress/*.js	Adds wasm stress cases targeting bounds/const-expr instantiation errors.
Test262 config JSTests/test262/config.yaml	Adds one Test262 skip entry for an Intl-related file.
LayoutTests: expectations LayoutTests/TestExpectations	Massive expectations update: many passes/failures/skips adjusted across scrolling/scroll-snap, filters, webgl/webgpu, timeouts/flakes, and other areas.
LayoutTests: accessibility LayoutTests/accessibility/...	Adds canvas drawFocusIfNeeded tests (with transforms and object-fit) and mac accessibility expected-output updates exposing text-marker attributes.
LayoutTests: many new/modified tests LayoutTests/**/*	Hundreds of new/updated HTML/JS/expected files across animations, compositing, editing, events, lists, touch/iOS touch-region suites, images, repaint, selectors, shadow DOM, tables, fullscreen, mediastream, promises, and more; many tests change completion timing and synchronization.
HTTP / navigation / security tests LayoutTests/http/tests/**/*	Adds CSP iframe-srcdoc import-bypass test and helper resource; adjusts many tests to clear memory cache and/or defer testRunner.notifyDone() via asynchronous tick; updates navigation/XFrameOptions expectations.
Site-isolation resources & tests LayoutTests/http/tests/site-isolation/*, .../resources/*	Adds cross-origin focus/type tests and an iframe text-input helper resource.
Imported WPTs & resources LayoutTests/imported/w3c/**	Adds and expands many WPT files and reference reftests (scroll-snap suite, CSS floats, anchor-position, flexbox, color-scheme, credential-management changes); updates resource lists and import expectations (e.g., skip file-system-access).
WPT feature maps .../WEB_FEATURES.yml, .../resource-files.json, .../import-expectations.json	Adds/updates WEB_FEATURES.yml entries and resource/import metadata for WPT test grouping and resource inclusion.
Test harness / timing fixes assorted LayoutTests/** HTML/JS	Widespread test-harness changes: replace sync notifyDone with setTimeout(..., 0), add requestAnimationFrame waits, waitForCompositor/scroll synchronization helpers, guards to avoid double completion, and other timing adjustments.

[coderabbitai]

Actionable comments posted: 77

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (3)

LayoutTests/fast/repaint/backgroundSizeRepaint.html (1)

4-23: ⚠️ Potential issue | 🟡 Minor

Add <title> to the <head> element.

The HTML file is missing a required <title> element in the <head> section, which static analysis flags as a linting violation. Add a descriptive title such as <title>Background-size repaint test</title> after the opening <head> tag.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@LayoutTests/fast/repaint/backgroundSizeRepaint.html` around lines 4 - 23, The
head element is missing a required <title>, causing a lint violation; add a
title element (for example "Background-size repaint test") immediately after the
opening <head> tag so the document has a descriptive title and the lint check
passes—locate the <head> in the file containing the existing <style> and
<script> blocks and insert the <title> element there.

LayoutTests/imported/w3c/web-platform-tests/css/css-scroll-snap/no-snap-position.html (1)

47-49: ⚠️ Potential issue | 🟠 Major

Bug: Use style.scrollSnapAlign instead of direct property assignment.

Line 48 assigns to target.scrollSnapAlign which sets an arbitrary property on the element object, not the CSS style. This should use target.style.scrollSnapAlign to match the pattern used elsewhere in this file (lines 66, 68, 76).

🐛 Proposed fix

   for (const target of document.querySelectorAll(".child")) {
-    target.scrollSnapAlign = "start none";
+    target.style.scrollSnapAlign = "start none";
   }

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In
`@LayoutTests/imported/w3c/web-platform-tests/css/css-scroll-snap/no-snap-position.html`
around lines 47 - 49, The loop that iterates over elements from
document.querySelectorAll(".child") incorrectly assigns to the DOM property
target.scrollSnapAlign (which just creates an arbitrary property); change this
to assign to the element's style: use target.style.scrollSnapAlign = "start
none" inside the same for (const target of document.querySelectorAll(".child"))
loop so the CSS is actually applied and matches the pattern used by other lines
(e.g., where style.scrollSnapAlign is used).

LayoutTests/imported/w3c/resources/resource-files.json (1)

7125-12834: 🧹 Nitpick | 🔵 Trivial

resource-files.json — JSON valid; consider flattening nested arrays

• File: LayoutTests/imported/w3c/resources/resource-files.json
• JSON syntax is valid.
• Sampled new resource paths exist in the repository.
• Top-level JSON currently contains two sub-arrays; naive, line-based duplicate checks can emit literal "[" / "]" artifacts — flatten to a single array if your tooling expects a flat list.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@LayoutTests/imported/w3c/resources/resource-files.json` around lines 7125 -
12834, The top-level JSON in resource-files.json currently has two nested arrays
which can break tools expecting a single flat array; open
LayoutTests/imported/w3c/resources/resource-files.json, locate the top-level
array that contains two sub-arrays (look for the duplicated leading "["/"]"
groups and the listed entries like "web-platform-tests/..."), and merge those
nested arrays into one flat array: remove the extra bracket boundaries, ensure
proper commas between entries, remove any accidental literal "[" or "]" tokens,
and validate the resulting JSON so the file becomes a single top-level array of
strings.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@JSTests/stress/optional-chaining-in-condition-context.js`:
- Around line 373-377: The function testThis uses optional chaining on this
(this?.x) and must run in strict mode to avoid sloppy-mode this coercion; modify
the function testThis so its body begins with a "use strict" directive (i.e.,
add the strict-mode directive as the first statement inside testThis) so that
testThis.call(null) and testThis.call(undefined) treat this as undefined and the
optional chaining behaves deterministically.

In `@JSTests/wasm/stress/const-expr-evaluate-error-offset.js`:
- Around line 21-23: The test currently allows a missing exception because it
only checks error?.message for the offset text; update the check around the
error variable (error) to first require that an error was thrown (throw a new
Error if error is falsy) and then validate that error.message contains "byte 27"
(replace the existing error?.message.indexOf check with a two-step: assert error
exists, then check error.message.indexOf('byte 27') === -1 and throw the
"evaluation error contains wrong offset" error if the substring is missing).

In
`@LayoutTests/accessibility/canvas-drawFocusIfNeeded-bounds-with-object-fit.html`:
- Around line 21-38: The test currently hardcodes an 8px page origin when
computing expectedPageX/Y for verifyCanvasFocusBounds, which makes it fragile;
update the test to query the canvas's page origin (as done in
canvas-drawFocusIfNeeded-bounds.html) from the canvas AX node or its
boundingClientRect and add that origin to the computed canvas-local focus
coordinates before passing expectedPageX and expectedPageY into
verifyCanvasFocusBounds (keep the same focusX/focusY/focusWidth/focusHeight and
variance), and remove the hardcoded 8px offsets so the expected bounds are
derived from the actual canvas page position.

In
`@LayoutTests/accessibility/canvas-drawFocusIfNeeded-bounds-with-transform.html`:
- Around line 21-31: The test hard-codes the canvas page origin (using "8 +
...") making it brittle; update the test to compute expectedPageX/Y from the
canvas's accessibility (AX) origin instead of adding 8 manually: call into the
same helper used to measure the canvas or augment verifyCanvasFocusBounds
(referencing verifyCanvasFocusBounds, canvasId and canvasDescendantId) to return
the canvas page origin (AX origin) and then compute expectedPageX =
canvasPageOrigin.x + focusX * deviceScale and expectedPageY = canvasPageOrigin.y
+ focusY * deviceScale (keeping expectedWidth/Height scaled similarly), and
replace the hard-coded expressions with those computed values so changes to body
margins or harness styles won't break the test.

In
`@LayoutTests/accessibility/mac/index-for-text-marker-on-non-webarea-element.html`:
- Around line 1-6: Add basic HTML metadata by setting a lang attribute on the
<html> element and adding a <title> element inside the <head>; update the
document root (<html>) to include lang="en" (or appropriate language tag) and
insert a <title> (e.g., "Accessibility test: text marker on non-webarea
element") as the first child of <head> to improve HTML compliance.

In `@LayoutTests/animations/animation-apply-pending-animation-crash.html`:
- Around line 9-18: The test currently relies on the implicit window.map named
property and uses invalid self-closing <map/> markup; update the markup to a
proper element (<map id="map"></map>) and explicitly grab the element in script
(e.g., const mapEl = document.getElementById("map")) instead of relying on the
global named property, then use that reference when calling mapEl.animate(...)
and anywhere else (animation, KeyframeEffect, main) so no implicit globals are
used.

In `@LayoutTests/editing/inserting/insert-list-then-edit-command-crash.html`:
- Around line 16-23: Guard the call to testRunner.notifyDone in the
window.onload callback by checking for the presence of window.testRunner (or
testRunner) before invoking notifyDone; locate the window.onload handler and
update the final step where testRunner.notifyDone() is called to only call it if
window.testRunner exists (e.g., if (window.testRunner)
window.testRunner.notifyDone()), ensuring no unconditional reference to
testRunner in the onload/requestAnimationFrame/setTimeout sequence.

In `@LayoutTests/fast/css/resize-corner-over-child-layer.html`:
- Around line 1-3: Add missing standards metadata so the test runs in standards
mode: insert a proper HTML5 doctype at the top (<!DOCTYPE html>), ensure the
<html> element has a lang attribute (e.g. lang="en"), and add minimal head
metadata including a <meta charset="utf-8"> and a <title> inside the existing
<head> block; apply the same changes to the other occurrence referenced (line
41) so both test files use standards mode.
- Around line 21-23: The early return when window.eventSender is falsy currently
produces no output; change it so the test explicitly marks itself skipped
instead of exiting silently — e.g., detect if window.eventSender is unavailable,
set a clear result string (such as document.body.textContent = "SKIPPED:
eventSender unavailable" or call layoutTestController?.notifyDone/dumpAsText
with a skip message if available) and then return; reference the
window.eventSender check in your patch and ensure the skip message is written
before the function returns.

In `@LayoutTests/fast/css/vertical-text-overflow-ellipsis-text-align-center.html`:
- Line 37: The <img> elements (e.g., <img src="resources/greenbox.png"> inside
the <div class="testDiv"> and the three other occurrences) are missing alt
attributes; update each <img> to include an empty alt attribute alt="" since
these are decorative test images (apply the same change for the other
occurrences referenced in the comment). Ensure you only add alt="" (not
descriptive text) so layout tests and accessibility expectations for decorative
images are preserved.

In `@LayoutTests/fast/events/event-disconnected-target.html`:
- Line 8: The test description string passed to description(...) contains a
grammar typo "a event" — update it to "an event" in the test (the
description(...) call in event-disconnected-target.html) and also update the
corresponding output file event-disconnected-target-expected.txt so the expected
text matches the new description string.

In `@LayoutTests/fast/events/tabindex-no-focusable-all-negative.html`:
- Around line 8-17: The test currently checks only for window.testRunner but
then calls eventSender.keyDown, which will throw if eventSender is missing;
update the test to also guard for eventSender (e.g., check window.eventSender or
typeof eventSender !== "undefined") and return early if it's not present, then
proceed to use eventSender.keyDown for both the tab and shift-tab cases after
the guard; ensure the guard surrounds the section that references
elem_focusme.focus(), eventSender.keyDown("\t"), and eventSender.keyDown("\t",
["shiftKey"]) so both calls are protected.
- Line 1: Add an HTML5 doctype as the very first line of the document to prevent
quirks-mode focus behavior; specifically, insert <!DOCTYPE html> before the
existing <script src="../../resources/js-test.js"></script> tag in
tabindex-no-focusable-all-negative.html so the page renders in standards mode
and keyboard focus traversal behaves consistently across ports.

In `@LayoutTests/fast/events/tabindex-no-focusable.html`:
- Line 1: Add a standards-mode DOCTYPE at the very top of the file by inserting
<!DOCTYPE html> as the first line before the existing content (e.g. before the
existing <script src="../../resources/js-test.js"></script> tag) so the test
runs in standards mode instead of quirks mode.
- Around line 8-18: The test assumes eventSender exists but only guards
testRunner; update the test to guard the eventSender before synthesizing Tab
events by checking window.eventSender (or if (!window.eventSender) return) and
only calling eventSender.keyDown(...) when eventSender is present; locate the
keyDown usages on eventSender in the current test (the two calls near
elem_focusme.focus()) and wrap or short-circuit around them so the test won't
throw if eventSender is unavailable.

In
`@LayoutTests/fast/events/touch/ios/touch-event-regions-layer-tree/dblclick-columns.html`:
- Around line 3-22: Add a lang attribute to the root <html> element (e.g., <html
lang="en">) and add a <title> element inside the <head> (e.g.,
<title>Double-click columns test</title>) so the document passes HTMLHint; place
the <title> before or directly after the existing <style> block in the head
where prepareForTest() and window.addEventListener('load', dumpRegions, false)
are defined.

In
`@LayoutTests/fast/events/touch/ios/touch-event-regions-layer-tree/dblclick-document.html`:
- Around line 3-10: The HTML root is missing a lang attribute and the document
head lacks a title; update the <html> element to include an appropriate lang
(e.g., "en") and add a <title> element inside the <head> (above or below the
script tags) so the document has proper metadata; you can locate this change
near the prepareForTest() and window.addEventListener('load', dumpRegions,
false) code in the head.

In
`@LayoutTests/fast/events/touch/ios/touch-event-regions-layer-tree/dblclick-iframes.html`:
- Line 3: Add missing document metadata and accessible names: set the lang
attribute on the <html> element (e.g., lang="en"), add a minimal <head>
containing a <title> element for the document, and add title attributes to each
<iframe> element (unique descriptive titles or identical test-safe titles) so
HTML/a11y linting passes; edit the <html>, <head>/<title> and each <iframe> tag
in the file (and the other listed locations) to make these changes without
altering test behavior.

In
`@LayoutTests/fast/events/touch/ios/touch-event-regions-layer-tree/dblclick-window.html`:
- Around line 3-10: Add a document language and a title to satisfy HTML lint
rules: update the <html> element to include a lang attribute (e.g., lang="en")
and add a <title> element inside the <head> (for example a short descriptive
title) while keeping the existing scripts and calls to prepareForTest() and
window.addEventListener('load', dumpRegions, false) unchanged.

In
`@LayoutTests/fast/events/touch/ios/touch-event-regions-layer-tree/mousemove-mouseup.html`:
- Around line 2-14: Add the required HTML metadata by adding a lang attribute to
the <html> tag (e.g., lang="en") and including a <title> element inside the
<head> (e.g., <title>Mousemove Mouseup Test</title>) so the document meets
linting rules; update the existing <html> and <head> in the file where those
elements are defined.

In `@LayoutTests/fast/loader/navigate-on-pageswap-crash.html`:
- Around line 1-2: The test HTML is missing an explicit doctype which can cause
quirks-mode parsing; add the HTML5 doctype declaration <!DOCTYPE html> as the
very first line of navigate-on-pageswap-crash.html (before any comments or
script tags) so the test runs in deterministic standards mode across
parser/layout changes.
- Around line 6-18: The test currently calls testRunner?.notifyDone() when
sessionStorage.testCompleted is set, but then continues executing crash-repro
code (creating audio, setting onpageswap, etc.); change control flow so that
when the "completed" branch runs (sessionStorage.testCompleted truthy) the
function returns immediately after calling testRunner?.notifyDone() (or
otherwise skips the rest of the test), ensuring the crash path (else branch that
sets sessionStorage.testCompleted, awaits navigation.reload(), and later sets
onpageswap/navigate) only runs on the second pass; update the code around
sessionStorage.testCompleted, testRunner?.notifyDone(), navigation.reload(), and
onpageswap to enforce this early exit.

In `@LayoutTests/fast/repaint/backgroundSizeRepaint.html`:
- Around line 17-19: Replace the nested requestAnimationFrame synchronization
used before calling testRunner.notifyDone() with a post-layout observer: stop
using requestAnimationFrame and instead create a ResizeObserver (or equivalent
observer) that observes the element under test and resolves when it fires, then
disconnect the observer and call testRunner.notifyDone(); locate the current
await new Promise(requestAnimationFrame) and testRunner.notifyDone() calls and
swap them so the test waits for ResizeObserver callback rather than RAF to
ensure post-paint stability.

In
`@LayoutTests/fast/shadow-dom/slot-display-contents-composed-tree-after-display-toggle.html`:
- Around line 1-4: Add an HTML5 doctype to ensure the test runs in standards
mode: insert <!DOCTYPE html> as the very first line of the file so the script
using window.testRunner and testRunner.dumpAsText() executes under
standards-mode layout/composed-tree instead of quirks mode.

In `@LayoutTests/fullscreen/fullscreen-clears-hover-on-overlay.html`:
- Around line 55-65: Replace the fixed setTimeout(…, 300) delay with an
event-driven wait: listen for the actual fullscreen/layout completion event
(e.g., the document's "fullscreenchange" or the overlay's relevant
"transitionend"/"animationend") and run the assertions there; specifically, move
the calls to testExpected("overlayReceivedLeave", true) and
testExpected("fsBtn.style.backgroundColor", "") and endTest() into the event
handler, remove the hardcoded timer (the setTimeout block), and ensure the
handler removes itself after firing so the test completes deterministically.

In
`@LayoutTests/http/tests/css/prefers-color-scheme-in-nested-iframes-follows-system-preference.html`:
- Around line 117-122: Comment typo: change "preferrence" to "preference" in the
two comments surrounding the test runs. Update the comment before the light test
("// Light system preference.") and the comment before the dark test ("// Dark
system preference.") near the run_tests(false, expectedLightColor) and
expectedDarkColor declarations so the spelling is corrected.

In
`@LayoutTests/http/tests/lockdown-mode/svg-with-unsupported-font-does-not-crash.html`:
- Around line 2-4: Add missing HTML metadata and accessibility attributes: set a
lang attribute on the <html> element (e.g., lang="en"), add a <title> element
inside the <head> (e.g., <title>Test: SVG with unsupported font</title>), and
include a descriptive alt attribute on the <img> tag (e.g., alt="Rendered SVG
with unsupported font") to resolve the lint failures referencing the <html>,
<title>, and <img> elements.
- Around line 15-21: The test currently calls testPassed and finishJSTest
unconditionally inside test() and uses a static <img> so it can false-pass;
change test() to create or select the image element and attach explicit load and
error handlers (use the image's onload to call testPassed("SVG loaded") and
onerror to call testFailed or testFailedWithMessage and then in each handler
call finishJSTest()) instead of calling testPassed immediately; update
references in test() to the image element (the <img> or Image() instance) to
ensure the assertion reflects the actual load result.

In
`@LayoutTests/http/tests/security/contentSecurityPolicy/iframe-srcdoc-import-bypass.html`:
- Around line 59-60: Both iframe elements (ids iframe1 and iframe2) are missing
accessible names; add descriptive title attributes to each iframe tag (e.g.,
title="..." for iframe1 and title="..." for iframe2) so screen readers have an
accessible name; update the elements referenced by id iframe1 and iframe2 to
include appropriate, concise titles that describe their purpose or content.
- Around line 2-6: Add the missing document language and title metadata by
adding a lang attribute to the <html> element and adding a <title> element
inside the <head>; specifically update the <html> tag to include lang="en" (or
appropriate locale) and insert a descriptive <title>...</title> within the
<head> near the existing <meta> so the document has both language and title
metadata.
- Around line 17-22: Tighten validation in reportResult and the message event
handler so only known iframe IDs affect test state: update
reportResult(iframeId, loaded) to explicitly handle "iframe1" and "iframe2" (do
not default all other values to iframe2Loaded and do not increment
resultsReceived for unknown ids), and change the postMessage listener that
currently checks only event.data.type === "import-result" to also validate
event.data.iframeId is either "iframe1" or "iframe2" before calling
reportResult; this prevents unknown or malicious payloads from changing
resultsReceived.

