Import from AlmaLinux stable repository

import AlmaLinux8 webkit2gtk3-2.40.5-1.el8
2024-05-31 18:15:10 +00:00 · 2023-12-12 11:26:30 +03:00
14 changed files with 697 additions and 928 deletions
--- a/.gitignore
+++ b/.gitignore
@ -1,2 +1,2 @@
-SOURCES/webkitgtk-2.38.5.tar.xz
+SOURCES/webkitgtk-2.42.5.tar.xz
 SOURCES/webkitgtk-keys.gpg
--- a/.webkit2gtk3.metadata
+++ b/.webkit2gtk3.metadata
@ -1,2 +0,0 @@
-1774390c628bb3a524d4ed76f11de4a878078db6 SOURCES/webkitgtk-2.38.5.tar.xz
-cf57cbbadf2a07c6ede1c886f9742b7d352460c0 SOURCES/webkitgtk-keys.gpg
--- a/SOURCES/CVE-2023-28204.patch
+++ b/SOURCES/CVE-2023-28204.patch
@ -1,167 +0,0 @@
-From 8efa99e7b5d5a37aefb476cc27ee24c2be4da0c7 Mon Sep 17 00:00:00 2001
-From: Michael Saboff <msaboff@apple.com>
-Date: Mon, 22 May 2023 13:40:46 -0700
-Subject: [PATCH] Cherry-pick 264365@main (698c6e293734).
- https://bugs.webkit.org/show_bug.cgi?id=254930
-
-    [JSC] RegExpGlobalData::performMatch issue leading to OOB read
-    https://bugs.webkit.org/show_bug.cgi?id=254930
-    rdar://107436732
-
-    Reviewed by Alexey Shvayka.
-
-    Fixed two issues:
-    1) In YarrInterpreter.cpp::matchAssertionBOL() we were advancing the string position for non-BMP
-       characters.  Since it is an assertion, we shouldn't advance the character position.
-       Made the same fix to matchAssertionEOL().
-    2) In StringPrototype.cpp::replaceUsingRegExpSearch(), we need to advance past both elements of
-       a non-BMP character for the case where the RegExp match is empty.
-
-    * JSTests/stress/string-replace-regexp-matchBOL-correct-advancing.js: New test.
-    * Source/JavaScriptCore/runtime/StringPrototype.cpp:
-    (JSC::replaceUsingRegExpSearch):
-    * Source/JavaScriptCore/yarr/YarrInterpreter.cpp:
-    (JSC::Yarr::Interpreter::InputStream::readCheckedDontAdvance):
-    (JSC::Yarr::Interpreter::matchAssertionBOL):
-    (JSC::Yarr::Interpreter::matchAssertionEOL):
-
-    Originally-landed-as: 259548.551@safari-7615-branch (e34edaa74575). rdar://107436732
-    Canonical link: https://commits.webkit.org/264365@main
---
- ...place-regexp-matchBOL-correct-advancing.js | 35 ++++++++++++++++++
- .../runtime/StringPrototype.cpp               | 10 ++++++
- .../JavaScriptCore/yarr/YarrInterpreter.cpp   | 36 +++++++++++++++++--
- 3 files changed, 79 insertions(+), 2 deletions(-)
- create mode 100644 JSTests/stress/string-replace-regexp-matchBOL-correct-advancing.js
-
-diff --git a/JSTests/stress/string-replace-regexp-matchBOL-correct-advancing.js b/JSTests/stress/string-replace-regexp-matchBOL-correct-advancing.js
-new file mode 100644
-index 000000000000..25b1a70b81d2
--- /dev/null
-+++ b/JSTests/stress/string-replace-regexp-matchBOL-correct-advancing.js
-@@ -0,0 +1,35 @@
-+// Check that we don't advance for BOL assertions when matching a non-BMP character in the YARR interpreter
-+// and that we do advance in String.replace() when processing an empty match.
-+
-+let expected = "|";
-+
-+for (let i = 0; i < 11; ++i)
-+    expected += String.fromCodePoint(128512) + '|';
-+
-+let str = String.fromCodePoint(128512).repeat(11);
-+
-+let result1 = str.replace(/(?!(?=^a|()+()+x)(abc))/gmu, r => {
-+    return '|';
-+});
-+
-+
-+if (result1 !== expected)
-+    print("FAILED: \"" + result1 + " !== " + expected + '"');
-+
-+let result2= str.replace(/(?!(?=^a|x)(abc))/gmu, r => {
-+    return '|';
-+});
-+
-+if (result2 !== expected)
-+    print("FAILED: \"" + result2 + " !== " + expected + '"');
-+
-+expected = "|" + String.fromCodePoint(128512);
-+
-+str = String.fromCodePoint(128512).repeat(1);
-+
-+let result3= str.replace(/(?!(?=^a|x)(abc))/mu, r => {
-+    return '|';
-+});
-+
-+if (result3 !== expected)
-+    print("FAILED: \"" + result3 + " !== " + expected + '"');
-diff --git a/Source/JavaScriptCore/runtime/StringPrototype.cpp b/Source/JavaScriptCore/runtime/StringPrototype.cpp
-index 08104b1dbfa9..459295f728a7 100644
--- a/Source/JavaScriptCore/runtime/StringPrototype.cpp
-+++ b/Source/JavaScriptCore/runtime/StringPrototype.cpp
-@@ -603,6 +603,11 @@ static ALWAYS_INLINE JSString* replaceUsingRegExpSearch(
-                 startPosition++;
-                 if (startPosition > sourceLen)
-                     break;
-+                if (U16_IS_LEAD(source[startPosition - 1]) && U16_IS_TRAIL(source[startPosition])) {
-+                    startPosition++;
-+                    if (startPosition > sourceLen)
-+                        break;
-+                }
-             }
-         }
-     } else {
-@@ -682,6 +687,11 @@ static ALWAYS_INLINE JSString* replaceUsingRegExpSearch(
-                 startPosition++;
-                 if (startPosition > sourceLen)
-                     break;
-+                if (U16_IS_LEAD(source[startPosition - 1]) && U16_IS_TRAIL(source[startPosition])) {
-+                    startPosition++;
-+                    if (startPosition > sourceLen)
-+                        break;
-+                }
-             }
-         } while (global);
-     }
-diff --git a/Source/JavaScriptCore/yarr/YarrInterpreter.cpp b/Source/JavaScriptCore/yarr/YarrInterpreter.cpp
-index 95a848a1a66d..b1a22b253866 100644
--- a/Source/JavaScriptCore/yarr/YarrInterpreter.cpp
-+++ b/Source/JavaScriptCore/yarr/YarrInterpreter.cpp
-@@ -209,6 +209,38 @@ public:
-             }
-             return result;
-         }
-+
-+        int readCheckedDontAdvance(unsigned negativePositionOffest)
-+        {
-+            RELEASE_ASSERT(pos >= negativePositionOffest);
-+            unsigned p = pos - negativePositionOffest;
-+            ASSERT(p < length);
-+            int result = input[p];
-+            if (U16_IS_LEAD(result) && decodeSurrogatePairs && p + 1 < length && U16_IS_TRAIL(input[p + 1])) {
-+                if (atEnd())
-+                    return -1;
-+
-+                result = U16_GET_SUPPLEMENTARY(result, input[p + 1]);
-+            }
-+            return result;
-+        }
-+
-+        // readForCharacterDump() is only for use by the DUMP_CURR_CHAR macro.
-+        // We don't want any side effects like the next() in readChecked() above.
-+        int readForCharacterDump(unsigned negativePositionOffest)
-+        {
-+            RELEASE_ASSERT(pos >= negativePositionOffest);
-+            unsigned p = pos - negativePositionOffest;
-+            ASSERT(p < length);
-+            int result = input[p];
-+            if (U16_IS_LEAD(result) && decodeSurrogatePairs && p + 1 < length && U16_IS_TRAIL(input[p + 1])) {
-+                if (atEnd())
-+                    return -1;
-+
-+                result = U16_GET_SUPPLEMENTARY(result, input[p + 1]);
-+            }
-+            return result;
-+        }
-         
-         int readSurrogatePairChecked(unsigned negativePositionOffset)
-         {
-@@ -482,13 +514,13 @@ public:
- 
-     bool matchAssertionBOL(ByteTerm& term)
-     {
-        return (input.atStart(term.inputPosition)) || (pattern->multiline() && testCharacterClass(pattern->newlineCharacterClass, input.readChecked(term.inputPosition + 1)));
-+        return (input.atStart(term.inputPosition)) || (pattern->multiline() && testCharacterClass(pattern->newlineCharacterClass, input.readCheckedDontAdvance(term.inputPosition + 1)));
-     }
- 
-     bool matchAssertionEOL(ByteTerm& term)
-     {
-         if (term.inputPosition)
-            return (input.atEnd(term.inputPosition)) || (pattern->multiline() && testCharacterClass(pattern->newlineCharacterClass, input.readChecked(term.inputPosition)));
-+            return (input.atEnd(term.inputPosition)) || (pattern->multiline() && testCharacterClass(pattern->newlineCharacterClass, input.readCheckedDontAdvance(term.inputPosition)));
- 
-         return (input.atEnd()) || (pattern->multiline() && testCharacterClass(pattern->newlineCharacterClass, input.read()));
-     }
-- 
-2.40.1
-
--- a/SOURCES/CVE-2023-28205.patch
+++ b/SOURCES/CVE-2023-28205.patch
@ -1,648 +0,0 @@
-From b315f620c349e001a697dd7d4c501bdd07fe18c5 Mon Sep 17 00:00:00 2001
-From: Mark Lam <mark.lam@apple.com>
-Date: Fri, 31 Mar 2023 10:49:49 -0700
-Subject: [PATCH] Cherry-pick 2c49ff7b0481. rdar://problem/107369977
-
-    CloneDeserializer::deserialize() should store cell pointers in a MarkedVector.
-    https://bugs.webkit.org/show_bug.cgi?id=254797
-    rdar://107369977
-
-    Reviewed by Justin Michaud.
-
-    Previously, CloneDeserializer::deserialize() was storing pointers to newly created objects
-    in a few Vectors.  This is problematic because the GC is not aware of Vectors, and cannot
-    scan them.  In this patch, we refactor the MarkedArgumentBuffer class into a MarkedVector
-    template class that offer 2 enhancements:
-
-    1. It can be configured to store specific types of cell pointer types.  This avoids us
-       having to constantly cast JSValues into these pointers.
-
-    2. It allows us to specify the type of OverflowHandler we want to use.  In this case,
-       we want to use CrashOnOverflow.  The previous MarkedArgumentBuffer always assumes
-       RecordOnOverflow.  This allows us to avoid having to manually check for overflows,
-       or have to use appendWithCrashOnOverflow.  For our current needs, MarkedVector can be
-       used as a drop in replacement for Vector.
-
-    And we fix the CloneDeserializer::deserialize() issue by replacing the use of Vectors
-    with MarkedVector instead.
-
-    * Source/JavaScriptCore/heap/Heap.cpp:
-    (JSC::Heap::addCoreConstraints):
-    * Source/JavaScriptCore/heap/Heap.h:
-    * Source/JavaScriptCore/heap/HeapInlines.h:
-    * Source/JavaScriptCore/runtime/ArgList.cpp:
-    (JSC::MarkedVectorBase::addMarkSet):
-    (JSC::MarkedVectorBase::markLists):
-    (JSC::MarkedVectorBase::slowEnsureCapacity):
-    (JSC::MarkedVectorBase::expandCapacity):
-    (JSC::MarkedVectorBase::slowAppend):
-    (JSC::MarkedArgumentBufferBase::addMarkSet): Deleted.
-    (JSC::MarkedArgumentBufferBase::markLists): Deleted.
-    (JSC::MarkedArgumentBufferBase::slowEnsureCapacity): Deleted.
