Upgrade to upstream WebKit 24362e675175

[sosukesuzuki]

Merge upstream WebKit 24362e675175 into the Bun fork.

Previous merge base: 51cc3feb7298 (#248). 464 upstream commits, 83 touching Source/JavaScriptCore / Source/WTF / Source/bmalloc.

Conflict resolutions

• runtime/JSMicrotask.cpp, runtime/JSPromisePrototype.cpp: ported the USE(BUN_JSC_ADDITIONS) async-context (AsyncLocalStorage) wrapping to upstream's reworked promise/async-generator internals — InternalMicrotask::AsyncGeneratorResumeNext → AsyncGeneratorAwaitReturn (https://bugs.webkit.org/show_bug.cgi?id=316447) and Promise.prototype.finally contexts now stored in JSSlimPromiseReaction instead of JSPromiseCombinatorsGlobalContext (https://bugs.webkit.org/show_bug.cgi?id=316553).
• runtime/JSFunction.cpp: took upstream's deletion of the finishCreation overloads (https://bugs.webkit.org/show_bug.cgi?id=316443); the fork's ASSERT reorder is obsolete.
• runtime/CodeCache.cpp: took upstream's requires-clause modernization.
• heap/FreeListInlines.h: upstream adopted the same MarkedBlock::blockSize assert bound the fork already had; kept the fork's explanatory comment.
• heap/GCOwnedDataScope.h, runtime/GetPutInfo.h: kept the fork's quote-style includes, added upstream's new includes.

Verified with a JSCOnly debug build plus a full Bun debug build and async-generator / AsyncLocalStorage / Promise.prototype.finally test runs.

[coderabbitai]

Walkthrough

The pull request updates build configuration and versioning, adds broad JavaScript, Temporal, Intl, and WebAssembly test coverage, reduces test262 skips and expectations, and adds or modernizes many LayoutTests and expected outputs.

Changes

Build, engine tests, and layout test updates

Layer / File(s)	Summary
Build configuration and versioning .gitignore, CMakeLists.txt, Configurations/CommonBase.xcconfig, Configurations/Version.xcconfig	Adds ignored build artifacts, changes early CMake Darwin/iOS setup and header-map generation, updates Swift frontend flags, and bumps TINY_VERSION to 21.
JavaScript engine microbenchmarks and non-Temporal regressions JSTests/microbenchmarks/*, JSTests/modules/*, JSTests/stress/class-fields-*, JSTests/stress/iterator-close-*, JSTests/stress/multi-*, JSTests/stress/regexp-*, JSTests/stress/string*, JSTests/stress/yarr-*	Adds new microbenchmarks and stress tests for class fields, RegExp matching paths, iterator closing, array DFG access/store behavior, string fast paths, and Yarr regex behavior.
Async generator and Promise semantics JSTests/stress/async-generator-*, JSTests/stress/promise-*	Adds reentrancy and observable-property tests for async generators and Promise constructor, resolution, and resolving-function behavior.
Temporal, Intl, and test262 coverage JSTests/stress/temporal-*, JSTests/stress/intl-*, JSTests/test262/*	Enables more Temporal coverage, adds many Temporal and Intl stress tests, removes related test262 skips and expectations, and updates one Temporal test262 metadata header.
WebAssembly regressions JSTests/wasm/stress/*, JSTests/stress/wasm-table-*	Adds wasm stress tests for memory32 operand normalization, table constructor defaults, and indirect tail-call argument forwarding.
New layout regressions and expectation changes LayoutTests/TestExpectations, LayoutTests/accessibility/*, LayoutTests/editing/selection/ios/*, LayoutTests/fast/canvas/canvas-line-batch-flush*, LayoutTests/fast/css-grid-layout/*, LayoutTests/fast/css3-text/..., LayoutTests/fast/dom/pseudo-element-hidePopover-*, LayoutTests/fast/events/pointerleave-*, LayoutTests/fast/events/site-isolation/*, LayoutTests/fast/events/touch/ios/netflix-*	Adds new layout tests for accessibility, iOS selection, canvas flushing, CSS crashes and rendering, popover and pointerleave regressions, BFCache event timing, and a touch-action quirk test, while updating top-level test expectations.
Layout harness and expected-output migration LayoutTests/editing/*, LayoutTests/fast/animation/*, LayoutTests/fast/canvas/..., LayoutTests/fast/dom/..., LayoutTests/fast/events/..., LayoutTests/fast/encoding/*	Migrates many existing LayoutTests to js-test.js with window.jsTestIsAsync and finishJSTest(), reorders or extends expected outputs, and moves several MIME-dump settings into runner directives.

Possibly related PRs

• oven-sh/WebKit#236: Also changes CMakeLists.txt around early Darwin SDK and project(WebKit ...) configuration flow.
• oven-sh/WebKit#248: Overlaps with the CMake and Configurations/CommonBase.xcconfig toolchain and Swift flag updates.
• oven-sh/WebKit#231: Touches the same shared build/version files, including CMakeLists.txt, Configurations/*.xcconfig, and version variables.

[coderabbitai]

Actionable comments posted: 16

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (2)

LayoutTests/fast/events/touch/gesture/gesture-tap-active-state-iframe.html (1)

25-39: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Unbalanced async lifecycle can hang this test on unsupported platforms.

Line 25 enables async mode, but Lines 32-39 return early without calling finishJSTest(). That can leave the test waiting indefinitely.

Suggested fix

- window.jsTestIsAsync = true;
+ window.jsTestIsAsync = true;
@@
     if (!window.eventSender) {
         debug('This test requires DRT.');
+        finishJSTest();
         return;
     }

     if (!eventSender.gestureTapDown) {
         debug('GestureTapDown is not supported by this platform');
+        finishJSTest();
         return;
     }

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@LayoutTests/fast/events/touch/gesture/gesture-tap-active-state-iframe.html`
around lines 25 - 39, The test enables async mode via window.jsTestIsAsync but
returns early in runTests when window.eventSender is missing or when
eventSender.gestureTapDown is unsupported, which can hang the harness; update
runTests to call finishJSTest() before each early return (i.e., in the branches
checking window.eventSender and eventSender.gestureTapDown) so the async
lifecycle is completed and the test never waits indefinitely.

LayoutTests/fast/events/mouse-cursor-update-during-raf.html (1)

21-23: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Consolidated root cause: async harness completion is not guaranteed on unsupported/dependency-missing paths.

Both tests switched to js-test.js async mode but leave at least one branch where async is enabled and finishJSTest() is not reached. This creates timeout-prone tests and flaky infrastructure behavior.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@LayoutTests/fast/events/mouse-cursor-update-during-raf.html` around lines 21
- 23, The test enables js-test.js async mode (window.jsTestIsAsync = true)
without guaranteeing a corresponding finishJSTest() on all execution paths,
causing timeouts; update the test to either only enable async when you will
definitely call finishJSTest() (wrap the assignment and any async-only logic in
the existing window.testRunner guard) or ensure every branch that can exit early
calls finishJSTest() (add calls to finishJSTest() in
unsupported/dependency-missing branches). Refer to window.testRunner,
window.jsTestIsAsync, finishJSTest(), and js-test.js when making the change.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@JSTests/microbenchmarks/regexp-prototype-match-no-strength-reduction.js`:
- Around line 6-9: The benchmark's hot loop is calling Math.random() each
iteration, adding nondeterministic overhead; in the for-loop that invokes
shouldBe and RegExp.prototype[Symbol.match], remove Math.random() from the
string concatenation (the second shouldBe call) so the input is deterministic —
e.g. replace "hello" + "world" + Math.random() with a constant like "helloworld"
or compute a single random suffix once outside the loop if variability is
required; update the call site that uses /hello/[Symbol.match] so it no longer
invokes Math.random() on every iteration.

In `@JSTests/stress/async-generator-reentrant-resume-during-resolve.js`:
- Around line 24-32: The test replaces Object.prototype.then without restoring
it; save the original descriptor for Object.prototype.then (e.g., origThenDesc =
Object.getOwnPropertyDescriptor(Object.prototype, "then")) before calling
Object.defineProperty, and after the test body (or in a finally/cleanup block)
restore it: if origThenDesc is undefined, delete Object.prototype.then,
otherwise call Object.defineProperty(Object.prototype, "then", origThenDesc).
Ensure the cleanup runs even if the test throws so thenGets/iter.next behavior
does not leak into other tests.

In `@JSTests/stress/temporal-gc-jit-stress.js`:
- Around line 77-82: The loop currently asserts monotonicity by comparing prev
and curr using Temporal.Instant.compare and throwing on cmp > 0; remove that
monotonicity check and the throw, and instead assert API validity by checking
each call returns a Temporal.Instant (e.g., verify typeof/instance or that
Temporal.Instant.compare can be called with the value without expecting
ordering), replacing uses of prev/curr comparison with a simple validation of
the result of Temporal.Now.instant() inside the for loop (referencing
Temporal.Now.instant, Temporal.Instant.compare only for validation if needed,
and the loop variables prev and curr).

In `@JSTests/stress/temporal-plainyearmonth-constructor-exception-check.js`:
- Around line 5-7: The test currently triggers a TDZ ReferenceError because it
declares let a4 and immediately uses a4.withPlainTime(a3); replace that
self-referential initialization by calling withPlainTime on the constructed
PlainYearMonth instance (use a2.withPlainTime(a3)) and keep a3 as the local time
object used for the call so the intended Temporal.PlainYearMonth path is
executed (refer to variables a1, a2, a3, a4 and the withPlainTime call).

In `@JSTests/stress/temporal-zdt-large-fold-disambiguation.js`:
- Around line 3-6: The assertion helper shouldBe currently uses JSON.stringify
on actual/expected which throws for BigInt; update shouldBe to format values
using JSON.stringify with a replacer that converts BigInt to a string (e.g. v =>
typeof v === 'bigint' ? v.toString() + 'n' : v) so mismatches produce the
intended "expected … but got …" message; modify the call sites inside the
shouldBe function to use this safe serializer for both actual and expected.

In `@JSTests/stress/temporal-zoned-datetime-dst-fold.js`:
- Around line 7-10: The helper shouldThrow currently swallows unexpected
exceptions; update the catch in shouldThrow(fn, msg) so it only treats errors
whose message starts with msg as the expected case and rethrows any other thrown
value (including non-Error values) — e.g. in the catch block, if the caught
value’s message startsWith(msg) return/allow, otherwise throw the caught value
(or rethrow non-Error as is) so unrelated exceptions do not produce
false-positive passes.

In `@JSTests/stress/wasm-table-constructor-wrapper-function-default.js`:
- Around line 87-90: The comment and test disagree: the block intends to
validate that non-function default values throw for new WebAssembly.Table but
the code passes a function (() => 1). Either replace the default argument with a
non-function (e.g., use 1 instead of () => 1) so the test actually exercises
non-function defaults when calling new WebAssembly.Table({ element: "funcref",
initial: 1 }, 1), or change the comment to state that the test is verifying
function defaults (keep () => 1) so the intent matches the code; update the
comment near the WebAssembly.Table invocation accordingly.

In
`@JSTests/test262/test/intl402/Temporal/PlainMonthDay/prototype/toLocaleString/basic.js`:
- Line 33: Remove the duplicated frontmatter entry "features: [Temporal]" so
only a single "features: [Temporal]" remains in the test file; locate the
repeated frontmatter key and delete the second occurrence, leaving the original
declaration intact to avoid metadata parsing ambiguity.

In
`@LayoutTests/editing/selection/ios/tap-focused-input-clears-outside-selection.html`:
- Around line 22-53: The test currently assumes UIHelper exists and may hang
because jsTestIsAsync = true; wrap the load handler logic with a guard like if
(typeof UIHelper === "undefined") { /* report skip and call finishJSTest() */
return; } so that when UIHelper/WTR is not available the test logs/skips and
calls finishJSTest() instead of awaiting UIHelper methods; ensure all calls to
UIHelper.activateAndWaitForInputSessionAt, UIHelper.longPressElement, and
UIHelper.activateElementAndWaitForInputSession are only executed when the guard
passes and that finishJSTest() is always invoked on the early-exit path to avoid
timeouts.

In `@LayoutTests/fast/canvas/webgl/draw-elements-out-of-bounds-uint-index.html`:
- Around line 21-24: The test marks success when the OES_element_index_uint
extension is missing but then continues executing the UNSIGNED_INT draw path;
modify the branch that checks contextType == "webgl" and the call to
context.getExtension("OES_element_index_uint") so that when the extension is
absent you not only call testPassed("no extension") but also return/exit the
test immediately to avoid running the UNSIGNED_INT draw code and producing
incorrect GL errors; locate the check around contextType and getExtension in the
test and add an early return (or skip) after testPassed to stop further
execution.

In `@LayoutTests/fast/canvas/webgl/gl-teximage-imagebitmap.html`:
- Around line 133-137: The rejection handler for the test promise must complete
the async JS test teardown by calling finishJSTest() in addition to reporting
the failure; update the rejection branch (the promise second argument or the
.catch handler that currently calls testFailed(String(e))) to also call
finishJSTest() after reporting the error (or use a .finally that calls
finishJSTest()), ensuring test(), testFailed(String(e)), and finishJSTest() are
invoked so window.jsTestIsAsync teardown completes on failures.

In `@LayoutTests/fast/dom/HTMLLinkElement/subresource.html`:
- Line 6: The test sets window.jsTestIsAsync = true but the onerror handler only
calls testFailed(...), so failures never call finishJSTest() and the test can
hang; update the onerror handler (the function assigned to the element's
onerror) to call finishJSTest() after reporting the failure (e.g., call
finishJSTest() immediately after testFailed(...)) so both success and failure
paths terminate the async test; ensure similar fixes are applied to the other
occurrences referenced by the review (the other onerror handlers at the
indicated locations).

In `@LayoutTests/fast/events/pointerleave-after-ancestor-removal.html`:
- Around line 30-43: When window.eventSender is not present the async waiter
never resolves; add a no-eventSender completion path so the test won't hang:
detect if (!window.eventSender) before using eventSender and immediately set
containerLeaveReceived = true (or call shouldBeTrue/finishJSTest directly) so
UIHelper.waitForCondition(() => containerLeaveReceived) can proceed; update the
block around eventSender.mouseMoveTo and the subsequent
UIHelper.waitForCondition usage (referencing eventSender,
containerLeaveReceived, UIHelper.waitForCondition, and finishJSTest) to ensure
the test completes synchronously when eventSender is unavailable.

In `@LayoutTests/fast/events/popup-blocking-timers2.html`:
- Line 5: The test enables async mode unconditionally via window.jsTestIsAsync
which can hang when window.eventSender automation is absent; change the harness
so async mode is only enabled when an automated click path exists (e.g., guard
setting window.jsTestIsAsync = true behind a check for window.eventSender or
equivalent), and ensure the code paths around the eventSender-driven clicks (the
logic referenced in the block handling the automated click) either call
finishJSTest() or avoid requiring async mode when window.eventSender is
undefined; update references in this file to gate setting window.jsTestIsAsync
and the eventSender click flow accordingly.