In
`@LayoutTests/http/tests/security/XFrameOptions/x-frame-options-ignore-deny-meta-tag-in-body.html`:
- Line 18: The deferred call to testRunner.notifyDone() can throw when the test
harness is absent; wrap the setTimeout call in a guard that checks for the
presence of the testRunner (e.g., typeof testRunner !== 'undefined' or
window.testRunner) before scheduling notifyDone so the delayed callback only
runs when testRunner exists and won’t error when the test runs outside the
harness.

In
`@LayoutTests/http/tests/security/XFrameOptions/x-frame-options-ignore-deny-meta-tag.html`:
- Line 18: The call to testRunner.notifyDone() is unguarded and can throw when
the test harness is absent; update the deferred call in the setTimeout and any
use inside checkIfDone() to first verify the harness exists (e.g., check typeof
testRunner !== 'undefined' or testRunner && typeof testRunner.notifyDone ===
'function') before invoking testRunner.notifyDone(), so deferred notify is only
called when the harness is present.

In `@LayoutTests/http/tests/site-isolation/focus-wrap-across-remote-frames.html`:
- Around line 2-30: Add missing accessibility attributes: add a lang attribute
to the <html> element, provide a label for the input with id "outerInput"
(either a <label for="outerInput"> or aria-label tied to that id), and give the
iframe with id "testIframe" an accessible name (e.g., title or aria-label) so
the test page is lint-clean; these changes will not affect
waitForActiveElementTagName but will satisfy HTML accessibility requirements for
outerInput and testIframe.
- Around line 33-57: The async runTest function can reject before calling
finishJSTest; wrap the entire body of runTest in a try/catch/finally so any
thrown/rejected promise is caught, call testFailed or log the error in catch
(including the caught error message) and ensure finishJSTest() is always invoked
in finally; keep existing awaits (UIHelper.setHardwareKeyboardAttached,
UIHelper.keyDown, waitForActiveElementTagName) and assertion calls inside the
try block so their failures are handled by the catch/finally.

In `@LayoutTests/http/tests/site-isolation/resources/text-input.html`:
- Around line 2-4: Add a language attribute on the root html element and an
accessible label for the input element: update the <html> tag to include a lang
(e.g., lang="en") and add a <label for="target">Text input</label> (or
visually-hidden label) that references the existing input id="target" so the
input is properly labeled for HTMLHint.
- Around line 6-20: Add defensive validation around the message handler
registered with window.addEventListener to avoid assuming event.data.type exists
and the DOM element is present: check that event && typeof event.data ===
"object" && typeof event.data.type === "string" before branching on
event.data.type, validate event.origin (or restrict allowed origins) before
calling window.parent.postMessage when appropriate, and guard DOM access from
getElementById("target") by confirming the returned element is non-null before
calling getBoundingClientRect() or reading .value; update the branches handling
"getInputRect" and "getInputValue" accordingly in the message handler.

In `@LayoutTests/http/tests/site-isolation/type-in-cross-origin-iframe.html`:
- Around line 2-6: Add missing document metadata and accessible iframe naming:
add a lang attribute to the <html> element, add a <title> element inside the
<head>, and give the iframe(s) an accessible name (e.g., a title attribute or
aria-label) to satisfy HTMLHint rules; locate the <html> tag, the <head> block
(where to insert the <title>), and the <iframe> elements in this file (and the
related occurrences at lines noted) and update them accordingly.
- Around line 25-29: The event listener added with window.addEventListener
currently uses the { once: true } option which unsubscribes on the first message
and can hang the promise if that message isn't type "inputRect"; change this to
register a named/closure listener without { once: true } and inside the listener
check if event.data.type === "inputRect", call resolve(event.data) and then
explicitly remove the listener via removeEventListener; ensure the postMessage
call to iframe.contentWindow.postMessage remains and that the listener removal
only happens after a matching "inputRect" is received.
- Around line 12-18: Scope the "inputValue" message handler to only accept
messages from the test iframe by verifying event.source matches the iframe's
contentWindow before processing: obtain the test iframe element used in this
test (e.g., the iframe variable/name in this file) and add a guard like if
(event.source !== iframe.contentWindow) return; then proceed to set
window.typedValue, call shouldBeEqualToString("typedValue", "hello") and
finishJSTest(); apply the same source check to the "inputRect" listener (even
though it uses { once: true }) to prevent unrelated messages from affecting the
test.

In
`@LayoutTests/http/tests/workers/service/resources/postmessage-after-sw-process-crash.js`:
- Around line 4-8: The guard variable didFinish must be set on every exit path
and set before calling finishSWTest(); update the
navigator.serviceWorker.addEventListener("message", async function(event) { ...
}) handler so that on both failure branches (the early returns around the checks
at the beginning and the checks later) you set didFinish = true immediately
before returning, and in the success/PASS branch set didFinish = true before
calling finishSWTest(); apply the same change for the other finish block around
lines 39-42 so all paths flip didFinish before terminating.

In `@LayoutTests/http/tests/xmlhttprequest/abort-should-cancel-load.html`:
- Line 23: The setTimeout callback calls testRunner.notifyDone() unguarded,
which throws when the test harness is absent; change the callback to check for
window.testRunner before invoking notifyDone (e.g., wrap the call with if
(window.testRunner) window.testRunner.notifyDone()) so that setTimeout(... )
still schedules but only calls notifyDone when window.testRunner exists.

In
`@LayoutTests/http/wpt/html/browsers/browsing-the-web/navigating-across-documents/navigating-iframe-sandbox.html`:
- Line 20: The retry loops use the pre-incremented condition "++counter < 50"
which only runs 49 times; update the condition to use "<= 50" (i.e. "++counter
<= 50") in both occurrences so the loops perform 50 retries (adjust the same
condition found in the two loops using the variable "counter").

In `@LayoutTests/http/wpt/service-workers/third-party-registration.html`:
- Line 33: The failure message in the logAndFinishTest call
(logAndFinishTest(`FAIL ancestorOriginsData[0] is "${ancestorOriginsData[0]}"
instead of localhost:8801`)) mismatches the asserted expected origin; update the
string to include the full expected origin "http://localhost:8801" (e.g. change
the trailing text to instead of http://localhost:8801) so the error message
matches the actual assertion.

In
`@LayoutTests/imported/w3c/web-platform-tests/credential-management/credentialscontainer-get-basics.https.html`:
- Around line 59-77: The current loop over invalidCombinations makes failures
opaque; change it so each invalid case is tested and labeled individually by
replacing the single bulk await promise_rejects_dom loop with per-case tests:
for each entry in invalidCombinations create a promise_test (or call
t.step/promise_rejects_dom with a descriptive message) that invokes
navigator.credentials.get(options) and asserts NotSupportedError via
promise_rejects_dom; reference the invalidCombinations array and use the index
or a short JSON/stringified summary of each options object in the test name so
failing combinations are reported clearly (symbols to update:
invalidCombinations, promise_rejects_dom, navigator.credentials.get).

In
`@LayoutTests/imported/w3c/web-platform-tests/css/css-anchor-position/position-visibility-anchor-visible.html`:
- Around line 27-28: The CSS contains duplicate position-visibility declarations
("position-visibility: always;" followed by "position-visibility:
anchor-visible;") so the second overrides the first; remove the redundant
"position-visibility: always;" declaration (or if the duplicate is intentional
to test cascade behavior, retain both but add an inline comment clarifying the
test intent next to the pair) so the intent is explicit and there is no
accidental dead/overridden rule.
- Around line 3-6: Update the CSS declaration that currently reads
"position-visibility: anchor-visible;" to the correct spec value
"position-visibility: anchors-visible;" so it matches the test metadata (the
meta assert "Position-visibility: anchors-visible") and the reference link; also
remove or consolidate the duplicate position-visibility declaration (the two
consecutive declarations around the same rule) so there is a single correct
"position-visibility: anchors-visible;" declaration that isn’t overridden by a
later duplicate.

In
`@LayoutTests/imported/w3c/web-platform-tests/css/css-images/gradient/gradient-analogous-missing-components-003.html`:
- Line 8: The fuzzy tolerance was widened by changing the meta tag content
"maxDifference=0-2;totalPixels=0-40000" which can mask regressions; update the
test to document the rationale by adding a short explanatory comment adjacent to
the meta tag (or a note in the PR description) that states why maxDifference was
increased (e.g., known cross-platform rendering variance on X platform or
specific gradient anti-aliasing flakiness) and include the identifying string
"meta name=\"fuzzy\" content=\"maxDifference=0-2;totalPixels=0-40000\"" so
future reviewers can see the justification.

In
`@LayoutTests/imported/w3c/web-platform-tests/css/css-scroll-snap/input/keyboard.html`:
- Around line 47-56: The initializeScrollPosition function currently wraps an
async executor inside new Promise (anti-pattern); remove the Promise constructor
and implement the logic using the async function directly: inside
initializeScrollPosition(scroller, x, y) await
waitForScrollEndFallbackToDelayWithoutScrollEvent(scroller) only when
scroller.scrollLeft != x || scroller.scrollTop != y after calling
scroller.scrollTo(x, y), then simply return (or return void) — reference
initializeScrollPosition and waitForScrollEndFallbackToDelayWithoutScrollEvent
to locate the code to change.

In
`@LayoutTests/imported/w3c/web-platform-tests/css/css-scroll-snap/input/mouse-wheel.html`:
- Around line 57-65: The test currently only awaits
waitForAnimationEnd(scrollTop) and asserts scroller.scrollTop ≈ 110, so it no
longer verifies the “no intermediate pause” behavior; update the test by either
(A) reintroducing an explicit intermediate-pause check: sample
scroller.scrollTop over time before waitForAnimationEnd (e.g. using a short
interval/timestamp loop) and assert there is no stable plateau before reaching
the final snap target, referencing the existing waitForAnimationEnd and
scrollStabilizedPromise variables, or (B) if you prefer to relax the test,
change the test title and assertion message (the final string passed to
assert_approx_equals and the test description) to remove the “without
intermediate pause” claim so the expectation matches the actual
final-position-only verification.

In
`@LayoutTests/imported/w3c/web-platform-tests/css/css-scroll-snap/input/paged.html`:
- Line 112: The line creating an implicit global "scrollTop = () =>
scroller.scrollTop" must be removed or made local; locate the assignment to the
symbol scrollTop and either delete it (preferred, since the function is never
called and other code uses scroller.scrollTop directly) or change it to a
properly declared local binding (e.g., const scrollTop = () =>
scroller.scrollTop) if you actually need the helper, ensuring you do not leak a
global variable.

In
`@LayoutTests/imported/w3c/web-platform-tests/css/css-scroll-snap/overscroll-snap.html`:
- Line 4: The meta tag uses a non-standard attribute "viewport" instead of the
HTML5-required name/content pair; update the meta element (the <meta ...> line)
to use name="viewport" and content="width=device-width, initial-scale=1" so
browsers recognize the viewport directive (keep it as a self-closing or standard
meta tag as appropriate).

In
`@LayoutTests/imported/w3c/web-platform-tests/css/css-scroll-snap/scroll-initial-target/parsing/scroll-initial-target-computed.html`:
- Line 2: The root html element is missing a lang attribute; update the <html>
start tag in the test file to include an appropriate lang value (e.g., "en") so
the document meets HTML linting and accessibility baselines—locate the opening
<html> tag in the file and add the lang attribute to that element.

In
`@LayoutTests/imported/w3c/web-platform-tests/css/css-scroll-snap/scroll-initial-target/scroll-initial-target-display-toggled.tentative.html`:
- Line 2: The <html> root element is missing a language attribute; update the
opening <html> tag (the HTML element in this file) to include an appropriate
lang value (e.g., lang="en") to meet accessibility requirements by editing the
<html> element declaration.

In
`@LayoutTests/imported/w3c/web-platform-tests/css/css-scroll-snap/scroll-initial-target/scroll-initial-target-nested-container.tentative.html`:
- Line 2: Add a lang attribute to the top-level <html> element to declare the
document language for accessibility (e.g., change <html> to <html lang="en"> or
the appropriate language tag); update the <html> element in the file so the root
element includes a valid BCP 47 language code.
- Around line 55-64: The HTML contains duplicate id="space-filler" in the nested
containers (inside the elements with id="outer-container" and
id="inner-container"), which is invalid; update the inner element to use a
unique id (e.g., id="space-filler-inner") or, better, replace both ids with a
shared class (e.g., class="space-filler") and move the existing `#space-filler`
CSS rules into a .space-filler rule (or add a .space-filler-inner rule with the
same styling) so selectors and any JS/CSS targeting the filler are updated to
the new id/class consistently while keeping the current layout behavior for
elements like large_space_outer, large_space_inner, and target.

In
`@LayoutTests/imported/w3c/web-platform-tests/css/css-scroll-snap/scroll-initial-target/scroll-initial-target-shadow-dom.tentative.html`:
- Line 2: Add a lang attribute to the <html> element in the document: locate the
<html> tag and update it to include an appropriate language code (e.g.,
lang="en") so the root element specifies the document language for accessibility
and screen readers.
- Around line 68-75: Two light-DOM elements use the same id "space" inside the
slot1scroller and slot2scroller nodes which creates duplicate IDs; change one or
both to unique identifiers or remove the id and rely on the existing "space"
class instead. Locate the two divs with id="space" inside the elements
referenced by slot1scroller and slot2scroller and either replace their id
attributes with distinct ids (e.g., space1/space2) or simply drop the id and use
the class "space" for styling/selection to avoid duplicate HTML IDs.

In
`@LayoutTests/imported/w3c/web-platform-tests/css/css-scroll-snap/scroll-initial-target/scroll-initial-target-span.tentative.html`:
- Line 2: The root HTML element (<html>) is missing a lang attribute; update the
root <html> tag in the document to include an appropriate language code (e.g.,
lang="en" or the document's actual language) so the element becomes <html
lang="..."> and ensure the value is correct for the document content to satisfy
metadata and lint checks.
- Line 5: The title element contains an unescaped closing angle bracket; update
the <title> text "CSS Scroll Snap 2 Test: scroll-initial-target with a <span>
element" to escape both angle brackets for the span (use &lt;span&gt;) so the
closing ">" is replaced with &gt;; locate the <title> tag in the file and modify
the text accordingly to satisfy HTML linting.
- Around line 48-49: The assertion message has a typo: change the string passed
to assert_equals that currently reads "scroller is initially scrolled to it
<span> scroll-initial-target" to use "its" instead of "it" so it reads "scroller
is initially scrolled to its <span> scroll-initial-target"; update the message
next to the assert_equals call comparing scroller.scrollTop and target.offsetTop
(the assertion in the test) accordingly.

In
`@LayoutTests/imported/w3c/web-platform-tests/css/css-scroll-snap/scroll-initial-target/scroll-initial-target-with-anchor-navigation.tentative.html`:
- Around line 31-32: The test currently asserts exact equality of
scroller.scrollTop to scroll_start_target_top which is flaky due to rounding;
change the assertion to an approximate comparison by comparing
scroller.scrollTop and scroll_start_target_top with a small tolerance (e.g.
Math.abs(scroller.scrollTop - scroll_start_target_top) <= allowedDelta) or use
the test harness's approximate assertion (e.g. assert_approx_equals) instead of
assert_equals so the initial scroll offset check tolerates minor rounding
differences.
- Line 18: The iframe element with id "frame" that loads
"scroll-initial-target-with-anchor-navigation-inner-frame.html" needs an
accessible name: add a descriptive title attribute (e.g., title="scroll initial
target test frame" or similar) to the <iframe id="frame" ...> element so
accessibility/lint checks pass; update the element where runTest() is invoked
onload to include the title attribute.

In
`@LayoutTests/imported/w3c/web-platform-tests/css/css-scroll-snap/scroll-initial-target/scroll-initial-target-with-hash-fragment-navigation.tentative.html`:
- Line 2: Add missing document/frame metadata: add a lang attribute to the
<html> element (update the existing <html> tag to include lang="en" or
appropriate language), give the unnamed <iframe> an accessible name (add a title
or aria-label to the <iframe> element referenced at the frame location), and
ensure the document ends with an explicit closing </html> tag; update the
<html>, <iframe>, and document footer accordingly so accessibility and lint
checks pass.

In
`@LayoutTests/imported/w3c/web-platform-tests/css/css-scroll-snap/scroll-initial-target/scroll-initial-target-with-scroll-snap.tentative.html`:
- Around line 1-79: The document is missing the closing </html> tag; add a final
</html> immediately after the existing </body> closing tag so the HTML document
is properly terminated (i.e., locate the </body> in the file and insert a
matching </html> closing tag after it).
- Around line 64-77: The test currently throws errors because the center element
ID/name and an operator are inconsistent: update the getElementById call and
variable usage so the center element is referenced consistently (use the same
identifier as the actual element, e.g., change
document.getElementById("center_box") to match the real ID or rename the element
to "center_box"), replace any undeclared uses of centerbox with the declared
center_box variable, and fix the expression for expected_scroll_left by adding
the missing '+' so the center box width is added to
top_left_box.getBoundingClientRect().width; locate symbols scroller,
top_left_box, center_box/centerbox, expected_scroll_top, and
expected_scroll_left to make these changes.

In
`@LayoutTests/imported/w3c/web-platform-tests/css/css-scroll-snap/scroll-initial-target/scroll-initial-target-with-scroll-start-root.tentative.html`:
- Line 66: The document opens an <html> root element but never closes it; add a
closing </html> tag at the end of the file (after the existing </body>) so the
root element is explicitly closed and the document has valid HTML structure.

In
`@LayoutTests/imported/w3c/web-platform-tests/css/CSS2/floats/float-avoids-float-with-margin-001.html`:
- Line 2: The HTML root element is missing a language attribute; update the
<html> tag in this document (the <html> start element) to include a suitable
lang attribute (e.g., lang="en" or the appropriate language code for the
content) so the element reads like <html lang="..."> to satisfy linting and
improve semantics.

In
`@LayoutTests/imported/w3c/web-platform-tests/css/CSS2/floats/float-avoids-float-with-margin-003-expected.html`:
- Line 2: Add a lang attribute to the root HTML element: update the <html>
element in the file (the HTML root tag) to include lang="en" (i.e., change
<html> to <html lang="en">) so the document includes a language declaration for
validators and accessibility.

In
`@LayoutTests/imported/w3c/web-platform-tests/css/CSS2/floats/float-avoids-float-with-margin-003-ref.html`:
- Line 2: Add the lang attribute to the root HTML element: update the <html> tag
(in the test reference file) to include lang="en" to improve conformance and
accessibility (e.g., change the <html> element in
float-avoids-float-with-margin-003-ref.html to include lang="en").

In
`@LayoutTests/imported/w3c/web-platform-tests/css/CSS2/floats/float-avoids-float-with-margin-005-expected.html`:
- Line 2: The HTML root element (<html>) is missing a lang attribute; add
lang="en" to the <html> tag (modify the <html> element in the file so it becomes
<html lang="en">) to improve accessibility and standards compliance while
keeping the rest of the WPT reference file unchanged.