-    (JSC::MarkedArgumentBufferBase::expandCapacity): Deleted.
-    (JSC::MarkedArgumentBufferBase::slowAppend): Deleted.
-    * Source/JavaScriptCore/runtime/ArgList.h:
-    (JSC::MarkedVectorWithSize::MarkedVectorWithSize):
-    (JSC::MarkedVectorWithSize::at const):
-    (JSC::MarkedVectorWithSize::clear):
-    (JSC::MarkedVectorWithSize::append):
-    (JSC::MarkedVectorWithSize::appendWithCrashOnOverflow):
-    (JSC::MarkedVectorWithSize::last const):
-    (JSC::MarkedVectorWithSize::takeLast):
-    (JSC::MarkedVectorWithSize::ensureCapacity):
-    (JSC::MarkedVectorWithSize::hasOverflowed):
-    (JSC::MarkedVectorWithSize::fill):
-    (JSC::MarkedArgumentBufferWithSize::MarkedArgumentBufferWithSize): Deleted.
-    * Source/WebCore/Modules/webaudio/AudioWorkletProcessor.cpp:
-    (WebCore::AudioWorkletProcessor::buildJSArguments):
-    * Source/WebCore/Modules/webaudio/AudioWorkletProcessor.h:
-    * Source/WebCore/bindings/js/SerializedScriptValue.cpp:
-    (WebCore::CloneDeserializer::deserialize):
-
-    Canonical link: https://commits.webkit.org/259548.530@safari-7615-branch
-
-Identifier: 259548.395@safari-7615.1.26.11-branch
---
- Source/JavaScriptCore/heap/Heap.cpp           |   4 +-
- Source/JavaScriptCore/heap/Heap.h             |   8 +-
- Source/JavaScriptCore/heap/HeapInlines.h      |   2 +-
- Source/JavaScriptCore/runtime/ArgList.cpp     |  46 ++--
- Source/JavaScriptCore/runtime/ArgList.h       | 207 ++++++++++--------
- .../webaudio/AudioWorkletProcessor.cpp        |   4 +-
- .../Modules/webaudio/AudioWorkletProcessor.h  |   7 +-
- .../bindings/js/SerializedScriptValue.cpp     |  11 +-
- 8 files changed, 159 insertions(+), 130 deletions(-)
-
-diff --git a/Source/JavaScriptCore/heap/Heap.cpp b/Source/JavaScriptCore/heap/Heap.cpp
-index 8a4c082cb36e..632b01f14546 100644
--- a/Source/JavaScriptCore/heap/Heap.cpp
-+++ b/Source/JavaScriptCore/heap/Heap.cpp
-@@ -1,5 +1,5 @@
- /*
- *  Copyright (C) 2003-2022 Apple Inc. All rights reserved.
-+ *  Copyright (C) 2003-2023 Apple Inc. All rights reserved.
-  *  Copyright (C) 2007 Eric Seidel <eric@webkit.org>
-  *
-  *  This library is free software; you can redistribute it and/or
-@@ -2847,7 +2847,7 @@ void Heap::addCoreConstraints()
-             
-             if (!m_markListSet.isEmpty()) {
-                 SetRootMarkReasonScope rootScope(visitor, RootMarkReason::ConservativeScan);
-                MarkedArgumentBufferBase::markLists(visitor, m_markListSet);
-+                MarkedVectorBase::markLists(visitor, m_markListSet);
-             }
- 
-             {
-diff --git a/Source/JavaScriptCore/heap/Heap.h b/Source/JavaScriptCore/heap/Heap.h
-index 418f24fd1212..8df576acf7f8 100644
--- a/Source/JavaScriptCore/heap/Heap.h
-+++ b/Source/JavaScriptCore/heap/Heap.h
-@@ -1,7 +1,7 @@
- /*
-  *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
-  *  Copyright (C) 2001 Peter Kelly (pmk@post.com)
- *  Copyright (C) 2003-2022 Apple Inc. All rights reserved.
-+ *  Copyright (C) 2003-2023 Apple Inc. All rights reserved.
-  *
-  *  This library is free software; you can redistribute it and/or
-  *  modify it under the terms of the GNU Lesser General Public
-@@ -85,7 +85,7 @@ class MarkStackArray;
- class MarkStackMergingConstraint;
- class MarkedJSValueRefArray;
- class BlockDirectory;
-class MarkedArgumentBufferBase;
-+class MarkedVectorBase;
- class MarkingConstraint;
- class MarkingConstraintSet;
- class MutatorScheduler;
-@@ -409,7 +409,7 @@ public:
-     JS_EXPORT_PRIVATE std::unique_ptr<TypeCountSet> protectedObjectTypeCounts();
-     JS_EXPORT_PRIVATE std::unique_ptr<TypeCountSet> objectTypeCounts();
- 
-    HashSet<MarkedArgumentBufferBase*>& markListSet();
-+    HashSet<MarkedVectorBase*>& markListSet();
-     void addMarkedJSValueRefArray(MarkedJSValueRefArray*);
-     
-     template<typename Functor> void forEachProtectedCell(const Functor&);
-@@ -778,7 +778,7 @@ private:
-     size_t m_deprecatedExtraMemorySize { 0 };
- 
-     ProtectCountSet m_protectedValues;
-    HashSet<MarkedArgumentBufferBase*> m_markListSet;
-+    HashSet<MarkedVectorBase*> m_markListSet;
-     SentinelLinkedList<MarkedJSValueRefArray, BasicRawSentinelNode<MarkedJSValueRefArray>> m_markedJSValueRefArrays;
- 
-     std::unique_ptr<MachineThreads> m_machineThreads;
-diff --git a/Source/JavaScriptCore/heap/HeapInlines.h b/Source/JavaScriptCore/heap/HeapInlines.h
-index 66d8317e317c..4d767a564d5f 100644
--- a/Source/JavaScriptCore/heap/HeapInlines.h
-+++ b/Source/JavaScriptCore/heap/HeapInlines.h
-@@ -206,7 +206,7 @@ inline void Heap::decrementDeferralDepthAndGCIfNeeded()
-     }
- }
- 
-inline HashSet<MarkedArgumentBufferBase*>& Heap::markListSet()
-+inline HashSet<MarkedVectorBase*>& Heap::markListSet()
- {
-     return m_markListSet;
- }
-diff --git a/Source/JavaScriptCore/runtime/ArgList.cpp b/Source/JavaScriptCore/runtime/ArgList.cpp
-index f2815b80c8c7..a72dea74a56f 100644
--- a/Source/JavaScriptCore/runtime/ArgList.cpp
-+++ b/Source/JavaScriptCore/runtime/ArgList.cpp
-@@ -1,5 +1,5 @@
- /*
- *  Copyright (C) 2003-2021 Apple Inc. All rights reserved.
-+ *  Copyright (C) 2003-2023 Apple Inc. All rights reserved.
-  *
-  *  This library is free software; you can redistribute it and/or
-  *  modify it under the terms of the GNU Library General Public
-@@ -27,7 +27,7 @@ using std::min;
- 
- namespace JSC {
- 
-void MarkedArgumentBufferBase::addMarkSet(JSValue v)
-+void MarkedVectorBase::addMarkSet(JSValue v)
- {
-     if (m_markSet)
-         return;
-@@ -52,47 +52,47 @@ void ArgList::getSlice(int startIndex, ArgList& result) const
- }
- 
- template<typename Visitor>
-void MarkedArgumentBufferBase::markLists(Visitor& visitor, ListSet& markSet)
-+void MarkedVectorBase::markLists(Visitor& visitor, ListSet& markSet)
- {
-     ListSet::iterator end = markSet.end();
-     for (ListSet::iterator it = markSet.begin(); it != end; ++it) {
-        MarkedArgumentBufferBase* list = *it;
-+        MarkedVectorBase* list = *it;
-         for (int i = 0; i < list->m_size; ++i)
-             visitor.appendUnbarriered(JSValue::decode(list->slotFor(i)));
-     }
- }
- 
-template void MarkedArgumentBufferBase::markLists(AbstractSlotVisitor&, ListSet&);
-template void MarkedArgumentBufferBase::markLists(SlotVisitor&, ListSet&);
-+template void MarkedVectorBase::markLists(AbstractSlotVisitor&, ListSet&);
-+template void MarkedVectorBase::markLists(SlotVisitor&, ListSet&);
- 
-void MarkedArgumentBufferBase::slowEnsureCapacity(size_t requestedCapacity)
-+auto MarkedVectorBase::slowEnsureCapacity(size_t requestedCapacity) -> Status
- {
-     setNeedsOverflowCheck();
-     auto checkedNewCapacity = CheckedInt32(requestedCapacity);
-     if (UNLIKELY(checkedNewCapacity.hasOverflowed()))
-        return this->overflowed();
-    expandCapacity(checkedNewCapacity);
-+        return Status::Overflowed;
-+    return expandCapacity(checkedNewCapacity);
- }
- 
-void MarkedArgumentBufferBase::expandCapacity()
-+auto MarkedVectorBase::expandCapacity() -> Status
- {
-     setNeedsOverflowCheck();
-     auto checkedNewCapacity = CheckedInt32(m_capacity) * 2;
-     if (UNLIKELY(checkedNewCapacity.hasOverflowed()))
-        return this->overflowed();
-    expandCapacity(checkedNewCapacity);
-+        return Status::Overflowed;
-+    return expandCapacity(checkedNewCapacity);
- }
- 
-void MarkedArgumentBufferBase::expandCapacity(int newCapacity)
-+auto MarkedVectorBase::expandCapacity(int newCapacity) -> Status
- {
-     setNeedsOverflowCheck();
-     ASSERT(m_capacity < newCapacity);
-     auto checkedSize = CheckedSize(newCapacity) * sizeof(EncodedJSValue);
-     if (UNLIKELY(checkedSize.hasOverflowed()))
-        return this->overflowed();
-+        return Status::Overflowed;
-     EncodedJSValue* newBuffer = static_cast<EncodedJSValue*>(Gigacage::tryMalloc(Gigacage::JSValue, checkedSize));
-     if (!newBuffer)
-        return this->overflowed();
-+        return Status::Overflowed;
-     for (int i = 0; i < m_size; ++i) {
-         newBuffer[i] = m_buffer[i];
-         addMarkSet(JSValue::decode(m_buffer[i]));
-@@ -103,21 +103,23 @@ void MarkedArgumentBufferBase::expandCapacity(int newCapacity)
- 
-     m_buffer = newBuffer;
-     m_capacity = newCapacity;
-+    return Status::Success;
- }
- 
-void MarkedArgumentBufferBase::slowAppend(JSValue v)
-+auto MarkedVectorBase::slowAppend(JSValue v) -> Status
- {
-     ASSERT(m_size <= m_capacity);
-    if (m_size == m_capacity)
-        expandCapacity();
-    if (UNLIKELY(Base::hasOverflowed())) {
-        ASSERT(m_needsOverflowCheck);
-        return;
-+    if (m_size == m_capacity) {
-+        auto status = expandCapacity();
-+        if (status == Status::Overflowed) {
-+            ASSERT(m_needsOverflowCheck);
-+            return status;
-+        }
-     }
-
-     slotFor(m_size) = JSValue::encode(v);
-     ++m_size;
-     addMarkSet(v);
-+    return Status::Success;
- }
- 
- } // namespace JSC
-diff --git a/Source/JavaScriptCore/runtime/ArgList.h b/Source/JavaScriptCore/runtime/ArgList.h
-index 8ea9b0e308b8..01a6d5e0e5dc 100644
--- a/Source/JavaScriptCore/runtime/ArgList.h
-+++ b/Source/JavaScriptCore/runtime/ArgList.h
-@@ -22,26 +22,27 @@
- #pragma once
- 
- #include "CallFrame.h"
-+#include "JSCast.h"
- #include <wtf/CheckedArithmetic.h>
- #include <wtf/ForbidHeapAllocation.h>
- #include <wtf/HashSet.h>
- 
- namespace JSC {
- 
-class alignas(alignof(EncodedJSValue)) MarkedArgumentBufferBase : public RecordOverflow {
-    WTF_MAKE_NONCOPYABLE(MarkedArgumentBufferBase);
-    WTF_MAKE_NONMOVABLE(MarkedArgumentBufferBase);