In `@LayoutTests/fast/events/touch/gesture/gesture-scroll.html`:
- Line 122: The test sets window.jsTestIsAsync = true but some
unsupported-environment or early-exit branches return/throw without calling
finishJSTest(), causing timeouts; update every early-exit/fallback branch in
this file (any feature-detection or "unsupported" code paths) to call
finishJSTest() before returning or exiting so the async harness is always
terminated (ensure finishJSTest() is invoked in the same branches that currently
call return/throw or call testFailed/closeEarly).

In
`@LayoutTests/fast/events/touch/gesture/long-press-on-draggable-element-in-nested-iframes-triggers-drag.html`:
- Around line 12-17: The test sets window.jsTestIsAsync = true but only calls
finishJSTest() conditionally inside onDragStart, which can leave non-TestRunner
environments hanging; modify onDragStart to always call finishJSTest() when
running in async mode by invoking finishJSTest() unconditionally (or guarded
only by the global jsTestIsAsync flag) after setting the result element,
referencing the onDragStart function and the finishJSTest call so the test
finishes in all environments.

---

Outside diff comments:
In `@LayoutTests/fast/events/mouse-cursor-update-during-raf.html`:
- Around line 21-23: The test enables js-test.js async mode
(window.jsTestIsAsync = true) without guaranteeing a corresponding
finishJSTest() on all execution paths, causing timeouts; update the test to
either only enable async when you will definitely call finishJSTest() (wrap the
assignment and any async-only logic in the existing window.testRunner guard) or
ensure every branch that can exit early calls finishJSTest() (add calls to
finishJSTest() in unsupported/dependency-missing branches). Refer to
window.testRunner, window.jsTestIsAsync, finishJSTest(), and js-test.js when
making the change.

In `@LayoutTests/fast/events/touch/gesture/gesture-tap-active-state-iframe.html`:
- Around line 25-39: The test enables async mode via window.jsTestIsAsync but
returns early in runTests when window.eventSender is missing or when
eventSender.gestureTapDown is unsupported, which can hang the harness; update
runTests to call finishJSTest() before each early return (i.e., in the branches
checking window.eventSender and eventSender.gestureTapDown) so the async
lifecycle is completed and the test never waits indefinitely.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: a4ef0777-0e3f-4f5e-abd2-34b37dcc81fc

📥 Commits

Reviewing files that changed from the base of the PR and between 5851d47 and 95df7e6.

📒 Files selected for processing (300)

• .gitignore
• CMakeLists.txt
• Configurations/CommonBase.xcconfig
• Configurations/Version.xcconfig
• JSTests/microbenchmarks/class-fields-anonymous-arrow-function-fields.js
• JSTests/microbenchmarks/regexp-empty-body-parens.js
• JSTests/microbenchmarks/regexp-fixed-count-capturing-parens.js
• JSTests/microbenchmarks/regexp-prototype-match-anchor.js
• JSTests/microbenchmarks/regexp-prototype-match-basic.js
• JSTests/microbenchmarks/regexp-prototype-match-complex-pattern.js
• JSTests/microbenchmarks/regexp-prototype-match-no-strength-reduction.js
• JSTests/microbenchmarks/regexp-prototype-match-observable-side-effects.js
• JSTests/microbenchmarks/regexp-prototype-match-short-string.js
• JSTests/modules/import-defer-then-not-enumerable.js
• JSTests/stress/array-sort-nested-comparator-call-ignore-result.js
• JSTests/stress/array-sort-nested-comparator-tail-call.js
• JSTests/stress/async-generator-next-on-completed-reentrant.js
• JSTests/stress/async-generator-reentrant-resume-during-resolve.js
• JSTests/stress/class-fields-anonymous-function-name-edge-cases.js
• JSTests/stress/class-fields-anonymous-function-name-inference.js
• JSTests/stress/intl-canonical-iana-time-zone.js
• JSTests/stress/intl-datetimeformat-temporal-era-width.js
• JSTests/stress/intl-datetimeformat-temporal-non-default-calendar.js
• JSTests/stress/iterator-close-map-set-fast-path-mid-iteration-return.js
• JSTests/stress/multi-get-by-val-mixed-dfg.js
• JSTests/stress/multi-get-by-val-mixed-oob-dfg.js
• JSTests/stress/multi-get-by-val-sane-chain-oob-dfg.js
• JSTests/stress/multi-put-by-val-mixed-dfg.js
• JSTests/stress/multi-put-by-val-oob-dfg.js
• JSTests/stress/promise-constructor-length.js
• JSTests/stress/promise-resolve-non-thenable-structure-cache-cross-realm-proto.js
• JSTests/stress/promise-resolving-functions-name-and-length.js
• JSTests/stress/regexp-greedy-varcount-reextend-after-content-backtrack.js
• JSTests/stress/regexp-prototype-symbol-match-edge-cases.js
• JSTests/stress/regexp-prototype-symbol-match-watchpoint-invalidation.js
• JSTests/stress/regexp-string-list-empty-alternative.js
• JSTests/stress/string-split-regexp-fast-path-limit-side-effects.js
• JSTests/stress/string-split-regexp-fast-path-tostring-side-effects.js
• JSTests/stress/stringProtoFuncAt-GCOwnedDataScope-atomstring-swap.js
• JSTests/stress/stringProtoFuncEndsWith-GCOwnedDataScope-atomstring-swap.js
• JSTests/stress/stringProtoFuncLocaleCompare-GCOwnedDataScope-atomstring-swap.js
• JSTests/stress/stringProtoFuncStartsWith-GCOwnedDataScope-atomstring-swap.js
• JSTests/stress/temporal-boundary-values.js
• JSTests/stress/temporal-calendar-daymath-weeks.js
• JSTests/stress/temporal-calendar-month-boundary.js
• JSTests/stress/temporal-calendar.js
• JSTests/stress/temporal-cross-type.js
• JSTests/stress/temporal-duration-relative-to-era-calendar.js
• JSTests/stress/temporal-duration-relativeto.js
• JSTests/stress/temporal-duration.js
• JSTests/stress/temporal-gc-jit-stress.js
• JSTests/stress/temporal-int32-overflow-duration.js
• JSTests/stress/temporal-iso8601-parse-bounds.js
• JSTests/stress/temporal-japanese-ce-bce-era-validation.js
• JSTests/stress/temporal-month-boundary-arithmetic.js
• JSTests/stress/temporal-month-overflow-truncation.js
• JSTests/stress/temporal-monthday-parsing-timezone.js
• JSTests/stress/temporal-monthday-refyear.js
• JSTests/stress/temporal-nan-fields.js
• JSTests/stress/temporal-non-iso-calendar.js
• JSTests/stress/temporal-plain-date-time-nan-fields.js
• JSTests/stress/temporal-plain-date-time-with-era-calendar.js
• JSTests/stress/temporal-plain-date-with-era-calendar.js
• JSTests/stress/temporal-plain-month-day-with-era-calendar.js
• JSTests/stress/temporal-plain-year-month-with-era-calendar.js
• JSTests/stress/temporal-plaindate-add-huge-days-out-of-range.js
• JSTests/stress/temporal-plaindate-to-yearmonth-monthday-calendar.js
• JSTests/stress/temporal-plaindatetime-calendar-propagation.js
• JSTests/stress/temporal-plainmonthday-from-large-string.js
• JSTests/stress/temporal-plainmonthday-to-plaindate-calendar.js
• JSTests/stress/temporal-plainyearmonth-constructor-exception-check.js
• JSTests/stress/temporal-pre-lmt-timezone.js
• JSTests/stress/temporal-rounding-modes.js
• JSTests/stress/temporal-string-parsing-edge.js
• JSTests/stress/temporal-timezone-diversity.js
• JSTests/stress/temporal-timezone-offset-identity.js
• JSTests/stress/temporal-timezone.js
• JSTests/stress/temporal-zdt-large-fold-disambiguation.js
• JSTests/stress/temporal-zdt-round-dst-midnight-crossing.js
• JSTests/stress/temporal-zdt-rounding-boundary.js
• JSTests/stress/temporal-zdt-rounding-halfeven.js
• JSTests/stress/temporal-zdt-timezone-canonicalization.js
• JSTests/stress/temporal-zdt-to-locale-string-inherited-options.js
• JSTests/stress/temporal-zdt-with-boundary.js
• JSTests/stress/temporal-zoned-date-time-with-era-calendar.js
• JSTests/stress/temporal-zoned-datetime-difference-day-correction.js
• JSTests/stress/temporal-zoned-datetime-dst-arithmetic.js
• JSTests/stress/temporal-zoned-datetime-dst-fold.js
• JSTests/stress/temporal-zoned-datetime-dst-gap.js
• JSTests/stress/temporal-zoned-datetime-timezone-identifier.js
• JSTests/stress/wasm-table-constructor-wrapper-function-default.js
• JSTests/stress/yarr-auto-possessification.js
• JSTests/stress/yarr-quantified-empty-parentheses.js
• JSTests/stress/yarr-quantified-parentheses-unified-backtracking.js
• JSTests/test262/config.yaml
• JSTests/test262/expectations.yaml
• JSTests/test262/test/intl402/Temporal/PlainMonthDay/prototype/toLocaleString/basic.js
• JSTests/wasm/libwabt.js
• JSTests/wasm/stress/memory32-atomics-pointer-upper-bits.js
• JSTests/wasm/stress/memory32-grow-upper-bits.js
• JSTests/wasm/stress/omg-indirect-tail-call-late-input-clobber.js
• LayoutTests/TestExpectations
• LayoutTests/accessibility/aria-grid-with-presentational-sections-expected.txt
• LayoutTests/accessibility/aria-grid-with-presentational-sections.html
• LayoutTests/accessibility/aria-owns-crash-after-subtree-update-expected.txt
• LayoutTests/accessibility/aria-owns-crash-after-subtree-update.html
• LayoutTests/accessibility/iframe-content-remains-accessible-after-navigation-expected.txt
• LayoutTests/accessibility/iframe-content-remains-accessible-after-navigation.html
• LayoutTests/accessibility/mac/input-type-change-without-renderer-expected.txt
• LayoutTests/accessibility/mac/input-type-change-without-renderer.html
• LayoutTests/accessibility/mac/selection-element-tabbing-to-link.html
• LayoutTests/accessibility/resources/iframe-with-buttons.html
• LayoutTests/editing/input/delete-text-in-composition.html
• LayoutTests/editing/pasteboard/paste-contents-with-side-effects.html
• LayoutTests/editing/selection/5497643.html
• LayoutTests/editing/selection/ios/select-text-by-long-press-with-focused-element-expected.txt
• LayoutTests/editing/selection/ios/select-text-by-long-press-with-focused-element.html
• LayoutTests/editing/selection/ios/select-text-by-long-press-with-hardware-keyboard-expected.txt
• LayoutTests/editing/selection/ios/select-text-by-long-press-with-hardware-keyboard.html
• LayoutTests/editing/selection/ios/tap-focused-input-clears-outside-selection-expected.txt
• LayoutTests/editing/selection/ios/tap-focused-input-clears-outside-selection.html
• LayoutTests/editing/spelling/document-markers-remain-after-removing-text-expected.txt
• LayoutTests/editing/spelling/document-markers-remain-after-removing-text.html
• LayoutTests/fast/animation/request-animation-frame-during-modal.html
• LayoutTests/fast/animation/request-animation-frame-iframe.html
• LayoutTests/fast/animation/request-animation-frame-iframe2.html
• LayoutTests/fast/animation/request-animation-frame-prefix-expected.txt
• LayoutTests/fast/animation/request-animation-frame-prefix.html
• LayoutTests/fast/animation/request-animation-frame-too-rapid-expected.txt
• LayoutTests/fast/animation/request-animation-frame-too-rapid.html
• LayoutTests/fast/attachment/cocoa/wide-attachment-save-event-expected.txt
• LayoutTests/fast/attachment/cocoa/wide-attachment-save-event.html
• LayoutTests/fast/canvas/2d.context.expando.html
• LayoutTests/fast/canvas/canvas-blending-color-over-image.html
• LayoutTests/fast/canvas/canvas-blending-color-over-pattern.html
• LayoutTests/fast/canvas/canvas-blending-gradient-over-image.html
• LayoutTests/fast/canvas/canvas-blending-gradient-over-pattern.html
• LayoutTests/fast/canvas/canvas-blending-image-over-color.html
• LayoutTests/fast/canvas/canvas-blending-image-over-gradient.html
• LayoutTests/fast/canvas/canvas-line-batch-flush-expected.txt
• LayoutTests/fast/canvas/canvas-line-batch-flush.html
• LayoutTests/fast/canvas/neutered-imagedata.html
• LayoutTests/fast/canvas/webgl/draw-elements-out-of-bounds-uint-index-expected.txt
• LayoutTests/fast/canvas/webgl/draw-elements-out-of-bounds-uint-index.html
• LayoutTests/fast/canvas/webgl/gl-teximage-imagebitmap.html
• LayoutTests/fast/canvas/webgl/shader-mix-with-bool-expected.txt
• LayoutTests/fast/canvas/webgl/shader-mix-with-bool.html
• LayoutTests/fast/canvas/webgl/tex-image-and-sub-image-2d-with-video-rgb565.html
• LayoutTests/fast/canvas/webgl/tex-image-and-sub-image-2d-with-video-rgba4444.html
• LayoutTests/fast/canvas/webgl/tex-image-and-sub-image-2d-with-video-rgba5551.html
• LayoutTests/fast/canvas/webgl/tex-image-and-sub-image-2d-with-video.html
• LayoutTests/fast/canvas/webgl/webgl-clear-composited-notshowing.html
• LayoutTests/fast/canvas/webgl/webgl-compressed-texture-astc-expected.txt
• LayoutTests/fast/canvas/webgl/webgl-compressed-texture-astc.html
• LayoutTests/fast/css-generated-content/pseudo-element-events.html
• LayoutTests/fast/css-generated-content/pseudo-transition-event.html
• LayoutTests/fast/css-grid-layout/masonry-span-exceeds-grid-axis-tracks-crash-expected.txt
• LayoutTests/fast/css-grid-layout/masonry-span-exceeds-grid-axis-tracks-crash.html
• LayoutTests/fast/css-grid-layout/masonry-subgrid-excluded-legend-crash-expected.txt
• LayoutTests/fast/css-grid-layout/masonry-subgrid-excluded-legend-crash.html
• LayoutTests/fast/css3-text/css3-text-wrap/text-wrap-balance-line-clamp-1-expected.html
• LayoutTests/fast/css3-text/css3-text-wrap/text-wrap-balance-line-clamp-1.html
• LayoutTests/fast/dom/DeviceMotion/no-page-cache.html
• LayoutTests/fast/dom/DeviceOrientation/no-page-cache.html
• LayoutTests/fast/dom/Geolocation/window-close-crash.html
• LayoutTests/fast/dom/HTMLButtonElement/change-type-expected.txt
• LayoutTests/fast/dom/HTMLButtonElement/change-type.html
• LayoutTests/fast/dom/HTMLImageElement/sizes/image-sizes-js-change-expected.txt
• LayoutTests/fast/dom/HTMLImageElement/sizes/image-sizes-js-change.html
• LayoutTests/fast/dom/HTMLImageElement/sizes/image-sizes-js-innerhtml-expected.txt
• LayoutTests/fast/dom/HTMLImageElement/sizes/image-sizes-js-innerhtml.html
• LayoutTests/fast/dom/HTMLLinkElement/link-and-subresource-test-nonexistent.html
• LayoutTests/fast/dom/HTMLLinkElement/link-and-subresource-test.html
• LayoutTests/fast/dom/HTMLLinkElement/prefetch-onerror.html
• LayoutTests/fast/dom/HTMLLinkElement/prefetch-too-many-clients-expected.txt
• LayoutTests/fast/dom/HTMLLinkElement/prefetch-too-many-clients.html
• LayoutTests/fast/dom/HTMLLinkElement/prefetch.html
• LayoutTests/fast/dom/HTMLLinkElement/subresource.html
• LayoutTests/fast/dom/HTMLScriptElement/dont-load-unknown-type-expected.txt
• LayoutTests/fast/dom/HTMLScriptElement/dont-load-unknown-type.html
• LayoutTests/fast/dom/Window/Location/window-shadow-location-using-js-object-with-toString-expected.txt
• LayoutTests/fast/dom/Window/Location/window-shadow-location-using-js-object-with-toString.html
• LayoutTests/fast/dom/Window/Location/window-shadow-location-using-string-expected.txt
• LayoutTests/fast/dom/Window/Location/window-shadow-location-using-string.html
• LayoutTests/fast/dom/Window/new-window-opener.html
• LayoutTests/fast/dom/Window/open-window-min-size.html
• LayoutTests/fast/dom/Window/window-property-invalid-characters-ignored.html
• LayoutTests/fast/dom/crash-with-bad-url.html
• LayoutTests/fast/dom/gc-image-element-2-expected.txt
• LayoutTests/fast/dom/gc-image-element-2.html
• LayoutTests/fast/dom/gc-image-element-expected.txt
• LayoutTests/fast/dom/gc-image-element.html
• LayoutTests/fast/dom/location-new-window-no-crash.html
• LayoutTests/fast/dom/node-filter-detached-iframe-crash-expected.txt
• LayoutTests/fast/dom/node-filter-detached-iframe-crash.html
• LayoutTests/fast/dom/node-move-to-new-document-crash-main.html
• LayoutTests/fast/dom/non-reified-event-isTrusted-ic-crash.html
• LayoutTests/fast/dom/pseudo-element-hidePopover-then-crash-expected.txt
• LayoutTests/fast/dom/pseudo-element-hidePopover-then-crash.html
• LayoutTests/fast/dom/window-inner-size-scaling-expected.txt
• LayoutTests/fast/dom/window-inner-size-scaling.html
• LayoutTests/fast/dom/window-scroll-scaling-expected.txt
• LayoutTests/fast/dom/window-scroll-scaling.html
• LayoutTests/fast/dom/wrapper-classes.html
• LayoutTests/fast/encoding/char-encoding-mac.html
• LayoutTests/fast/encoding/char-encoding.html
• LayoutTests/fast/encoding/resources/char-encoding-utils.js
• LayoutTests/fast/events/autoscroll-in-iframe-body-expected.txt
• LayoutTests/fast/events/autoscroll-in-iframe-body.html
• LayoutTests/fast/events/autoscroll-in-iframe-expected.txt
• LayoutTests/fast/events/autoscroll-in-iframe.html
• LayoutTests/fast/events/autoscroll-in-overflow-hidden-html-expected.txt
• LayoutTests/fast/events/autoscroll-in-overflow-hidden-html.html
• LayoutTests/fast/events/click-focus-control-expected.txt
• LayoutTests/fast/events/click-focus-control.html
• LayoutTests/fast/events/click-range-slider-expected.txt
• LayoutTests/fast/events/click-range-slider.html
• LayoutTests/fast/events/clientXY-in-zoom-and-scroll-expected.txt
• LayoutTests/fast/events/clientXY-in-zoom-and-scroll.html
• LayoutTests/fast/events/data-transfer-files-attribute-identity-expected.txt
• LayoutTests/fast/events/data-transfer-files-attribute-identity.html
• LayoutTests/fast/events/file-input-hidden-in-ondrop-expected.txt
• LayoutTests/fast/events/file-input-hidden-in-ondrop.html
• LayoutTests/fast/events/ios/viewport-no-width-value-allows-double-tap.html
• LayoutTests/fast/events/mouse-cursor-change.html
• LayoutTests/fast/events/mouse-cursor-hidden-when-out-of-bounds.html
• LayoutTests/fast/events/mouse-cursor-image-set.html
• LayoutTests/fast/events/mouse-cursor-light-dark.html
• LayoutTests/fast/events/mouse-cursor-multiframecur.html
• LayoutTests/fast/events/mouse-cursor-no-mousemove.html
• LayoutTests/fast/events/mouse-cursor-pseudo-elements.html
• LayoutTests/fast/events/mouse-cursor-update-during-raf.html
• LayoutTests/fast/events/mouse-cursor.html
• LayoutTests/fast/events/mouseover-button-expected.txt
• LayoutTests/fast/events/mouseover-button.html
• LayoutTests/fast/events/onerror-img-after-gc-expected.txt
• LayoutTests/fast/events/onerror-img-after-gc.html
• LayoutTests/fast/events/page-visibility-iframe-move-test.html
• LayoutTests/fast/events/pointerleave-after-ancestor-removal-expected.txt
• LayoutTests/fast/events/pointerleave-after-ancestor-removal.html
• LayoutTests/fast/events/popup-allowed-from-gesture-initiated-event-expected.txt
• LayoutTests/fast/events/popup-allowed-from-gesture-initiated-event.html
• LayoutTests/fast/events/popup-blocked-from-fake-button-click-expected.txt
• LayoutTests/fast/events/popup-blocked-from-fake-button-click.html
• LayoutTests/fast/events/popup-blocked-from-fake-focus-expected.txt
• LayoutTests/fast/events/popup-blocked-from-fake-focus.html
• LayoutTests/fast/events/popup-blocked-from-fake-user-gesture-expected.txt
• LayoutTests/fast/events/popup-blocked-from-fake-user-gesture.html
• LayoutTests/fast/events/popup-blocked-from-untrusted-click-event-on-anchor-expected.txt
• LayoutTests/fast/events/popup-blocked-from-untrusted-click-event-on-anchor.html
• LayoutTests/fast/events/popup-blocking-timers1-expected.txt
• LayoutTests/fast/events/popup-blocking-timers1.html
• LayoutTests/fast/events/popup-blocking-timers2-expected.txt
• LayoutTests/fast/events/popup-blocking-timers2.html
• LayoutTests/fast/events/popup-blocking-timers3-expected.txt
• LayoutTests/fast/events/popup-blocking-timers3.html
• LayoutTests/fast/events/popup-blocking-timers5-expected.txt
• LayoutTests/fast/events/popup-blocking-timers5.html
• LayoutTests/fast/events/popup-blocking-timers6-expected.txt
• LayoutTests/fast/events/popup-blocking-timers6.html
• LayoutTests/fast/events/site-isolation/event-timing-back-forward-cache-duration-expected.txt
• LayoutTests/fast/events/site-isolation/event-timing-back-forward-cache-duration.html
• LayoutTests/fast/events/touch/basic-single-touch-events.html
• LayoutTests/fast/events/touch/emulated-touch-iframe-expected.txt
• LayoutTests/fast/events/touch/emulated-touch-iframe.html
• LayoutTests/fast/events/touch/gesture/gesture-click.html
• LayoutTests/fast/events/touch/gesture/gesture-dblclick.html
• LayoutTests/fast/events/touch/gesture/gesture-scroll.html
• LayoutTests/fast/events/touch/gesture/gesture-tap-active-state-iframe.html
• LayoutTests/fast/events/touch/gesture/long-press-on-draggable-element-in-iframe-triggers-drag.html
• LayoutTests/fast/events/touch/gesture/long-press-on-draggable-element-in-nested-iframes-triggers-drag.html
• LayoutTests/fast/events/touch/gesture/resources/gesture-helpers.js
• LayoutTests/fast/events/touch/gesture/touch-gesture-noscroll-body-propagated.html
• LayoutTests/fast/events/touch/gesture/touch-gesture-noscroll-body-xhidden.html
• LayoutTests/fast/events/touch/gesture/touch-gesture-noscroll-body-yhidden.html
• LayoutTests/fast/events/touch/gesture/touch-gesture-noscroll-body.html
• LayoutTests/fast/events/touch/gesture/touch-gesture-noscroll-div.html
• LayoutTests/fast/events/touch/gesture/touch-gesture-noscroll-iframe.html
• LayoutTests/fast/events/touch/gesture/touch-gesture-scroll-div-not-propagated.html
• LayoutTests/fast/events/touch/gesture/touch-gesture-scroll-div-propagated.html
• LayoutTests/fast/events/touch/gesture/touch-gesture-scroll-div-scaled.html
• LayoutTests/fast/events/touch/gesture/touch-gesture-scroll-div-twice-propagated.html
• LayoutTests/fast/events/touch/gesture/touch-gesture-scroll-div.html
• LayoutTests/fast/events/touch/gesture/touch-gesture-scroll-iframe-editable.html
• LayoutTests/fast/events/touch/gesture/touch-gesture-scroll-iframe-not-propagated.html
• LayoutTests/fast/events/touch/gesture/touch-gesture-scroll-iframe-propagated.html
• LayoutTests/fast/events/touch/gesture/touch-gesture-scroll-iframe.html
• LayoutTests/fast/events/touch/gesture/touch-gesture-scroll-page-not-propagated.html
• LayoutTests/fast/events/touch/gesture/touch-gesture-scroll-page-propagated.html
• LayoutTests/fast/events/touch/gesture/touch-gesture-scroll-page.html
• LayoutTests/fast/events/touch/gesture/touch-gesture-scroll-shy-target.html
• LayoutTests/fast/events/touch/gesture/touch-gesture-scroll-sideways.html
• LayoutTests/fast/events/touch/ios/gesture-node-move-between-documents-expected.txt
• LayoutTests/fast/events/touch/ios/gesture-node-move-between-documents.html
• LayoutTests/fast/events/touch/ios/netflix-volume-slider-touch-action-quirk-expected.txt
• LayoutTests/fast/events/touch/ios/netflix-volume-slider-touch-action-quirk.html
• LayoutTests/fast/events/touch/ios/overflow-node-move-between-documents-expected.txt
• LayoutTests/fast/events/touch/ios/overflow-node-move-between-documents.html
• LayoutTests/fast/events/touch/ios/slider-node-move-between-documents-expected.txt
• LayoutTests/fast/events/touch/ios/slider-node-move-between-documents.html