In
`@LayoutTests/imported/w3c/web-platform-tests/css/CSS2/floats/float-avoids-float-with-margin-007-ref.html`:
- Line 2: Add a lang attribute to the root HTML element: update the <html> tag
in the test file (the document's root element) to include lang="en" so the
element reads <html lang="en"> to satisfy validators and improve metadata.

In
`@LayoutTests/imported/w3c/web-platform-tests/css/CSS2/floats/float-avoids-float-with-margin-008-expected.html`:
- Line 2: Update the root html element to include a language attribute for
conformance: modify the <html> tag in the file (the element shown as <html>) to
be <html lang="en"> so the document declares its primary language.

In
`@LayoutTests/imported/w3c/web-platform-tests/css/CSS2/floats/float-avoids-float-with-margin-012-expected.html`:
- Line 2: The root <html> element in the file is missing the required lang
attribute; update the <html> tag (the document root) to include an appropriate
language code (e.g., lang="en" or the document's actual language) so the element
reads <html lang="..."> to satisfy HTML linting and accessibility rules.

In
`@LayoutTests/imported/w3c/web-platform-tests/css/CSS2/floats/float-avoids-float-with-margin-012-ref.html`:
- Line 2: The HTML root element is missing a language declaration; update the
<html> element in float-avoids-float-with-margin-012-ref.html to include an
appropriate lang attribute (for example lang="en") so the document has valid
language metadata—ensure the lang is placed on the existing <html> tag (and add
xml:lang if required by project conventions).

In
`@LayoutTests/imported/w3c/web-platform-tests/css/CSS2/floats/float-avoids-float-with-margin-012.html`:
- Line 2: Add a lang attribute to the root HTML element (<html>) to set the
document language for standards and accessibility; update the <html> start tag
(the root element shown in the diff) to include an appropriate lang value (e.g.,
lang="en" or the document's language) so the root element declares the page
language.

In `@LayoutTests/TestExpectations`:
- Around line 5516-5517: Update the directory-level skip entry by adding a
trailing slash to the path string
"imported/w3c/web-platform-tests/css/css-scroll-snap/snap-events" referenced
under the "# Scroll snap events are not implemented" section in TestExpectations
so it becomes "imported/w3c/web-platform-tests/css/css-scroll-snap/snap-events/
[ Skip ]", making the skip explicitly apply to the directory.

---

Outside diff comments:
In `@LayoutTests/fast/repaint/backgroundSizeRepaint.html`:
- Around line 4-23: The head element is missing a required <title>, causing a
lint violation; add a title element (for example "Background-size repaint test")
immediately after the opening <head> tag so the document has a descriptive title
and the lint check passes—locate the <head> in the file containing the existing
<style> and <script> blocks and insert the <title> element there.

In `@LayoutTests/imported/w3c/resources/resource-files.json`:
- Around line 7125-12834: The top-level JSON in resource-files.json currently
has two nested arrays which can break tools expecting a single flat array; open
LayoutTests/imported/w3c/resources/resource-files.json, locate the top-level
array that contains two sub-arrays (look for the duplicated leading "["/"]"
groups and the listed entries like "web-platform-tests/..."), and merge those
nested arrays into one flat array: remove the extra bracket boundaries, ensure
proper commas between entries, remove any accidental literal "[" or "]" tokens,
and validate the resulting JSON so the file becomes a single top-level array of
strings.

In
`@LayoutTests/imported/w3c/web-platform-tests/css/css-scroll-snap/no-snap-position.html`:
- Around line 47-49: The loop that iterates over elements from
document.querySelectorAll(".child") incorrectly assigns to the DOM property
target.scrollSnapAlign (which just creates an arbitrary property); change this
to assign to the element's style: use target.style.scrollSnapAlign = "start
none" inside the same for (const target of document.querySelectorAll(".child"))
loop so the CSS is actually applied and matches the pattern used by other lines
(e.g., where style.scrollSnapAlign is used).

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

[coderabbitai]

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

wc -l JSTests/stress/optional-chaining-in-condition-context.js

Repository: oven-sh/WebKit

Length of output: 119

---

🏁 Script executed:

sed -n '365,385p' JSTests/stress/optional-chaining-in-condition-context.js

Repository: oven-sh/WebKit

Length of output: 668

---

🏁 Script executed:

sed -n '585,605p' JSTests/stress/optional-chaining-in-condition-context.js

Repository: oven-sh/WebKit

Length of output: 894

---

🏁 Script executed:

sed -n '1,50p' JSTests/stress/optional-chaining-in-condition-context.js

Repository: oven-sh/WebKit

Length of output: 1168

---

🏁 Script executed:

sed -n '585,605p' JSTests/stress/optional-chaining-in-condition-context.js

Repository: oven-sh/WebKit

Length of output: 894

---

🏁 Script executed:

grep -n "this\.x\|globalThis\.x\|window\.x" JSTests/stress/optional-chaining-in-condition-context.js

Repository: oven-sh/WebKit

Length of output: 40

---

🏁 Script executed:

sed -n '590,600p' JSTests/stress/optional-chaining-in-condition-context.js

Repository: oven-sh/WebKit

Length of output: 586

---

🏁 Script executed:

sed -n '360,410p' JSTests/stress/optional-chaining-in-condition-context.js

Repository: oven-sh/WebKit

Length of output: 1483

---

🏁 Script executed:

sed -n '370,400p' JSTests/stress/optional-chaining-in-condition-context.js | cat -n

Repository: oven-sh/WebKit

Length of output: 1121

---

🏁 Script executed:

sed -n '585,615p' JSTests/stress/optional-chaining-in-condition-context.js | cat -n

Repository: oven-sh/WebKit

Length of output: 1471

---

🏁 Script executed:

grep -n "^function\|^async function" JSTests/stress/optional-chaining-in-condition-context.js

Repository: oven-sh/WebKit

Length of output: 1323

---

🏁 Script executed:

cat -n JSTests/stress/optional-chaining-in-condition-context.js | sed -n '590,600p'

Repository: oven-sh/WebKit

Length of output: 663

---

🏁 Script executed:

rg "this\?\." JSTests/stress/optional-chaining-in-condition-context.js -B 5 -A 5

Repository: oven-sh/WebKit

Length of output: 349

---

🏁 Script executed:

rg "globalThis\.x|window\.x|\\.x\s*=" JSTests/stress/optional-chaining-in-condition-context.js

Repository: oven-sh/WebKit

Length of output: 175

---

🏁 Script executed:

grep -n "^\s*\(var\|let\|const\)\s\+x\|^\s*[a-zA-Z].*\.x\s*=" JSTests/stress/optional-chaining-in-condition-context.js

Repository: oven-sh/WebKit

Length of output: 116

---

🏁 Script executed:

head -20 JSTests/stress/optional-chaining-in-condition-context.js && echo "..." && tail -30 JSTests/stress/optional-chaining-in-condition-context.js

Repository: oven-sh/WebKit

Length of output: 1827

---

Add strict mode to testThis to prevent this coercion ambiguity.

In sloppy mode, .call(null) and .call(undefined) coerce this to the global object. If globalThis.x is defined anywhere, testThis.call(null) would unexpectedly return "T" instead of the expected "F", making the test non-deterministic. Strict mode prevents this coercion and guarantees this?.x evaluates to undefined for both null and undefined.

Proposed fix

 function testThis() {
+    "use strict";
     if (this?.x)
         return "T";
     return "F";
 }

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	function testThis() {
	if (this?.x)
	return "T";
	return "F";
	}
	function testThis() {
	"use strict";
	if (this?.x)
	return "T";
	return "F";
	}

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@JSTests/stress/optional-chaining-in-condition-context.js` around lines 373 -
377, The function testThis uses optional chaining on this (this?.x) and must run
in strict mode to avoid sloppy-mode this coercion; modify the function testThis
so its body begins with a "use strict" directive (i.e., add the strict-mode
directive as the first statement inside testThis) so that testThis.call(null)
and testThis.call(undefined) treat this as undefined and the optional chaining
behaves deterministically.

[coderabbitai]

⚠️ Potential issue | 🟠 Major

Fail the test when no exception is thrown

Current assertion passes when instantiation does not throw, which can hide regressions. Require an error object before validating offset text.

Proposed fix

-let error;
+let error;
 try {
     new WebAssembly.Instance(module);
 } catch (e) {
     error = e;
 }
 
-if (error?.message.indexOf('byte 27') === -1) {
+const message = error && typeof error.message === "string" ? error.message : "";
+if (!error || !message.includes("byte 27")) {
     throw new Error("evaluation error contains wrong offset");
 }

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@JSTests/wasm/stress/const-expr-evaluate-error-offset.js` around lines 21 -
23, The test currently allows a missing exception because it only checks
error?.message for the offset text; update the check around the error variable
(error) to first require that an error was thrown (throw a new Error if error is
falsy) and then validate that error.message contains "byte 27" (replace the
existing error?.message.indexOf check with a two-step: assert error exists, then
check error.message.indexOf('byte 27') === -1 and throw the "evaluation error
contains wrong offset" error if the substring is missing).

[coderabbitai]

⚠️ Potential issue | 🟠 Major

Avoid hardcoded page-origin assumptions in expected bounds.

Line 31 and Line 36 bake in a default 8px body margin. That makes this test fragile to harness/style shifts. Derive page origin from the canvas AX node (as done in canvas-drawFocusIfNeeded-bounds.html) and offset from that.

Proposed robustness fix

 if (window.accessibilityController) {
     window.jsTestIsAsync = true;

     touchAccessibilityTree(accessibilityController.rootElement);
+    var axCanvas = accessibilityController.accessibleElementById("canvas");
+    var canvasPageX = axCanvas.pageX;
+    var canvasPageY = axCanvas.pageY;
@@
-    // Page position: (8 + 100, 8 + 150) = (108, 158), size (80, 40).
+    // Page position is canvas page origin + mapped object-fit offset.
     setTimeout(async function() {
         output += await verifyCanvasFocusBounds({
             canvasId: "canvas", canvasDescendantId: "button",
             focusX: 50, focusY: 25, focusWidth: 40, focusHeight: 20,
-            expectedPageX: 108, expectedPageY: 158,
+            expectedPageX: canvasPageX + 100, expectedPageY: canvasPageY + 150,
             expectedWidth: 80, expectedHeight: 40,
             variance: 1,
         });

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In
`@LayoutTests/accessibility/canvas-drawFocusIfNeeded-bounds-with-object-fit.html`
around lines 21 - 38, The test currently hardcodes an 8px page origin when
computing expectedPageX/Y for verifyCanvasFocusBounds, which makes it fragile;
update the test to query the canvas's page origin (as done in
canvas-drawFocusIfNeeded-bounds.html) from the canvas AX node or its
boundingClientRect and add that origin to the computed canvas-local focus
coordinates before passing expectedPageX and expectedPageY into
verifyCanvasFocusBounds (keep the same focusX/focusY/focusWidth/focusHeight and
variance), and remove the hardcoded 8px offsets so the expected bounds are
derived from the actual canvas page position.

[coderabbitai]

⚠️ Potential issue | 🟠 Major

Compute expected page coordinates from AX canvas origin, not 8 + ....

Line 21 and Line 29 assume a fixed page origin. This can make the test brittle if default margins or harness styles change.

Proposed robustness fix

 if (window.accessibilityController) {
     window.jsTestIsAsync = true;

     touchAccessibilityTree(accessibilityController.rootElement);
+    var axCanvas = accessibilityController.accessibleElementById("canvas");
+    var canvasPageX = axCanvas.pageX;
+    var canvasPageY = axCanvas.pageY;
@@
-    // The canvas is at (8, 8) due to body margin and has transform: scale(2)
+    // The focus rect is mapped from canvas-local space, then offset by canvas page origin.
@@
             canvasId: "canvas", canvasDescendantId: "button",
             focusX: 100, focusY: 50, focusWidth: 80, focusHeight: 40,
-            expectedPageX: 8 + 100 * 2, expectedPageY: 8 + 50 * 2,
+            expectedPageX: canvasPageX + 100 * 2, expectedPageY: canvasPageY + 50 * 2,
             expectedWidth: 80 * 2, expectedHeight: 40 * 2,
             variance: 1,
         });

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In
`@LayoutTests/accessibility/canvas-drawFocusIfNeeded-bounds-with-transform.html`
around lines 21 - 31, The test hard-codes the canvas page origin (using "8 +
...") making it brittle; update the test to compute expectedPageX/Y from the
canvas's accessibility (AX) origin instead of adding 8 manually: call into the
same helper used to measure the canvas or augment verifyCanvasFocusBounds
(referencing verifyCanvasFocusBounds, canvasId and canvasDescendantId) to return
the canvas page origin (AX origin) and then compute expectedPageX =
canvasPageOrigin.x + focusX * deviceScale and expectedPageY = canvasPageOrigin.y
+ focusY * deviceScale (keeping expectedWidth/Height scaled similarly), and
replace the hard-coded expressions with those computed values so changes to body
margins or harness styles won't break the test.

[coderabbitai]

🧹 Nitpick | 🔵 Trivial

Optional: Add standard HTML document metadata.

While not critical for layout tests, consider adding a lang attribute to the <html> element and a <title> in the <head> for better HTML compliance.

📋 Suggested enhancement

 <!DOCTYPE HTML>
-<html>
+<html lang="en">
 <head>
+<title>Accessibility: AXIndexForTextMarker on non-WebArea elements</title>
 <script src="../../resources/accessibility-helper.js"></script>
 <script src="../../resources/js-test.js"></script>
 </head>

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	<!DOCTYPE HTML>
	<html>
	<head>
	<script src="../../resources/accessibility-helper.js"></script>
	<script src="../../resources/js-test.js"></script>
	</head>
	<!DOCTYPE HTML>
	<html lang="en">
	<head>
	<title>Accessibility: AXIndexForTextMarker on non-WebArea elements</title>
	<script src="../../resources/accessibility-helper.js"></script>
	<script src="../../resources/js-test.js"></script>
	</head>

🧰 Tools

🪛 HTMLHint (1.9.2)

[warning] 2-2: An lang attribute must be present on elements.

(html-lang-require)

---

[error] 6-6: <title> must be present in tag.

(title-require)

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In
`@LayoutTests/accessibility/mac/index-for-text-marker-on-non-webarea-element.html`
around lines 1 - 6, Add basic HTML metadata by setting a lang attribute on the
<html> element and adding a <title> element inside the <head>; update the
document root (<html>) to include lang="en" (or appropriate language tag) and
insert a <title> (e.g., "Accessibility test: text marker on non-webarea
element") as the first child of <head> to improve HTML compliance.

[coderabbitai]

🧹 Nitpick | 🔵 Trivial

Duplicate position-visibility declarations.

Two position-visibility declarations are present:

position-visibility: always;
position-visibility: anchor-visible;

The second declaration will override the first per CSS cascade rules. If this is intentional to test CSS cascade behavior, consider adding a comment to clarify. Otherwise, remove line 27.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In
`@LayoutTests/imported/w3c/web-platform-tests/css/css-anchor-position/position-visibility-anchor-visible.html`
around lines 27 - 28, The CSS contains duplicate position-visibility
declarations ("position-visibility: always;" followed by "position-visibility:
anchor-visible;") so the second overrides the first; remove the redundant
"position-visibility: always;" declaration (or if the duplicate is intentional
to test cascade behavior, retain both but add an inline comment clarifying the
test intent next to the pair) so the intent is explicit and there is no
accidental dead/overridden rule.

[coderabbitai]

🧹 Nitpick | 🔵 Trivial

Optional: Consider adding lang attribute for standards compliance.

The static analysis tool flags the missing lang attribute on the <html> element. While this is technically a best practice for accessibility and internationalization, it's often omitted in WPT reference files that prioritize minimal markup. Adding lang="en" would improve standards compliance but is not critical for this reference file's functionality.

📝 Optional improvement

-<html>
+<html lang="en">

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	<html>
	<html lang="en">

🧰 Tools

🪛 HTMLHint (1.9.2)

[warning] 2-2: An lang attribute must be present on elements.

(html-lang-require)

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In
`@LayoutTests/imported/w3c/web-platform-tests/css/CSS2/floats/float-avoids-float-with-margin-005-expected.html`
at line 2, The HTML root element (<html>) is missing a lang attribute; add
lang="en" to the <html> tag (modify the <html> element in the file so it becomes
<html lang="en">) to improve accessibility and standards compliance while
keeping the rest of the WPT reference file unchanged.

[coderabbitai]

⚠️ Potential issue | 🟡 Minor

Add missing lang attribute on <html>.

Line 2 is missing document language metadata required by HTML linting rules.

🔧 Proposed fix

-<html>
+<html lang="en">

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	<html>
	<html lang="en">

🧰 Tools

🪛 HTMLHint (1.9.2)

[warning] 2-2: An lang attribute must be present on elements.

(html-lang-require)

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In
`@LayoutTests/imported/w3c/web-platform-tests/css/CSS2/floats/float-avoids-float-with-margin-012-expected.html`
at line 2, The root <html> element in the file is missing the required lang
attribute; update the <html> tag (the document root) to include an appropriate
language code (e.g., lang="en" or the document's actual language) so the element
reads <html lang="..."> to satisfy HTML linting and accessibility rules.

[coderabbitai]

⚠️ Potential issue | 🟡 Minor

Add missing document language metadata.

Line 2 should include a lang attribute on <html> to satisfy HTML conformance checks.

🔧 Proposed fix

-<html>
+<html lang="en">

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	<html>
	<html lang="en">

🧰 Tools

🪛 HTMLHint (1.9.2)

[warning] 2-2: An lang attribute must be present on elements.

(html-lang-require)

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In
`@LayoutTests/imported/w3c/web-platform-tests/css/CSS2/floats/float-avoids-float-with-margin-012-ref.html`
at line 2, The HTML root element is missing a language declaration; update the
<html> element in float-avoids-float-with-margin-012-ref.html to include an
appropriate lang attribute (for example lang="en") so the document has valid
language metadata—ensure the lang is placed on the existing <html> tag (and add
xml:lang if required by project conventions).

[coderabbitai]

⚠️ Potential issue | 🟡 Minor

Set page language on the root element.

Please add a lang attribute on Line 2 for HTML standards compliance.

🔧 Proposed fix

-<html>
+<html lang="en">

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	<html>
	<html lang="en">

🧰 Tools

🪛 HTMLHint (1.9.2)

[warning] 2-2: An lang attribute must be present on elements.

(html-lang-require)

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In
`@LayoutTests/imported/w3c/web-platform-tests/css/CSS2/floats/float-avoids-float-with-margin-012.html`
at line 2, Add a lang attribute to the root HTML element (<html>) to set the
document language for standards and accessibility; update the <html> start tag
(the root element shown in the diff) to include an appropriate lang value (e.g.,
lang="en" or the document's language) so the root element declares the page
language.

[github-actions]

Preview Builds

Commit	Release	Date
9dc26d0d	autobuild-preview-pr-203-9dc26d0d	2026-04-29 03:36:43 UTC
a5bf2e31	autobuild-preview-pr-203-a5bf2e31	2026-04-29 01:59:51 UTC
f7b52b08	autobuild-preview-pr-203-f7b52b08	2026-04-29 00:41:16 UTC

[coderabbitai]

Actionable comments posted: 46

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

LayoutTests/fast/repaint/backgroundSizeRepaint.html (1)

4-22: ⚠️ Potential issue | 🟡 Minor

Add a <title> in <head> to satisfy HTML validation.

HTMLHint flags this file because <head> has no <title>. Please add one to keep test HTML compliant.