-+class alignas(alignof(EncodedJSValue)) MarkedVectorBase {
-+    WTF_MAKE_NONCOPYABLE(MarkedVectorBase);
-+    WTF_MAKE_NONMOVABLE(MarkedVectorBase);
-     WTF_FORBID_HEAP_ALLOCATION;
-     friend class VM;
-     friend class ArgList;
- 
-+protected:
-+    enum class Status { Success, Overflowed };
- public:
-    using Base = RecordOverflow;
-    typedef HashSet<MarkedArgumentBufferBase*> ListSet;
-+    typedef HashSet<MarkedVectorBase*> ListSet;
- 
-    ~MarkedArgumentBufferBase()
-+    ~MarkedVectorBase()
-     {
-        ASSERT(!m_needsOverflowCheck);
-         if (m_markSet)
-             m_markSet->remove(this);
- 
-@@ -52,92 +53,20 @@ public:
-     size_t size() const { return m_size; }
-     bool isEmpty() const { return !m_size; }
- 
-    JSValue at(int i) const
-    {
-        if (i >= m_size)
-            return jsUndefined();
-
-        return JSValue::decode(slotFor(i));
-    }
-
-    void clear()
-    {
-        ASSERT(!m_needsOverflowCheck);
-        clearOverflow();
-        m_size = 0;
-    }
-
-    enum OverflowCheckAction {
-        CrashOnOverflow,
-        WillCheckLater
-    };
-    template<OverflowCheckAction action>
-    void appendWithAction(JSValue v)
-    {
-        ASSERT(m_size <= m_capacity);
-        if (m_size == m_capacity || mallocBase()) {
-            slowAppend(v);
-            if (action == CrashOnOverflow)
-                RELEASE_ASSERT(!hasOverflowed());
-            return;
-        }
-
-        slotFor(m_size) = JSValue::encode(v);
-        ++m_size;
-    }
-    void append(JSValue v) { appendWithAction<WillCheckLater>(v); }
-    void appendWithCrashOnOverflow(JSValue v) { appendWithAction<CrashOnOverflow>(v); }
-
-     void removeLast()
-     { 
-         ASSERT(m_size);
-         m_size--;
-     }
- 
-    JSValue last() 
-    {
-        ASSERT(m_size);
-        return JSValue::decode(slotFor(m_size - 1));
-    }
-
-    JSValue takeLast()
-    {
-        JSValue result = last();
-        removeLast();
-        return result;
-    }
-        
-     template<typename Visitor> static void markLists(Visitor&, ListSet&);
- 
-    void ensureCapacity(size_t requestedCapacity)
-    {
-        if (requestedCapacity > static_cast<size_t>(m_capacity))
-            slowEnsureCapacity(requestedCapacity);
-    }
-
-    bool hasOverflowed()
-    {
-        clearNeedsOverflowCheck();
-        return Base::hasOverflowed();
-    }
-
-     void overflowCheckNotNeeded() { clearNeedsOverflowCheck(); }
- 
-    template<typename Functor>
-    void fill(size_t count, const Functor& func)
-    {
-        ASSERT(!m_size);
-        ensureCapacity(count);
-        if (Base::hasOverflowed())
-            return;
-        m_size = count;
-        func(reinterpret_cast<JSValue*>(&slotFor(0)));
-    }
-
- protected:
-     // Constructor for a read-write list, to which you may append values.
-     // FIXME: Remove all clients of this API, then remove this API.
-    MarkedArgumentBufferBase(size_t capacity)
-+    MarkedVectorBase(size_t capacity)
-         : m_size(0)
-         , m_capacity(capacity)
-         , m_buffer(inlineBuffer())
-@@ -147,17 +76,16 @@ protected:
- 
-     EncodedJSValue* inlineBuffer()
-     {
-        return bitwise_cast<EncodedJSValue*>(bitwise_cast<uint8_t*>(this) + sizeof(MarkedArgumentBufferBase));
-+        return bitwise_cast<EncodedJSValue*>(bitwise_cast<uint8_t*>(this) + sizeof(MarkedVectorBase));
-     }
- 
-private:
-    void expandCapacity();
-    void expandCapacity(int newCapacity);
-    void slowEnsureCapacity(size_t requestedCapacity);
-+    Status expandCapacity();
-+    Status expandCapacity(int newCapacity);
-+    Status slowEnsureCapacity(size_t requestedCapacity);
- 
-     void addMarkSet(JSValue);
- 
-    JS_EXPORT_PRIVATE void slowAppend(JSValue);
-+    JS_EXPORT_PRIVATE Status slowAppend(JSValue);
- 
-     EncodedJSValue& slotFor(int item) const
-     {
-@@ -172,11 +100,14 @@ private:
-     }
- 
- #if ASSERT_ENABLED
-    void setNeedsOverflowCheck() { m_needsOverflowCheck = true; }
-+    void disableNeedsOverflowCheck() { m_overflowCheckEnabled = false; }
-+    void setNeedsOverflowCheck() { m_needsOverflowCheck = m_overflowCheckEnabled; }
-     void clearNeedsOverflowCheck() { m_needsOverflowCheck = false; }
- 
-     bool m_needsOverflowCheck { false };
-+    bool m_overflowCheckEnabled { true };
- #else
-+    void disableNeedsOverflowCheck() { }
-     void setNeedsOverflowCheck() { }
-     void clearNeedsOverflowCheck() { }
- #endif // ASSERT_ENABLED
-@@ -186,22 +117,114 @@ private:
-     ListSet* m_markSet;
- };
- 
-template<size_t passedInlineCapacity = 8>
-class MarkedArgumentBufferWithSize : public MarkedArgumentBufferBase {
-+template<typename T, size_t passedInlineCapacity = 8, class OverflowHandler = CrashOnOverflow>
-+class MarkedVector : public OverflowHandler, public MarkedVectorBase  {
- public:
-     static constexpr size_t inlineCapacity = passedInlineCapacity;
- 
-    MarkedArgumentBufferWithSize()
-        : MarkedArgumentBufferBase(inlineCapacity)
-+    MarkedVector()
-+        : MarkedVectorBase(inlineCapacity)
-     {
-         ASSERT(inlineBuffer() == m_inlineBuffer);
-+        if constexpr (std::is_same_v<OverflowHandler, CrashOnOverflow>) {
-+            // CrashOnOverflow handles overflows immediately. So, we do not
-+            // need to check for it after.
-+            disableNeedsOverflowCheck();
-+        }
-+    }
-+
-+    auto at(int i) const -> decltype(auto)
-+    {
-+        if constexpr (std::is_same_v<T, JSValue>) {
-+            if (i >= m_size)
-+                return jsUndefined();
-+            return JSValue::decode(slotFor(i));
-+        } else {
-+            if (i >= m_size)
-+                return static_cast<T>(nullptr);
-+            return jsCast<T>(JSValue::decode(slotFor(i)).asCell());
-+        }
-+    }
-+
-+    void clear()
-+    {
-+        ASSERT(!m_needsOverflowCheck);
-+        OverflowHandler::clearOverflow();
-+        m_size = 0;
-+    }
-+
-+    void append(T v)
-+    {
-+        ASSERT(m_size <= m_capacity);
-+        if (m_size == m_capacity || mallocBase()) {
-+            if (slowAppend(v) == Status::Overflowed)
-+                this->overflowed();
-+            return;
-+        }
-+
-+        slotFor(m_size) = JSValue::encode(v);
-+        ++m_size;
-+    }
-+
-+    void appendWithCrashOnOverflow(T v)
-+    {
-+        append(v);
-+        if constexpr (!std::is_same<OverflowHandler, CrashOnOverflow>::value)
-+            RELEASE_ASSERT(!this->hasOverflowed());
-+    }
-+
-+    auto last() const -> decltype(auto)
-+    {
-+        if constexpr (std::is_same_v<T, JSValue>) {
-+            ASSERT(m_size);
-+            return JSValue::decode(slotFor(m_size - 1));
-+        } else {
-+            ASSERT(m_size);
-+            return jsCast<T>(JSValue::decode(slotFor(m_size - 1)).asCell());
-+        }
-+    }
-+
-+    JSValue takeLast()
-+    {
-+        JSValue result = last();
-+        removeLast();
-+        return result;
-+    }
-+
-+    void ensureCapacity(size_t requestedCapacity)
-+    {
-+        if (requestedCapacity > static_cast<size_t>(m_capacity)) {
-+            if (slowEnsureCapacity(requestedCapacity) == Status::Overflowed)
-+                this->overflowed();
-+        }
-+    }
-+
-+    bool hasOverflowed()
-+    {
-+        clearNeedsOverflowCheck();
-+        return OverflowHandler::hasOverflowed();
-+    }
-+
-+    template<typename Functor>
-+    void fill(size_t count, const Functor& func)
-+    {
-+        ASSERT(!m_size);
-+        ensureCapacity(count);
-+        if (OverflowHandler::hasOverflowed())
-+            return;
-+        m_size = count;
-+        func(reinterpret_cast<JSValue*>(&slotFor(0)));
-     }
- 
- private:
-     EncodedJSValue m_inlineBuffer[inlineCapacity] { };
- };
- 
-using MarkedArgumentBuffer = MarkedArgumentBufferWithSize<>;
-+template<size_t passedInlineCapacity>
-+class MarkedArgumentBufferWithSize : public MarkedVector<JSValue, passedInlineCapacity, RecordOverflow> {
-+};
-+
-+using MarkedArgumentBuffer = MarkedVector<JSValue, 8, RecordOverflow>;
- 
- class ArgList {
-     WTF_MAKE_FAST_ALLOCATED;
-diff --git a/Source/WebCore/Modules/webaudio/AudioWorkletProcessor.cpp b/Source/WebCore/Modules/webaudio/AudioWorkletProcessor.cpp
-index 13d04e3bdb3b..f827b2ec6a6b 100644
--- a/Source/WebCore/Modules/webaudio/AudioWorkletProcessor.cpp
-+++ b/Source/WebCore/Modules/webaudio/AudioWorkletProcessor.cpp
-@@ -1,5 +1,5 @@
- /*
- * Copyright (C) 2020 Apple Inc. All rights reserved.
-+ * Copyright (C) 2020-2023 Apple Inc. All rights reserved.
-  *
-  * Redistribution and use in source and binary forms, with or without
-  * modification, are permitted provided that the following conditions
-@@ -219,7 +219,7 @@ AudioWorkletProcessor::AudioWorkletProcessor(AudioWorkletGlobalScope& globalScop
-     ASSERT(!isMainThread());
- }
- 
-void AudioWorkletProcessor::buildJSArguments(VM& vm, JSGlobalObject& globalObject, MarkedArgumentBufferBase& args, const Vector<RefPtr<AudioBus>>& inputs, Vector<Ref<AudioBus>>& outputs, const MemoryCompactLookupOnlyRobinHoodHashMap<String, std::unique_ptr<AudioFloatArray>>& paramValuesMap)
-+void AudioWorkletProcessor::buildJSArguments(VM& vm, JSGlobalObject& globalObject, MarkedArgumentBuffer& args, const Vector<RefPtr<AudioBus>>& inputs, Vector<Ref<AudioBus>>& outputs, const MemoryCompactLookupOnlyRobinHoodHashMap<String, std::unique_ptr<AudioFloatArray>>& paramValuesMap)
- {
-     // For performance reasons, we cache the arrays passed to JS and reconstruct them only when the topology changes.