💤 Files with no reviewable changes (14)

• LayoutTests/fast/canvas/webgl/webgl-compressed-texture-astc-expected.txt
• JSTests/stress/temporal-calendar.js
• LayoutTests/accessibility/mac/selection-element-tabbing-to-link.html
• LayoutTests/fast/events/mouse-cursor.html
• LayoutTests/fast/events/mouse-cursor-pseudo-elements.html
• LayoutTests/fast/events/mouse-cursor-hidden-when-out-of-bounds.html
• JSTests/stress/temporal-duration.js
• LayoutTests/fast/canvas/webgl/tex-image-and-sub-image-2d-with-video.html
• LayoutTests/fast/events/mouse-cursor-light-dark.html
• LayoutTests/fast/canvas/neutered-imagedata.html
• LayoutTests/fast/canvas/webgl/tex-image-and-sub-image-2d-with-video-rgba4444.html
• JSTests/test262/expectations.yaml
• LayoutTests/fast/canvas/webgl/tex-image-and-sub-image-2d-with-video-rgb565.html
• LayoutTests/fast/canvas/webgl/tex-image-and-sub-image-2d-with-video-rgba5551.html

[coderabbitai]

⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Remove Math.random() from the benchmark hot path.

Using RNG each iteration introduces unrelated and nondeterministic overhead, which can skew the RegExp.prototype[Symbol.match] measurement.

Proposed change

 for (let i = 0; i < 1e5; i++) {
     shouldBe(new RegExp("wor" + "ld")[Symbol.match]("hello world")[0], "world");
-    shouldBe(/hello/[Symbol.match]("hello" + "world" + Math.random())[0], "hello");
+    const input = "hello" + "world" + (i & 1);
+    shouldBe(/hello/[Symbol.match](input)[0], "hello");
 }

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	for (let i = 0; i < 1e5; i++) {
	shouldBe(new RegExp("wor" + "ld")[Symbol.match]("hello world")[0], "world");
	shouldBe(/hello/[Symbol.match]("hello" + "world" + Math.random())[0], "hello");
	}
	for (let i = 0; i < 1e5; i++) {
	shouldBe(new RegExp("wor" + "ld")[Symbol.match]("hello world")[0], "world");
	const input = "hello" + "world" + (i & 1);
	shouldBe(/hello/[Symbol.match](input)[0], "hello");
	}

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@JSTests/microbenchmarks/regexp-prototype-match-no-strength-reduction.js`
around lines 6 - 9, The benchmark's hot loop is calling Math.random() each
iteration, adding nondeterministic overhead; in the for-loop that invokes
shouldBe and RegExp.prototype[Symbol.match], remove Math.random() from the
string concatenation (the second shouldBe call) so the input is deterministic —
e.g. replace "hello" + "world" + Math.random() with a constant like "helloworld"
or compute a single random suffix once outside the loop if variability is
required; update the call site that uses /hello/[Symbol.match] so it no longer
invokes Math.random() on every iteration.

[coderabbitai]

🧹 Nitpick | 🔵 Trivial | ⚡ Quick win

Restore Object.prototype.then after the test body.

This test mutates a global prototype and never tears it down. Add cleanup to prevent cross-test/harness leakage.