Proposed fix

 <head>
+<title>background-size repaint on growth</title>
 <style type="text/css">
     div.test { width: 200px; height: 120px; border: 1px solid blue; padding: 10px; }
 </style>

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@LayoutTests/fast/repaint/backgroundSizeRepaint.html` around lines 4 - 22, Add
a <title> element inside the existing <head> to satisfy HTML validation; update
the head block (the one containing the <style> and the window.load script that
manipulates elements with ids 'a' and 'b') to include a concise title (e.g.,
<title>backgroundSizeRepaint</title>) immediately after or before the <style> so
the document has a valid head section.

♻️ Duplicate comments (26)

LayoutTests/fast/events/touch/ios/touch-event-regions-layer-tree/dblclick-document.html (1)

3-10: ⚠️ Potential issue | 🟡 Minor

Add required document metadata (lang and <title>).

<html> is missing lang, and <head> is missing <title>, which will trip HTML linting in this test file.

Proposed fix

-<html>
+<html lang="en">
 <head>
+    <title>dblclick document touch regions</title>
     <script src="resources/touch-regions-helper.js"></script>
     <script>

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In
`@LayoutTests/fast/events/touch/ios/touch-event-regions-layer-tree/dblclick-document.html`
around lines 3 - 10, The HTML file is missing required metadata: add a lang
attribute to the <html> tag and add a <title> element inside the <head>; locate
the top of the file where <html> and <head> are declared (near the
prepareForTest() and window.addEventListener('load', dumpRegions, false) script
block) and update <html> to include an appropriate lang="en" (or other locale)
and insert a minimal <title>...<\/title> element in the head before the scripts.

LayoutTests/fast/events/touch/ios/touch-event-regions-layer-tree/dblclick-columns.html (1)

3-22: ⚠️ Potential issue | 🟡 Minor

Add missing document metadata (lang and <title>).

Line 3 still lacks lang on <html>, and <head> still has no <title>, which keeps HTMLHint failing.

Suggested patch

-<html>
+<html lang="en">
 <head>
+    <title>dblclick columns touch regions</title>
     <style>

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In
`@LayoutTests/fast/events/touch/ios/touch-event-regions-layer-tree/dblclick-columns.html`
around lines 3 - 22, Add the missing document metadata: set the lang attribute
on the <html> element and add a <title> element inside the <head>. Locate the
opening <html> tag in this file and add the appropriate lang attribute (e.g.,
lang="en"), and insert a concise <title> (e.g., describing the test) into the
<head> before the existing <style> or <script> tags so the page (which uses
prepareForTest() and registers dumpRegions on load) passes HTMLHint checks.

LayoutTests/http/tests/lockdown-mode/svg-with-unsupported-font-does-not-crash.html (2)

2-4: ⚠️ Potential issue | 🟡 Minor

Add missing document metadata/accessibility attributes.

Line 2 is missing lang, Line 19 has no <title> in <head>, and Line 21 <img> has no alt.

Proposed patch

-<html>
+<html lang="en">
 <head>
+<title>Lockdown mode SVG unsupported font test</title>
 <script src="/js-test-resources/js-test.js"></script>
@@
-<img src="resources/opentype_font_graph.svg">
+<img src="resources/opentype_font_graph.svg" alt="" onload="imageLoaded()" onerror="imageFailed()">

Also applies to: 19-21

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In
`@LayoutTests/http/tests/lockdown-mode/svg-with-unsupported-font-does-not-crash.html`
around lines 2 - 4, Add standard accessibility/metadata: add a lang attribute to
the root <html> tag, include a <title> element inside the existing <head>, and
add an appropriate alt attribute to the <img> element; locate the <html> tag,
the <head> section (insert <title> there) and the <img> element in the file
(svg-with-unsupported-font-does-not-crash.html) and update those elements
accordingly.

---

15-17: ⚠️ Potential issue | 🟠 Major

Avoid false-positive pass by asserting actual image load outcome.

Line 15/16 reports success and finishes before verifying the SVG resource result; this can mask regressions.

Proposed patch

 function test() {
     if (window.FileSystemHandle == undefined)
     	testPassed("Confirmed Lockdown Mode process");
     else
         testFailed("This is NOT a Lockdown Mode process.");
-
-    testPassed("The SVG loaded without crashing.");
-    finishJSTest();
 }
+
+function imageLoaded()
+{
+    testPassed("The SVG loaded without crashing.");
+    finishJSTest();
+}
+
+function imageFailed()
+{
+    testFailed("SVG failed to load.");
+    finishJSTest();
+}
@@
-<img src="resources/opentype_font_graph.svg">
+<img src="resources/opentype_font_graph.svg" alt="" onload="imageLoaded()" onerror="imageFailed()">

Also applies to: 21-21

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In
`@LayoutTests/http/tests/lockdown-mode/svg-with-unsupported-font-does-not-crash.html`
around lines 15 - 17, The test currently calls testPassed("The SVG loaded
without crashing.") and finishJSTest() unconditionally which can produce false
positives; modify the SVG/image loading code to wait for the actual load outcome
by attaching explicit onload and onerror (or equivalent Promise) handlers to the
<img> or <object> element and call testPassed(...) only from the onload handler
and call testFailed(...) from the onerror handler before calling finishJSTest();
update both occurrences referenced near testPassed and finishJSTest so the test
only finishes after the resource success/failure is asserted.

LayoutTests/http/wpt/html/browsers/browsing-the-web/navigating-across-documents/navigating-iframe-sandbox.html (1)

20-20: ⚠️ Potential issue | 🟡 Minor

Off-by-one retry condition still allows only 49 attempts

Line 20 and Line 40 use ++counter < 50. Since counter starts at 0, this runs at most 49 times. If you intended 50 retries, switch to counter++ < 50 (or ++counter <= 50) in both loops.

Suggested fix

-    while (++counter < 50 && !isOk) {
+    while (counter++ < 50 && !isOk) {
         isOk = await new Promise(resolve => {
             window.onmessage = () => resolve(false);
             setTimeout(() => resolve(true), 200);
         });
     }

Also applies to: 40-40

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In
`@LayoutTests/http/wpt/html/browsers/browsing-the-web/navigating-across-documents/navigating-iframe-sandbox.html`
at line 20, The retry loops use prefix increment (++counter < 50) which with
counter starting at 0 only allows 49 iterations; update both loops that use
++counter < 50 (referenced with the loop condition variables counter and isOk)
to use either post-increment (counter++ < 50) or adjust to ++counter <= 50 so
they perform the intended 50 retries, and apply the same change at the other
occurrence of the same condition.

LayoutTests/http/tests/workers/service/resources/postmessage-after-sw-process-crash.js (1)

7-8: ⚠️ Potential issue | 🟠 Major

Guarded finish is still incomplete; finish can run more than once.

At Line 42, didFinish is set after finishSWTest(), and failure paths (Line 13, Line 26) still finish without flipping the guard. This still allows re-entry/double-finish under extra message events.

Proposed fix

 let didFinish = false;
+function finishOnce()
+{
+    if (didFinish)
+        return;
+    didFinish = true;
+    finishSWTest();
+}
 
 navigator.serviceWorker.addEventListener("message", async function(event) {
     if (didFinish)
         return;
@@
         if (!event.data) {
             log("FAIL: service worker did not receive the state");
-            finishSWTest();
+            finishOnce();
             return;
         }
@@
             if (!remainingAttempts) {
                 log("FAIL: service worker did not respond after process termination");
                 clearInterval(handle);
-                finishSWTest();
+                finishOnce();
                 return;
             }
@@
     log("PASS: service worker lost the state and responded the postMessage after process termination");
     clearInterval(handle);
-    finishSWTest();
-    didFinish = true;
+    finishOnce();
 });

Also applies to: 42-42

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In
`@LayoutTests/http/tests/workers/service/resources/postmessage-after-sw-process-crash.js`
around lines 7 - 8, The didFinish guard is incomplete and finishSWTest() can be
called multiple times; fix by introducing a single safe finish path: create or
use a helper (e.g., safeFinish or inline) that first checks if didFinish is
true, if not sets didFinish = true immediately and then calls finishSWTest(),
and replace all direct calls to finishSWTest() (including every failure path and
the success path where didFinish is currently set after finishSWTest()) with
calls to this safe finish so the guard is flipped before finishSWTest runs.

LayoutTests/http/wpt/service-workers/third-party-registration.html (1)

33-33: ⚠️ Potential issue | 🟡 Minor

Make expected-origin text match the actual assertion.

The failure message says instead of localhost:8801, but line 32 asserts against "http://localhost:8801". Include the full protocol and URL in the error message for consistency.

📝 Suggested fix

-            logAndFinishTest(`FAIL ancestorOriginsData[0] is "${ancestorOriginsData[0]}" instead of localhost:8801`);
+            logAndFinishTest(`FAIL ancestorOriginsData[0] is "${ancestorOriginsData[0]}" instead of "http://localhost:8801"`);

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@LayoutTests/http/wpt/service-workers/third-party-registration.html` at line
33, The failure message for the ancestor origin assertion uses a shortened URL;
update the log in the logAndFinishTest call that mentions ancestorOriginsData[0]
so it matches the actual assertion value by including the full protocol and host
"http://localhost:8801" (i.e., change the trailing text from localhost:8801 to
http://localhost:8801).

LayoutTests/fast/loader/navigate-on-pageswap-crash.html (2)

6-18: ⚠️ Potential issue | 🟠 Major

notifyDone() is called before the repro path completes.

Line 8 signals completion, but execution continues through Lines 14-18. Move notifyDone() to the end of the second pass and return immediately after navigation.reload().

Proposed fix

 (async () => {
-  if (sessionStorage.testCompleted) {
-    delete sessionStorage.testCompleted;
-    testRunner?.notifyDone();
-  } else {
+  if (!sessionStorage.testCompleted) {
     sessionStorage.testCompleted = true;
     await navigation.reload();
+    return;
   }
+  delete sessionStorage.testCompleted;
 
   let audio = document.createElement('audio');
   audio.src = '/resources/foo.mp4';
   await navigator.locks.query();
   onpageswap = async (e) => { await navigation.navigate("foo"); };
   await cookieStore.get("bar");
+  testRunner?.notifyDone();
 })();

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@LayoutTests/fast/loader/navigate-on-pageswap-crash.html` around lines 6 - 18,
The current flow calls testRunner?.notifyDone() immediately when
sessionStorage.testCompleted is set, but execution then continues into the repro
path; change the logic so that after setting sessionStorage.testCompleted and
awaiting navigation.reload() you immediately return to avoid running the
second-pass code, and move the call to testRunner?.notifyDone() to the end of
the second-pass path (after the async work such as awaiting
navigator.locks.query(), installing onpageswap, and awaiting
cookieStore.get("bar")). In practice: in the branch that sets
sessionStorage.testCompleted = true, call await navigation.reload(); then
return; and in the other branch (where you detect sessionStorage.testCompleted),
delete sessionStorage.testCompleted and invoke testRunner?.notifyDone() as the
last action after the second-pass async operations have completed.

---

1-2: ⚠️ Potential issue | 🟡 Minor

Add <!DOCTYPE html> as the first line.

Line 1 starts with a comment, so the document can enter quirks mode.

Proposed fix

+<!DOCTYPE html>
 <!-- webkit-test-runner [ dumpJSConsoleLogInStdErr=true ] -->
 <script>

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@LayoutTests/fast/loader/navigate-on-pageswap-crash.html` around lines 1 - 2,
Add a HTML5 doctype as the very first line to avoid quirks mode: insert
"<!DOCTYPE html>" before the existing "<!-- webkit-test-runner [
dumpJSConsoleLogInStdErr=true ] -->" comment so the document starts with the
doctype rather than the comment; no other changes to the existing "<script>"
block are required.

LayoutTests/accessibility/canvas-drawFocusIfNeeded-bounds-with-object-fit.html (1)

21-37: ⚠️ Potential issue | 🟠 Major

Replace hardcoded page-origin math with measured canvas AX origin.

Line 31 and Line 36 assume a fixed 8px page origin. This makes the test fragile to harness/style changes; derive expected page coordinates from the canvas AX origin instead.

Proposed fix

 if (window.accessibilityController) {
     window.jsTestIsAsync = true;

     touchAccessibilityTree(accessibilityController.rootElement);
+    var axCanvas = accessibilityController.accessibleElementById("canvas");
+    var canvasPageX = axCanvas.pageX;
+    var canvasPageY = axCanvas.pageY;

@@
-    // Page position: (8 + 100, 8 + 150) = (108, 158), size (80, 40).
+    // Page position is canvas page origin + mapped object-fit offset.
     setTimeout(async function() {
         output += await verifyCanvasFocusBounds({
             canvasId: "canvas", canvasDescendantId: "button",
             focusX: 50, focusY: 25, focusWidth: 40, focusHeight: 20,
-            expectedPageX: 108, expectedPageY: 158,
+            expectedPageX: canvasPageX + 100, expectedPageY: canvasPageY + 150,
             expectedWidth: 80, expectedHeight: 40,
             variance: 1,
         });

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In
`@LayoutTests/accessibility/canvas-drawFocusIfNeeded-bounds-with-object-fit.html`
around lines 21 - 37, The test currently adds a hardcoded 8px page-origin offset
when computing expectedPageX/Y; update the test to query the canvas's actual
accessibility (AX) page origin and use that to compute expectedPageX and
expectedPageY before calling verifyCanvasFocusBounds (use the canvas AX origin
plus the scaled focus coordinates), referencing the verifyCanvasFocusBounds call
and the canvasId/canvasDescendantId/focusX/focusY values so the expected
positions are derived from the measured canvas AX origin instead of the fixed
8px.

LayoutTests/accessibility/canvas-drawFocusIfNeeded-bounds-with-transform.html (1)

21-30: ⚠️ Potential issue | 🟠 Major

Do not hardcode 8 + ... for expected page coordinates.

Line 21 and Line 29 bake in a fixed page origin. Compute expected pageX/pageY from the measured AX canvas origin to avoid brittle assumptions.

Proposed fix

 if (window.accessibilityController) {
     window.jsTestIsAsync = true;

     touchAccessibilityTree(accessibilityController.rootElement);
+    var axCanvas = accessibilityController.accessibleElementById("canvas");
+    var canvasPageX = axCanvas.pageX;
+    var canvasPageY = axCanvas.pageY;

@@
-    // The canvas is at (8, 8) due to body margin and has transform: scale(2)
+    // Expected page coordinates are canvas AX origin + transformed local offsets.
@@
             canvasId: "canvas", canvasDescendantId: "button",
             focusX: 100, focusY: 50, focusWidth: 80, focusHeight: 40,
-            expectedPageX: 8 + 100 * 2, expectedPageY: 8 + 50 * 2,
+            expectedPageX: canvasPageX + 100 * 2, expectedPageY: canvasPageY + 50 * 2,
             expectedWidth: 80 * 2, expectedHeight: 40 * 2,
             variance: 1,
         });

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In
`@LayoutTests/accessibility/canvas-drawFocusIfNeeded-bounds-with-transform.html`
around lines 21 - 30, The test is hardcoding the canvas page origin (using
expressions like 8 + ...). Update the call to verifyCanvasFocusBounds to compute
expectedPageX and expectedPageY from the measured accessibility canvas origin
instead of a fixed constant: call the routine that queries the AX canvas origin
(or use the existing measured origin variable returned by
verifyCanvasFocusBounds helpers) and set expectedPageX = canvasOriginX + focusX
* canvasScale and expectedPageY = canvasOriginY + focusY * canvasScale; keep
other params (canvasId, canvasDescendantId, focusX, focusY, focusWidth,
focusHeight, expectedWidth, expectedHeight) the same and replace the literal "8
+ ..." expressions with those computed values so the test derives page
coordinates from the measured AX canvas origin.

LayoutTests/fast/events/event-disconnected-target.html (1)

8-8: ⚠️ Potential issue | 🟡 Minor

Fix the description typo (“a event” → “an event”).

Line 8 still has the grammar error previously flagged. Please update this string and keep LayoutTests/fast/events/event-disconnected-target-expected.txt line 1 in sync.

✏️ Proposed fix

--- a/LayoutTests/fast/events/event-disconnected-target.html
+++ b/LayoutTests/fast/events/event-disconnected-target.html
@@
-description('This tests removing a event target from its ancestor. WebKit should keep the root node alive.');
+description('This tests removing an event target from its ancestor. WebKit should keep the root node alive.');
--- a/LayoutTests/fast/events/event-disconnected-target-expected.txt
+++ b/LayoutTests/fast/events/event-disconnected-target-expected.txt
@@
-This tests removing a event target from its ancestor. WebKit should keep the root node alive.
+This tests removing an event target from its ancestor. WebKit should keep the root node alive.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@LayoutTests/fast/events/event-disconnected-target.html` at line 8, Fix the
grammar in the test description by changing the string passed to
description(...) from "This tests removing a event target from its ancestor.
WebKit should keep the root node alive." to "This tests removing an event target
from its ancestor. WebKit should keep the root node alive."; also update the
corresponding first line of event-disconnected-target-expected.txt so the
expected output stays in sync with the corrected description.

LayoutTests/imported/w3c/web-platform-tests/css/css-anchor-position/position-visibility-anchor-visible.html (1)

27-28: ⚠️ Potential issue | 🟠 Major

Use the spec value and remove the overridden declaration.

position-visibility: anchor-visible; should be anchors-visible, and the preceding always declaration is dead/overridden in this rule block.

🔧 Proposed fix

-    position-visibility: always;
-    position-visibility: anchor-visible;
+    position-visibility: anchors-visible;

What are the valid values for CSS `position-visibility` in the CSS Anchor Positioning Level 1 specification?

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In
`@LayoutTests/imported/w3c/web-platform-tests/css/css-anchor-position/position-visibility-anchor-visible.html`
around lines 27 - 28, Replace the incorrect and overridden CSS declaration in
the rule block: remove the dead "position-visibility: always;" line and change
"position-visibility: anchor-visible;" to the spec-correct value
"position-visibility: anchors-visible" (look for the position-visibility
property in the rule containing these two declarations).

LayoutTests/fast/events/touch/ios/touch-event-regions-layer-tree/mousemove-mouseup.html (1)

2-14: ⚠️ Potential issue | 🟡 Minor

Please resolve remaining HTML lint metadata gaps.

Line 2 still lacks lang on <html>, and <head> still lacks a <title>. These were already raised in earlier review feedback and are still present.

Proposed fix

-<html>
+<html lang="en">
 <head>
+    <title>mousemove and mouseup touch regions</title>
     <script src="resources/touch-regions-helper.js"></script>

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In
`@LayoutTests/fast/events/touch/ios/touch-event-regions-layer-tree/mousemove-mouseup.html`
around lines 2 - 14, Add missing HTML metadata: set a lang attribute on the
<html> element (e.g., lang="en") and add a <title> element inside the <head>
(e.g., <title>mousemove-mouseup test</title>) so the document has proper
language and title metadata; update the existing <html> and <head> tags in the
file to include these attributes/elements.

LayoutTests/http/tests/site-isolation/resources/text-input.html (1)

2-4: ⚠️ Potential issue | 🟡 Minor

Resolve remaining HTML metadata/accessibility lint warnings.

<html> is still missing lang, and the text input is still missing an associated <label> (Line 2 and Line 4). This was already flagged in prior review feedback and remains unresolved.