-     if (!copyDataFromBusesToJSArray(globalObject, inputs, toJSArray(m_jsInputs)))
-diff --git a/Source/WebCore/Modules/webaudio/AudioWorkletProcessor.h b/Source/WebCore/Modules/webaudio/AudioWorkletProcessor.h
-index 3f3d708c7ae4..b0bce3609198 100644
--- a/Source/WebCore/Modules/webaudio/AudioWorkletProcessor.h
-+++ b/Source/WebCore/Modules/webaudio/AudioWorkletProcessor.h
-@@ -1,5 +1,5 @@
- /*
- * Copyright (C) 2020 Apple Inc. All rights reserved.
-+ * Copyright (C) 2020-2023 Apple Inc. All rights reserved.
-  *
-  * Redistribution and use in source and binary forms, with or without
-  * modification, are permitted provided that the following conditions
-@@ -41,7 +41,8 @@
- 
- namespace JSC {
- class JSArray;
-class MarkedArgumentBufferBase;
-+template<typename T, size_t, class> class MarkedVector;
-+using MarkedArgumentBuffer = MarkedVector<JSValue, 8, RecordOverflow>;
- }
- 
- namespace WebCore {
-@@ -71,7 +72,7 @@ public:
- 
- private:
-     explicit AudioWorkletProcessor(AudioWorkletGlobalScope&, const AudioWorkletProcessorConstructionData&);
-    void buildJSArguments(JSC::VM&, JSC::JSGlobalObject&, JSC::MarkedArgumentBufferBase&, const Vector<RefPtr<AudioBus>>& inputs, Vector<Ref<AudioBus>>& outputs, const MemoryCompactLookupOnlyRobinHoodHashMap<String, std::unique_ptr<AudioFloatArray>>& paramValuesMap);
-+    void buildJSArguments(JSC::VM&, JSC::JSGlobalObject&, JSC::MarkedArgumentBuffer&, const Vector<RefPtr<AudioBus>>& inputs, Vector<Ref<AudioBus>>& outputs, const MemoryCompactLookupOnlyRobinHoodHashMap<String, std::unique_ptr<AudioFloatArray>>& paramValuesMap);
- 
-     AudioWorkletGlobalScope& m_globalScope;
-     String m_name;
-diff --git a/Source/WebCore/bindings/js/SerializedScriptValue.cpp b/Source/WebCore/bindings/js/SerializedScriptValue.cpp
-index e0d4316a169f..5897e1066512 100644
--- a/Source/WebCore/bindings/js/SerializedScriptValue.cpp
-+++ b/Source/WebCore/bindings/js/SerializedScriptValue.cpp
-@@ -540,6 +540,7 @@ static const unsigned StringDataIs8BitFlag = 0x80000000;
- using DeserializationResult = std::pair<JSC::JSValue, SerializationReturnCode>;
- 
- class CloneBase {
-+    WTF_FORBID_HEAP_ALLOCATION;
- protected:
-     CloneBase(JSGlobalObject* lexicalGlobalObject)
-         : m_lexicalGlobalObject(lexicalGlobalObject)
-@@ -617,6 +618,7 @@ template <> bool writeLittleEndian<uint8_t>(Vector<uint8_t>& buffer, const uint8
- }
- 
- class CloneSerializer : CloneBase {
-+    WTF_FORBID_HEAP_ALLOCATION;
- public:
-     static SerializationReturnCode serialize(JSGlobalObject* lexicalGlobalObject, JSValue value, Vector<RefPtr<MessagePort>>& messagePorts, Vector<RefPtr<JSC::ArrayBuffer>>& arrayBuffers, const Vector<RefPtr<ImageBitmap>>& imageBitmaps,
- #if ENABLE(OFFSCREEN_CANVAS_IN_WORKERS)
-@@ -2150,6 +2152,7 @@ SerializationReturnCode CloneSerializer::serialize(JSValue in)
- }
- 
- class CloneDeserializer : CloneBase {
-+    WTF_FORBID_HEAP_ALLOCATION;
- public:
-     static String deserializeString(const Vector<uint8_t>& buffer)
-     {
-@@ -3921,10 +3924,10 @@ DeserializationResult CloneDeserializer::deserialize()
- 
-     Vector<uint32_t, 16> indexStack;
-     Vector<Identifier, 16> propertyNameStack;
-    Vector<JSObject*, 32> outputObjectStack;
-    Vector<JSValue, 4> mapKeyStack;
-    Vector<JSMap*, 4> mapStack;
-    Vector<JSSet*, 4> setStack;
-+    MarkedVector<JSObject*, 32> outputObjectStack;
-+    MarkedVector<JSValue, 4> mapKeyStack;
-+    MarkedVector<JSMap*, 4> mapStack;
-+    MarkedVector<JSSet*, 4> setStack;
-     Vector<WalkerState, 16> stateStack;
-     WalkerState lexicalGlobalObject = StateUnknown;
-     JSValue outValue;
-- 
-2.40.0
-
--- a/SOURCES/CVE-2023-32373.patch
+++ b/SOURCES/CVE-2023-32373.patch
@ -1,36 +0,0 @@
-From 85fd2302d16a09a82d9a6e81eb286babb23c4b3c Mon Sep 17 00:00:00 2001
-From: Antoine Quint <graouts@webkit.org>
-Date: Mon, 22 May 2023 13:37:32 -0700
-Subject: [PATCH] Potential use-after-free in WebAnimation::commitStyles
- https://bugs.webkit.org/show_bug.cgi?id=254840 rdar://107444873
-
-Reviewed by Dean Jackson and Darin Adler.
-
-Ensure that the animation's effect and target are kept alive for the duration of this method
-since it is possible that calling updateStyleIfNeeded() could call into JavaScript and thus
-these two pointers could be changed to a null value using the Web Animations API.
-
-* Source/WebCore/animation/WebAnimation.cpp:
-(WebCore::WebAnimation::commitStyles):
-
-Originally-landed-as: 259548.532@safari-7615-branch (1d6fe184ea53). rdar://107444873
-Canonical link: https://commits.webkit.org/264363@main
---
- Source/WebCore/animation/WebAnimation.cpp | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/Source/WebCore/animation/WebAnimation.cpp b/Source/WebCore/animation/WebAnimation.cpp
-index 68ea47985807..ae20c79c36cf 100644
--- a/Source/WebCore/animation/WebAnimation.cpp
-+++ b/Source/WebCore/animation/WebAnimation.cpp
-@@ -1531,8 +1531,8 @@ ExceptionOr<void> WebAnimation::commitStyles()
-     // https://drafts.csswg.org/web-animations-1/#commit-computed-styles
- 
-     // 1. Let targets be the set of all effect targets for animation effects associated with animation.
-    auto* effect = dynamicDowncast<KeyframeEffect>(m_effect.get());
-    auto* target = effect ? effect->target() : nullptr;
-+    RefPtr effect = dynamicDowncast<KeyframeEffect>(m_effect.get());
-+    RefPtr target = effect ? effect->target() : nullptr;
- 
-     // 2. For each target in targets:
-     //
--- a/SOURCES/cairo-1.15.patch
+++ b/SOURCES/cairo-1.15.patch
@ -0,0 +1,36 @@
+diff --git a/Source/cmake/OptionsGTK.cmake b/Source/cmake/OptionsGTK.cmake
+index 526fe7cfe0cf..7650ea1bade2 100644
+--- a/Source/cmake/OptionsGTK.cmake
+++ b/Source/cmake/OptionsGTK.cmake
+@@ -13,7 +13,7 @@ endif ()
+ 
+ set(USER_AGENT_BRANDING "" CACHE STRING "Branding to add to user agent string")
+ 
+-find_package(Cairo 1.16.0 REQUIRED)
+find_package(Cairo 1.14.0 REQUIRED)
+ find_package(Fontconfig 2.13.0 REQUIRED)
+ find_package(Freetype 2.9.0 REQUIRED)
+ find_package(LibGcrypt 1.6.0 REQUIRED)
+@@ -91,6 +91,14 @@ else ()
+     WEBKIT_OPTION_DEFAULT_PORT_VALUE(ENABLE_RESOURCE_USAGE PRIVATE OFF)
+ endif ()
+ 
+# Enable variation fonts when cairo >= 1.16, fontconfig >= 2.13.0, freetype >= 2.9.0 and harfbuzz >= 1.4.2.
+if (("${PC_CAIRO_VERSION}" VERSION_GREATER "1.16.0" OR "${PC_CAIRO_VERSION}" STREQUAL "1.16.0")
+    AND ("${PC_FONTCONFIG_VERSION}" VERSION_GREATER "2.13.0" OR "${PC_FONTCONFIG_VERSION}" STREQUAL "2.13.0")
+    AND ("${FREETYPE_VERSION_STRING}" VERSION_GREATER "2.9.0" OR "${FREETYPE_VERSION_STRING}" STREQUAL "2.9.0")
+    AND ("${PC_HARFBUZZ_VERSION}" VERSION_GREATER "1.4.2" OR "${PC_HARFBUZZ_VERSION}" STREQUAL "1.4.2"))
+    WEBKIT_OPTION_DEFAULT_PORT_VALUE(ENABLE_VARIATION_FONTS PRIVATE ON)
+endif ()
+
+ # Public options shared with other WebKit ports. Do not add any options here
+ # without approval from a GTK reviewer. There must be strong reason to support
+ # changing the value of the option.