Proposed fix

 Object.defineProperty(Object.prototype, "then", {
     get() {
         log.push("then:" + thenGets);
         if (thenGets++ === 0)
             iter.next();
         return undefined;
     },
     configurable: true,
 });
 
-let error = null;
-let resolvedWith = null;
-
-(async function main() {
-    iter = gen();
-    await iter.next();
-    log.push("await-first");
-    await 0;
-    await 0;
-    return 10;
-})().then(result => { resolvedWith = result; }, e => { error = e; });
-
-drainMicrotasks();
-
-if (error)
-    throw error;
-shouldBe(log.join("|"), "start|then:0|resume|await-first|then:1");
-shouldBe(resolvedWith, 10);
+let error = null;
+let resolvedWith = null;
+try {
+    (async function main() {
+        iter = gen();
+        await iter.next();
+        log.push("await-first");
+        await 0;
+        await 0;
+        return 10;
+    })().then(result => { resolvedWith = result; }, e => { error = e; });
+
+    drainMicrotasks();
+
+    if (error)
+        throw error;
+    shouldBe(log.join("|"), "start|then:0|resume|await-first|then:1");
+    shouldBe(resolvedWith, 10);
+} finally {
+    delete Object.prototype.then;
+}

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@JSTests/stress/async-generator-reentrant-resume-during-resolve.js` around
lines 24 - 32, The test replaces Object.prototype.then without restoring it;
save the original descriptor for Object.prototype.then (e.g., origThenDesc =
Object.getOwnPropertyDescriptor(Object.prototype, "then")) before calling
Object.defineProperty, and after the test body (or in a finally/cleanup block)
restore it: if origThenDesc is undefined, delete Object.prototype.then,
otherwise call Object.defineProperty(Object.prototype, "then", origThenDesc).
Ensure the cleanup runs even if the test throws so thenGets/iter.next behavior
does not leak into other tests.

[coderabbitai]

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

❓ Verification inconclusive

🌐 Web query:

Does the ECMAScript Temporal specification guarantee that Temporal.Now.instant() is monotonic (non-decreasing) across calls?

💡 Result:

No, the ECMAScript Temporal specification does not guarantee that Temporal.Now.instant is monotonic [1]. Subsequent calls to Temporal.Now.instant may return the same value or, in some cases, even a smaller value if the system clock is adjusted (e.g., via NTP) between calls [2][1]. The Temporal specification defines Temporal.Now.instant to return the current system time [3][4]. Because it relies on the underlying system clock, it does not provide the monotonic properties required for measuring elapsed time without potential drift or stagnation [2]. TC39 champions have explicitly declined to mandate monotonicity for this method, noting that limiting the accuracy of the system clock is the domain of the host environment (such as the browser or runtime) rather than the ECMAScript specification itself [1]. For monotonic time measurements, developers should use platform-specific APIs, such as performance.now in web browsers [2].

Citations:

• 1: API/Documentation risk with Temporal.Now tc39/proposal-temporal#2713
• 2: Does temporal support for query monotonic nanosecond current time? tc39/proposal-temporal#2048
• 3: https://tc39.es/proposal-temporal/docs/now.html
• 4: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Temporal/Now/instant

---

Monotonic wall-clock assertion can make this stress test flaky.

Lines 77–82 assume Temporal.Now.instant() is non-decreasing across calls, but the Temporal spec/TC39 does not guarantee monotonicity because it’s based on the underlying system clock and can move backwards if the host adjusts time (e.g., NTP). Replace the monotonic check with an API-validity assertion (e.g., that each call returns a Temporal.Instant) to avoid unrelated failures.

Deterministic alternative focused on API validity (not host clock monotonicity)

-    let prev = Temporal.Now.instant();
-    for (let i = 0; i < 100; i++) {
-        const curr = Temporal.Now.instant();
-        const cmp = Temporal.Instant.compare(prev, curr);
-        if (cmp > 0) throw new Error(`Now.instant() not monotonic at iteration ${i}`);
-        prev = curr;
-    }
+    for (let i = 0; i < 100; i++) {
+        const curr = Temporal.Now.instant();
+        shouldBe(curr instanceof Temporal.Instant, true, `Now.instant() returns Instant at iteration ${i}`);
+    }

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	let prev = Temporal.Now.instant();
	for (let i = 0; i < 100; i++) {
	const curr = Temporal.Now.instant();
	const cmp = Temporal.Instant.compare(prev, curr);
	if (cmp > 0) throw new Error(`Now.instant() not monotonic at iteration ${i}`);
	prev = curr;
	for (let i = 0; i < 100; i++) {
	const curr = Temporal.Now.instant();
	shouldBe(curr instanceof Temporal.Instant, true, `Now.instant() returns Instant at iteration ${i}`);
	}

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@JSTests/stress/temporal-gc-jit-stress.js` around lines 77 - 82, The loop
currently asserts monotonicity by comparing prev and curr using
Temporal.Instant.compare and throwing on cmp > 0; remove that monotonicity check
and the throw, and instead assert API validity by checking each call returns a
Temporal.Instant (e.g., verify typeof/instance or that Temporal.Instant.compare
can be called with the value without expecting ordering), replacing uses of
prev/curr comparison with a simple validation of the result of
Temporal.Now.instant() inside the for loop (referencing Temporal.Now.instant,
Temporal.Instant.compare only for validation if needed, and the loop variables
prev and curr).

[coderabbitai]

⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Fix self-referential a4 TDZ that masks the intended Temporal check.

Line 6 (let a4 = a4.withPlainTime(a3);) always throws ReferenceError first, so this test stops validating the intended Temporal.PlainYearMonth flow. Use the constructed a2 object instead, and keep a3 local.

Proposed fix

 function opt(a1) {
     var a2 = new Temporal.PlainYearMonth(((NaN * a1 <= 0).__proto__ = "\\u{1F4A9}ba"), 1, 'chinese', 1);
-    a3 = a1;
-    let a4 = a4.withPlainTime(a3);
+    let a3 = a1;
+    a2.withPlainTime(a3);
     throw a1;
 }

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	a3 = a1;
	let a4 = a4.withPlainTime(a3);
	throw a1;
	function opt(a1) {
	var a2 = new Temporal.PlainYearMonth(((NaN * a1 <= 0).__proto__ = "\\u{1F4A9}ba"), 1, 'chinese', 1);
	let a3 = a1;
	a2.withPlainTime(a3);
	throw a1;
	}

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@JSTests/stress/temporal-plainyearmonth-constructor-exception-check.js` around
lines 5 - 7, The test currently triggers a TDZ ReferenceError because it
declares let a4 and immediately uses a4.withPlainTime(a3); replace that
self-referential initialization by calling withPlainTime on the constructed
PlainYearMonth instance (use a2.withPlainTime(a3)) and keep a3 as the local time
object used for the call so the intended Temporal.PlainYearMonth path is
executed (refer to variables a1, a2, a3, a4 and the withPlainTime call).

[coderabbitai]

⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

🧩 Analysis chain

🌐 Web query:

Does JSON.stringify throw on JavaScript BigInt values, and what error is specified?

💡 Result:

Yes, JSON.stringify throws a TypeError when it encounters a JavaScript BigInt value [1][2][3]. This occurs because BigInt values are not supported by the JSON standard [1][4]. The specific error message can vary slightly depending on the JavaScript engine: - Firefox typically throws: TypeError: BigInt value can't be serialized in JSON [1]. - V8-based engines (such as Chrome and Node.js) typically throw: TypeError: Do not know how to serialize a BigInt [1][5][6]. - Safari typically throws: TypeError: JSON.stringify cannot serialize BigInt [1]. To resolve this, you can provide a replacer function to JSON.stringify to convert BigInts to strings or numbers, or define a toJSON method on BigInt.prototype [1][5][7].

Citations:

• 1: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Errors/BigInt_not_serializable
• 2: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global%5FObjects/JSON/stringify
• 3: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/JSON/stringify
• 4: ECMAScript specification documentation needs to be updated about JSON.stringify(24.5.2.1)? tc39/ecma262#1840
• 5: https://stackoverflow.com/questions/79529978/typeerror-do-not-know-how-to-serialize-a-bigint-when-json-stringifyobject
• 6: JSON.stringify should disallow BigInt value microsoft/TypeScript#63333
• 7: https://stackoverflow.com/questions/65152373/typescript-serialize-bigint-in-json

---

Fix BigInt assertion error formatting in shouldBe().

shouldBe() formats mismatches via JSON.stringify(...), but JSON.stringify(BigInt) throws a TypeError (“Do not know how to serialize a BigInt” / similar), so a failing BigInt comparison reports that TypeError instead of the intended “expected … but got …” message.

 function shouldBe(actual, expected) {
+    const format = (value) => typeof value === "bigint" ? `${value}n` : JSON.stringify(value);
     if (actual !== expected)
-        throw new Error(`expected ${JSON.stringify(expected)} but got ${JSON.stringify(actual)}`);
+        throw new Error(`expected ${format(expected)} but got ${format(actual)}`);
 }

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	function shouldBe(actual, expected) {
	if (actual !== expected)
	throw new Error(`expected ${JSON.stringify(expected)} but got ${JSON.stringify(actual)}`);
	}
	function shouldBe(actual, expected) {
	const format = (value) => typeof value === "bigint" ? `${value}n` : JSON.stringify(value);
	if (actual !== expected)
	throw new Error(`expected ${format(expected)} but got ${format(actual)}`);
	}

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@JSTests/stress/temporal-zdt-large-fold-disambiguation.js` around lines 3 - 6,
The assertion helper shouldBe currently uses JSON.stringify on actual/expected
which throws for BigInt; update shouldBe to format values using JSON.stringify
with a replacer that converts BigInt to a string (e.g. v => typeof v ===
'bigint' ? v.toString() + 'n' : v) so mismatches produce the intended "expected
… but got …" message; modify the call sites inside the shouldBe function to use
this safe serializer for both actual and expected.

[coderabbitai]

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Missing async completion on failure path causes timeout

Line 15 handles onerror with testFailed(...) only. With Line 6 setting window.jsTestIsAsync = true, the error path never calls finishJSTest(), so this test can hang instead of terminating cleanly.

Suggested fix

 <script>
 window.jsTestIsAsync = true;
 function prefetch_onload() {
     testPassed('onload called!');
     finishJSTest();
 }
+function prefetch_onerror() {
+    testFailed('onerror');
+    finishJSTest();
+}
 </script>
@@
-<link href="prefetch.link" rel="prefetch" onload="prefetch_onload()" onerror="testFailed('onerror')" />
+<link href="prefetch.link" rel="prefetch" onload="prefetch_onload()" onerror="prefetch_onerror()" />

Also applies to: 9-9, 15-15

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@LayoutTests/fast/dom/HTMLLinkElement/subresource.html` at line 6, The test
sets window.jsTestIsAsync = true but the onerror handler only calls
testFailed(...), so failures never call finishJSTest() and the test can hang;
update the onerror handler (the function assigned to the element's onerror) to
call finishJSTest() after reporting the failure (e.g., call finishJSTest()
immediately after testFailed(...)) so both success and failure paths terminate
the async test; ensure similar fixes are applied to the other occurrences
referenced by the review (the other onerror handlers at the indicated
locations).

[coderabbitai]

⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Add a no-eventSender completion path to avoid async hang.

window.jsTestIsAsync is always true, but when window.eventSender is unavailable the condition at Line 40 never becomes true, so the test can stall until timeout.

Suggested fix

-    if (window.eventSender) {
+    if (window.eventSender) {
         var r = btn.getBoundingClientRect();
         eventSender.mouseMoveTo(r.left + r.width / 2, r.top + r.height / 2);

         container.removeChild(wrapper);

         var r2 = other.getBoundingClientRect();
         eventSender.mouseMoveTo(r2.left + r2.width / 2, r2.top + r2.height / 2);
+    } else {
+        testFailed("This test requires eventSender");
+        finishJSTest();
+        return;
     }

     UIHelper.waitForCondition(() => containerLeaveReceived).then(() => {
         shouldBeTrue("containerLeaveReceived");
         finishJSTest();

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	if (window.eventSender) {
	var r = btn.getBoundingClientRect();
	eventSender.mouseMoveTo(r.left + r.width / 2, r.top + r.height / 2);
	container.removeChild(wrapper);
	var r2 = other.getBoundingClientRect();
	eventSender.mouseMoveTo(r2.left + r2.width / 2, r2.top + r2.height / 2);
	}
	UIHelper.waitForCondition(() => containerLeaveReceived).then(() => {
	shouldBeTrue("containerLeaveReceived");
	finishJSTest();
	});
	if (window.eventSender) {
	var r = btn.getBoundingClientRect();
	eventSender.mouseMoveTo(r.left + r.width / 2, r.top + r.height / 2);
	container.removeChild(wrapper);
	var r2 = other.getBoundingClientRect();
	eventSender.mouseMoveTo(r2.left + r2.width / 2, r2.top + r2.height / 2);
	} else {
	testFailed("This test requires eventSender");
	finishJSTest();
	return;
	}
	UIHelper.waitForCondition(() => containerLeaveReceived).then(() => {
	shouldBeTrue("containerLeaveReceived");
	finishJSTest();
	});

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@LayoutTests/fast/events/pointerleave-after-ancestor-removal.html` around
lines 30 - 43, When window.eventSender is not present the async waiter never
resolves; add a no-eventSender completion path so the test won't hang: detect if
(!window.eventSender) before using eventSender and immediately set
containerLeaveReceived = true (or call shouldBeTrue/finishJSTest directly) so
UIHelper.waitForCondition(() => containerLeaveReceived) can proceed; update the
block around eventSender.mouseMoveTo and the subsequent
UIHelper.waitForCondition usage (referencing eventSender,
containerLeaveReceived, UIHelper.waitForCondition, and finishJSTest) to ensure
the test completes synchronously when eventSender is unavailable.

[coderabbitai]

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Async mode is enabled even when no automated click path exists.

Line 5 forces async mode, but Lines 19–27 do nothing when window.eventSender is unavailable. That combination can hang this test (no finishJSTest() path triggered automatically).

Suggested fix (gate async mode to automation path)

-        window.jsTestIsAsync = true;
+        window.jsTestIsAsync = !!window.eventSender;

Also applies to: 19-27

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@LayoutTests/fast/events/popup-blocking-timers2.html` at line 5, The test
enables async mode unconditionally via window.jsTestIsAsync which can hang when
window.eventSender automation is absent; change the harness so async mode is
only enabled when an automated click path exists (e.g., guard setting
window.jsTestIsAsync = true behind a check for window.eventSender or
equivalent), and ensure the code paths around the eventSender-driven clicks (the
logic referenced in the block handling the automated click) either call
finishJSTest() or avoid requiring async mode when window.eventSender is
undefined; update references in this file to gate setting window.jsTestIsAsync
and the eventSender click flow accordingly.

[coderabbitai]

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Root cause: async harness migration missed fallback termination paths.
These tests now opt into async (jsTestIsAsync = true) but at least one unsupported-environment branch exits/fails without finishJSTest(), creating timeout risk. Ensure every early-exit/fallback path explicitly finishes the test.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@LayoutTests/fast/events/touch/gesture/gesture-scroll.html` at line 122, The
test sets window.jsTestIsAsync = true but some unsupported-environment or
early-exit branches return/throw without calling finishJSTest(), causing
timeouts; update every early-exit/fallback branch in this file (any
feature-detection or "unsupported" code paths) to call finishJSTest() before
returning or exiting so the async harness is always terminated (ensure
finishJSTest() is invoked in the same branches that currently call return/throw
or call testFailed/closeEarly).