Proposed fix

-<html>
+<html lang="en">
 <body>
+<label for="target" style="position:absolute;left:-9999px;">Target input</label>
 <input id="target" type="text" autocapitalize="none" style="width: 200px; font-size: 16px;">

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@LayoutTests/http/tests/site-isolation/resources/text-input.html` around lines
2 - 4, The HTML lacks a language attribute on the root <html> element and the
text input with id "target" has no associated label; add a lang attribute (e.g.,
lang="en") to the <html> tag and create an accessible <label for="target">
(visible or offscreen) that describes the input so the input with id "target" is
properly associated with its label.

LayoutTests/editing/inserting/insert-list-then-edit-command-crash.html (1)

20-20: ⚠️ Potential issue | 🟡 Minor

Guard testRunner.notifyDone() before invoking it.

Line 20 can throw when the test is run without window.testRunner.

Proposed fix

-                testRunner.notifyDone();
+                if (window.testRunner)
+                    testRunner.notifyDone();

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@LayoutTests/editing/inserting/insert-list-then-edit-command-crash.html` at
line 20, Guard the call to testRunner.notifyDone() by checking for the existence
of window.testRunner (or testRunner) before invoking it; update the code around
the testRunner.notifyDone() invocation to only call testRunner.notifyDone() when
window.testRunner (or typeof testRunner !== 'undefined') is truthy so the test
won't throw when testRunner is not present.

LayoutTests/fast/shadow-dom/slot-display-contents-composed-tree-after-display-toggle.html (1)

1-4: ⚠️ Potential issue | 🟡 Minor

Add <!DOCTYPE html> to force standards mode.

This test currently starts without a doctype, which can introduce quirks-mode variance in composed-tree/layout behavior.

Proposed fix

+<!DOCTYPE html>
 <script>
 if (window.testRunner)
     testRunner.dumpAsText();

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In
`@LayoutTests/fast/shadow-dom/slot-display-contents-composed-tree-after-display-toggle.html`
around lines 1 - 4, This HTML test lacks a doctype and should be forced into
standards mode: add the document type declaration <!DOCTYPE html> at the very
top of the file so the <script> block (and the entire test content) runs in
standards mode rather than quirks mode; place the doctype before the existing
<script> tag to ensure composed-tree/layout behavior is consistent across
engines.

JSTests/stress/optional-chaining-in-condition-context.js (1)

373-377: ⚠️ Potential issue | 🟡 Minor

Add strict mode to testThis to prevent this coercion ambiguity.

In sloppy mode, .call(null) and .call(undefined) coerce this to the global object. If globalThis.x happens to be defined, testThis.call(null) would unexpectedly return "T" instead of "F", making the test non-deterministic. Strict mode prevents this coercion and guarantees this?.x evaluates to undefined for both null and undefined.

Proposed fix

 function testThis() {
+    "use strict";
     if (this?.x)
         return "T";
     return "F";
 }

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@JSTests/stress/optional-chaining-in-condition-context.js` around lines 373 -
377, The function testThis uses this?.x and must run in strict mode to avoid
this coercion; make testThis strict by adding the directive 'use strict'; as the
very first statement inside the function body of testThis so that calls like
testThis.call(null) and testThis.call(undefined) do not coerce this to the
global object and the this?.x check behaves deterministically.

LayoutTests/http/tests/security/XFrameOptions/x-frame-options-ignore-deny-meta-tag-in-body.html (1)

18-18: ⚠️ Potential issue | 🟡 Minor

Guard deferred notifyDone() call behind window.testRunner.

Line 18 schedules testRunner.notifyDone() even when the harness is absent, which can throw at runtime.

Proposed fix

-        setTimeout(() => testRunner.notifyDone(), 0);
+        if (window.testRunner)
+            setTimeout(() => testRunner.notifyDone(), 0);

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In
`@LayoutTests/http/tests/security/XFrameOptions/x-frame-options-ignore-deny-meta-tag-in-body.html`
at line 18, The test schedules testRunner.notifyDone() unconditionally which can
throw if the harness is absent; update the call site that uses setTimeout and
guard it by checking window.testRunner exists before invoking notifyDone (either
check before scheduling or inside the timeout callback), referencing the
testRunner identifier and its notifyDone method so the code only calls
window.testRunner.notifyDone() when window.testRunner is truthy.

LayoutTests/http/tests/xmlhttprequest/abort-should-cancel-load.html (1)

23-23: ⚠️ Potential issue | 🟡 Minor

Guard notifyDone() with window.testRunner.

Line 23 can throw when this file is opened outside the test harness.

Proposed fix

-    setTimeout(() => testRunner.notifyDone(), 0);
+    if (window.testRunner)
+        setTimeout(() => testRunner.notifyDone(), 0);

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@LayoutTests/http/tests/xmlhttprequest/abort-should-cancel-load.html` at line
23, The call to testRunner.notifyDone() may throw when opened outside the test
harness; wrap or guard the call by checking window.testRunner exists before
invoking notifyDone (i.e., replace direct testRunner.notifyDone() with a
conditional that calls window.testRunner.notifyDone() only if window.testRunner
is truthy) so the setTimeout callback is safe outside the harness.

LayoutTests/http/tests/security/XFrameOptions/x-frame-options-ignore-deny-meta-tag.html (1)

18-18: ⚠️ Potential issue | 🟡 Minor

Guard deferred notifyDone() in non-harness runs.

Line 18 still calls testRunner.notifyDone() unconditionally inside setTimeout, which can throw ReferenceError when window.testRunner is absent.

Suggested fix

-        setTimeout(() => testRunner.notifyDone(), 0);
+        if (window.testRunner)
+            setTimeout(() => testRunner.notifyDone(), 0);

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In
`@LayoutTests/http/tests/security/XFrameOptions/x-frame-options-ignore-deny-meta-tag.html`
at line 18, The setTimeout callback calls testRunner.notifyDone() unguarded and
can throw when window.testRunner is missing; update the setTimeout callback in
this file to check for the presence of the harness before calling notifyDone
(e.g., testRunner exists or typeof testRunner !== "undefined" or
window.testRunner) and only call testRunner.notifyDone() when present, leaving
non-harness runs unaffected.

LayoutTests/http/tests/site-isolation/focus-wrap-across-remote-frames.html (2)

2-30: ⚠️ Potential issue | 🟡 Minor

Address unresolved test-page metadata/accessibility warnings.

Line 2 is missing lang; Line 29 input has no label; Line 30 iframe lacks an accessible name.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@LayoutTests/http/tests/site-isolation/focus-wrap-across-remote-frames.html`
around lines 2 - 30, Add missing accessibility metadata: set a lang attribute on
the <html> element, give the outer input (id="outerInput") an accessible name
(e.g. associate a <label> with it or add aria-label/aria-labelledby), and
provide an accessible name for the iframe (id="testIframe") via a title
attribute or aria-label/aria-labelledby so the iframe is programmatically named.

---

33-57: ⚠️ Potential issue | 🟠 Major

Ensure finishJSTest() always runs on failure paths.

Line 56 is only reached on success; any rejection before that can leave the test hanging until timeout.

Proposed fix

 async function runTest() {
     testRunner?.dumpAsText();
-    await UIHelper.setHardwareKeyboardAttached(true);
-
-    shouldBe("document.activeElement.tagName", "'BODY'");
-
-    // Focus the outer input.
-    document.getElementById('outerInput').focus();
-    shouldBe("document.activeElement.id", "'outerInput'");
-    testPassed("Outer input focused");
-
-    // Tab into the cross-origin iframe.
-    await UIHelper.keyDown("\t");
-    await waitForActiveElementTagName('IFRAME');
-    shouldBe("document.activeElement.tagName", "'IFRAME'");
-    testPassed("Tab moved focus into iframe");
-
-    // Tab again — focus should relinquish to chrome (leave the web view).
-    await UIHelper.keyDown("\t");
-    await waitForActiveElementTagName('BODY');
-    shouldBe("document.activeElement.tagName", "'BODY'");
-    testPassed("Tab relinquished focus to chrome");
-
-    finishJSTest();
+    await UIHelper.setHardwareKeyboardAttached(true);
+    try {
+        shouldBe("document.activeElement.tagName", "'BODY'");
+        document.getElementById('outerInput').focus();
+        shouldBe("document.activeElement.id", "'outerInput'");
+        testPassed("Outer input focused");
+
+        await UIHelper.keyDown("\t");
+        await waitForActiveElementTagName('IFRAME');
+        shouldBe("document.activeElement.tagName", "'IFRAME'");
+        testPassed("Tab moved focus into iframe");
+
+        await UIHelper.keyDown("\t");
+        await waitForActiveElementTagName('BODY');
+        shouldBe("document.activeElement.tagName", "'BODY'");
+        testPassed("Tab relinquished focus to chrome");
+    } catch (error) {
+        testFailed(String(error));
+    } finally {
+        finishJSTest();
+    }
 }

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@LayoutTests/http/tests/site-isolation/focus-wrap-across-remote-frames.html`
around lines 33 - 57, Wrap the asynchronous test steps in runTest() with a
try/catch/finally (or try/finally) so finishJSTest() is always invoked on both
success and failure; ensure any awaited calls like
UIHelper.setHardwareKeyboardAttached, UIHelper.keyDown,
waitForActiveElementTagName and the assertions (shouldBe, testPassed) are inside
the try and call finishJSTest() from the finally block (or call finishJSTest()
in the catch before rethrowing/logging) so the test never hangs on rejected
promises.

LayoutTests/http/tests/site-isolation/type-in-cross-origin-iframe.html (1)

2-48: ⚠️ Potential issue | 🟡 Minor

Fix unresolved metadata/accessibility lint warnings.

Line 2 is missing lang, the head has no <title>, and Line 47 iframe lacks an accessible name.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@LayoutTests/http/tests/site-isolation/type-in-cross-origin-iframe.html`
around lines 2 - 48, Add missing accessibility metadata: set a lang attribute on
the <html> element (e.g. lang="en"), add a descriptive <title> inside the
<head>, and give the iframe with id "frame" an accessible name (e.g. title or
aria-label such as title="Cross-origin input frame" or aria-label="Cross-origin
input frame") so the document and the iframe are properly identified by
assistive tech and resolve the lint warnings.

LayoutTests/http/tests/security/contentSecurityPolicy/iframe-srcdoc-import-bypass.html (2)

17-22: ⚠️ Potential issue | 🟠 Major

Validate message payloads and iframe IDs before mutating test state.

The current flow lets unknown payloads increment resultsReceived and influence iframe2Loaded, which can produce false completion.

Proposed fix

 function reportResult(iframeId, loaded) {
     if (iframeId === "iframe1")
         iframe1Loaded = loaded;
-    else
+    else if (iframeId === "iframe2")
         iframe2Loaded = loaded;
+    else
+        return;
     resultsReceived++;
@@
 window.addEventListener("message", (event) => {
-    if (event.data.type === "import-result")
-        reportResult(event.data.iframe, event.data.loaded);
+    if (!event.data || event.data.type !== "import-result")
+        return;
+    if (event.data.iframe !== "iframe1" && event.data.iframe !== "iframe2")
+        return;
+    reportResult(event.data.iframe, !!event.data.loaded);
 });

Also applies to: 34-37

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In
`@LayoutTests/http/tests/security/contentSecurityPolicy/iframe-srcdoc-import-bypass.html`
around lines 17 - 22, The reportResult function currently trusts incoming
iframeId and loaded values and always mutates iframe1Loaded/iframe2Loaded and
increments resultsReceived; update reportResult to first validate the message
payload and iframeId (e.g., only accept "iframe1" or "iframe2" and ensure loaded
is a boolean) and return early for any unknown or malformed messages so state
isn't changed; apply the same validation approach to the duplicate handler
around the other occurrence (the block that sets iframe1Loaded/iframe2Loaded and
increments resultsReceived) to avoid false completion.

---

2-6: ⚠️ Potential issue | 🟡 Minor

Add missing document/iframe metadata (lang, <title>, iframe titles).

This file is still missing root language metadata, a document title, and accessible iframe names.

Proposed fix

-<html>
+<html lang="en">
 <head>
 <meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval';">
+<title>iframe srcdoc import CSP bypass regression test</title>
 <script src="/js-test-resources/js-test.js"></script>
@@
-<iframe id="iframe1" sandbox="allow-scripts"></iframe>
-<iframe id="iframe2" sandbox="allow-scripts" srcdoc=""></iframe>
+<iframe id="iframe1" title="iframe 1 import probe" sandbox="allow-scripts"></iframe>
+<iframe id="iframe2" title="iframe 2 import probe" sandbox="allow-scripts" srcdoc=""></iframe>

Also applies to: 59-60

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In
`@LayoutTests/http/tests/security/contentSecurityPolicy/iframe-srcdoc-import-bypass.html`
around lines 2 - 6, Add the missing accessibility and metadata: set a root
language on the <html> element (e.g., lang="en"), add a descriptive <title>
element inside the <head>, and ensure any <iframe> elements referenced in this
test (see the iframe at/around lines 59-60) include an accessible name (use a
title attribute or aria-label) so the document and embedded frames have proper
language, title, and accessible labels.

[coderabbitai]

🧹 Nitpick | 🔵 Trivial

Clean up Object.prototype["0"] after the stress phase.

Keeping the prototype mutation installed beyond the test body is avoidable global state leakage.

Proposed fix

 Object.defineProperty(Object.prototype, "0", {
     get() { return "shadow"; },
     set(v) { },
     configurable: true,
 });
 
-for (let i = 0; i < testLoopCount; ++i) {
-    shouldBe(sumMapEntries(map), expectedMapSum);
-    shouldBe(sumSetValues(set), expectedSetSum);
-}
+try {
+    for (let i = 0; i < testLoopCount; ++i) {
+        shouldBe(sumMapEntries(map), expectedMapSum);
+        shouldBe(sumSetValues(set), expectedSetSum);
+    }
+} finally {
+    delete Object.prototype["0"];
+}

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	Object.defineProperty(Object.prototype, "0", {
	get() { return "shadow"; },
	set(v) { },
	configurable: true,
	});
	for (let i = 0; i < testLoopCount; ++i) {
	shouldBe(sumMapEntries(map), expectedMapSum);
	shouldBe(sumSetValues(set), expectedSetSum);
	}
	Object.defineProperty(Object.prototype, "0", {
	get() { return "shadow"; },
	set(v) { },
	configurable: true,
	});
	try {
	for (let i = 0; i < testLoopCount; ++i) {
	shouldBe(sumMapEntries(map), expectedMapSum);
	shouldBe(sumSetValues(set), expectedSetSum);
	}
	} finally {
	delete Object.prototype["0"];
	}

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@JSTests/stress/iterator-dfg-fast-path-bad-time.js` around lines 56 - 65, The
test mutates global state by adding Object.prototype["0"] via
Object.defineProperty and never removes it; after the stress loop that calls
shouldBe(sumMapEntries(map), ...) and shouldBe(sumSetValues(set), ...), remove
or restore the prototype change (e.g., delete Object.prototype["0"] or restore
the previous descriptor) so the prototype mutation does not leak beyond this
test, ensuring cleanup happens once the stress phase completes.

[coderabbitai]

🧹 Nitpick | 🔵 Trivial

Add a tracking bug reference for this new skip.

Please attach a bug/issue link (and ideally the affected ICU version range) so this doesn’t become a permanent silent coverage loss.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@JSTests/test262/config.yaml` around lines 53 - 54, Add a tracking bug/issue
reference and affected ICU version range beside the skipped entry in
JSTests/test262/config.yaml for the skipped test
"test/intl402/Locale/constructor-apply-options-canonicalizes-twice.js": update
the comment above or inline with that skip to include a link to the bug/issue
and the ICU version range (e.g., "ICU >= 66") so reviewers can find the root
cause and the skip is not permanent.

[coderabbitai]

⚠️ Potential issue | 🟠 Major

Declare <!DOCTYPE html> to keep the test in standards mode.

Line 1 starts with non-doctype content, and HTMLHint reports this as an error. For crash tests, standards-mode consistency matters.

🔧 Proposed fix

+<!DOCTYPE html>
 <style>

🧰 Tools

🪛 HTMLHint (1.9.2)

[error] 1-1: Doctype must be declared before any non-comment content.

(doctype-first)

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@LayoutTests/animations/animation-apply-pending-animation-crash.html` at line
1, The file is missing a document type declaration which puts the test in quirks
mode; add an HTML5 doctype declaration ("<!DOCTYPE html>") as the very first
line of the file so the test runs in standards mode and HTMLHint no longer
reports a non-doctype error—ensure the doctype precedes any <style> or other
content at the top of animation-apply-pending-animation-crash.html.

[coderabbitai]

⚠️ Potential issue | 🟡 Minor

Add lang and <title> to satisfy HTML lint checks.

This file currently triggers html-lang-require and title-require.

Proposed fix

-<html>
+<html lang="en">
 <head>
+    <title>compositing-clip-path-empty expected</title>
     <style>

Also applies to: 16-16

🧰 Tools

🪛 HTMLHint (1.9.2)

[warning] 3-3: An lang attribute must be present on elements.

(html-lang-require)

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@LayoutTests/compositing/masks/compositing-clip-path-empty-expected.html`
around lines 3 - 4, The document is missing a lang attribute on the <html>
element and a <title> in the <head>, causing html-lang-require and title-require
lint failures; update the <html> start tag to include an appropriate lang
attribute (e.g., lang="en") and add a <title>...</title> element inside the
<head> (using a concise title relevant to the test) so both lint rules are
satisfied for the file (affects the <html> and <head> elements shown).

[coderabbitai]

⚠️ Potential issue | 🟡 Minor

Add minimal document metadata to satisfy HTML lint checks.

Please add lang on <html> and a <title> in <head> to resolve the reported HTMLHint issues.

Proposed fix

-<html>
+<html lang="en">
 <head>
+    <title>Compositing clip-path empty</title>
     <style>
         .box {
           width: 100px;

🧰 Tools

🪛 HTMLHint (1.9.2)

[warning] 3-3: An lang attribute must be present on elements.

(html-lang-require)

---

[error] 20-20: <title> must be present in tag.

(title-require)

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@LayoutTests/compositing/masks/compositing-clip-path-empty.html` around lines
3 - 20, Add minimal document metadata: set the lang attribute on the <html>
element (e.g., lang="en") and add a <title> element inside the <head> (e.g.,
<title>Compositing Clip Path Empty</title>) so the document satisfies HTML lint
rules; update the file's root <html> tag and the <head> section accordingly.

[coderabbitai]

⚠️ Potential issue | 🟡 Minor

Set document language on <html>.

Add lang="en" to resolve the HTML lang-require warning.

Proposed fix

-<html>
+<html lang="en">

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	<html>
	<html lang="en">

🧰 Tools

🪛 HTMLHint (1.9.2)

[warning] 2-2: An lang attribute must be present on elements.

(html-lang-require)

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In
`@LayoutTests/imported/w3c/web-platform-tests/css/CSS2/floats/float-avoids-float-with-margin-009.html`
at line 2, The HTML root element is missing a language attribute; update the
opening <html> tag (the element shown in the diff) to include a lang attribute
(e.g., lang="en") so the document declares its language and resolves the
lang-require warning.

[coderabbitai]

⚠️ Potential issue | 🟡 Minor

Missing lang on root <html>.

Please add lang="en" to satisfy HTML linting.

Proposed fix

-<html>
+<html lang="en">

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	<html>
	<html lang="en">

🧰 Tools

🪛 HTMLHint (1.9.2)

[warning] 2-2: An lang attribute must be present on elements.