+@@ -149,7 +157,6 @@ WEBKIT_OPTION_DEFAULT_PORT_VALUE(ENABLE_POINTER_LOCK PRIVATE ON)
+ WEBKIT_OPTION_DEFAULT_PORT_VALUE(ENABLE_SERVICE_WORKER PRIVATE ON)
+ WEBKIT_OPTION_DEFAULT_PORT_VALUE(ENABLE_SHAREABLE_RESOURCE PRIVATE ON)
+ WEBKIT_OPTION_DEFAULT_PORT_VALUE(ENABLE_SPEECH_SYNTHESIS PRIVATE ${ENABLE_EXPERIMENTAL_FEATURES})
+-WEBKIT_OPTION_DEFAULT_PORT_VALUE(ENABLE_VARIATION_FONTS PRIVATE ON)
+ WEBKIT_OPTION_DEFAULT_PORT_VALUE(ENABLE_WEB_API_STATISTICS PRIVATE ON)
+ WEBKIT_OPTION_DEFAULT_PORT_VALUE(ENABLE_WEB_CODECS PRIVATE ${ENABLE_EXPERIMENTAL_FEATURES})
+ WEBKIT_OPTION_DEFAULT_PORT_VALUE(ENABLE_WEB_RTC PRIVATE ${ENABLE_EXPERIMENTAL_FEATURES})
--- a/SOURCES/evolution-shared-secondary-process.patch
+++ b/SOURCES/evolution-shared-secondary-process.patch
@ -1,26 +1,14 @@
-From ffe84688fc8a91b1e6d1c4462120fc44349a7c05 Mon Sep 17 00:00:00 2001
-From: Michael Catanzaro <mcatanzaro@redhat.com>
-Date: Thu, 27 Oct 2022 19:12:43 -0500
-Subject: [PATCH] Force Evolution to use single secondary process
-
---
- Source/WebKit/UIProcess/API/glib/WebKitWebContext.cpp | 3 +++
- 1 file changed, 3 insertions(+)
-
 diff --git a/Source/WebKit/UIProcess/API/glib/WebKitWebContext.cpp b/Source/WebKit/UIProcess/API/glib/WebKitWebContext.cpp
-index 6bb6767869af..2a05a69d9b0d 100644
+index a30f5b13be26..72ad006cde21 100644
 --- a/Source/WebKit/UIProcess/API/glib/WebKitWebContext.cpp
 +++ b/Source/WebKit/UIProcess/API/glib/WebKitWebContext.cpp
-@@ -431,6 +431,9 @@ static void webkitWebContextConstructed(GObject* object)
+@@ -438,6 +438,9 @@ static void webkitWebContextConstructed(GObject* object)
     }
     configuration.setTimeZoneOverride(String::fromUTF8(priv->timeZoneOverride.data(), priv->timeZoneOverride.length()));
 
 +    if (!g_strcmp0(g_get_prgname(), "evolution"))
 +        configuration.setUsesSingleWebProcess(true);
 +
+ #if !ENABLE(2022_GLIB_API)
     if (!priv->websiteDataManager)
         priv->websiteDataManager = adoptGRef(webkit_website_data_manager_new("local-storage-directory", priv->localStorageDirectory.data(), nullptr));
- 
-- 
-2.31.1
-
--- a/SOURCES/glib-2.56.patch
+++ b/SOURCES/glib-2.56.patch
@ -0,0 +1,39 @@
+diff --git a/Tools/MiniBrowser/gtk/BrowserSettingsDialog.c b/Tools/MiniBrowser/gtk/BrowserSettingsDialog.c
+index ef000cd2b910..432c97257048 100644
+--- a/Tools/MiniBrowser/gtk/BrowserSettingsDialog.c
+++ b/Tools/MiniBrowser/gtk/BrowserSettingsDialog.c
+@@ -175,11 +175,12 @@ static void featureTreeViewRenderStatusData(GtkTreeViewColumn *column, GtkCellRe
+ {
+     g_autoptr(WebKitFeature) feature = NULL;
+     gtk_tree_model_get(model, iter, FEATURES_LIST_COLUMN_FEATURE, &feature, -1);
+-    g_autoptr(GEnumClass) enumClass = g_type_class_ref(WEBKIT_TYPE_FEATURE_STATUS);
+    GEnumClass *enumClass = g_type_class_ref(WEBKIT_TYPE_FEATURE_STATUS);
+     g_object_set(renderer,
+                  "markup", NULL,
+                  "text", g_enum_get_value(enumClass, webkit_feature_get_status(feature))->value_nick,
+                  NULL);
+    g_type_class_unref(enumClass);
+ }
+ 
+ static void featureTreeViewRenderCategoryData(GtkTreeViewColumn *column, GtkCellRenderer *renderer, GtkTreeModel *model, GtkTreeIter *iter, gpointer data)
+diff --git a/Tools/MiniBrowser/gtk/main.c b/Tools/MiniBrowser/gtk/main.c
+index 8be643a54151..ae82b41400b5 100644
+--- a/Tools/MiniBrowser/gtk/main.c
+++ b/Tools/MiniBrowser/gtk/main.c
+@@ -273,7 +273,7 @@ static gboolean parseFeaturesOptionCallback(const gchar *option, const gchar *va
+                 "features, prefixes '-' and '!' disable features. Names are case-insensitive. Example:\n"
+                 "\n    %s --features='!DirPseudo,+WebAnimationsCustomEffects,webgl'\n\n"
+                 "Available features (+/- = enabled/disabled by default):\n\n", g_get_prgname());
+-        g_autoptr(GEnumClass) statusEnum = g_type_class_ref(WEBKIT_TYPE_FEATURE_STATUS);
+        GEnumClass *statusEnum = g_type_class_ref(WEBKIT_TYPE_FEATURE_STATUS);
+         for (gsize i = 0; i < webkit_feature_list_get_length(featureList); i++) {
+             WebKitFeature *feature = webkit_feature_list_get(featureList, i);
+             g_print("  %c %s (%s)",
+@@ -284,6 +284,7 @@ static gboolean parseFeaturesOptionCallback(const gchar *option, const gchar *va
+                 g_print(": %s", webkit_feature_get_name(feature));
+             g_print("\n");
+         }
+        g_type_class_unref(statusEnum);
+         exit(EXIT_SUCCESS);
+     }
+
--- a/SOURCES/gstreamer-1.16.1.patch
+++ b/SOURCES/gstreamer-1.16.1.patch
@ -0,0 +1,483 @@
+diff --git a/Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp b/Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp
+index 77a0d6507240..353fb87900ba 100644
+--- a/Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp
+++ b/Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp
+@@ -479,7 +479,6 @@ bool MediaPlayerPrivateGStreamer::doSeek(const MediaTime& position, float rate)
+ 
+     auto seekStart = toGstClockTime(startTime);
+     auto seekStop = toGstClockTime(endTime);
+-    GST_DEBUG_OBJECT(pipeline(), "[Seek] Performing actual seek to %" GST_TIMEP_FORMAT " (endTime: %" GST_TIMEP_FORMAT ") at rate %f", &seekStart, &seekStop, rate);
+     return gst_element_seek(m_pipeline.get(), rate, GST_FORMAT_TIME, m_seekFlags, GST_SEEK_TYPE_SET, seekStart, GST_SEEK_TYPE_SET, seekStop);
+ }
+ 
+@@ -3296,9 +3295,6 @@ static uint32_t fourccValue(GstVideoFormat format)
+     case GST_VIDEO_FORMAT_P010_10LE:
+     case GST_VIDEO_FORMAT_P010_10BE:
+         return uint32_t(DMABufFormat::FourCC::P010);
+-    case GST_VIDEO_FORMAT_P016_LE:
+-    case GST_VIDEO_FORMAT_P016_BE:
+-        return uint32_t(DMABufFormat::FourCC::P016);
+     default:
+         break;
+     }
+
+From bbc469a2b43531275243850693af65f5f7d11bc6 Mon Sep 17 00:00:00 2001
+From: Michael Catanzaro <mcatanzaro@redhat.com>
+Date: Wed, 20 Sep 2023 13:07:44 -0500
+Subject: [PATCH 1/2] Revert GStreamer 1.18 dependency
+
+This reverts https://commits.webkit.org/263218@main
+---
+ .../AudioSourceProviderGStreamer.cpp          |  5 +-
+ .../gstreamer/GLVideoSinkGStreamer.cpp        | 11 ++--
+ .../gstreamer/GStreamerAudioMixer.cpp         |  2 +-
+ .../graphics/gstreamer/GStreamerCommon.cpp    | 52 +++++++++++++++++++
+ .../graphics/gstreamer/GStreamerCommon.h      | 16 ++++++
+ .../gstreamer/GStreamerRegistryScanner.cpp    |  9 +++-
+ .../gstreamer/MediaPlayerPrivateGStreamer.cpp | 46 +++++++++++++---
+ .../gstreamer/MediaPlayerPrivateGStreamer.h   |  1 +
+ Source/cmake/GStreamerChecks.cmake            |  2 +-
+ 9 files changed, 127 insertions(+), 17 deletions(-)
+
+diff --git a/Source/WebCore/platform/audio/gstreamer/AudioSourceProviderGStreamer.cpp b/Source/WebCore/platform/audio/gstreamer/AudioSourceProviderGStreamer.cpp
+index a97e6431802c..d8b1a1f4bd8b 100644
+--- a/Source/WebCore/platform/audio/gstreamer/AudioSourceProviderGStreamer.cpp
+++ b/Source/WebCore/platform/audio/gstreamer/AudioSourceProviderGStreamer.cpp
+@@ -122,7 +122,10 @@ AudioSourceProviderGStreamer::AudioSourceProviderGStreamer(MediaStreamTrackPriva
+     g_signal_connect_swapped(decodebin, "pad-added", G_CALLBACK(+[](AudioSourceProviderGStreamer* provider, GstPad* pad) {
+         auto padCaps = adoptGRef(gst_pad_query_caps(pad, nullptr));
+         bool isAudio = doCapsHaveType(padCaps.get(), "audio");
+-        RELEASE_ASSERT(isAudio);
+        if (webkitGstCheckVersion(1, 18, 0))
+            RELEASE_ASSERT(isAudio);
+        else if (!isAudio)
+            return;
+ 
+         auto sinkPad = adoptGRef(gst_element_get_static_pad(provider->m_audioSinkBin.get(), "sink"));
+         gst_pad_link(pad, sinkPad.get());
+diff --git a/Source/WebCore/platform/graphics/gstreamer/GLVideoSinkGStreamer.cpp b/Source/WebCore/platform/graphics/gstreamer/GLVideoSinkGStreamer.cpp
+index 1a7480828861..f3a51be68534 100644
+--- a/Source/WebCore/platform/graphics/gstreamer/GLVideoSinkGStreamer.cpp
+++ b/Source/WebCore/platform/graphics/gstreamer/GLVideoSinkGStreamer.cpp
+@@ -186,12 +186,13 @@ static void webKitGLVideoSinkGetProperty(GObject* object, guint propertyId, GVal
+     WebKitGLVideoSink* sink = WEBKIT_GL_VIDEO_SINK(object);
+ 
+     switch (propertyId) {
+-    case PROP_STATS: {
+-        GUniqueOutPtr<GstStructure> stats;
+-        g_object_get(sink->priv->appSink.get(), "stats", &stats.outPtr(), nullptr);
+-        gst_value_set_structure(value, stats.get());
+    case PROP_STATS:
+        if (webkitGstCheckVersion(1, 18, 0)) {
+            GUniqueOutPtr<GstStructure> stats;
+            g_object_get(sink->priv->appSink.get(), "stats", &stats.outPtr(), nullptr);
+            gst_value_set_structure(value, stats.get());
+        }
+         break;
+-    }
+     default:
+         G_OBJECT_WARN_INVALID_PROPERTY_ID(object, propertyId, paramSpec);
+         RELEASE_ASSERT_NOT_REACHED();
+diff --git a/Source/WebCore/platform/graphics/gstreamer/GStreamerAudioMixer.cpp b/Source/WebCore/platform/graphics/gstreamer/GStreamerAudioMixer.cpp
+index ad4b1ae3f77e..fb7e617b5d56 100644
+--- a/Source/WebCore/platform/graphics/gstreamer/GStreamerAudioMixer.cpp
+++ b/Source/WebCore/platform/graphics/gstreamer/GStreamerAudioMixer.cpp
+@@ -32,7 +32,7 @@ GST_DEBUG_CATEGORY_STATIC(webkit_media_gst_audio_mixer_debug);
+ 
+ bool GStreamerAudioMixer::isAvailable()
+ {
+-    return isGStreamerPluginAvailable("inter") && isGStreamerPluginAvailable("audiomixer");
+    return webkitGstCheckVersion(1, 18, 0) && isGStreamerPluginAvailable("inter") && isGStreamerPluginAvailable("audiomixer");
+ }
+ 
+ GStreamerAudioMixer& GStreamerAudioMixer::singleton()
+diff --git a/Source/WebCore/platform/graphics/gstreamer/GStreamerCommon.cpp b/Source/WebCore/platform/graphics/gstreamer/GStreamerCommon.cpp