[coderabbitai]

⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Call finishJSTest() unconditionally in async mode.

With window.jsTestIsAsync = true on Line 12, gating completion on Line 16 can leave non-TestRunner runs pending indefinitely.

Proposed fix

 function onDragStart() {
     document.getElementById("result").innerHTML = "PASS";
-    if (window.testRunner) {
-        finishJSTest();
-    }
+    finishJSTest();
 }

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	window.jsTestIsAsync = true;
	function onDragStart() {
	document.getElementById("result").innerHTML = "PASS";
	if (window.testRunner) {
	testRunner.notifyDone();
	finishJSTest();
	}
	window.jsTestIsAsync = true;
	function onDragStart() {
	document.getElementById("result").innerHTML = "PASS";
	finishJSTest();
	}

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In
`@LayoutTests/fast/events/touch/gesture/long-press-on-draggable-element-in-nested-iframes-triggers-drag.html`
around lines 12 - 17, The test sets window.jsTestIsAsync = true but only calls
finishJSTest() conditionally inside onDragStart, which can leave non-TestRunner
environments hanging; modify onDragStart to always call finishJSTest() when
running in async mode by invoking finishJSTest() unconditionally (or guarded
only by the global jsTestIsAsync flag) after setting the result element,
referencing the onDragStart function and the finishJSTest call so the test
finishes in all environments.

[coderabbitai]

Actionable comments posted: 16

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (4)

LayoutTests/fast/events/popup-blocked-from-fake-user-gesture.html (1)

29-44: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Missing finishJSTest() when testRunner is unavailable.

The entire test logic is wrapped in an if (window.testRunner) guard (lines 29-44) with no else branch. When testRunner is unavailable, finishJSTest() is never called, causing a timeout in async mode (jsTestIsAsync = true at line 9).

🔧 Suggested fix

             if (window.testRunner) {

                 var button = document.getElementById("test");

                 if (window.eventSender) {
                     eventSender.mouseMoveTo(button.offsetLeft + button.offsetWidth / 2, button.offsetTop + button.offsetHeight / 2);
                     eventSender.mouseDown();
                     eventSender.mouseUp();
                 }

                 clickHandler = clickHandler2;
                 window.event = stolenEvent;
                 button.click();

                 finishJSTest();
+            } else {
+                debug("This test requires testRunner.");
+                finishJSTest();
             }

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@LayoutTests/fast/events/popup-blocked-from-fake-user-gesture.html` around
lines 29 - 44, The test currently only calls finishJSTest() inside the if
(window.testRunner) block, so when window.testRunner is falsy the async test
never finishes; update the logic around the if (window.testRunner) guard (the
block that manipulates button, eventSender, clickHandler, window.event and calls
button.click()) to ensure finishJSTest() is always invoked regardless of
window.testRunner presence — either by adding an else that calls finishJSTest()
or by moving the finishJSTest() call out of the conditional so finishJSTest()
runs in all cases.

LayoutTests/fast/events/touch/gesture/touch-gesture-noscroll-body-yhidden.html (1)

142-143: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Missing finishJSTest() in the no-eventSender fallback path.

When window.eventSender is unavailable, this else branch (lines 142-143) only logs a debug message without calling finishJSTest(). Since the test enables async mode (jsTestIsAsync = true at line 127), this causes a timeout.

🔧 Suggested fix

     } else {
         debug("This test requires DumpRenderTree.  Touch scroll the red rect to log.");
+        finishJSTest();
     }

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In
`@LayoutTests/fast/events/touch/gesture/touch-gesture-noscroll-body-yhidden.html`
around lines 142 - 143, The else branch that runs when window.eventSender is
missing only calls debug("This test requires DumpRenderTree. Touch scroll the
red rect to log."); but does not call finishJSTest(), causing an async test
timeout (jsTestIsAsync is true). Update that fallback else block to call
finishJSTest() after the debug() call so the test completes; locate the branch
that checks window.eventSender and add a finishJSTest() invocation to it.

LayoutTests/fast/events/popup-blocking-timers5.html (1)

22-31: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Missing finishJSTest() when eventSender is unavailable.

clickButton() is called unconditionally on page load (line 34). When window.eventSender is missing, the conditional block (lines 26-30) prevents the click from firing, so clickHandler() never runs and finishJSTest() is never called, causing a timeout in async test mode.

🔧 Suggested fix

         function clickButton() {
             var button = document.getElementById("test");
             var buttonX = button.offsetLeft + button.offsetWidth / 2;
             var buttonY = button.offsetTop + button.offsetHeight / 2;
             if (window.eventSender) {
                 eventSender.mouseMoveTo(buttonX, buttonY);
                 eventSender.mouseDown();
                 eventSender.mouseUp();
+            } else {
+                debug("This test requires DumpRenderTree.");
+                finishJSTest();
             }
         }

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@LayoutTests/fast/events/popup-blocking-timers5.html` around lines 22 - 31,
The clickButton function currently only triggers a click when window.eventSender
exists, so when eventSender is missing clickHandler and finishJSTest never run;
update clickButton to handle the fallback case by either invoking button.click()
or calling clickHandler() directly and then calling finishJSTest() when
eventSender is unavailable (referencing clickButton, clickHandler, finishJSTest,
eventSender and the DOM element with id "test").

LayoutTests/fast/events/touch/gesture/gesture-dblclick.html (1)

76-78: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Missing finishJSTest() in the no-eventSender fallback path.

When window.eventSender is unavailable, this else branch (lines 76-78) only logs a debug message without calling finishJSTest(). Since the test enables async mode (jsTestIsAsync = true at line 70), this causes a timeout.

🔧 Suggested fix

     } else {
         debug("This test requires DumpRenderTree.")
+        finishJSTest();
     }

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@LayoutTests/fast/events/touch/gesture/gesture-dblclick.html` around lines 76
- 78, The else branch that runs when window.eventSender is unavailable only
calls debug("This test requires DumpRenderTree.") and never completes the async
test; update that branch to call finishJSTest() after logging so the async test
ends correctly (jsTestIsAsync is set to true); locate the else block in
gesture-dblclick.html that checks for window.eventSender and add a
finishJSTest() call there to avoid timeouts.

♻️ Duplicate comments (14)

JSTests/test262/test/intl402/Temporal/PlainMonthDay/prototype/toLocaleString/basic.js (1)

33-33: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Remove duplicated features frontmatter entry.

Line 33 repeats features: [Temporal] already declared at Line 31. The duplicate entry should be removed to avoid metadata parsing ambiguity.

🧹 Proposed fix

 locale: [en-US, de-AT]
-features: [Temporal]
 ---*/

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In
`@JSTests/test262/test/intl402/Temporal/PlainMonthDay/prototype/toLocaleString/basic.js`
at line 33, Remove the duplicated frontmatter entry by deleting the second
"features: [Temporal]" occurrence so only a single "features: [Temporal]"
remains in the file; search for the duplicate string "features: [Temporal]" and
remove the later instance to avoid metadata ambiguity.

LayoutTests/editing/selection/ios/tap-focused-input-clears-outside-selection.html (1)

25-53: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Add a guard for missing UIHelper to prevent async test hangs.

With jsTestIsAsync = true (line 22), if UIHelper is unavailable, the load handler will throw an error at line 31 before reaching finishJSTest() (line 52), causing an indefinite timeout. The past review comment correctly identified this issue.

🛡️ Proposed guard

 addEventListener("load", async () => {
+    if (!window.UIHelper) {
+        testFailed("This test requires WebKitTestRunner UIHelper.");
+        finishJSTest();
+        return;
+    }
     const input = document.querySelector("input");

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In
`@LayoutTests/editing/selection/ios/tap-focused-input-clears-outside-selection.html`
around lines 25 - 53, The load handler assumes UIHelper exists and will throw
before finishJSTest(), causing the async test to hang; add an early guard at the
top of the addEventListener("load", ...) callback that checks for
window.UIHelper (or typeof UIHelper !== "undefined") and if missing logs a clear
failure and calls finishJSTest() (or otherwise terminates the test) so the test
never times out; reference the UIHelper usage (activateAndWaitForInputSessionAt,
longPressElement, activateElementAndWaitForInputSession) and ensure
finishJSTest() is invoked on the guard path.

LayoutTests/fast/events/pointerleave-after-ancestor-removal.html (1)

30-43: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Add fallback when eventSender is unavailable to prevent test hang.

When window.eventSender is not present, containerLeaveReceived remains false indefinitely, causing UIHelper.waitForCondition() at line 40 to wait forever and the async test to hang.

🔧 Suggested fix

     if (window.eventSender) {
         var r = btn.getBoundingClientRect();
         eventSender.mouseMoveTo(r.left + r.width / 2, r.top + r.height / 2);

         container.removeChild(wrapper);

         var r2 = other.getBoundingClientRect();
         eventSender.mouseMoveTo(r2.left + r2.width / 2, r2.top + r2.height / 2);
+    } else {
+        testFailed("This test requires eventSender");
+        finishJSTest();
+        return;
     }

     UIHelper.waitForCondition(() => containerLeaveReceived).then(() => {

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@LayoutTests/fast/events/pointerleave-after-ancestor-removal.html` around
lines 30 - 43, The test can hang if window.eventSender is missing because
containerLeaveReceived never becomes true; update the logic around the
eventSender check (the block that calls eventSender.mouseMoveTo) to provide a
fallback when window.eventSender is falsy: either synthesize the pointer/leave
outcome by setting containerLeaveReceived = true (or dispatching the equivalent
DOM event) before calling UIHelper.waitForCondition(), so
UIHelper.waitForCondition(() => containerLeaveReceived) will not wait
indefinitely; adjust the code near eventSender, containerLeaveReceived, and
UIHelper.waitForCondition to implement this fallback.

JSTests/stress/temporal-plainyearmonth-constructor-exception-check.js (1)

5-7: ⚠️ Potential issue | 🔴 Critical | ⚡ Quick win

Fix self-referential a4 TDZ that masks the intended Temporal check.

Line 6 (let a4 = a4.withPlainTime(a3);) always throws ReferenceError due to temporal dead zone before the intended Temporal.PlainYearMonth validation can execute. Use the constructed a2 instance or fix the initialization chain.

🐛 Proposed fix

 function opt(a1) {
     var a2 = new Temporal.PlainYearMonth(((NaN * a1 <= 0).__proto__ = "\\u{1F4A9}ba"), 1, 'chinese', 1);
-    a3 = a1;
-    let a4 = a4.withPlainTime(a3);
+    let a3 = a1;
+    a2.withPlainTime(a3);
     throw a1;
 }

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@JSTests/stress/temporal-plainyearmonth-constructor-exception-check.js` around
lines 5 - 7, The current initialization uses a self-referential let binding:
"let a4 = a4.withPlainTime(a3);" which triggers a ReferenceError from the TDZ
and prevents the intended Temporal.PlainYearMonth validation; change the
initialization to call withPlainTime on the already-constructed instance (use
"a2.withPlainTime(a3)" or otherwise use the constructed object instead of a4) so
the Temporal check occurs instead of the TDZ error, and ensure subsequent throws
still reference the correct variables (a1, a2, a3, a4).

LayoutTests/fast/dom/HTMLLinkElement/subresource.html (1)

6-6: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Error path still missing finishJSTest().

The success path (L9) correctly calls finishJSTest(), but the error handler at L15 (onerror="testFailed('onerror')") does not call finishJSTest(). With window.jsTestIsAsync = true set at L6, the test will hang on failure instead of terminating.

🛡️ Proposed fix

+function prefetch_onerror() {
+    testFailed('onerror');
+    finishJSTest();
+}
 </script>
 <html>
 <p>This test will only print "PASS" or "FAIL" if link prefetches are
 enabled, otherwise it will show nothing below.</p>
-<link href="prefetch.link" rel="prefetch" onload="prefetch_onload()" onerror="testFailed('onerror')" />
+<link href="prefetch.link" rel="prefetch" onload="prefetch_onload()" onerror="prefetch_onerror()" />

Also applies to: 9-9, 15-15

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@LayoutTests/fast/dom/HTMLLinkElement/subresource.html` at line 6, The error
handler for the image link does not call finishJSTest(), so when
window.jsTestIsAsync = true the test hangs on failure; update the onerror path
to ensure finishJSTest() is invoked (either by calling finishJSTest() directly
in the onerror="..." attribute alongside testFailed('onerror') or by making
testFailed(...) itself call finishJSTest()), referencing the existing onerror
handler and the finishJSTest function to ensure the test always terminates on
both success and failure.

LayoutTests/fast/canvas/webgl/gl-teximage-imagebitmap.html (1)

135-137: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Rejection handler must call finishJSTest() to complete async test.

With window.jsTestIsAsync = true, the rejection path must also call finishJSTest() after testFailed(). Without it, test failures will time out instead of completing.

🔧 Proposed fix

 test().then(() => {
   finishJSTest();
 }, e => {
   testFailed(String(e));
+  finishJSTest();
 });

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@LayoutTests/fast/canvas/webgl/gl-teximage-imagebitmap.html` around lines 135
- 137, The rejection handler for the promise currently only calls
testFailed(String(e)) and must also call finishJSTest() so the async JS test
completes; update the arrow function (the rejection callback passed after the
success handler) to call testFailed(String(e)) followed by finishJSTest(),
ensuring window.jsTestIsAsync is respected.

LayoutTests/fast/events/touch/gesture/gesture-scroll.html (1)

137-138: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Missing finishJSTest() in the no-eventSender fallback path.

The test sets jsTestIsAsync = true (line 122), but when window.eventSender is unavailable, this branch only calls debug() without calling finishJSTest(), causing a timeout.

🔧 Suggested fix

     } else {
         debug("This test requires DumpRenderTree.");
+        finishJSTest();
     }

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@LayoutTests/fast/events/touch/gesture/gesture-scroll.html` around lines 137 -
138, The no-eventSender fallback branch only calls debug("This test requires
DumpRenderTree.") while jsTestIsAsync is set, causing a timeout; update that
branch so after the debug() call it also calls finishJSTest() to end the async
test. Locate the check for window.eventSender and add the finishJSTest()
invocation after the debug(...) call to ensure the test completes when
eventSender is unavailable.

JSTests/stress/temporal-zoned-datetime-dst-fold.js (1)

7-10: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

shouldThrow silently swallows unexpected exceptions, causing false-positive test passes.

The catch block only rethrows when e.message.startsWith(msg). If fn() throws an unrelated exception (e.g., a TypeError or a RangeError with a different message), the test will silently pass instead of failing.

🐛 Proposed fix

 function shouldThrow(fn, msg) {
-    try { fn(); throw new Error(`${msg}: should have thrown`); }
-    catch (e) { if (e.message.startsWith(msg)) throw e; }
+    let didThrow = false;
+    try {
+        fn();
+    } catch (e) {
+        didThrow = true;
+    }
+    if (!didThrow)
+        throw new Error(`${msg}: should have thrown`);
 }

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@JSTests/stress/temporal-zoned-datetime-dst-fold.js` around lines 7 - 10, The
helper shouldThrow currently swallows unexpected exceptions; update the function
shouldThrow(fn, msg) so that it throws the "should have thrown" error when fn()
does not throw, and in the catch block rethrow any exception that does not match
the expected message (i.e., if !e.message.startsWith(msg) then throw e),
otherwise treat the expected exception as success. Locate shouldThrow and adjust
the try/catch accordingly to avoid silently swallowing unrelated errors.