(html-lang-require)

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In
`@LayoutTests/imported/w3c/web-platform-tests/css/CSS2/floats/float-avoids-float-with-margin-010-expected.html`
at line 2, The root HTML element is missing a lang attribute; update the opening
<html> tag in the file (the document's root <html> element) to include lang="en"
so it reads <html lang="en"> to satisfy HTML linting and accessibility
requirements.

[coderabbitai]

⚠️ Potential issue | 🟡 Minor

Add lang on the root <html> element.

Please add a language attribute to satisfy HTML linting and keep test documents standards-compliant.

Proposed fix

-<html>
+<html lang="en">

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	<html>
	<html lang="en">

🧰 Tools

🪛 HTMLHint (1.9.2)

[warning] 2-2: An lang attribute must be present on elements.

(html-lang-require)

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In
`@LayoutTests/imported/w3c/web-platform-tests/css/CSS2/floats/float-avoids-float-with-margin-010-ref.html`
at line 2, The root <html> element is missing a language attribute; update the
document's root tag (the <html> element in this file) to include an appropriate
lang attribute (e.g., lang="en" or the test's intended language) so the document
passes HTML linting and is standards-compliant.

[coderabbitai]

⚠️ Potential issue | 🟡 Minor

Add document language metadata on the root element.

Line 2 is missing lang, which triggers the active HTML lint rule and weakens accessibility metadata.

🔧 Proposed fix

-<html>
+<html lang="en">

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	<html>
	<html lang="en">

🧰 Tools

🪛 HTMLHint (1.9.2)

[warning] 2-2: An lang attribute must be present on elements.

(html-lang-require)

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In
`@LayoutTests/imported/w3c/web-platform-tests/css/CSS2/floats/float-avoids-float-with-margin-010.html`
at line 2, The root HTML element (<html>) is missing language metadata; add a
lang attribute (e.g., lang="en" or the appropriate locale) to the <html> tag so
the document includes language metadata for accessibility and lint rules
(optionally also add xml:lang if you need XML compatibility).

[coderabbitai]

⚠️ Potential issue | 🟡 Minor

Root <html> is missing lang.

Please add lang="en" to clear lint and improve document metadata quality.

Proposed fix

-<html>
+<html lang="en">

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	<html>
	<html lang="en">

🧰 Tools

🪛 HTMLHint (1.9.2)

[warning] 2-2: An lang attribute must be present on elements.

(html-lang-require)

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In
`@LayoutTests/imported/w3c/web-platform-tests/css/CSS2/floats/float-avoids-float-with-margin-ref.html`
at line 2, Add the missing language attribute to the root HTML element by
modifying the root <html> tag in the document (the top-level <html> element) to
include lang="en" so the file declares its primary language and satisfies the
linter requirement.

[coderabbitai]

Actionable comments posted: 35

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (2)

LayoutTests/fast/repaint/backgroundSizeRepaint.html (1)

4-22: ⚠️ Potential issue | 🟡 Minor

Add a <title> element to satisfy HTML linting.

<head> currently has no title, which is flagged by HTMLHint.

Proposed fix

 <head>
+<title>backgroundSizeRepaint</title>
 <style type="text/css">

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@LayoutTests/fast/repaint/backgroundSizeRepaint.html` around lines 4 - 22, Add
a <title> element inside the existing <head> to satisfy HTML linting: open the
head in the file that contains the window.addEventListener('load', async () => {
... }) script and add a concise title (for example
<title>backgroundSizeRepaint</title>) near the top of the head above the <style>
block so the document has a title while leaving the rest of the code
(document.getElementById('a'), document.getElementById('b'),
testRunner.waitUntilDone/notifyDone) unchanged.

LayoutTests/imported/w3c/web-platform-tests/css/css-scroll-snap/scroll-initial-target/scroll-initial-target-root.tentative.html (1)

62-64: ⚠️ Potential issue | 🟡 Minor

Close the root HTML element explicitly.

The document currently ends after </body> without </html>.

🔧 Suggested patch

 </body>
+</html>

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In
`@LayoutTests/imported/w3c/web-platform-tests/css/css-scroll-snap/scroll-initial-target/scroll-initial-target-root.tentative.html`
around lines 62 - 64, The HTML document ends with </body> but is missing the
closing root tag; update the file so the root element is explicitly closed by
adding a trailing </html> after the existing </body>, ensuring proper
well-formedness of the document.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@JSTests/wasm/stress/bounds-check-int32-offset-dirty-high-bits.js`:
- Around line 22-24: Rename the ambiguous variable `dirty` to a more descriptive
identifier such as `dirtyHighBitsAddress` (or add a short inline comment where
`const dirty = 0xffffffff00000000n;` is defined) so intent is explicit; update
all usages (e.g., the call to `instance.exports.run(dirty, 100)`) to use the new
name and keep the semantics unchanged.

In `@LayoutTests/fast/repaint/backgroundSizeRepaint.html`:
- Around line 10-15: The current guard returns early when window.testRunner is
missing so the DOM mutations for elements 'a' and 'b' never run for manual
tests; remove the early return and instead only call testRunner.waitUntilDone()
conditionally (e.g., if (window.testRunner) testRunner.waitUntilDone()) so that
document.getElementById('a').style.height = '40px' and
document.getElementById('b').style.height = '60px' always execute while still
preserving the waitWhenDone behavior when testRunner exists.

In `@LayoutTests/fullscreen/fullscreen-clears-hover-on-overlay.html`:
- Around line 2-17: Add basic document semantics: set a lang attribute on the
html element (e.g., lang="en"), add a <title> element inside the head to provide
a document title, and give the fullscreen trigger button (id "fs-btn") an
explicit type attribute (e.g., type="button") to avoid it acting as a submit
button.
- Around line 45-50: The assertion that fsBtn hover changed
(testExpected("fsBtn.style.backgroundColor", ...)) must be guarded by the same
precondition used earlier: only perform the mouse move and the subsequent
expectation if window.eventSender exists; so wrap the eventSender-dependent
actions and the testExpected call in the same conditional (check
window.eventSender) using the existing fsBtn/getBoundingClientRect and
eventSender.mouseMoveTo flow, ensuring that when eventSender is absent the test
skips the hover assertion rather than running it.

In
`@LayoutTests/http/tests/css/prefers-color-scheme-in-nested-iframes-follows-system-preference.html`:
- Around line 83-85: The code assigns to caughtEvent without a declaration,
creating an implicit global; fix by declaring the variable locally (e.g., add
"const caughtEvent = await ..." or "let caughtEvent = await ...") where the
assignment occurs so it doesn't leak to the global scope and works in strict
mode; update the promise-await line that currently reads "caughtEvent = await
new Promise(...)" to include the chosen declaration.

In `@LayoutTests/http/tests/navigation/cross-origin-navigation-fires-onload.html`:
- Line 1: The test currently forces non-default isolation by embedding the
directive "webkit-test-runner [ SiteIsolationEnabled=false ]" at the top of
LayoutTests/http/tests/navigation/cross-origin-navigation-fires-onload.html
which narrows cross-origin coverage; remove that forced flag or add a parallel
test variant that runs with SiteIsolationEnabled=true (or document why isolation
must be off) so the cross-origin behavior is exercised under the default
isolation-enabled execution model; update the file (or add a copy) and ensure
the test harness runs the isolation-enabled variant for cross-origin coverage.

In `@LayoutTests/http/tests/site-isolation/resources/text-input.html`:
- Around line 6-18: The message handler must be hardened: in the
window.addEventListener("message", ...) callback (the handler that checks
event.data.type for "getInputRect" and "getInputValue"), first verify
event.source === window.parent and that typeof event.data === "object" &&
event.data !== null and typeof event.data.type === "string"; only then handle
known types ("getInputRect" / "getInputValue"); when posting back, use
event.origin (not "*") and include only the minimal response fields (x/y for
getInputRect computed from
document.getElementById("target").getBoundingClientRect() and value for
getInputValue from .value). Ensure you early-return for unexpected senders or
malformed payloads so no data is leaked to other frames.

In `@LayoutTests/imported/w3c/resources/import-expectations.json`:
- Line 183: The import-expectations.json entry currently disables the entire
"web-platform-tests/file-system-access" import subtree which is too broad;
instead, restrict the suppression to specific failing subpaths (replace the
broad key with explicit paths under "web-platform-tests/file-system-access/..."
that are failing) or keep the broad suppression but add an adjacent comment or
metadata in the file documenting a tracking issue ID and an expiry date so the
suppression is reviewed (refer to the "web-platform-tests/file-system-access"
key and update the JSON accordingly).

In
`@LayoutTests/imported/w3c/web-platform-tests/css/css-anchor-position/position-visibility-anchor-valid.tentative.html`:
- Line 3: The title and the CSS rule use the singular spec keyword
"anchor-valid" but the spec requires the plural "anchors-valid"; update the
<title> text content ("CSS Anchor Positioning Test: position-visibility:
anchor-valid") to use "anchors-valid" and change the CSS declaration that uses
position-visibility: anchor-valid to position-visibility: anchors-valid so both
the document title and the stylesheet use the correct spec keyword.

In
`@LayoutTests/imported/w3c/web-platform-tests/css/css-scroll-snap/crashtests/fractional-covering-area-crash.html`:
- Line 2: The HTML root element (<html>) is missing a lang attribute; update the
<html> tag in fractional-covering-area-crash.html to include an appropriate
language code (for example lang="en") so the document complies with WPT
conventions and accessibility best practices, ensuring the change is applied to
the existing <html> element rather than adding a new duplicate.
- Line 6: Replace the deprecated CSS declaration "overflow: overlay" with a
standard value; locate the rule that includes the "overflow: overlay"
declaration (the overflow property in the stylesheet for the test page) and
change it to "overflow: auto" (or "overflow: scroll" if always-on scrollbars are
required) so the crashtest targets current browser behavior and avoids the
removed overlay value.

In
`@LayoutTests/imported/w3c/web-platform-tests/css/css-scroll-snap/input/keyboard.html`:
- Around line 47-56: The initializeScrollPosition function uses an async
executor inside new Promise, which is unnecessary and hides exceptions; refactor
by removing the new Promise wrapper and the async executor: make
initializeScrollPosition an async function that directly performs the check,
calls waitForScrollEndFallbackToDelayWithoutScrollEvent(scroller) and awaits it
when needed, then returns (or returns void) so errors propagate correctly and no
extra Promise wrapper remains.

In
`@LayoutTests/imported/w3c/web-platform-tests/css/css-scroll-snap/input/mouse-wheel.html`:
- Around line 57-65: The test only asserts final stabilization
(assert_approx_equals on scroller.scrollTop) but does not verify there was no
intermediate pause; modify the test around
waitForAnimationEnd/scrollStabilizedPromise to actively detect a pre-snap pause
by sampling scroller.scrollTop while the wheel-scroll is progressing and
asserting it does not remain within a small delta for longer than a short
threshold before the final snap. In practice, start a timer when the wheel event
begins, poll scroller.scrollTop at animation frames (or use a helper like
waitForAnimationEnd) and record timestamps when movement stalls; fail the test
if any stall duration exceeds the allowed threshold, then keep the existing
assert_approx_equals check for final position.

In
`@LayoutTests/imported/w3c/web-platform-tests/css/css-scroll-snap/multicol-001-expected.txt`:
- Around line 3-4: Add a TestExpectations entry to mark the failing multicol-001
test as a partial failure so it doesn't noise CI; locate the test named
"css/css-scroll-snap/multicol-001" (the assertions showing "scroll-snap-align:
end" and "scroll-snap-align: center" failures) and add a line in
TestExpectations marking it with [ Failure ] (include a bug reference like "bug
12345") so the harness records the test as expected-failing until
scroll-snap-align is fixed.

In
`@LayoutTests/imported/w3c/web-platform-tests/css/css-scroll-snap/overflowing-snap-areas-nested-expected.txt`:
- Around line 2-3: The baselined failures in the test output for "Snap within a
snap area which covers snapport on x" and "Snap within a snap area which covers
snapport on y" should not be committed as expected output; instead update the
test expectations by adding a TestExpectations entry that marks this test as [
Failure ] with an appropriate bug ID (e.g., BUG=...) so the test remains flagged
while allowing future changes to surface; locate the test by the failing
description strings from the diff and add the single-line expectation to your
TestExpectations file referencing the test path and a bug number.

In
`@LayoutTests/imported/w3c/web-platform-tests/css/css-scroll-snap/overscroll-snap.html`:
- Around line 4-6: The <meta viewport> tag is malformed and the document lacks a
<title>; replace the incorrect <meta viewport="..."> with a proper meta viewport
element using name="viewport" and content="width=device-width, initial-scale=1",
and add a descriptive <title> element inside the document head (adjacent to the
existing <link rel="help"> and <script src="/resources/testharness.js">) so the
page has valid viewport metadata and a document title.

In
`@LayoutTests/imported/w3c/web-platform-tests/css/css-scroll-snap/scroll-initial-target/parsing/scroll-initial-target-computed-expected.txt`:
- Around line 2-3: The expected-output file currently encodes unsupported
assertions as FAIL lines for the scroll-initial-target computed-style checks
(the two lines referencing scroll-initial-target value 'nearest' and 'none' in
scroll-initial-target-computed-expected.txt); remove those FAIL lines from the
baselined expected output and instead add an entry in TestExpectations marking
the corresponding test as a Failure (e.g., "[ Failure ] <test-name> = FAIL @
crbug.com/XXXXX") with a bug reference placeholder so the test runner reports
the known failure externally rather than hiding it in the expected file; ensure
the TestExpectations entry targets the same test that produced
scroll-initial-target-computed-expected.txt and include the bug number before
landing.

In
`@LayoutTests/imported/w3c/web-platform-tests/css/css-scroll-snap/scroll-initial-target/parsing/scroll-initial-target-computed.html`:
- Line 2: Add a lang attribute to the root HTML element: update the <html> start
tag (the document root) to include an appropriate language code (e.g.,
lang="en") so the root <html> element contains language metadata for
accessibility and HTML linting.

In
`@LayoutTests/imported/w3c/web-platform-tests/css/css-scroll-snap/scroll-initial-target/parsing/scroll-initial-target-invalid.html`:
- Line 2: The root <html> element is missing a lang attribute; update the <html>
tag in the file so it includes a document language (e.g., add lang="en" on the
<html> element; optionally include xml:lang if needed for XHTML) to ensure the
document language is declared.

In
`@LayoutTests/imported/w3c/web-platform-tests/css/css-scroll-snap/scroll-initial-target/parsing/scroll-initial-target-valid-expected.txt`:
- Around line 2-3: The baseline shows FAILs for the CSS property
scroll-initial-target when assigning "none" and "nearest" while the test uses
test_valid_value() expecting them to pass; fix by either (A) adding
TestExpectations entries that mark these tests as failing on the target platform
with a short reason so the baseline is tracked, referencing the test name/test
file and the values "none"/"nearest", or (B) update the implementation that
parses/sets the scroll-initial-target CSS property (the code path invoked by
e.style['scroll-initial-target'] and any parser/serializer for
scroll-initial-target) to accept and store the keywords "none" and "nearest" as
valid values so test_valid_value() passes; choose one approach and apply the
change consistently for both "none" and "nearest".

In
`@LayoutTests/imported/w3c/web-platform-tests/css/css-scroll-snap/scroll-initial-target/scroll-initial-target-aligns-with-snap-align.tentative.html`:
- Line 2: The root <html> element is missing a lang attribute; update the
opening html tag (the root <html> element in the file) to include an appropriate
language code (for example lang="en" or the document's primary language) so HTML
linting and accessibility metadata requirements are satisfied.

In
`@LayoutTests/imported/w3c/web-platform-tests/css/css-scroll-snap/scroll-initial-target/scroll-initial-target-root.tentative.html`:
- Line 2: The root html element is missing a language attribute; update the
<html> tag in the test file (the root element) to include an appropriate lang
value (e.g., lang="en" or the repo/project default) so the document has language
metadata; modify the <html> start tag to add the lang attribute.

In
`@LayoutTests/imported/w3c/web-platform-tests/css/css-scroll-snap/scroll-initial-target/scroll-initial-target-shadow-dom.tentative.html`:
- Line 2: Add a lang attribute to the root HTML element: update the root <html>
tag in the document (the top-level <html> element) to include an appropriate
language code (e.g., lang="en") so the document provides language metadata and
resolves the HTML lint warning.
- Around line 69-74: The duplicated id="space" attributes in the spacer elements
(the elements with class="space" inside the scrollers including the element
within the container and the one inside the element with id="slot2scroller")
must be made unique or removed; replace the repeated id with unique ids (e.g.,
space-1, space-2) or drop the id and rely on class="space" for
styling/selection, and update any CSS or JS selectors that reference `#space` to
use the new unique ids or the .space class so id-based lookups no longer break.

In
`@LayoutTests/imported/w3c/web-platform-tests/css/css-scroll-snap/scroll-initial-target/scroll-initial-target-span.tentative-expected.txt`:
- Line 2: The baseline marks the tentative feature test
"scroll-initial-target-span" as a failure in the expected file instead of using
TestExpectations; update the test expectations by adding an entry for the test
name "scroll-initial-target-span" in TestExpectations with "[ Failure ]
crbug.com/XXXXX" (replace XXXXX with the tracking bug) so the tentative/unstable
spec failure is tracked there rather than hardcoding the failure in the
tentative expected baseline; ensure the test name matches the existing test
(e.g., scroll-initial-target-span) and remove or adjust the tentative-expected
baseline entry accordingly.

In
`@LayoutTests/imported/w3c/web-platform-tests/css/css-scroll-snap/scroll-initial-target/scroll-initial-target-with-anchor-navigation-inner-frame.html`:
- Around line 2-5: Add basic document metadata by adding a lang attribute to the
root <html> element (e.g., lang="en") and including a <title> element inside the
existing <head> (e.g., <title>Scroll initial target test</title>) so the
document has language information and a title; update the <html> start tag and
add the <title> node within the <head> section.

In
`@LayoutTests/imported/w3c/web-platform-tests/css/css-scroll-snap/scroll-initial-target/scroll-initial-target-with-scroll-start.tentative-expected.txt`:
- Around line 1-3: The expected output file
scroll-initial-target-with-scroll-start.tentative-expected.txt contains
excessive blank lines around the single FAIL line; open that file and trim it so
it contains only the single FAIL message line ("FAIL  CSS Scroll Snap 2 Test:
scroll-initial-target* assert_approx_equals: scroll-initial-target sets initial
vertical scroll position expected 200 +/- 1 but got 0") with a single
terminating newline, removing the extra blank lines before and after.

In
`@LayoutTests/imported/w3c/web-platform-tests/css/CSS2/floats/float-avoids-float-with-margin-002-expected.html`:
- Line 2: The <html> root element is missing a lang attribute; update the HTML
tag (<html>) to include an appropriate lang value (e.g., lang="en") to satisfy
linting and accessibility checks by adding the attribute to the existing <html>
element.

In
`@LayoutTests/imported/w3c/web-platform-tests/css/CSS2/floats/float-avoids-float-with-margin-002-ref.html`:
- Line 2: The root <html> element is missing a lang attribute; update the HTML
start tag (the <html> element) to include an appropriate language tag (e.g.,
lang="en" or the document's correct BCP 47 language) so the document declares
its language for HTML linting and metadata completeness; ensure the value is a
valid language code.

In
`@LayoutTests/imported/w3c/web-platform-tests/css/CSS2/floats/float-avoids-float-with-margin-009-expected.html`:
- Line 2: The root HTML element is missing a lang attribute which fails linting
and reduces metadata consistency; add an appropriate lang attribute (for example
lang="en") to the <html> element in the test file so the root <html> tag
includes the language declaration, ensuring consistency across imported tests
and satisfying the linter.