+index 794beaa6932a..5f6b3826f182 100644
+--- a/Source/WebCore/platform/graphics/gstreamer/GStreamerCommon.cpp
+++ b/Source/WebCore/platform/graphics/gstreamer/GStreamerCommon.cpp
+@@ -105,6 +105,24 @@ GstPad* webkitGstGhostPadFromStaticTemplate(GstStaticPadTemplate* staticPadTempl
+     return pad;
+ }
+ 
+#if !GST_CHECK_VERSION(1, 18, 0)
+void webkitGstVideoFormatInfoComponent(const GstVideoFormatInfo* info, guint plane, gint components[GST_VIDEO_MAX_COMPONENTS])
+{
+    guint c, i = 0;
+
+    /* Reverse mapping of info->plane. */
+    for (c = 0; c < GST_VIDEO_FORMAT_INFO_N_COMPONENTS(info); c++) {
+        if (GST_VIDEO_FORMAT_INFO_PLANE(info, c) == plane) {
+            components[i] = c;
+            i++;
+        }
+    }
+
+    for (c = i; c < GST_VIDEO_MAX_COMPONENTS; c++)
+        components[c] = -1;
+}
+#endif
+
+ #if ENABLE(VIDEO)
+ bool getVideoSizeAndFormatFromCaps(const GstCaps* caps, WebCore::IntSize& size, GstVideoFormat& format, int& pixelAspectRatioNumerator, int& pixelAspectRatioDenominator, int& stride)
+ {
+@@ -748,6 +766,36 @@ String gstStructureToJSONString(const GstStructure* structure)
+     return value->toJSONString();
+ }
+ 
+#if !GST_CHECK_VERSION(1, 18, 0)
+GstClockTime webkitGstElementGetCurrentRunningTime(GstElement* element)
+{
+    g_return_val_if_fail(GST_IS_ELEMENT(element), GST_CLOCK_TIME_NONE);
+
+    auto baseTime = gst_element_get_base_time(element);
+    if (!GST_CLOCK_TIME_IS_VALID(baseTime)) {
+        GST_DEBUG_OBJECT(element, "Could not determine base time");
+        return GST_CLOCK_TIME_NONE;
+    }
+
+    auto clock = adoptGRef(gst_element_get_clock(element));
+    if (!clock) {
+        GST_DEBUG_OBJECT(element, "Element has no clock");
+        return GST_CLOCK_TIME_NONE;
+    }
+
+    auto clockTime = gst_clock_get_time(clock.get());
+    if (!GST_CLOCK_TIME_IS_VALID(clockTime))
+        return GST_CLOCK_TIME_NONE;
+
+    if (clockTime < baseTime) {
+        GST_DEBUG_OBJECT(element, "Got negative current running time");
+        return GST_CLOCK_TIME_NONE;
+    }
+
+    return clockTime - baseTime;
+}
+#endif
+
+ GstClockTime webkitGstInitTime()
+ {
+     return s_webkitGstInitTime;
+@@ -805,6 +853,7 @@ PlatformVideoColorSpace videoColorSpaceFromInfo(const GstVideoInfo& info)
+     case GST_VIDEO_TRANSFER_BT709:
+         colorSpace.transfer = PlatformVideoTransferCharacteristics::Bt709;
+         break;
+#if GST_CHECK_VERSION(1, 18, 0)
+     case GST_VIDEO_TRANSFER_BT601:
+         colorSpace.transfer = PlatformVideoTransferCharacteristics::Smpte170m;
+         break;
+@@ -817,6 +866,7 @@ PlatformVideoColorSpace videoColorSpaceFromInfo(const GstVideoInfo& info)
+     case GST_VIDEO_TRANSFER_BT2020_10:
+         colorSpace.transfer = PlatformVideoTransferCharacteristics::Bt2020_10bit;
+         break;
+#endif
+     case GST_VIDEO_TRANSFER_BT2020_12:
+         colorSpace.transfer = PlatformVideoTransferCharacteristics::Bt2020_12bit;
+         break;
+@@ -935,6 +985,7 @@ void fillVideoInfoColorimetryFromColorSpace(GstVideoInfo* info, const PlatformVi
+         case PlatformVideoTransferCharacteristics::Bt709:
+             GST_VIDEO_INFO_COLORIMETRY(info).transfer = GST_VIDEO_TRANSFER_BT709;
+             break;
+#if GST_CHECK_VERSION(1, 18, 0)
+         case PlatformVideoTransferCharacteristics::Smpte170m:
+             GST_VIDEO_INFO_COLORIMETRY(info).transfer = GST_VIDEO_TRANSFER_BT601;
+             break;
+@@ -947,6 +998,7 @@ void fillVideoInfoColorimetryFromColorSpace(GstVideoInfo* info, const PlatformVi
+         case PlatformVideoTransferCharacteristics::Bt2020_10bit:
+             GST_VIDEO_INFO_COLORIMETRY(info).transfer = GST_VIDEO_TRANSFER_BT2020_10;
+             break;
+#endif
+         case PlatformVideoTransferCharacteristics::Bt2020_12bit:
+             GST_VIDEO_INFO_COLORIMETRY(info).transfer = GST_VIDEO_TRANSFER_BT2020_12;
+             break;
+diff --git a/Source/WebCore/platform/graphics/gstreamer/GStreamerCommon.h b/Source/WebCore/platform/graphics/gstreamer/GStreamerCommon.h
+index fae7ef96d6c5..65ef4bfefdaa 100644
+--- a/Source/WebCore/platform/graphics/gstreamer/GStreamerCommon.h
+++ b/Source/WebCore/platform/graphics/gstreamer/GStreamerCommon.h
+@@ -56,6 +56,15 @@ inline bool webkitGstCheckVersion(guint major, guint minor, guint micro)
+     return true;
+ }
+ 
+// gst_video_format_info_component() is GStreamer 1.18 API, so for older versions we use a local
+// vendored copy of the function.
+#if !GST_CHECK_VERSION(1, 18, 0)
+#define GST_VIDEO_MAX_COMPONENTS 4
+void webkitGstVideoFormatInfoComponent(const GstVideoFormatInfo*, guint, gint components[GST_VIDEO_MAX_COMPONENTS]);
+
+#define gst_video_format_info_component webkitGstVideoFormatInfoComponent
+#endif
+
+ #define GST_VIDEO_CAPS_TYPE_PREFIX  "video/"
+ #define GST_AUDIO_CAPS_TYPE_PREFIX  "audio/"
+ #define GST_TEXT_CAPS_TYPE_PREFIX   "text/"
+@@ -323,6 +332,13 @@ GstElement* makeGStreamerBin(const char* description, bool ghostUnlinkedPads);
+ 
+ String gstStructureToJSONString(const GstStructure*);
+ 
+// gst_element_get_current_running_time() is GStreamer 1.18 API, so for older versions we use a local
+// vendored copy of the function.
+#if !GST_CHECK_VERSION(1, 18, 0)
+GstClockTime webkitGstElementGetCurrentRunningTime(GstElement*);
+#define gst_element_get_current_running_time webkitGstElementGetCurrentRunningTime
+#endif
+
+ GstClockTime webkitGstInitTime();
+ 
+ PlatformVideoColorSpace videoColorSpaceFromCaps(const GstCaps*);
+diff --git a/Source/WebCore/platform/graphics/gstreamer/GStreamerRegistryScanner.cpp b/Source/WebCore/platform/graphics/gstreamer/GStreamerRegistryScanner.cpp
+index 7cd1926e6d15..032f086b43c0 100644
+--- a/Source/WebCore/platform/graphics/gstreamer/GStreamerRegistryScanner.cpp
+++ b/Source/WebCore/platform/graphics/gstreamer/GStreamerRegistryScanner.cpp
+@@ -900,8 +900,13 @@ GStreamerRegistryScanner::CodecLookupResult GStreamerRegistryScanner::isAVC1Code
+         return checkH264Caps(makeString("video/x-h264, level=(string)", maxLevelString).utf8().data());
+     }
+ 
+-    GST_DEBUG("Checking video decoders for constrained caps");
+-    return checkH264Caps(makeString("video/x-h264, level=(string)", level, ", profile=(string)", profile).utf8().data());
+    if (webkitGstCheckVersion(1, 18, 0)) {
+        GST_DEBUG("Checking video decoders for constrained caps");
+        return checkH264Caps(makeString("video/x-h264, level=(string)", level, ", profile=(string)", profile).utf8().data());
+    }
+
+    GST_DEBUG("Falling back to unconstrained caps");
+    return checkH264Caps("video/x-h264");
+ }
+ 
+ const char* GStreamerRegistryScanner::configurationNameForLogging(Configuration configuration) const
+diff --git a/Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp b/Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp
+index aad2c0bc432b..77a0d6507240 100644
+--- a/Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp
+++ b/Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp
+@@ -4114,7 +4114,29 @@ GstElement* MediaPlayerPrivateGStreamer::createVideoSink()
+         g_signal_connect_swapped(m_videoSink.get(), "repaint-cancelled", G_CALLBACK(repaintCancelledCallback), this);
+     }
+ 
+-    return m_videoSink.get();
+    GstElement* videoSink = nullptr;
+    if (!webkitGstCheckVersion(1, 18, 0)) {
+        m_fpsSink = makeGStreamerElement("fpsdisplaysink", "sink");
+        if (m_fpsSink) {
+            g_object_set(m_fpsSink.get(), "silent", TRUE , nullptr);
+
+            // Turn off text overlay unless tracing is enabled.
+            if (gst_debug_category_get_threshold(webkit_media_player_debug) < GST_LEVEL_TRACE)
+                g_object_set(m_fpsSink.get(), "text-overlay", FALSE , nullptr);
+
+            if (gstObjectHasProperty(m_fpsSink.get(), "video-sink")) {
+                g_object_set(m_fpsSink.get(), "video-sink", m_videoSink.get(), nullptr);
+                videoSink = m_fpsSink.get();
+            } else
+                m_fpsSink = nullptr;
+        }
+    }
+
+    if (!m_fpsSink)
+        videoSink = m_videoSink.get();
+
+    ASSERT(videoSink);
+    return videoSink;
+ }
+ 
+ void MediaPlayerPrivateGStreamer::setStreamVolumeElement(GstStreamVolume* volume)
+@@ -4147,16 +4169,26 @@ bool MediaPlayerPrivateGStreamer::updateVideoSinkStatistics()
+     if (!m_videoSink)
+         return false;
+ 
+    if (!webkitGstCheckVersion(1, 18, 0) && !m_fpsSink)
+        return false;
+
+     uint64_t totalVideoFrames = 0;
+     uint64_t droppedVideoFrames = 0;
+-    GUniqueOutPtr<GstStructure> stats;
+-    g_object_get(m_videoSink.get(), "stats", &stats.outPtr(), nullptr);
+    if (webkitGstCheckVersion(1, 18, 0)) {
+        GUniqueOutPtr<GstStructure> stats;
+        g_object_get(m_videoSink.get(), "stats", &stats.outPtr(), nullptr);
+ 
+-    if (!gst_structure_get_uint64(stats.get(), "rendered", &totalVideoFrames))
+-        return false;
+        if (!gst_structure_get_uint64(stats.get(), "rendered", &totalVideoFrames))
+            return false;
+ 
+-    if (!gst_structure_get_uint64(stats.get(), "dropped", &droppedVideoFrames))
+-        return false;
+        if (!gst_structure_get_uint64(stats.get(), "dropped", &droppedVideoFrames))
+            return false;
+    } else if (m_fpsSink) {
+        unsigned renderedFrames, droppedFrames;
+        g_object_get(m_fpsSink.get(), "frames-rendered", &renderedFrames, "frames-dropped", &droppedFrames, nullptr);
+        totalVideoFrames = renderedFrames;
+        droppedVideoFrames = droppedFrames;
+    }
+ 
+     // Caching is required so that metrics queries performed after EOS still return valid values.