LayoutTests/fast/events/popup-blocking-timers2.html (1)

5-5: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Async mode is enabled even when no automated click path exists.

Line 5 forces async mode, but Lines 19–27 do nothing when window.eventSender is unavailable. That combination can hang this test (no finishJSTest() path triggered automatically).

Suggested fix (gate async mode to automation path)

-        window.jsTestIsAsync = true;
+        window.jsTestIsAsync = !!window.eventSender;

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@LayoutTests/fast/events/popup-blocking-timers2.html` at line 5, Gate enabling
async mode to the automated click path: only set window.jsTestIsAsync = true
when the automation eventSender is present (e.g., wrap the assignment in if
(window.eventSender) { window.jsTestIsAsync = true; }). Ensure the existing code
paths that use window.eventSender (and the automatic finishJSTest() trigger)
remain unchanged so tests without eventSender do not enter async mode and hang.

LayoutTests/fast/canvas/webgl/draw-elements-out-of-bounds-uint-index.html (1)

21-24: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Return early when OES_element_index_uint is unavailable in WebGL1.

Line 23 marks pass ("no extension") but continues into the UNSIGNED_INT draw path. Without the extension, drawElements with UNSIGNED_INT generates INVALID_ENUM, not the expected INVALID_OPERATION at line 40, causing the test to fail incorrectly.

🐛 Proposed fix to add early return

     if (contextType == "webgl") {
-        if (!context.getExtension("OES_element_index_uint"))
+        if (!context.getExtension("OES_element_index_uint")) {
             testPassed("no extension");
+            return;
+        }
     }

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@LayoutTests/fast/canvas/webgl/draw-elements-out-of-bounds-uint-index.html`
around lines 21 - 24, In the webgl branch where you check for
OES_element_index_uint (the if (contextType == "webgl") block that calls
context.getExtension("OES_element_index_uint") and testPassed("no extension")),
return immediately after logging the pass so execution does not fall through
into the UNSIGNED_INT drawElements path; specifically, add an early return right
after testPassed("no extension") to avoid calling drawElements with UNSIGNED_INT
when the extension is missing.

JSTests/stress/async-generator-reentrant-resume-during-resolve.js (1)

24-32: 🛠️ Refactor suggestion | 🟠 Major | ⚡ Quick win

Restore Object.prototype.then after the test body.

This test mutates a global prototype and never tears it down. Add cleanup to prevent cross-test/harness leakage.

♻️ Proposed fix to add cleanup

 Object.defineProperty(Object.prototype, "then", {
     get() {
         log.push("then:" + thenGets);
         if (thenGets++ === 0)
             iter.next();
         return undefined;
     },
     configurable: true,
 });
 
 let error = null;
 let resolvedWith = null;
-
-(async function main() {
-    iter = gen();
-    await iter.next();
-    log.push("await-first");
-    await 0;
-    await 0;
-    return 10;
-})().then(result => { resolvedWith = result; }, e => { error = e; });
-
-drainMicrotasks();
-
-if (error)
-    throw error;
-shouldBe(log.join("|"), "start|then:0|resume|await-first|then:1");
-shouldBe(resolvedWith, 10);
+try {
+    (async function main() {
+        iter = gen();
+        await iter.next();
+        log.push("await-first");
+        await 0;
+        await 0;
+        return 10;
+    })().then(result => { resolvedWith = result; }, e => { error = e; });
+
+    drainMicrotasks();
+
+    if (error)
+        throw error;
+    shouldBe(log.join("|"), "start|then:0|resume|await-first|then:1");
+    shouldBe(resolvedWith, 10);
+} finally {
+    delete Object.prototype.then;
+}

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@JSTests/stress/async-generator-reentrant-resume-during-resolve.js` around
lines 24 - 32, The test adds a getter for Object.prototype.then and never
restores it; save the original descriptor for "then" before calling
Object.defineProperty (or detect if it was undefined), then ensure you restore
the original state in a finally/cleanup block after the test body (either by
re-defining the saved descriptor or deleting Object.prototype.then if it didn’t
exist). Locate the existing Object.defineProperty(Object.prototype, "then", {
get() { ... } }) usage (and related symbols thenGets, iter, log) and wrap the
test mutation so the original descriptor is restored regardless of test success
or failure to avoid leaking into other tests.

JSTests/stress/wasm-table-constructor-wrapper-function-default.js (1)

87-95: 🧹 Nitpick | 🔵 Trivial | ⚡ Quick win

Clarify comment or fix test input to match intent.

The comment on Line 87 states "Non-function default values keep throwing," but Line 90 passes a function (() => 1). If the intent is to test rejection of plain JS functions (not WebAssembly wrapper functions), the comment should be reworded. If the intent is to test actual non-function values (numbers, strings, objects), then replace () => 1 with a non-function value like 1.

Option 1: Test actual non-function values

-// Non-function default values keep throwing.
+// Non-function default values throw TypeError.
 let threw = false;
 try {
-    new WebAssembly.Table({ element: "funcref", initial: 1 }, () => 1);
+    new WebAssembly.Table({ element: "funcref", initial: 1 }, 1);
 } catch (error) {

Option 2: Clarify comment for plain JS function rejection

-// Non-function default values keep throwing.
+// Plain JS functions (not WebAssembly wrapper functions) throw TypeError.
 let threw = false;
 try {
     new WebAssembly.Table({ element: "funcref", initial: 1 }, () => 1);

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@JSTests/stress/wasm-table-constructor-wrapper-function-default.js` around
lines 87 - 95, The test comment and input disagree: the comment "Non-function
default values keep throwing" but the code passes a function in the
WebAssembly.Table constructor call new WebAssembly.Table({ element: "funcref",
initial: 1 }, () => 1); — either update the comment to state "Plain JS functions
are rejected as defaults" if you intend to assert rejection of regular JS
functions, or change the second argument to a non-function value (e.g., replace
() => 1 with 1 or "foo") to test actual non-function defaults; modify the
comment or the constructor call in the test so the intent and input match (refer
to the WebAssembly.Table constructor call in this file).

JSTests/stress/temporal-zdt-large-fold-disambiguation.js (1)

3-6: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Fix BigInt serialization in shouldBe error messages.

The shouldBe helper uses JSON.stringify() which throws TypeError when encountering BigInt values. Since this test compares epochNanoseconds (BigInt), any assertion failure would produce a serialization error instead of the intended "expected … but got …" message.

🛠️ Proposed fix

 function shouldBe(actual, expected) {
+    const format = (value) => typeof value === "bigint" ? `${value}n` : JSON.stringify(value);
     if (actual !== expected)
-        throw new Error(`expected ${JSON.stringify(expected)} but got ${JSON.stringify(actual)}`);
+        throw new Error(`expected ${format(expected)} but got ${format(actual)}`);
 }

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@JSTests/stress/temporal-zdt-large-fold-disambiguation.js` around lines 3 - 6,
The shouldBe helper throws a TypeError when JSON.stringify encounters BigInt (so
assertion failures on epochNanoseconds hide the real message); update the
shouldBe function to safely serialize values (e.g., use a replacer that converts
BigInt to a string or detect typeof value === 'bigint' and call toString())
before constructing the error message so the thrown Error contains "expected …
but got …" for BigInt comparisons; keep the function name shouldBe and only
change how actual and expected are stringified for the error text.

LayoutTests/fast/events/touch/gesture/long-press-on-draggable-element-in-nested-iframes-triggers-drag.html (1)

15-17: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Call finishJSTest() unconditionally in async mode.

With window.jsTestIsAsync = true on line 12, the conditional guard on line 15 can prevent proper test completion. When using the async harness pattern, finishJSTest() should be called unconditionally to properly close the test.

🔧 Proposed fix

 function onDragStart() {
     document.getElementById("result").innerHTML = "PASS";
-    if (window.testRunner) {
-        finishJSTest();
-    }
+    finishJSTest();
 }

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In
`@LayoutTests/fast/events/touch/gesture/long-press-on-draggable-element-in-nested-iframes-triggers-drag.html`
around lines 15 - 17, The test currently calls finishJSTest() only when
window.testRunner exists, which can prevent completion in async mode
(window.jsTestIsAsync = true); remove the conditional guard around
finishJSTest() so that finishJSTest() is invoked unconditionally at the end of
the script (replace the if (window.testRunner) { finishJSTest(); } block with a
direct call to finishJSTest()), ensuring the async test harness always closes
the test.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@JSTests/microbenchmarks/regexp-prototype-match-observable-side-effects.js`:
- Around line 26-28: Change the loose equality checks that rely on coercion
(assert(accesses == "")) to explicit empty-array checks: use
assert(accesses.length === 0, "...") (or assert(Array.isArray(accesses) &&
accesses.length === 0, "...") if you want to be defensive) for each occurrence
where the test verifies no accesses (the assert calls around the
RegExp.prototype[Symbol.match].call(obj, ...) checks referencing the variable
accesses). Replace all instances of accesses == "" with the explicit length (or
Array.isArray + length) check so the intent is clear and not dependent on JS
coercion.
- Line 109: Replace the loose equality check in the assertion with a strict
equality check: in the assertion that compares accesses.toString() to
"flags,exec" (the assert call referencing the accesses variable), change the
operator from == to === so the test uses strict string comparison and avoids
coercion.

In `@JSTests/stress/async-generator-next-on-completed-reentrant.js`:
- Around line 17-30: The test modifies Object.prototype by defining a "then"
accessor; record the original descriptor (or presence) before defining it and
restore it after the test completes (after the it.next() invocation and any
awaited microtasks), or at minimum delete Object.prototype.then at the end of
the test; update the code around the getter definition for "then" and the final
it.next() call to ensure the original state is restored (use the saved
originalDescriptor or delete if none) so global prototype pollution is cleaned
up.

In `@JSTests/stress/multi-put-by-val-mixed-dfg.js`:
- Line 20: The for-loop uses an undefined variable testLoopCount which causes a
ReferenceError; define a local iteration constant (e.g. const testLoopCount =
1e4 or another large number appropriate for DFG stress) above the loop that
contains for (let i = 0; i < testLoopCount; ++i) so the loop can run—add the
constant near the top of the file or immediately before the loop to ensure the
test executes and triggers DFG compilation.

In `@JSTests/stress/promise-resolving-functions-name-and-length.js`:
- Line 87: The for-loop references an undefined variable testLoopCount causing a
ReferenceError; fix it by declaring and initializing testLoopCount to a sensible
numeric iteration count (e.g., const testLoopCount = <N>) before the for (let i
= 0; i < testLoopCount; ++i) loop or by replacing testLoopCount with an existing
iteration variable (if one exists) so the loop uses a defined numeric value;
ensure the constant is >0 and placed in the same scope as the loop (near the top
of the test or just above the loop) so repeated allocation/JIT validation runs
as intended.

In `@JSTests/stress/temporal-boundary-values.js`:
- Around line 7-10: The helper shouldThrow has inverted logic: in the catch
block it currently re-throws when the caught error message matches the expected
prefix; change it so that shouldThrow re-throws the caught error only when
e.message does NOT start with the expected msg, and otherwise treat it as the
expected success (i.e., return/silently succeed). Update the catch in
shouldThrow to check e.message.startsWith(msg) and return on match, rethrow on
mismatch so wrong error messages no longer pass.

In `@JSTests/stress/temporal-int32-overflow-duration.js`:
- Line 46: Remove the duplicate assertion that repeats
Temporal.PlainYearMonth.from("-271821-04").toString() === "-271821-04" (the same
shouldBe call present twice); locate the repeated shouldBe invocation for
Temporal.PlainYearMonth.from("-271821-04").toString() and delete the second
occurrence (or replace it with a different, meaningful assertion if additional
coverage was intended).

In `@JSTests/stress/temporal-pre-lmt-timezone.js`:
- Around line 46-58: Rename the misleading variable isAmbiguous to reflect a DST
gap/nonexistent time (e.g., isNonexistent or isGap) in the test block that
constructs Temporal.ZonedDateTime earlier and later for 2025-03-09 02:30
America/Vancouver; update the assertion and any references to use the new name
so the test reads correctly (earlier and later produce different results because
the local time is non-existent).

In `@JSTests/stress/temporal-zoned-datetime-dst-gap.js`:
- Around line 9-12: The helper function shouldThrow has inverted logic: in the
catch it re-throws when the caught error's message does match the expected
prefix; change the condition so it re-throws only when the message does NOT
match the expected prefix (i.e. use a negated startsWith check) so correct
matches are swallowed and unexpected/errors from fn are propagated; update the
catch in shouldThrow accordingly.

In `@JSTests/wasm/stress/memory32-atomics-pointer-upper-bits.js`:
- Around line 45-47: The three assertions that check for an out-of-bounds trap
(the calls to exports.notify, exports.wait32, and exports.wait64) are too strict
by matching the entire RuntimeError message; change them to match only the
stable core text by using a regex or starts-with check for "Out of bounds memory
access" (e.g. assert.throws(..., WebAssembly.RuntimeError, /^Out of bounds
memory access/ or asserting error.message.startsWith("Out of bounds memory
access")) so variants with callsite context still pass.

In `@LayoutTests/fast/canvas/canvas-line-batch-flush.html`:
- Line 4: Replace the legacy test harness include in this test by swapping the
script src from "js-test-pre.js" to the newer "js-test.js" so the file uses the
same harness as the other updated tests (e.g., change-type.html); update the
<script> tag that currently references "js-test-pre.js" to reference
"js-test.js" and ensure any pre-test setup expectations in this file align with
the newer harness behavior.

In `@LayoutTests/fast/css-grid-layout/masonry-subgrid-excluded-legend-crash.html`:
- Line 4: The test uses "display: grid-lanes" which is a valid WebKit display
value when the gridLanes feature is enabled, so update the test to run with the
gridLanesEnabled feature flag on (instead of treating the value as invalid):
enable gridLanesEnabled in the test harness/setup (e.g. add the appropriate
layout-test meta or test-run option that turns on gridLanesEnabled) so the CSS
rule "display: grid-lanes" in this file is exercised under the feature gate and
the crash path is reached.

In `@LayoutTests/fast/dom/crash-with-bad-url.html`:
- Around line 4-7: The test currently relies on the subframe calling
testRunner.notifyDone() inside the injected image onerror handler, but that call
is guarded by if (window.testRunner) and may never run; update the test to
ensure async completion by either calling finishJSTest() from the top-level page
after creating the subframe or by making the subframe unconditionally call
testRunner.notifyDone() (or invoke a top-level finishJSTest() via postMessage
from the subframe) so the harness is always notified; locate the image onerror
handler in the subframe injection and the main test code around
finishJSTest()/testRunner.notifyDone() and implement one of these fixes.