In
`@LayoutTests/imported/w3c/web-platform-tests/css/CSS2/floats/float-avoids-float-with-margin-011-expected.html`:
- Line 2: Add a language attribute to the root <html> element: update the
opening <html> tag (the document's root element) to include a valid lang
attribute (e.g., lang="en" or appropriate language code for the test) so the
document passes HTML linting.

In
`@LayoutTests/imported/w3c/web-platform-tests/css/CSS2/floats/float-avoids-float-with-margin-011-ref.html`:
- Line 2: The root html element is missing a lang attribute; update the root
<html> tag in the file (the top-level html element) to include an appropriate
language attribute (e.g., lang="en" or the document's correct language) so the
reference file meets HTML metadata/lint expectations.

In
`@LayoutTests/imported/w3c/web-platform-tests/css/CSS2/floats/float-avoids-float-with-margin-011.html`:
- Line 2: Add a lang attribute to the root HTML element: locate the opening html
tag (<html>) in this document (the root element) and update it to include an
appropriate language code (e.g., lang="en") so the element becomes <html
lang="en"> to satisfy standards/lint compliance.

In `@LayoutTests/TestExpectations`:
- Line 2240: The skipped test line
"imported/w3c/web-platform-tests/html/semantics/embedded-content/the-object-element/object-fallback-failed-cross-origin-navigation.sub.html
[ Skip ] # Timeout" should include a bug tracker reference like
"webkit.org/b/XXXXXX"; update that entry to append the bug URL or bug ID (e.g.,
replace "# Timeout" with "# Timeout (webkit.org/b/123456)") so skips follow the
same pattern as other entries and the timeout can be tracked for investigation.
- Around line 8125-8129: These timeout skips for the five imported
embedded-content tests (canvas-descendants-focusability-006.html,
iframe_sandbox_allow_top_navigation_by_user_activation_with_user_gesture.html,
object-allowed-schemas.sub.window.html,
video-loading-lazy-autoplay-when-visible.html,
video-loading-lazy-in-viewport.html) need a tracking bug reference; file a
single umbrella bug for these related embedded-content timeouts and update each
Skip entry in LayoutTests/TestExpectations to include that bug ID or URL (e.g.,
append “# Timeout (crbug.com/XXXXX)” or “# Skip — bug XXXXX”) so each skipped
test line references the created bug for tracking.

---

Outside diff comments:
In `@LayoutTests/fast/repaint/backgroundSizeRepaint.html`:
- Around line 4-22: Add a <title> element inside the existing <head> to satisfy
HTML linting: open the head in the file that contains the
window.addEventListener('load', async () => { ... }) script and add a concise
title (for example <title>backgroundSizeRepaint</title>) near the top of the
head above the <style> block so the document has a title while leaving the rest
of the code (document.getElementById('a'), document.getElementById('b'),
testRunner.waitUntilDone/notifyDone) unchanged.

In
`@LayoutTests/imported/w3c/web-platform-tests/css/css-scroll-snap/scroll-initial-target/scroll-initial-target-root.tentative.html`:
- Around line 62-64: The HTML document ends with </body> but is missing the
closing root tag; update the file so the root element is explicitly closed by
adding a trailing </html> after the existing </body>, ensuring proper
well-formedness of the document.

---

Duplicate comments:
In `@JSTests/stress/iterator-dfg-fast-path-bad-time.js`:
- Around line 56-65: The test currently mutates Object.prototype["0"] and never
restores it, leaking the change beyond the stress loop; modify the test so you
save the original descriptor (or a flag if undefined) for Object.prototype["0"]
before defining the shadowing property, run the stress phase (the for loop using
testLoopCount and the shouldBe calls), and then restore the original descriptor
(or delete the property if it did not previously exist) in a finally block to
guarantee restoration even on failure; reference Object.prototype["0"], the
getter/setter descriptor you add, and the for (let i = 0; i < testLoopCount;
++i) loop when making the change.

In `@JSTests/stress/optional-chaining-in-condition-context.js`:
- Around line 373-377: Make testThis run in strict mode so
this.call(null)/call(undefined) stay null/undefined: add a "use strict";
directive as the first statement inside the function testThis (i.e., inside
function testThis() { "use strict"; ... }) so optional chaining actually
operates on null/undefined rather than the global object.

In `@JSTests/wasm/stress/const-expr-evaluate-error-offset.js`:
- Around line 21-23: The current check inspects error.message before ensuring an
exception was thrown, allowing a false pass; modify the logic around the error
variable (the same variable used in the existing if check) to first assert that
error is truthy (throw an explicit failure like "expected exception not thrown"
if it's falsy), then validate that error.message contains "byte 27" and throw
the existing "evaluation error contains wrong offset" if that substring is
missing.

In
`@LayoutTests/accessibility/canvas-drawFocusIfNeeded-bounds-with-object-fit.html`:
- Around line 21-37: The test hardcodes page-origin offsets (e.g., +8) when
computing expectedPageX/Y; update the test to query the canvas's page position
and use it to compute expectedPageX and expectedPageY instead of hardcoded
values. Locate the call to verifyCanvasFocusBounds (with canvasId: "canvas",
canvasDescendantId: "button") and compute the canvas page origin via the canvas
AX node or the canvas element's page bounds (e.g., get the canvas's pageX/pageY
or bounding rect) and add the scaled focus coordinates to those values to
produce expectedPageX/expectedPageY before calling verifyCanvasFocusBounds.

In
`@LayoutTests/accessibility/canvas-drawFocusIfNeeded-bounds-with-transform.html`:
- Around line 21-31: The test currently hardcodes the canvas page origin (using
"8 + ..."), which is brittle; update the test to compute expectedPageX and
expectedPageY from the canvas automation node like the other test does: obtain
the canvas automation node (axCanvas) for "canvas" via getAutomationNode or the
same helper used elsewhere, read axCanvas.pageX and axCanvas.pageY, and set
expectedPageX = axCanvas.pageX + focusX * scale and expectedPageY =
axCanvas.pageY + focusY * scale before calling verifyCanvasFocusBounds; keep
expectedWidth/expectedHeight computed from the focus size and scale and preserve
variance.

In `@LayoutTests/compositing/masks/compositing-clip-path-empty-expected.html`:
- Around line 3-4: The HTML expected file is missing a lang attribute on the
<html> element and a <title> in the <head>, causing HTMLHint failures; update
the <html> start tag to include a lang (e.g., lang="en") and add a minimal
<title> element inside the <head> (e.g.,
<title>compositing-clip-path-empty</title>) so lint checks pass.

In `@LayoutTests/compositing/masks/compositing-clip-path-empty.html`:
- Around line 3-5: Add minimal document metadata by updating the root <html>
element to include a lang attribute (e.g., lang="en") and adding a <title>
element inside the <head> (e.g., <title>Compositing clip-path empty</title>) so
the file passes HTMLHint; modify the existing <html> tag and the <head> block in
compositing-clip-path-empty.html (and the other referenced file) to include
these elements.

In `@LayoutTests/editing/inserting/insert-list-then-edit-command-crash.html`:
- Around line 16-21: The deferred completion callback unconditionally calls
testRunner.notifyDone(), which can throw if testRunner isn't present; update the
callback inside window.onload -> requestAnimationFrame -> setTimeout to guard
the call, e.g. check for typeof testRunner !== "undefined" && typeof
testRunner.notifyDone === "function" (or window.testRunner && typeof
window.testRunner.notifyDone === "function") before invoking notifyDone(), so
the test only calls notifyDone when the test runner API is available.

In `@LayoutTests/fast/css/resize-corner-over-child-layer.html`:
- Around line 1-3: This test is missing standards-mode metadata; add a HTML5
doctype and basic head metadata so it runs in standards mode: insert <!DOCTYPE
html>, change the <html> tag to include a lang attribute (e.g. lang="en"), and
add a minimal <head> with a <meta charset="utf-8"> and a <title> (e.g.
"resize-corner-over-child-layer") before the existing <style> so the test won't
run in quirks mode.
- Around line 21-23: Replace the silent early return at the check "if
(!window.eventSender) return;" with an explicit skip result: when
window.eventSender is missing, set a clear skip message (e.g.,
document.body.textContent = "SKIP: eventSender not available") and then exit;
also, if a test harness exists (e.g., layoutTestController or similar), call its
completion/notify method (layoutTestController.notifyDone() or equivalent) so
the test runner records the skip instead of leaving an empty result.

In `@LayoutTests/fast/css/vertical-text-overflow-ellipsis-text-align-center.html`:
- Line 37: The <img> elements used as decorative test images (e.g., the <img
src="resources/greenbox.png"> inside the <div class="testDiv"> and the other
similar <img> tags referenced in the diff) are missing alt attributes; update
each decorative <img> to include an empty alt attribute (alt="") to satisfy
accessibility/lint rules without changing test behavior — ensure you add alt=""
to the <img src="resources/greenbox.png"> instances and the other <img> tags
mentioned.

In
`@LayoutTests/fast/events/touch/ios/touch-event-regions-layer-tree/dblclick-document.html`:
- Around line 3-10: Add missing HTML metadata by adding a lang attribute to the
<html> element and a <title> element inside the <head>; specifically, update the
existing <html> tag to include lang="en" (or appropriate locale) and insert a
concise <title>...</title> in the head above the script block (the rest of the
head should remain unchanged so prepareForTest() and
window.addEventListener('load', dumpRegions, false) continue to run).

In
`@LayoutTests/fast/events/touch/ios/touch-event-regions-layer-tree/dblclick-iframes.html`:
- Line 26: The iframe element in dblclick-iframes.html is missing an accessible
name; add a descriptive title attribute to the <iframe> tag (the iframe with
width="200" height="120" srcdoc="...") to provide an accessible name (e.g.,
title="Description of iframe content") so screen readers can announce it.
- Line 18: The document is missing a <title> element inside the <head>; add a
<title> element between the existing <head> and </head> tags (e.g.,
<title>dblclick-iframes</title>) so the page has a proper document title and
screen-reader/SEO metadata; ensure the title content is descriptive and unique
for this test page.
- Line 21: The iframe element with attributes scrolling="no" width="200"
height="120" and srcdoc (the iframe tag in dblclick-iframes.html) lacks an
accessible name; add a descriptive title attribute (e.g., title="Example
content" or an appropriate description) to the <iframe> element so screen
readers can identify it.
- Line 33: The iframe in the test HTML (the <iframe ... srcdoc="..."> element)
lacks an accessible name; add a descriptive title attribute to that iframe tag
(e.g., title="..." ) so the element has an accessible name for assistive
technologies; update the iframe element in dblclick-iframes.html accordingly.
- Line 3: The top-level HTML element is missing the required lang attribute
which impairs accessibility; update the <html> element in dblclick-iframes.html
to include an appropriate language code (e.g., lang="en" or the document's
actual language) by adding the lang attribute to the existing <html> tag so
screen readers and AT tools can detect the document language.

In
`@LayoutTests/fast/events/touch/ios/touch-event-regions-layer-tree/dblclick-window.html`:
- Around line 3-10: Add the missing document metadata by adding a lang attribute
to the <html> element (e.g., <html lang="en">) and include a <title> element
inside the <head> (e.g., <title>Touch event regions dblclick window</title>),
placing the <title> before the scripts that call prepareForTest() and before the
window.addEventListener('load', dumpRegions, false) invocation so the document
declares language and a title for lint compliance.

In
`@LayoutTests/fast/events/touch/ios/touch-event-regions-layer-tree/mousemove-mouseup.html`:
- Around line 2-14: Add missing HTML metadata by setting the lang attribute on
the <html> element and adding a <title> element inside the <head>; update the
top-level <html> tag to include lang="en" (or appropriate locale) and insert a
concise <title> within the <head> section to satisfy lint requirements.

In `@LayoutTests/fast/loader/navigate-on-pageswap-crash.html`:
- Around line 6-12: The test currently calls testRunner?.notifyDone()
immediately when sessionStorage.testCompleted is set, which signals completion
too early; change the flow so the first pass only sets
sessionStorage.testCompleted and awaits navigation.reload(), and on the
subsequent pass (when sessionStorage.testCompleted is present) run the
repro/crash sequence and only after that call testRunner?.notifyDone(); in other
words, remove/move the notifyDone() call out of the early branch and place it at
the very end of the second-pass path that executes the repro.
- Around line 1-2: Prepend the HTML5 doctype declaration to the test file so it
runs in standards mode: add "<!DOCTYPE html>" as the very first line of the file
(before the existing "<!-- webkit-test-runner [ dumpJSConsoleLogInStdErr=true ]
-->" comment and the "<script>" tag) in
LayoutTests/fast/loader/navigate-on-pageswap-crash.html.

In `@LayoutTests/fast/mediastream/image-capture-take-photo.html`:
- Around line 187-188: photoPromises is awaited before constraintPromises which
can leave a constraint rejection unhandled; fix by awaiting both promise arrays
concurrently instead of sequentially—combine photoPromises and
constraintPromises into a single Promise.all call (or start both Promise.all
calls and await them together) so that rejections from constraintPromises are
observed at the same time as photoPromises.

In `@LayoutTests/fast/repaint/resources/line-flow-with-floats.js`:
- Around line 5-10: The completion path can run multiple times because the
condition allows any loadCount >= 2; change the guard so the body runs exactly
once by testing for equality to the expected count (e.g. require ++loadCount ===
2 or loadCount++ === 1) instead of >=, then call document.body.offsetTop,
test(iframe.contentDocument) and window.testRunner?.notifyDone() only when that
equality holds; update the increment/check around loadCount to ensure test(...)
and notifyDone() execute a single time.

In `@LayoutTests/fast/selectors/has-invalidation-traversal-size.html`:
- Around line 147-149: The HTML contains two consecutive closing "</script>"
tags where the second "</script>" is unmatched; remove the extra closing
"</script>" so there is only a single closing script tag before the closing body
tag (i.e., ensure the script block is closed once and delete the duplicate
"</script>" token).

In
`@LayoutTests/fast/shadow-dom/slot-display-contents-composed-tree-after-display-toggle.html`:
- Line 1: This HTML test file is missing a doctype which can trigger quirks
mode; add a <!DOCTYPE html> declaration at the very top of the file (before the
existing <script> tag in this file) so the document is parsed in standards mode
and composed-tree/layout output is stable across ports.

In
`@LayoutTests/http/tests/css/prefers-color-scheme-in-nested-iframes-follows-system-preference.html`:
- Around line 117-122: Update the two inline comments that say "Light system
preferrence." and "Dark system preferrence." to correct the spelling to "Light
system preference." and "Dark system preference." near the test invocation using
run_tests and the expectedLightColor / expectedDarkColor variables so the
comments accurately reflect system preference.

In
`@LayoutTests/http/tests/lockdown-mode/svg-with-unsupported-font-does-not-crash.html`:
- Around line 2-4: Add missing HTML metadata and accessibility attributes: set a
lang attribute on the <html> element (e.g., lang="en"), add a <title> element
inside the <head> (e.g., <title>Test: svg-with-unsupported-font</title>), and
provide a descriptive alt attribute on the <img> element referenced in the file
(the <img> around line 21) so the document passes basic accessibility/lint
checks.
- Around line 15-21: The test currently calls testPassed() and finishJSTest()
immediately in test(), which can false-pass before the SVG image actually loads;
change test() to wait for the image load outcome by selecting the <img> (e.g.,
by adding an id or querying the src) and attach onload and onerror handlers that
call testPassed("...") on success or testFailed("...") on error, then call
finishJSTest() from those handlers so the test only finishes after the image
load result is observed.

In `@LayoutTests/http/tests/navigation/cross-site-iframe-nav.html`:
- Around line 28-33: The function recordBack1Event is mutating
back1ExpectedEvents with arbitrary keys (back1ExpectedEvents[name] = true); add
validation to only accept known event names before mutating: check that name
exists in the back1ExpectedEvents map (e.g. via
Object.prototype.hasOwnProperty.call(back1ExpectedEvents, name) or an explicit
allowed-names set) and if it does not, fail fast (return false or throw) so
typos/unknown events don't silently block completion; keep the existing
completion logic that sets back1ExpectedEvents = null when both popup and
crosssite are true.

In
`@LayoutTests/http/tests/security/XFrameOptions/x-frame-options-ignore-deny-meta-tag-in-body.html`:
- Line 18: The deferred callback calls testRunner.notifyDone() unguarded and can
throw when the harness is absent; update the setTimeout callback so it checks
that testRunner is defined and has notifyDone (e.g., typeof testRunner !==
'undefined' && typeof testRunner.notifyDone === 'function') before invoking it,
keeping the setTimeout(..., 0) behavior and only calling notifyDone when
present.

In
`@LayoutTests/http/tests/security/XFrameOptions/x-frame-options-ignore-deny-meta-tag.html`:
- Line 18: The unconditional setTimeout(() => testRunner.notifyDone(), 0) can
throw if window.testRunner is undefined; change it to only call notifyDone when
the harness exists by guarding the call (e.g., check window.testRunner or typeof
testRunner !== "undefined") before invoking testRunner.notifyDone inside the
setTimeout or by wrapping the notify call in a conditional so the test won't
error in environments without the harness.

In `@LayoutTests/http/tests/site-isolation/focus-wrap-across-remote-frames.html`:
- Around line 2-30: Add missing accessibility attributes: set a lang attribute
on the <html> element, give the input with id "outerInput" an accessible label
(either add a <label for="outerInput">...<\/label> or add
aria-label/aria-labelledby on the element), and provide an accessible name for
the iframe with id "testIframe" (use title, aria-label, or aria-labelledby).
Update the test markup around the "outerInput" and "testIframe" identifiers to
include these attributes so the test page is properly accessible.
- Around line 33-57: The async runTest function can hang if an awaited promise
rejects before finishJSTest() is reached; wrap the main body of runTest in a
try/finally (or use try/catch/finally) so finishJSTest() is always called in the
finally block on success or any failure. Locate the runTest function and ensure
that after performing UIHelper.setHardwareKeyboardAttached, focus checks,
UIHelper.keyDown calls, and waitForActiveElementTagName awaits, finishJSTest()
is invoked from a finally block so it runs even when await rejects.

In `@LayoutTests/http/tests/site-isolation/resources/text-input.html`:
- Around line 2-4: The HTML lacks language and an accessible label for the
input: add a lang attribute (e.g., lang="en") to the <html> element and provide
an accessible label for the input with id="target" — either add a visible <label
for="target">...<\/label> or an aria-label/aria-labelledby on the input — so the
page has a declared language and the input is properly labeled for assistive
technologies.

In
`@LayoutTests/http/tests/workers/service/resources/postmessage-after-sw-process-crash.js`:
- Around line 4-8: The guard using the module-level variable didFinish is unsafe
because some failure branches and the PASS path don't set it before calling
finishSWTest(), allowing re-entry; update the
navigator.serviceWorker.addEventListener("message", async function(event) { ...
}) handler (and the other similar blocks noted) so that every completion path
sets didFinish = true before returning or before calling finishSWTest(), and
ensure all error/early-return branches also set didFinish = true so the handler
cannot run twice.

In `@LayoutTests/http/tests/xmlhttprequest/abort-should-cancel-load.html`:
- Line 23: The timeout callback unconditionally dereferences
testRunner.notifyDone which can throw if testRunner is undefined; modify the
setTimeout callback used around testRunner.notifyDone so it first checks that
testRunner exists and has notifyDone (e.g., guard with a conditional like
checking typeof testRunner !== 'undefined' or testing testRunner &&
testRunner.notifyDone) before calling notifyDone from the setTimeout callback.