+     if (totalVideoFrames)
+diff --git a/Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h b/Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h
+index e0cdb0a2d01f..f33a674481e1 100644
+--- a/Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h
+++ b/Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h
+@@ -578,6 +578,7 @@ private:
+     uint64_t m_networkReadPosition { 0 };
+     mutable uint64_t m_readPositionAtLastDidLoadingProgress { 0 };
+ 
+    GRefPtr<GstElement> m_fpsSink { nullptr };
+     uint64_t m_totalVideoFrames { 0 };
+     uint64_t m_droppedVideoFrames { 0 };
+     uint64_t m_decodedVideoFrames { 0 };
+diff --git a/Source/cmake/GStreamerChecks.cmake b/Source/cmake/GStreamerChecks.cmake
+index 5380617afc9c..8774f1d2aca8 100644
+--- a/Source/cmake/GStreamerChecks.cmake
+++ b/Source/cmake/GStreamerChecks.cmake
+@@ -36,7 +36,7 @@ if (ENABLE_VIDEO OR ENABLE_WEB_AUDIO)
+               list(APPEND GSTREAMER_COMPONENTS webrtc)
+           endif ()
+ 
+-          find_package(GStreamer 1.18.4 REQUIRED COMPONENTS ${GSTREAMER_COMPONENTS})
+          find_package(GStreamer 1.16.2 REQUIRED COMPONENTS ${GSTREAMER_COMPONENTS})
+ 
+           if (ENABLE_WEB_AUDIO)
+               if (NOT PC_GSTREAMER_AUDIO_FOUND OR NOT PC_GSTREAMER_FFT_FOUND)
+-- 
+2.41.0
+
+From 9046961d80cc168aab253e3e0eda2268bd956293 Mon Sep 17 00:00:00 2001
+From: Michael Catanzaro <mcatanzaro@redhat.com>
+Date: Wed, 20 Sep 2023 13:09:28 -0500
+Subject: [PATCH 2/2] Revert GStreamer 1.16 dependency
+
+This (mostly) reverts https://commits.webkit.org/256284@main
+---
+ .../gstreamer/GLVideoSinkGStreamer.cpp        | 20 ++++++++++++++++++-
+ .../gstreamer/eme/GStreamerEMEUtilities.h     | 10 ++++++++++
+ ...bKitCommonEncryptionDecryptorGStreamer.cpp |  7 +++++--
+ Source/cmake/GStreamerChecks.cmake            |  2 +-
+ 4 files changed, 35 insertions(+), 4 deletions(-)
+
+diff --git a/Source/WebCore/platform/graphics/gstreamer/GLVideoSinkGStreamer.cpp b/Source/WebCore/platform/graphics/gstreamer/GLVideoSinkGStreamer.cpp
+index f3a51be68534..bf8ebeda1725 100644
+--- a/Source/WebCore/platform/graphics/gstreamer/GLVideoSinkGStreamer.cpp
+++ b/Source/WebCore/platform/graphics/gstreamer/GLVideoSinkGStreamer.cpp
+@@ -88,7 +88,25 @@ static void webKitGLVideoSinkConstructed(GObject* object)
+     ASSERT(colorconvert);
+     gst_bin_add_many(GST_BIN_CAST(sink), upload, colorconvert, sink->priv->appSink.get(), nullptr);
+ 
+-    GRefPtr<GstCaps> caps = adoptGRef(gst_caps_from_string("video/x-raw, format = (string) " GST_GL_CAPS_FORMAT));
+    // Workaround until we can depend on GStreamer 1.16.2.
+    // https://gitlab.freedesktop.org/gstreamer/gst-plugins-base/commit/8d32de090554cf29fe359f83aa46000ba658a693
+    // Forcing a color conversion to RGBA here allows glupload to internally use
+    // an uploader that adds a VideoMeta, through the TextureUploadMeta caps
+    // feature, without needing the patch above. However this specific caps
+    // feature is going to be removed from GStreamer so it is considered a
+    // short-term workaround. This code path most likely will have a negative
+    // performance impact on embedded platforms as well. Downstream embedders
+    // are highly encouraged to cherry-pick the patch linked above in their BSP
+    // and set the WEBKIT_GST_NO_RGBA_CONVERSION environment variable until
+    // GStreamer 1.16.2 is released.
+    // See also https://bugs.webkit.org/show_bug.cgi?id=201422
+    GRefPtr<GstCaps> caps;
+    if (webkitGstCheckVersion(1, 16, 2) || getenv("WEBKIT_GST_NO_RGBA_CONVERSION"))
+        caps = adoptGRef(gst_caps_from_string("video/x-raw, format = (string) " GST_GL_CAPS_FORMAT));
+    else {
+        GST_INFO_OBJECT(sink, "Forcing RGBA as GStreamer is not new enough.");
+        caps = adoptGRef(gst_caps_from_string("video/x-raw, format = (string) RGBA"));
+    }
+     gst_caps_set_features(caps.get(), 0, gst_caps_features_new(GST_CAPS_FEATURE_MEMORY_GL_MEMORY, nullptr));
+     g_object_set(sink->priv->appSink.get(), "caps", caps.get(), nullptr);
+ 
+diff --git a/Source/WebCore/platform/graphics/gstreamer/eme/GStreamerEMEUtilities.h b/Source/WebCore/platform/graphics/gstreamer/eme/GStreamerEMEUtilities.h
+index 6dbf6a67dfd1..184c5c3e5f77 100644
+--- a/Source/WebCore/platform/graphics/gstreamer/eme/GStreamerEMEUtilities.h
+++ b/Source/WebCore/platform/graphics/gstreamer/eme/GStreamerEMEUtilities.h
+@@ -61,8 +61,10 @@ public:
+     const String& systemId() const { return m_systemId; }
+     String payloadContainerType() const
+     {
+#if GST_CHECK_VERSION(1, 16, 0)
+         if (m_systemId == GST_PROTECTION_UNSPECIFIED_SYSTEM_ID ""_s)
+             return "webm"_s;
+#endif
+         return "cenc"_s;
+     }
+ 
+@@ -111,8 +113,10 @@ public:
+     static constexpr auto s_WidevineKeySystem = "com.widevine.alpha"_s;
+     static constexpr auto s_PlayReadyUUID = WEBCORE_GSTREAMER_EME_UTILITIES_PLAYREADY_UUID ""_s;
+     static constexpr std::array<ASCIILiteral, 2> s_PlayReadyKeySystems = { "com.microsoft.playready"_s,  "com.youtube.playready"_s };
+#if GST_CHECK_VERSION(1, 16, 0)
+     static constexpr auto s_unspecifiedUUID = GST_PROTECTION_UNSPECIFIED_SYSTEM_ID ""_s;
+     static constexpr auto s_unspecifiedKeySystem = GST_PROTECTION_UNSPECIFIED_SYSTEM_ID ""_s;
+#endif
+ 
+     static bool isClearKeyKeySystem(const String& keySystem)
+     {
+@@ -144,6 +148,7 @@ public:
+         return equalIgnoringASCIICase(uuid, s_PlayReadyUUID);
+     }
+ 
+#if GST_CHECK_VERSION(1, 16, 0)
+     static bool isUnspecifiedKeySystem(const String& keySystem)
+     {
+         return equalIgnoringASCIICase(keySystem, s_unspecifiedKeySystem);
+@@ -153,6 +158,7 @@ public:
+     {
+         return equalIgnoringASCIICase(uuid, s_unspecifiedUUID);
+     }
+#endif
+ 
+     static const char* keySystemToUuid(const String& keySystem)
+     {
+@@ -165,8 +171,10 @@ public:
+         if (isPlayReadyKeySystem(keySystem))
+             return s_PlayReadyUUID;
+ 
+#if GST_CHECK_VERSION(1, 16, 0)
+         if (isUnspecifiedKeySystem(keySystem))
+             return s_unspecifiedUUID;
+#endif
+ 
+         ASSERT_NOT_REACHED();
+         return { };
+@@ -183,8 +191,10 @@ public:
+         if (isPlayReadyUUID(uuid))
+             return s_PlayReadyKeySystems[0];
+ 
+#if GST_CHECK_VERSION(1, 16, 0)
+         if (isUnspecifiedUUID(uuid))
+             return s_unspecifiedKeySystem;
+#endif
+ 
+         ASSERT_NOT_REACHED();
+         return ""_s;
+diff --git a/Source/WebCore/platform/graphics/gstreamer/eme/WebKitCommonEncryptionDecryptorGStreamer.cpp b/Source/WebCore/platform/graphics/gstreamer/eme/WebKitCommonEncryptionDecryptorGStreamer.cpp
+index 0cde37e1f83f..a7bbf7fc569c 100644
+--- a/Source/WebCore/platform/graphics/gstreamer/eme/WebKitCommonEncryptionDecryptorGStreamer.cpp
+++ b/Source/WebCore/platform/graphics/gstreamer/eme/WebKitCommonEncryptionDecryptorGStreamer.cpp
+@@ -171,8 +171,11 @@ static GstCaps* transformCaps(GstBaseTransform* base, GstPadDirection direction,
+ 
+                 // GST_PROTECTION_UNSPECIFIED_SYSTEM_ID was added in the GStreamer
+                 // developement git master which will ship as version 1.16.0.