In `@LayoutTests/fast/dom/pseudo-element-hidePopover-then-crash.html`:
- Line 31: Test mixes old synchronous harness with the new async harness: remove
the old synchronous harness includes and usage and keep the async pattern.
Specifically, delete the script tags referencing js-test-pre.js and
js-test-post.js (the lines that include those files) and any synchronous harness
assumptions, ensure window.jsTestIsAsync = true remains, and keep the
finishJSTest() call to complete the test; verify no other synchronous test
harness functions remain in the file (look for js-test-pre.js, js-test-post.js,
window.jsTestIsAsync, finishJSTest).

In `@LayoutTests/fast/events/popup-allowed-from-gesture-initiated-event.html`:
- Around line 64-67: The test currently only calls nextTest() when
window.testRunner exists, leaving jsTestIsAsync = true and never calling
finishJSTest() when testRunner is absent; add an else branch that calls
finishJSTest() (or otherwise ensures finishJSTest() is invoked) when
window.testRunner is falsy so the async test completes. Locate the conditional
around window.testRunner and nextTest() and insert the finishJSTest() call in
the fallback path so the test always finishes.

In `@LayoutTests/TestExpectations`:
- Around line 7115-7116: The test
imported/w3c/web-platform-tests/navigation-api/navigate-event/dangling-navigate-event-after-bfcache-restore.html
is causing a crash during BFCache restore; update the TestExpectations entry to
mark it as a Crash (not just Skip) and annotate it with the rdar://179168475
tracking ID so it shows as a prioritized stability regression, and file/link a
bug/regression ticket referencing rdar://179168475 and the test path so the
crash can be triaged and fixed; ensure the TestExpectations line for that test
is changed from "[ Skip ]" to the appropriate crash expectation and add a
one-line TODO comment with the bug ID for follow-up.

---

Outside diff comments:
In `@LayoutTests/fast/events/popup-blocked-from-fake-user-gesture.html`:
- Around line 29-44: The test currently only calls finishJSTest() inside the if
(window.testRunner) block, so when window.testRunner is falsy the async test
never finishes; update the logic around the if (window.testRunner) guard (the
block that manipulates button, eventSender, clickHandler, window.event and calls
button.click()) to ensure finishJSTest() is always invoked regardless of
window.testRunner presence — either by adding an else that calls finishJSTest()
or by moving the finishJSTest() call out of the conditional so finishJSTest()
runs in all cases.

In `@LayoutTests/fast/events/popup-blocking-timers5.html`:
- Around line 22-31: The clickButton function currently only triggers a click
when window.eventSender exists, so when eventSender is missing clickHandler and
finishJSTest never run; update clickButton to handle the fallback case by either
invoking button.click() or calling clickHandler() directly and then calling
finishJSTest() when eventSender is unavailable (referencing clickButton,
clickHandler, finishJSTest, eventSender and the DOM element with id "test").

In `@LayoutTests/fast/events/touch/gesture/gesture-dblclick.html`:
- Around line 76-78: The else branch that runs when window.eventSender is
unavailable only calls debug("This test requires DumpRenderTree.") and never
completes the async test; update that branch to call finishJSTest() after
logging so the async test ends correctly (jsTestIsAsync is set to true); locate
the else block in gesture-dblclick.html that checks for window.eventSender and
add a finishJSTest() call there to avoid timeouts.

In
`@LayoutTests/fast/events/touch/gesture/touch-gesture-noscroll-body-yhidden.html`:
- Around line 142-143: The else branch that runs when window.eventSender is
missing only calls debug("This test requires DumpRenderTree. Touch scroll the
red rect to log."); but does not call finishJSTest(), causing an async test
timeout (jsTestIsAsync is true). Update that fallback else block to call
finishJSTest() after the debug() call so the test completes; locate the branch
that checks window.eventSender and add a finishJSTest() invocation to it.

---

Duplicate comments:
In `@JSTests/stress/async-generator-reentrant-resume-during-resolve.js`:
- Around line 24-32: The test adds a getter for Object.prototype.then and never
restores it; save the original descriptor for "then" before calling
Object.defineProperty (or detect if it was undefined), then ensure you restore
the original state in a finally/cleanup block after the test body (either by
re-defining the saved descriptor or deleting Object.prototype.then if it didn’t
exist). Locate the existing Object.defineProperty(Object.prototype, "then", {
get() { ... } }) usage (and related symbols thenGets, iter, log) and wrap the
test mutation so the original descriptor is restored regardless of test success
or failure to avoid leaking into other tests.

In `@JSTests/stress/temporal-plainyearmonth-constructor-exception-check.js`:
- Around line 5-7: The current initialization uses a self-referential let
binding: "let a4 = a4.withPlainTime(a3);" which triggers a ReferenceError from
the TDZ and prevents the intended Temporal.PlainYearMonth validation; change the
initialization to call withPlainTime on the already-constructed instance (use
"a2.withPlainTime(a3)" or otherwise use the constructed object instead of a4) so
the Temporal check occurs instead of the TDZ error, and ensure subsequent throws
still reference the correct variables (a1, a2, a3, a4).

In `@JSTests/stress/temporal-zdt-large-fold-disambiguation.js`:
- Around line 3-6: The shouldBe helper throws a TypeError when JSON.stringify
encounters BigInt (so assertion failures on epochNanoseconds hide the real
message); update the shouldBe function to safely serialize values (e.g., use a
replacer that converts BigInt to a string or detect typeof value === 'bigint'
and call toString()) before constructing the error message so the thrown Error
contains "expected … but got …" for BigInt comparisons; keep the function name
shouldBe and only change how actual and expected are stringified for the error
text.

In `@JSTests/stress/temporal-zoned-datetime-dst-fold.js`:
- Around line 7-10: The helper shouldThrow currently swallows unexpected
exceptions; update the function shouldThrow(fn, msg) so that it throws the
"should have thrown" error when fn() does not throw, and in the catch block
rethrow any exception that does not match the expected message (i.e., if
!e.message.startsWith(msg) then throw e), otherwise treat the expected exception
as success. Locate shouldThrow and adjust the try/catch accordingly to avoid
silently swallowing unrelated errors.

In `@JSTests/stress/wasm-table-constructor-wrapper-function-default.js`:
- Around line 87-95: The test comment and input disagree: the comment
"Non-function default values keep throwing" but the code passes a function in
the WebAssembly.Table constructor call new WebAssembly.Table({ element:
"funcref", initial: 1 }, () => 1); — either update the comment to state "Plain
JS functions are rejected as defaults" if you intend to assert rejection of
regular JS functions, or change the second argument to a non-function value
(e.g., replace () => 1 with 1 or "foo") to test actual non-function defaults;
modify the comment or the constructor call in the test so the intent and input
match (refer to the WebAssembly.Table constructor call in this file).

In
`@JSTests/test262/test/intl402/Temporal/PlainMonthDay/prototype/toLocaleString/basic.js`:
- Line 33: Remove the duplicated frontmatter entry by deleting the second
"features: [Temporal]" occurrence so only a single "features: [Temporal]"
remains in the file; search for the duplicate string "features: [Temporal]" and
remove the later instance to avoid metadata ambiguity.

In
`@LayoutTests/editing/selection/ios/tap-focused-input-clears-outside-selection.html`:
- Around line 25-53: The load handler assumes UIHelper exists and will throw
before finishJSTest(), causing the async test to hang; add an early guard at the
top of the addEventListener("load", ...) callback that checks for
window.UIHelper (or typeof UIHelper !== "undefined") and if missing logs a clear
failure and calls finishJSTest() (or otherwise terminates the test) so the test
never times out; reference the UIHelper usage (activateAndWaitForInputSessionAt,
longPressElement, activateElementAndWaitForInputSession) and ensure
finishJSTest() is invoked on the guard path.

In `@LayoutTests/fast/canvas/webgl/draw-elements-out-of-bounds-uint-index.html`:
- Around line 21-24: In the webgl branch where you check for
OES_element_index_uint (the if (contextType == "webgl") block that calls
context.getExtension("OES_element_index_uint") and testPassed("no extension")),
return immediately after logging the pass so execution does not fall through
into the UNSIGNED_INT drawElements path; specifically, add an early return right
after testPassed("no extension") to avoid calling drawElements with UNSIGNED_INT
when the extension is missing.

In `@LayoutTests/fast/canvas/webgl/gl-teximage-imagebitmap.html`:
- Around line 135-137: The rejection handler for the promise currently only
calls testFailed(String(e)) and must also call finishJSTest() so the async JS
test completes; update the arrow function (the rejection callback passed after
the success handler) to call testFailed(String(e)) followed by finishJSTest(),
ensuring window.jsTestIsAsync is respected.

In `@LayoutTests/fast/dom/HTMLLinkElement/subresource.html`:
- Line 6: The error handler for the image link does not call finishJSTest(), so
when window.jsTestIsAsync = true the test hangs on failure; update the onerror
path to ensure finishJSTest() is invoked (either by calling finishJSTest()
directly in the onerror="..." attribute alongside testFailed('onerror') or by
making testFailed(...) itself call finishJSTest()), referencing the existing
onerror handler and the finishJSTest function to ensure the test always
terminates on both success and failure.

In `@LayoutTests/fast/events/pointerleave-after-ancestor-removal.html`:
- Around line 30-43: The test can hang if window.eventSender is missing because
containerLeaveReceived never becomes true; update the logic around the
eventSender check (the block that calls eventSender.mouseMoveTo) to provide a
fallback when window.eventSender is falsy: either synthesize the pointer/leave
outcome by setting containerLeaveReceived = true (or dispatching the equivalent
DOM event) before calling UIHelper.waitForCondition(), so
UIHelper.waitForCondition(() => containerLeaveReceived) will not wait
indefinitely; adjust the code near eventSender, containerLeaveReceived, and
UIHelper.waitForCondition to implement this fallback.

In `@LayoutTests/fast/events/popup-blocking-timers2.html`:
- Line 5: Gate enabling async mode to the automated click path: only set
window.jsTestIsAsync = true when the automation eventSender is present (e.g.,
wrap the assignment in if (window.eventSender) { window.jsTestIsAsync = true;
}). Ensure the existing code paths that use window.eventSender (and the
automatic finishJSTest() trigger) remain unchanged so tests without eventSender
do not enter async mode and hang.

In `@LayoutTests/fast/events/touch/gesture/gesture-scroll.html`:
- Around line 137-138: The no-eventSender fallback branch only calls debug("This
test requires DumpRenderTree.") while jsTestIsAsync is set, causing a timeout;
update that branch so after the debug() call it also calls finishJSTest() to end
the async test. Locate the check for window.eventSender and add the
finishJSTest() invocation after the debug(...) call to ensure the test completes
when eventSender is unavailable.

In
`@LayoutTests/fast/events/touch/gesture/long-press-on-draggable-element-in-nested-iframes-triggers-drag.html`:
- Around line 15-17: The test currently calls finishJSTest() only when
window.testRunner exists, which can prevent completion in async mode
(window.jsTestIsAsync = true); remove the conditional guard around
finishJSTest() so that finishJSTest() is invoked unconditionally at the end of
the script (replace the if (window.testRunner) { finishJSTest(); } block with a
direct call to finishJSTest()), ensuring the async test harness always closes
the test.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

[coderabbitai]

🧹 Nitpick | 🔵 Trivial | ⚡ Quick win

Use explicit array checks instead of relying on coercion.

Lines 26, 28, 44, 66, 84, and 106 compare arrays to empty strings using loose equality (accesses == ""), which relies on JavaScript's coercion behavior. While this works (empty arrays coerce to ""), it's not idiomatic and reduces clarity.

♻️ Suggested refactor

-    assert(accesses == "", "Should not be able to override lastIndex");
+    assert(accesses.length === 0, "Should not be able to override lastIndex");

Apply similar changes to lines 28, 44, 66, 84, and 106.

Also applies to: 44-44, 66-66, 84-84, 106-106

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@JSTests/microbenchmarks/regexp-prototype-match-observable-side-effects.js`
around lines 26 - 28, Change the loose equality checks that rely on coercion
(assert(accesses == "")) to explicit empty-array checks: use
assert(accesses.length === 0, "...") (or assert(Array.isArray(accesses) &&
accesses.length === 0, "...") if you want to be defensive) for each occurrence
where the test verifies no accesses (the assert calls around the
RegExp.prototype[Symbol.match].call(obj, ...) checks referencing the variable
accesses). Replace all instances of accesses == "" with the explicit length (or
Array.isArray + length) check so the intent is clear and not dependent on JS
coercion.

[coderabbitai]

🧹 Nitpick | 🔵 Trivial | ⚡ Quick win

Use strict equality for string comparison.

Line 109 uses loose equality (==) when comparing stringified array results. Prefer strict equality (===) for clarity and to avoid unexpected coercion.

♻️ Suggested fix

-    assert(accesses.toString() == "flags,exec", "Proxy not able to observe some gets, got: " + accesses);
+    assert(accesses.toString() === "flags,exec", "Proxy not able to observe some gets, got: " + accesses);

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@JSTests/microbenchmarks/regexp-prototype-match-observable-side-effects.js` at
line 109, Replace the loose equality check in the assertion with a strict
equality check: in the assertion that compares accesses.toString() to
"flags,exec" (the assert call referencing the accesses variable), change the
operator from == to === so the test uses strict string comparison and avoids
coercion.

[coderabbitai]

🧹 Nitpick | 🔵 Trivial | 💤 Low value

Consider cleaning up Object.prototype modification.

The test defines a property on Object.prototype (line 17) but doesn't delete it after the test completes. While the getter only returns undefined and the test terminates after verification, best practice is to clean up global state modifications.

♻️ Recommended cleanup

 drainMicrotasks();

 shouldBe(log.join("|"), "h2|m1");
+delete Object.prototype.then;

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@JSTests/stress/async-generator-next-on-completed-reentrant.js` around lines
17 - 30, The test modifies Object.prototype by defining a "then" accessor;
record the original descriptor (or presence) before defining it and restore it
after the test completes (after the it.next() invocation and any awaited
microtasks), or at minimum delete Object.prototype.then at the end of the test;
update the code around the getter definition for "then" and the final it.next()
call to ensure the original state is restored (use the saved originalDescriptor
or delete if none) so global prototype pollution is cleaned up.

[coderabbitai]

⚠️ Potential issue | 🔴 Critical | ⚡ Quick win

Undefined variable testLoopCount will crash the test.

The loop references testLoopCount, which is never defined in this file or provided by the JSC stress test harness. This will throw a ReferenceError before any test assertions run.

🔧 Proposed fix

-for (let i = 0; i < testLoopCount; ++i) {
+for (let i = 0; i < 1e4; ++i) {

(Use an appropriate iteration count for DFG compilation; typical stress tests use 1e4 or higher.)