In
`@LayoutTests/http/wpt/html/browsers/browsing-the-web/navigating-across-documents/navigating-iframe-sandbox.html`:
- Line 20: The while loops using "while (++counter < 50 && !isOk)" perform only
49 attempts due to the pre-increment < 50 check; update both occurrences (the
loops that reference counter and isOk) to use a <= comparison (e.g., "++counter
<= 50 && !isOk") so the loop will allow 50 retries; apply the same change at
both loop sites referenced in the diff.

In `@LayoutTests/http/wpt/service-workers/third-party-registration.html`:
- Line 33: The failure message uses a shortened origin; update the string passed
to logAndFinishTest so it matches the expected origin format used in the
assertion—change the message that references ancestorOriginsData[0] in the
logAndFinishTest call to include the full origin "http://localhost:8801" (e.g.,
replace localhost:8801 with http://localhost:8801) so the text is consistent
with the expectation.

In
`@LayoutTests/imported/w3c/web-platform-tests/css/css-anchor-position/position-visibility-anchor-visible.html`:
- Around line 27-28: Replace the invalid value and remove the redundant
declaration: change the second declaration of the CSS property
position-visibility from "anchor-visible" to the spec-correct "anchors-visible"
and delete the prior "position-visibility: always;" line since it is immediately
overridden; ensure the resulting rule only contains a single
position-visibility: anchors-visible declaration.

In
`@LayoutTests/imported/w3c/web-platform-tests/css/css-scroll-snap/input/scroll-padding-paged-expected.txt`:
- Around line 8-10: Remove the "Harness Error (TIMEOUT)" and timeout lines from
the expected output file (scroll-padding-paged-expected.txt) so infrastructural
timeouts are not treated as correct behavior, and instead add an entry for this
test to the appropriate TestExpectations file using "[ Timeout ]" or "[ Skip ]"
with a bug/triage reference (e.g., for the scroll-padding-paged test) until the
test is stabilized; ensure the expectation targets the same test identifier used
by the harness so CI treats it as a timeout/skip rather than passing.

In
`@LayoutTests/imported/w3c/web-platform-tests/css/css-scroll-snap/scroll-initial-target/scroll-initial-target-span.tentative.html`:
- Around line 20-39: The <span id="target" class="target"> is invalid because it
contains a block <div class="box">; change the target element to a block-level
element (e.g., replace the <span id="target" class="target"> with <div
id="target" class="target"> and its matching closing tag) so the DOM/parsing and
element geometry remain stable when testing scroll-initial-target: nearest on
`#target/.target`.

In
`@LayoutTests/imported/w3c/web-platform-tests/css/css-scroll-snap/scroll-initial-target/scroll-initial-target-with-anchor-navigation.tentative.html`:
- Line 18: The iframe element with id "frame"
(src="scroll-initial-target-with-anchor-navigation-inner-frame.html" and
onload="runTest()") lacks an accessible name; add a descriptive title attribute
to that iframe (e.g., title="Scroll initial-target test frame" or similar) so
the frame has an accessible name for assistive technologies.
- Line 2: The root <html> element in the test is missing an explicit lang
attribute; update the root <html> tag in
scroll-initial-target-with-anchor-navigation.tentative.html to include a valid
language tag (e.g., lang="en" or the document’s correct language) so the
document provides explicit language metadata per HTML requirements.

In
`@LayoutTests/imported/w3c/web-platform-tests/css/css-scroll-snap/scroll-initial-target/scroll-initial-target-with-hash-fragment-navigation.tentative.html`:
- Line 34: The HTML document is missing the closing </html> tag at EOF; open the
test file and add the missing </html> closing tag to properly terminate the root
<html> element (ensure it comes after the existing </body> tag so the document
is well-formed).

In
`@LayoutTests/imported/w3c/web-platform-tests/css/css-scroll-snap/scroll-initial-target/scroll-initial-target-with-scroll-snap.tentative.html`:
- Line 79: The document is missing the closing root element tag; add a closing
</html> tag at the end of the file to properly close the root <html> element and
ensure the document is well-formed (i.e., after the existing </body> append the
closing </html> tag so the <html> element started at the top is properly
closed).
- Around line 66-71: The expected-offset calculations are broken due to an
ID/name mismatch and a dropped addition; replace the inconsistent centerbox
symbol with center_box and compute expected_scroll_top as
top_left_box.getBoundingClientRect().height +
center_box.getBoundingClientRect().height, and compute expected_scroll_left as
top_left_box.getBoundingClientRect().width +
center_box.getBoundingClientRect().width so both dimensions sum correctly (fix
the stray no-op expression and use the correct center_box identifier in the
expressions).

In
`@LayoutTests/imported/w3c/web-platform-tests/css/css-scroll-snap/scroll-initial-target/scroll-initial-target-with-scroll-start-root.tentative.html`:
- Line 66: The HTML document is missing the closing </html> tag that matches the
opening <html> element (opened near the top of the file); add a single closing
</html> tag after the existing </body> to properly close the root element and
ensure the document is well-formed.

In
`@LayoutTests/imported/w3c/web-platform-tests/css/CSS2/floats/float-avoids-float-with-margin-003-expected.html`:
- Line 2: The <html> element is missing language metadata; update the <html> tag
(the "<html>" element) to include an appropriate lang attribute (for example
change "<html>" to "<html lang=\"en\">") so the document declares its language.

In
`@LayoutTests/imported/w3c/web-platform-tests/css/CSS2/floats/float-avoids-float-with-margin-009-ref.html`:
- Line 2: The root <html> element is missing a lang attribute; update the root
tag (the lone "<html>" in the file) to include an appropriate language
declaration (e.g., lang="en" or the document's actual language) so the element
becomes "<html lang=\"...\">", ensuring the document conforms to the lint rule
requiring a lang attribute on the root element.

In
`@LayoutTests/imported/w3c/web-platform-tests/css/CSS2/floats/float-avoids-float-with-margin-012-expected.html`:
- Line 2: The HTML root element (<html>) is missing a lang attribute which
triggers the language-metadata lint warning; update the document's root element
(the <html> tag) to include an appropriate lang value (e.g., lang="en" or the
correct language code for the document) so that the <html> element declares the
page language.

In
`@LayoutTests/imported/w3c/web-platform-tests/css/CSS2/floats/float-avoids-float-with-margin-012-ref.html`:
- Line 2: The root HTML element is missing a lang attribute; add an appropriate
language code (e.g., lang="en" or the document's actual language) to the <html>
element in float-avoids-float-with-margin-012-ref.html so the document declares
its language on the root element; ensure the attribute is placed on the existing
<html> tag and commit the change.

In
`@LayoutTests/imported/w3c/web-platform-tests/css/CSS2/floats/float-avoids-float-with-margin-ref.html`:
- Line 2: The root <html> element is missing a lang attribute; update the
document's root element (the <html> tag) to include an appropriate lang value
(e.g., lang="en" or the document's actual language) so the document declares its
language metadata.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

[coderabbitai]

🧹 Nitpick | 🔵 Trivial

Consider making the dirty-value intent more explicit.

A name like dirtyHighBitsAddress (or a short inline comment) would improve quick triage readability.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@JSTests/wasm/stress/bounds-check-int32-offset-dirty-high-bits.js` around
lines 22 - 24, Rename the ambiguous variable `dirty` to a more descriptive
identifier such as `dirtyHighBitsAddress` (or add a short inline comment where
`const dirty = 0xffffffff00000000n;` is defined) so intent is explicit; update
all usages (e.g., the call to `instance.exports.run(dirty, 100)`) to use the new
name and keep the semantics unchanged.

[coderabbitai]

⚠️ Potential issue | 🟡 Minor

Don’t gate the visual mutation behind testRunner availability.

Line 10 returns before Lines 14-15, so manual runs won’t execute the resize step at all.

Proposed fix

         window.addEventListener('load', async () => {
-            if (!window.testRunner)
-                return;
-            testRunner.waitUntilDone();
-
             document.getElementById('a').style.height = '40px';
             document.getElementById('b').style.height = '60px';
 
+            if (!window.testRunner)
+                return;
+            testRunner.waitUntilDone();
+
             await new Promise(requestAnimationFrame);
 
             testRunner.notifyDone();
         });

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	if (!window.testRunner)
	return;
	testRunner.waitUntilDone();
	function runTest()
	{
	document.getElementById('a').style.height = '40px';
	document.getElementById('b').style.height = '60px';
	if (window.testRunner)
	testRunner.notifyDone();
	}
	document.getElementById('a').style.height = '40px';
	document.getElementById('b').style.height = '60px';
	window.addEventListener('load', async () => {
	document.getElementById('a').style.height = '40px';
	document.getElementById('b').style.height = '60px';
	if (!window.testRunner)
	return;
	testRunner.waitUntilDone();
	await new Promise(requestAnimationFrame);
	testRunner.notifyDone();
	});

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@LayoutTests/fast/repaint/backgroundSizeRepaint.html` around lines 10 - 15,
The current guard returns early when window.testRunner is missing so the DOM
mutations for elements 'a' and 'b' never run for manual tests; remove the early
return and instead only call testRunner.waitUntilDone() conditionally (e.g., if
(window.testRunner) testRunner.waitUntilDone()) so that
document.getElementById('a').style.height = '40px' and
document.getElementById('b').style.height = '60px' always execute while still
preserving the waitWhenDone behavior when testRunner exists.

[coderabbitai]

⚠️ Potential issue | 🟡 Minor

Add basic document semantics (lang, title, button type).

Line 2, Line 3-10, and Line 17 are missing standard attributes/elements flagged by static analysis. This is minor, but worth fixing for consistency and accessibility hygiene.

Proposed fix

-<html>
+<html lang="en">
 <head>
+<title>Fullscreen clears hover on overlay</title>
 <script src="full-screen-test.js"></script>
 <style>
@@
-        <button id="fs-btn">Enter Fullscreen</button>
+        <button id="fs-btn" type="button">Enter Fullscreen</button>

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	<html>
	<head>
	<script src="full-screen-test.js"></script>
	<style>
	#target { position: relative; width: 300px; height: 200px; background: #eee; }
	#overlay { position: absolute; inset: 0; display: flex; flex-direction: column; }
	#fs-btn { padding: 8px; margin-top: auto; }
	</style>
	</head>
	<body>
	<p>Tests that entering fullscreen dispatches boundary events so that
	JS-driven hover state on a full-coverage overlay is properly cleared.</p>
	<div id="target">
	<div id="overlay">
	<p>Fullscreen content</p>
	<button id="fs-btn">Enter Fullscreen</button>
	<html lang="en">
	<head>
	<title>Fullscreen clears hover on overlay</title>
	<script src="full-screen-test.js"></script>
	<style>
	`#target` { position: relative; width: 300px; height: 200px; background: `#eee`; }
	`#overlay` { position: absolute; inset: 0; display: flex; flex-direction: column; }
	`#fs-btn` { padding: 8px; margin-top: auto; }
	</style>
	</head>
	<body>
	<p>Tests that entering fullscreen dispatches boundary events so that
	JS-driven hover state on a full-coverage overlay is properly cleared.</p>
	<div id="target">
	<div id="overlay">
	<p>Fullscreen content</p>
	<button id="fs-btn" type="button">Enter Fullscreen</button>

🧰 Tools

🪛 HTMLHint (1.9.2)

[warning] 2-2: An lang attribute must be present on elements.

(html-lang-require)

---

[error] 10-10: <title> must be present in tag.

(title-require)

---

[warning] 17-17: The type attribute must be present on elements.

(button-type-require)

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@LayoutTests/fullscreen/fullscreen-clears-hover-on-overlay.html` around lines
2 - 17, Add basic document semantics: set a lang attribute on the html element
(e.g., lang="en"), add a <title> element inside the head to provide a document
title, and give the fullscreen trigger button (id "fs-btn") an explicit type
attribute (e.g., type="button") to avoid it acting as a submit button.

[coderabbitai]

⚠️ Potential issue | 🟠 Major

Guard the precondition assertion when eventSender is unavailable.

Line 50 assumes hover was established, but Line 45 makes that conditional. On harnesses without eventSender, this assertion fails even though functionality isn’t under test there.

Proposed fix

-    if (window.eventSender) {
+    if (window.eventSender) {
         var btnRect = fsBtn.getBoundingClientRect();
         eventSender.mouseMoveTo(btnRect.left + btnRect.width / 2, btnRect.top + btnRect.height / 2);
+        testExpected("fsBtn.style.backgroundColor", "rgba(0, 0, 255, 0.2)");
+    } else {
+        debug("SKIP: eventSender is required for pointer precondition.");
+        endTest();
+        throw new Error("eventSender unavailable");
     }
-
-    testExpected("fsBtn.style.backgroundColor", "rgba(0, 0, 255, 0.2)");

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	if (window.eventSender) {
	var btnRect = fsBtn.getBoundingClientRect();
	eventSender.mouseMoveTo(btnRect.left + btnRect.width / 2, btnRect.top + btnRect.height / 2);
	}
	testExpected("fsBtn.style.backgroundColor", "rgba(0, 0, 255, 0.2)");
	if (window.eventSender) {
	var btnRect = fsBtn.getBoundingClientRect();
	eventSender.mouseMoveTo(btnRect.left + btnRect.width / 2, btnRect.top + btnRect.height / 2);
	testExpected("fsBtn.style.backgroundColor", "rgba(0, 0, 255, 0.2)");
	} else {
	debug("SKIP: eventSender is required for pointer precondition.");
	endTest();
	throw new Error("eventSender unavailable");
	}

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@LayoutTests/fullscreen/fullscreen-clears-hover-on-overlay.html` around lines
45 - 50, The assertion that fsBtn hover changed
(testExpected("fsBtn.style.backgroundColor", ...)) must be guarded by the same
precondition used earlier: only perform the mouse move and the subsequent
expectation if window.eventSender exists; so wrap the eventSender-dependent
actions and the testExpected call in the same conditional (check
window.eventSender) using the existing fsBtn/getBoundingClientRect and
eventSender.mouseMoveTo flow, ensuring that when eventSender is absent the test
skips the hover assertion rather than running it.

[coderabbitai]

⚠️ Potential issue | 🟡 Minor

Missing variable declaration creates implicit global.

caughtEvent is assigned without let/const/var, creating an implicit global variable. This would fail in strict mode.

Suggested fix

-      caughtEvent = await new Promise((resolve) => window.addEventListener("message", resolve, { once: true }));
+      const caughtEvent = await new Promise((resolve) => window.addEventListener("message", resolve, { once: true }));

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	caughtEvent = await new Promise((resolve) => window.addEventListener("message", resolve, { once: true }));
	shouldBeEqualToString("caughtEvent.data", expectedColor);
	main.replaceChildren();
	const caughtEvent = await new Promise((resolve) => window.addEventListener("message", resolve, { once: true }));
	shouldBeEqualToString("caughtEvent.data", expectedColor);
	main.replaceChildren();

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In
`@LayoutTests/http/tests/css/prefers-color-scheme-in-nested-iframes-follows-system-preference.html`
around lines 83 - 85, The code assigns to caughtEvent without a declaration,
creating an implicit global; fix by declaring the variable locally (e.g., add
"const caughtEvent = await ..." or "let caughtEvent = await ...") where the
assignment occurs so it doesn't leak to the global scope and works in strict
mode; update the promise-await line that currently reads "caughtEvent = await
new Promise(...)" to include the chosen declaration.

[coderabbitai]

⚠️ Potential issue | 🟡 Minor

Add a language attribute on the root element.

<html> is missing lang, which keeps tripping HTML linting on these test documents.

🔧 Proposed fix

-<html>
+<html lang="en">

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	<html>
	<html lang="en">

🧰 Tools

🪛 HTMLHint (1.9.2)

[warning] 2-2: An lang attribute must be present on elements.

(html-lang-require)

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In
`@LayoutTests/imported/w3c/web-platform-tests/css/CSS2/floats/float-avoids-float-with-margin-011-expected.html`
at line 2, Add a language attribute to the root <html> element: update the
opening <html> tag (the document's root element) to include a valid lang
attribute (e.g., lang="en" or appropriate language code for the test) so the
document passes HTML linting.

[coderabbitai]

⚠️ Potential issue | 🟡 Minor

Add lang to the root <html> element.

This keeps the new reference file aligned with HTML metadata/lint expectations.

🔧 Proposed fix

-<html>
+<html lang="en">

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	<html>
	<html lang="en">

🧰 Tools

🪛 HTMLHint (1.9.2)

[warning] 2-2: An lang attribute must be present on elements.

(html-lang-require)

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In
`@LayoutTests/imported/w3c/web-platform-tests/css/CSS2/floats/float-avoids-float-with-margin-011-ref.html`
at line 2, The root html element is missing a lang attribute; update the root
<html> tag in the file (the top-level html element) to include an appropriate
language attribute (e.g., lang="en" or the document's correct language) so the
reference file meets HTML metadata/lint expectations.

[coderabbitai]

⚠️ Potential issue | 🟡 Minor

Add lang to the root HTML element.

Line 2 should include lang for standards/lint compliance.

Suggested fix

-<html>
+<html lang="en">

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	<html>
	<html lang="en">

🧰 Tools

🪛 HTMLHint (1.9.2)

[warning] 2-2: An lang attribute must be present on elements.

(html-lang-require)

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In
`@LayoutTests/imported/w3c/web-platform-tests/css/CSS2/floats/float-avoids-float-with-margin-011.html`
at line 2, Add a lang attribute to the root HTML element: locate the opening
html tag (<html>) in this document (the root element) and update it to include
an appropriate language code (e.g., lang="en") so the element becomes <html
lang="en"> to satisfy standards/lint compliance.

[coderabbitai]

🧹 Nitpick | 🔵 Trivial

Consider adding a bug reference for the skipped test.

Skipping tests due to timeout should ideally be tracked with a bug reference (e.g., webkit.org/b/XXXXXX) so the issue can be investigated and resolved. Other skip entries in this file follow this pattern.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@LayoutTests/TestExpectations` at line 2240, The skipped test line
"imported/w3c/web-platform-tests/html/semantics/embedded-content/the-object-element/object-fallback-failed-cross-origin-navigation.sub.html
[ Skip ] # Timeout" should include a bug tracker reference like
"webkit.org/b/XXXXXX"; update that entry to append the bug URL or bug ID (e.g.,
replace "# Timeout" with "# Timeout (webkit.org/b/123456)") so skips follow the
same pattern as other entries and the timeout can be tracked for investigation.

[coderabbitai]

🧹 Nitpick | 🔵 Trivial

Consider adding bug references for these skipped tests.

These five timeout skips lack bug references for tracking. Consider filing a single bug to track these related embedded-content timeout issues, which would help ensure they're eventually investigated.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@LayoutTests/TestExpectations` around lines 8125 - 8129, These timeout skips
for the five imported embedded-content tests
(canvas-descendants-focusability-006.html,
iframe_sandbox_allow_top_navigation_by_user_activation_with_user_gesture.html,
object-allowed-schemas.sub.window.html,
video-loading-lazy-autoplay-when-visible.html,
video-loading-lazy-in-viewport.html) need a tracking bug reference; file a
single umbrella bug for these related embedded-content timeouts and update each
Skip entry in LayoutTests/TestExpectations to include that bug ID or URL (e.g.,
append “# Timeout (crbug.com/XXXXX)” or “# Skip — bug XXXXX”) so each skipped
test line references the created bug for tracking.