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	for (let i = 0; i < testLoopCount; ++i) {
	for (let i = 0; i < 1e4; ++i) {

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@JSTests/stress/multi-put-by-val-mixed-dfg.js` at line 20, The for-loop uses
an undefined variable testLoopCount which causes a ReferenceError; define a
local iteration constant (e.g. const testLoopCount = 1e4 or another large number
appropriate for DFG stress) above the loop that contains for (let i = 0; i <
testLoopCount; ++i) so the loop can run—add the constant near the top of the
file or immediately before the loop to ensure the test executes and triggers DFG
compilation.

[coderabbitai]

⚠️ Potential issue | 🔴 Critical | ⚡ Quick win

Undefined variable testLoopCount will cause ReferenceError.

Line 87 references testLoopCount but it's never defined in this file. The test will crash with ReferenceError: Can't find variable: testLoopCount before exercising the repeated allocation/JIT tier validation.

🐛 Proposed fix

+// Run many times so the test covers all JIT tiers / repeated allocation paths.
+const testLoopCount = 1e4;
 for (let i = 0; i < testLoopCount; ++i) {

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	for (let i = 0; i < testLoopCount; ++i) {
	// Run many times so the test covers all JIT tiers / repeated allocation paths.
	const testLoopCount = 1e4;
	for (let i = 0; i < testLoopCount; ++i) {

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@JSTests/stress/promise-resolving-functions-name-and-length.js` at line 87,
The for-loop references an undefined variable testLoopCount causing a
ReferenceError; fix it by declaring and initializing testLoopCount to a sensible
numeric iteration count (e.g., const testLoopCount = <N>) before the for (let i
= 0; i < testLoopCount; ++i) loop or by replacing testLoopCount with an existing
iteration variable (if one exists) so the loop uses a defined numeric value;
ensure the constant is >0 and placed in the same scope as the loop (near the top
of the test or just above the loop) so repeated allocation/JIT validation runs
as intended.

[coderabbitai]

⚠️ Potential issue | 🟡 Minor

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Search for other uses of grid-lanes in the codebase and CSS specifications

echo "=== Searching for grid-lanes usage in test files ==="
rg -n "grid-lanes" --type html --type css -C 2

echo -e "\n=== Searching for grid-lanes in source code ==="
rg -n "grid-lanes" Source/ -C 2

echo -e "\n=== Checking CSS display property implementations ==="
rg -n "CSSPropertyDisplay|DisplayType" Source/WebCore/css/ -g "*.h" -g "*.cpp" | head -20

Repository: oven-sh/WebKit

Length of output: 50372

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "=== grid-lanes occurrences in Source/WebCore (limited) ==="
rg -n "grid-lanes" Source/WebCore -S --max-count 50

echo -e "\n=== grid-lanes occurrences in whole Source (limited to likely related identifiers) ==="
rg -n "GridLanes|gridLanes|grid lanes|Grid lanes" Source/WebCore -S --max-count 50

echo -e "\n=== CSS display parsing for grid-lanes (narrower search) ==="
rg -n "display\s*:\s*grid-lanes|Display.*grid-lanes|grid-lanes.*display" Source/WebCore -S --max-count 50

Repository: oven-sh/WebKit

Length of output: 9607

---

Review comment

File: LayoutTests/fast/css-grid-layout/masonry-subgrid-excluded-legend-crash.html
Lines: 4-4

Snippet showing the final state of code at these lines

    display: grid-lanes;

Comment

display: grid-lanes is a valid/implemented CSS display value in WebKit

WebKit’s CSS parser treats grid-lanes as a supported <display-inside> value (mapped to Style::DisplayType::BlockGridLanes / InlineGridLanes), so this isn’t an “invalid CSS” value. The main thing to check is that it’s feature-gated by the gridLanesEnabled setting—ensure the test runs with that flag enabled so the crash path is actually exercised.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@LayoutTests/fast/css-grid-layout/masonry-subgrid-excluded-legend-crash.html`
at line 4, The test uses "display: grid-lanes" which is a valid WebKit display
value when the gridLanes feature is enabled, so update the test to run with the
gridLanesEnabled feature flag on (instead of treating the value as invalid):
enable gridLanesEnabled in the test harness/setup (e.g. add the appropriate
layout-test meta or test-run option that turns on gridLanesEnabled) so the CSS
rule "display: grid-lanes" in this file is exercised under the feature gate and
the crash path is reached.

[coderabbitai]

🧹 Nitpick | 🔵 Trivial

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Search for other tests using jsTestIsAsync without finishJSTest
rg -l 'jsTestIsAsync.*true' --type html LayoutTests/ | xargs rg -L 'finishJSTest' | head -20

# Check if this specific test passes
echo "---"
echo "Verify crash-with-bad-url.html test completes correctly in test runs"
rg -C3 'crash-with-bad-url.html' LayoutTests/TestExpectations || echo "Not in TestExpectations (likely passing)"

Repository: oven-sh/WebKit

Length of output: 2062

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# 1) Inspect the specific test for jsTestIsAsync / finishJSTest / waitUntilDone / notifyDone
echo "=== crash-with-bad-url.html: relevant calls ==="
rg -n --hidden --no-ignore --context 2 'jsTestIsAsync|finishJSTest|waitUntilDone|notifyDone|testRunner' LayoutTests/fast/dom/crash-with-bad-url.html || true

# 2) Check whether finishJSTest exists anywhere in this test
echo "=== crash-with-bad-url.html: finishJSTest occurrences (raw) ==="
rg -n --hidden --no-ignore 'finishJSTest\(' LayoutTests/fast/dom/crash-with-bad-url.html || echo "no finishJSTest()"

# 3) Find other html tests that set jsTestIsAsync = true but do NOT contain finishJSTest()
echo "=== Other tests: jsTestIsAsync = true without finishJSTest() ==="
# Use rg -L correctly: -L prints filenames; we then verify by printing 2-3 lines around jsTestIsAsync in the candidates.
candidates=$(
  rg -l 'jsTestIsAsync\s*=\s*true' --type html LayoutTests/ \
  | xargs -r rg -L 'finishJSTest\(' \
)
echo "$candidates" | head -50
echo "--- count (capped to 200) ---"
echo "$candidates" | wc -l

# 4) For the first few candidates, show jsTestIsAsync and any testRunner.notifyDone usage
echo "=== First candidates: jsTestIsAsync + notifyDone context ==="
echo "$candidates" | head -10 | while read -r f; do
  echo "--- $f ---"
  rg -n --context 1 'jsTestIsAsync\s*=\s*true|notifyDone|finishJSTest\(' "$f" || true
done

Repository: oven-sh/WebKit

Length of output: 7022

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# 1) Find and inspect the js-test.js implementation used by this test
echo "=== Locate js-test.js files ==="
fd -a "js-test.js" LayoutTests | head -20

js_test_path="$(fd -a "js-test.js" LayoutTests | head -1 || true)"
echo "=== Using js-test.js candidate: $js_test_path ==="
if [ -n "${js_test_path}" ]; then
  echo "=== js-test.js: relevant parts (jsTestIsAsync/finishJSTest/notifyDone) ==="
  rg -n "jsTestIsAsync|finishJSTest|notifyDone" "$js_test_path" || true
  rg -n "function finishJSTest|finishJSTest\s*=" "$js_test_path" || true
  rg -n "notifyDone" "$js_test_path" || true
fi

# 2) Check whether other tests use jsTestIsAsync=true + testRunner.notifyDone() without finishJSTest()
echo "=== Find tests: jsTestIsAsync=true and notifyDone but no finishJSTest() ==="
# Print filenames that contain both patterns
files_both=$(
  rg -l 'jsTestIsAsync\s*=\s*true' --type html LayoutTests/ \
  | xargs -r rg -l 'notifyDone' --type html \
)
# From those, exclude files containing finishJSTest(
candidates=$(
  printf "%s\n" "$files_both" | xargs -r rg -L 'finishJSTest\(' --type html || true
)
echo "$candidates" | head -50
echo "--- count (capped) ---"
echo "$candidates" | wc -l

# 3) Directly inspect crash-with-bad-url.html for notifyDone vs finishJSTest
echo "=== crash-with-bad-url.html: notifyDone and finishJSTest context ==="
rg -n --context 2 'jsTestIsAsync\s*=\s*true|finishJSTest\(|notifyDone' LayoutTests/fast/dom/crash-with-bad-url.html || true

Repository: oven-sh/WebKit

Length of output: 2905

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

js_test="LayoutTests/resources/js-test.js"

echo "=== js-test.js: lines ~100-180 (jsTestIsAsync gating) ==="
sed -n '100,190p' "$js_test" | nl -ba

echo "=== js-test.js: lines ~880-960 (finishJSTest + notifyDone) ==="
sed -n '880,960p' "$js_test" | nl -ba

echo "=== js-test.js: lines ~900-940 (finishJSTest function body) ==="
sed -n '900,940p' "$js_test" | nl -ba

echo "=== Find any other finish/async completion bookkeeping around jsTestIsAsync ==="
rg -n "jsTestIsAsync|finishJSTest|notifyDone|TestRunner" "$js_test" | head -80

Repository: oven-sh/WebKit

Length of output: 177

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

js_test="LayoutTests/resources/js-test.js"

echo "=== js-test.js: lines 100-190 ==="
sed -n '100,190p' "$js_test" | cat -n

echo "=== js-test.js: lines 880-960 ==="
sed -n '880,960p' "$js_test" | cat -n

echo "=== js-test.js: lines 900-940 (finishJSTest function body) ==="
sed -n '900,940p' "$js_test" | cat -n

echo "=== js-test.js: completion-related occurrences ==="
rg -n "jsTestIsAsync|finishJSTest|notifyDone|testRunner" "$js_test" | head -120

Repository: oven-sh/WebKit

Length of output: 8537

---

Reassess async completion for crash-with-bad-url.html after js-test.js migration

• js-test.js drives async completion via testRunner.waitUntilDone() + testRunner.notifyDone() (normally from finishJSTest()), so finishJSTest() is not strictly required.
• This test omits finishJSTest() but calls testRunner.notifyDone() directly from the subframe’s injected img onerror handler.
• Remaining risk: that call is guarded by if(window.testRunner) inside the subframe; if testRunner isn’t exposed there, the test may hang.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@LayoutTests/fast/dom/crash-with-bad-url.html` around lines 4 - 7, The test
currently relies on the subframe calling testRunner.notifyDone() inside the
injected image onerror handler, but that call is guarded by if
(window.testRunner) and may never run; update the test to ensure async
completion by either calling finishJSTest() from the top-level page after
creating the subframe or by making the subframe unconditionally call
testRunner.notifyDone() (or invoke a top-level finishJSTest() via postMessage
from the subframe) so the harness is always notified; locate the image onerror
handler in the subframe injection and the main test code around
finishJSTest()/testRunner.notifyDone() and implement one of these fixes.

[coderabbitai]

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Incompatible test harness patterns mixed.

This test uses both the old synchronous harness (js-test-pre.js at line 31 and js-test-post.js at line 58) and the new async harness (window.jsTestIsAsync = true at line 34 and finishJSTest() at line 50). These patterns are incompatible and may cause the test to fail or produce incorrect results.

Based on the pattern used in the other migrated tests in this PR (files gesture-click.html, no-page-cache.html, autoscroll-in-iframe.html, and delete-text-in-composition.html), the correct approach is to use only the new async pattern.

🔧 Recommended fix

-    <script src="../../resources/js-test-pre.js"></script>
+    <script src="../../resources/js-test.js"></script>
     <script src="../../resources/ui-helper.js"></script>
     <script>
       window.jsTestIsAsync = true;
...
     <div class="trigger"></div>
     <div class="tooltip" popover="manual"></div>
     <div id="console"></div>
-    <script src="../../resources/js-test-post.js"></script>
 </body>

Also applies to: 34-34, 50-50, 58-58

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@LayoutTests/fast/dom/pseudo-element-hidePopover-then-crash.html` at line 31,
Test mixes old synchronous harness with the new async harness: remove the old
synchronous harness includes and usage and keep the async pattern. Specifically,
delete the script tags referencing js-test-pre.js and js-test-post.js (the lines
that include those files) and any synchronous harness assumptions, ensure
window.jsTestIsAsync = true remains, and keep the finishJSTest() call to
complete the test; verify no other synchronous test harness functions remain in
the file (look for js-test-pre.js, js-test-post.js, window.jsTestIsAsync,
finishJSTest).

[coderabbitai]

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Missing finishJSTest() when testRunner is unavailable.

The test conditionally starts only if window.testRunner exists (line 64). When testRunner is unavailable, no code runs and finishJSTest() is never called, causing a timeout in async mode (jsTestIsAsync = true at line 11).

🔧 Suggested fix

             if (window.testRunner) {

                 nextTest();
+            } else {
+                debug("This test requires testRunner.");
+                finishJSTest();
             }

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	if (window.testRunner) {
	testRunner.dumpAsText();
	testRunner.waitUntilDone();
	nextTest();
	}
	if (window.testRunner) {
	nextTest();
	} else {
	debug("This test requires testRunner.");
	finishJSTest();
	}

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@LayoutTests/fast/events/popup-allowed-from-gesture-initiated-event.html`
around lines 64 - 67, The test currently only calls nextTest() when
window.testRunner exists, leaving jsTestIsAsync = true and never calling
finishJSTest() when testRunner is absent; add an else branch that calls
finishJSTest() (or otherwise ensures finishJSTest() is invoked) when
window.testRunner is falsy so the async test completes. Locate the conditional
around window.testRunner and nextTest() and insert the finishJSTest() call in
the fallback path so the test always finishes.

[coderabbitai]

⚠️ Potential issue | 🔴 Critical | ⚡ Quick win

Crash in BFCache navigation requires urgent attention.

This test is crashing during back-forward cache restoration with a dangling navigate event. BFCache-related crashes can indicate use-after-free or lifecycle issues that may affect real users during navigation. While properly tracked (rdar://179168475), ensure this is prioritized as a critical stability issue.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@LayoutTests/TestExpectations` around lines 7115 - 7116, The test
imported/w3c/web-platform-tests/navigation-api/navigate-event/dangling-navigate-event-after-bfcache-restore.html
is causing a crash during BFCache restore; update the TestExpectations entry to
mark it as a Crash (not just Skip) and annotate it with the rdar://179168475
tracking ID so it shows as a prioritized stability regression, and file/link a
bug/regression ticket referencing rdar://179168475 and the test path so the
crash can be triaged and fixed; ensure the TestExpectations line for that test
is changed from "[ Skip ]" to the appropriate crash expectation and add a
one-line TODO comment with the bug ID for follow-up.

[github-actions]

Preview Builds

Commit	Release	Date
92b221c1	autobuild-preview-pr-251-92b221c1	2026-06-11 14:43:30 UTC
10fc0cab	autobuild-preview-pr-251-10fc0cab	2026-06-11 06:54:25 UTC