+-                gst_structure_set_name(outgoingStructure.get(), !g_strcmp0(klass->protectionSystemId(self),
+-                    GST_PROTECTION_UNSPECIFIED_SYSTEM_ID) ? "application/x-webm-enc" : "application/x-cenc");
+                gst_structure_set_name(outgoingStructure.get(),
+#if GST_CHECK_VERSION(1, 16, 0)
+                    !g_strcmp0(klass->protectionSystemId(self), GST_PROTECTION_UNSPECIFIED_SYSTEM_ID) ? "application/x-webm-enc" :
+#endif
+                    "application/x-cenc");
+             }
+         }
+ 
+diff --git a/Source/cmake/GStreamerChecks.cmake b/Source/cmake/GStreamerChecks.cmake
+index 8774f1d2aca8..d43093ec7824 100644
+--- a/Source/cmake/GStreamerChecks.cmake
+++ b/Source/cmake/GStreamerChecks.cmake
+@@ -36,7 +36,7 @@ if (ENABLE_VIDEO OR ENABLE_WEB_AUDIO)
+               list(APPEND GSTREAMER_COMPONENTS webrtc)
+           endif ()
+ 
+-          find_package(GStreamer 1.16.2 REQUIRED COMPONENTS ${GSTREAMER_COMPONENTS})
+          find_package(GStreamer 1.14.0 REQUIRED COMPONENTS ${GSTREAMER_COMPONENTS})
+ 
+           if (ENABLE_WEB_AUDIO)
+               if (NOT PC_GSTREAMER_AUDIO_FOUND OR NOT PC_GSTREAMER_FFT_FOUND)
+-- 
+2.41.0
+
--- a/SOURCES/i686-build.patch
+++ b/SOURCES/i686-build.patch
@ -0,0 +1,16 @@
+From: Alberto Garcia <berto@igalia.com>
+Subject: Fix FTBFS in i386
+Bug: https://bugs.webkit.org/show_bug.cgi?id=268739
+Index: webkitgtk/Source/JavaScriptCore/llint/LowLevelInterpreter.cpp
+===================================================================
+--- webkitgtk.orig/Source/JavaScriptCore/llint/LowLevelInterpreter.cpp
+++ webkitgtk/Source/JavaScriptCore/llint/LowLevelInterpreter.cpp
+@@ -336,8 +336,6 @@ JSValue CLoop::execute(OpcodeID entryOpc
+     UNUSED_VARIABLE(t2);
+     UNUSED_VARIABLE(t3);
+     UNUSED_VARIABLE(t5);
+-    UNUSED_VARIABLE(t6);
+-    UNUSED_VARIABLE(t7);
+ 
+     struct StackPointerScope {
+         StackPointerScope(CLoopStack& stack)
--- a/SOURCES/icu60.patch
+++ b/SOURCES/icu60.patch
@ -1,17 +1,3 @@
-From 833cfdd150b6f7f0fb021ac5de7890dff158f5fd Mon Sep 17 00:00:00 2001
-From: Michael Catanzaro <mcatanzaro@redhat.com>
-Date: Thu, 27 Oct 2022 16:32:43 -0500
-Subject: [PATCH] Build against ICU 60
-
---
- Source/JavaScriptCore/runtime/IntlCache.cpp        |  3 +++
- Source/JavaScriptCore/runtime/IntlCache.h          |  3 +++
- Source/JavaScriptCore/runtime/IntlDisplayNames.cpp | 11 +++++++++++
- Source/JavaScriptCore/runtime/IntlDisplayNames.h   |  7 +++++++
- Source/JavaScriptCore/runtime/IntlObject.cpp       |  6 +++++-
- Source/cmake/OptionsGTK.cmake                      |  2 +-
- 6 files changed, 30 insertions(+), 2 deletions(-)
-
 diff --git a/Source/JavaScriptCore/runtime/IntlCache.cpp b/Source/JavaScriptCore/runtime/IntlCache.cpp
 index b17d7340df56..94a5474059b6 100644
 --- a/Source/JavaScriptCore/runtime/IntlCache.cpp
@ -62,10 +48,10 @@ index 058b2423786d..e7a8c82f392b 100644
 private:
     UDateTimePatternGenerator* getSharedPatternGenerator(const CString& locale, UErrorCode& status)
 diff --git a/Source/JavaScriptCore/runtime/IntlDisplayNames.cpp b/Source/JavaScriptCore/runtime/IntlDisplayNames.cpp
-index c281f796eaee..1bc3c0c8a8c6 100644
+index ed8dd34fdf44..9ec789b65413 100644
 --- a/Source/JavaScriptCore/runtime/IntlDisplayNames.cpp
 +++ b/Source/JavaScriptCore/runtime/IntlDisplayNames.cpp
-@@ -110,6 +110,7 @@ void IntlDisplayNames::initializeDisplayNames(JSGlobalObject* globalObject, JSVa
+@@ -104,6 +104,7 @@ void IntlDisplayNames::initializeDisplayNames(JSGlobalObject* globalObject, JSVa
     m_languageDisplay = intlOption<LanguageDisplay>(globalObject, options, vm.propertyNames->languageDisplay, { { "dialect"_s, LanguageDisplay::Dialect }, { "standard"_s, LanguageDisplay::Standard } }, "languageDisplay must be either \"dialect\" or \"standard\""_s, LanguageDisplay::Dialect);
     RETURN_IF_EXCEPTION(scope, void());
 
@ -73,18 +59,18 @@ index c281f796eaee..1bc3c0c8a8c6 100644
     UErrorCode status = U_ZERO_ERROR;
 
     UDisplayContext contexts[] = {
-@@ -137,6 +138,10 @@ void IntlDisplayNames::initializeDisplayNames(JSGlobalObject* globalObject, JSVa
+@@ -131,6 +132,10 @@ void IntlDisplayNames::initializeDisplayNames(JSGlobalObject* globalObject, JSVa
         throwTypeError(globalObject, scope, "failed to initialize DisplayNames"_s);
         return;
     }
 +#else
-+        throwTypeError(globalObject, scope, "failed to initialize Intl.DisplayNames since feature is not supported by the ICU version"_s);
-+        return;
+    throwTypeError(globalObject, scope, "failed to initialize Intl.DisplayNames since feature is not supported by the ICU version"_s);
+    return;
 +#endif
 }
 
 // https://tc39.es/proposal-intl-displaynames/#sec-Intl.DisplayNames.prototype.of
-@@ -146,6 +151,7 @@ JSValue IntlDisplayNames::of(JSGlobalObject* globalObject, JSValue codeValue) co
+@@ -140,6 +145,7 @@ JSValue IntlDisplayNames::of(JSGlobalObject* globalObject, JSValue codeValue) co
     VM& vm = globalObject->vm();
     auto scope = DECLARE_THROW_SCOPE(vm);
 
@ -92,7 +78,7 @@ index c281f796eaee..1bc3c0c8a8c6 100644
     ASSERT(m_displayNames);
     auto code = codeValue.toWTFString(globalObject);
     RETURN_IF_EXCEPTION(scope, { });
-@@ -350,6 +356,11 @@ JSValue IntlDisplayNames::of(JSGlobalObject* globalObject, JSValue codeValue) co
+@@ -344,6 +350,11 @@ JSValue IntlDisplayNames::of(JSGlobalObject* globalObject, JSValue codeValue) co
         return throwTypeError(globalObject, scope, "Failed to query a display name."_s);
     }
     return jsString(vm, String(WTFMove(buffer)));
@ -105,7 +91,7 @@ index c281f796eaee..1bc3c0c8a8c6 100644
 
 // https://tc39.es/proposal-intl-displaynames/#sec-Intl.DisplayNames.prototype.resolvedOptions
 diff --git a/Source/JavaScriptCore/runtime/IntlDisplayNames.h b/Source/JavaScriptCore/runtime/IntlDisplayNames.h
-index d80dc3d83a15..f2bf36275c79 100644
+index 2101c342865e..87a95a26f55c 100644
 --- a/Source/JavaScriptCore/runtime/IntlDisplayNames.h
 +++ b/Source/JavaScriptCore/runtime/IntlDisplayNames.h
@@ -29,6 +29,13 @@
@ -122,19 +108,39 @@ index d80dc3d83a15..f2bf36275c79 100644
 namespace JSC {
 
 enum class RelevantExtensionKey : uint8_t;
+diff --git a/Source/JavaScriptCore/runtime/IntlDurationFormat.cpp b/Source/JavaScriptCore/runtime/IntlDurationFormat.cpp
+index fdcaa71f2011..f6aa1b0e3def 100644
+--- a/Source/JavaScriptCore/runtime/IntlDurationFormat.cpp
+++ b/Source/JavaScriptCore/runtime/IntlDurationFormat.cpp
+@@ -41,7 +41,6 @@
+ #endif
+ #endif
+ #include <unicode/ulistformatter.h>
+-#include <unicode/unumberformatter.h>
+ #include <unicode/ures.h>
+ #if HAVE(ICU_U_LIST_FORMATTER)
+ #define U_HIDE_DRAFT_API 1
+@@ -49,6 +48,7 @@
+ 
+ #if HAVE(ICU_U_LIST_FORMATTER)
+ #include <unicode/uformattedvalue.h>
+#include <unicode/unumberformatter.h>
+ #endif
+ 
+ namespace JSC {
 diff --git a/Source/JavaScriptCore/runtime/IntlObject.cpp b/Source/JavaScriptCore/runtime/IntlObject.cpp
-index f7dc4d578d77..a6ccbe1b9f74 100644
+index cba15c79bc45..9553eb6b263b 100644
 --- a/Source/JavaScriptCore/runtime/IntlObject.cpp
 +++ b/Source/JavaScriptCore/runtime/IntlObject.cpp
-@@ -153,7 +153,6 @@ namespace JSC {
-   getCanonicalLocales   intlObjectFuncGetCanonicalLocales            DontEnum|Function 1
+@@ -165,7 +165,6 @@ namespace JSC {
+   supportedValuesOf     intlObjectFuncSupportedValuesOf              DontEnum|Function 1
   Collator              createCollatorConstructor                    DontEnum|PropertyCallback
   DateTimeFormat        createDateTimeFormatConstructor              DontEnum|PropertyCallback
 -  DisplayNames          createDisplayNamesConstructor                DontEnum|PropertyCallback
   Locale                createLocaleConstructor                      DontEnum|PropertyCallback
   NumberFormat          createNumberFormatConstructor                DontEnum|PropertyCallback
   PluralRules           createPluralRulesConstructor                 DontEnum|PropertyCallback
-@@ -239,6 +238,11 @@ void IntlObject::finishCreation(VM& vm, JSGlobalObject* globalObject)
+@@ -253,6 +252,11 @@ void IntlObject::finishCreation(VM& vm, JSGlobalObject*)
     Base::finishCreation(vm);
     ASSERT(inherits(info()));
     JSC_TO_STRING_TAG_WITHOUT_TRANSITION();
@ -144,21 +150,18 @@ index f7dc4d578d77..a6ccbe1b9f74 100644
 +    UNUSED_PARAM(&createDisplayNamesConstructor);
 +#endif
 #if HAVE(ICU_U_LIST_FORMATTER)
-     putDirectWithoutTransition(vm, vm.propertyNames->ListFormat, createListFormatConstructor(vm, this), static_cast<unsigned>(PropertyAttribute::DontEnum));
- #else
+     if (Options::useIntlDurationFormat())
+         putDirectWithoutTransition(vm, vm.propertyNames->DurationFormat, createDurationFormatConstructor(vm, this), static_cast<unsigned>(PropertyAttribute::DontEnum));
 diff --git a/Source/cmake/OptionsGTK.cmake b/Source/cmake/OptionsGTK.cmake
-index 5e653a9e0b5a..0977f2c49037 100644
+index 526fe7cfe0cf..7b057f87b67e 100644
 --- a/Source/cmake/OptionsGTK.cmake
 +++ b/Source/cmake/OptionsGTK.cmake
-@@ -19,7 +19,7 @@ find_package(Freetype 2.4.2 REQUIRED)
+@@ -18,7 +18,7 @@ find_package(Fontconfig 2.13.0 REQUIRED)
+ find_package(Freetype 2.9.0 REQUIRED)
 find_package(LibGcrypt 1.6.0 REQUIRED)
- find_package(GLIB 2.56.4 REQUIRED COMPONENTS gio gio-unix gobject gthread gmodule)
- find_package(HarfBuzz 0.9.18 REQUIRED COMPONENTS ICU)
+ find_package(HarfBuzz 1.4.2 REQUIRED COMPONENTS ICU)
 -find_package(ICU 61.2 REQUIRED COMPONENTS data i18n uc)
-+find_package(ICU 60.2 REQUIRED COMPONENTS data i18n uc)
+find_package(ICU 60 REQUIRED COMPONENTS data i18n uc)
 find_package(JPEG REQUIRED)
+ find_package(LibEpoxy 1.4.0 REQUIRED)
 find_package(LibXml2 2.8.0 REQUIRED)
- find_package(PNG REQUIRED)
-- 
-2.31.1
-
--- a/SOURCES/webkitgtk-2.38.5.tar.xz.asc
+++ b/SOURCES/webkitgtk-2.38.5.tar.xz.asc
@ -1,6 +0,0 @@
-----BEGIN PGP SIGNATURE-----
-
-iF0EABEDAB0WIQTX/PYc+aLeqzHYG9Pz0yLQ7EWCwwUCY+yu2QAKCRDz0yLQ7EWC
-w7UkAKCS0EoptKZRn3/Z+WgGerHQEQXaFQCg51h2++dwb1bqVZ05Q1YtHmoT2gk=
-=or/S
-----END PGP SIGNATURE-----
--- a/SOURCES/webkitgtk-2.42.5.tar.xz.asc
+++ b/SOURCES/webkitgtk-2.42.5.tar.xz.asc
@ -0,0 +1,6 @@
+-----BEGIN PGP SIGNATURE-----
+
+iF0EABECAB0WIQTX/PYc+aLeqzHYG9Pz0yLQ7EWCwwUCZcCvFAAKCRDz0yLQ7EWC
+w1FoAJ9+JY5XpvsElI4nSgXhLk3k6O7L5QCeNx1Hj5iFlSDQY17oYfa4FyMEI9I=
+=NxQN
+-----END PGP SIGNATURE-----
--- a/SPECS/webkit2gtk3.spec
+++ b/SPECS/webkit2gtk3.spec
@ -6,8 +6,8 @@
        cp -p %1 _license_files/$(echo '%1' | sed -e 's!/!.!g')

 Name:           webkit2gtk3
-Version:        2.38.5
-Release:        1%{?dist}.4
+Version:        2.42.5
+Release:        1%{?dist}
 Summary:        GTK Web content engine library

 License:        LGPLv2
@ -25,23 +25,30 @@ Patch0:         evolution-shared-secondary-process.patch
 # https://bugs.webkit.org/show_bug.cgi?id=235367
 Patch1:         icu60.patch

-# https://bugzilla.redhat.com/show_bug.cgi?id=2209208
-Patch2:         CVE-2023-28204.patch
-# https://bugzilla.redhat.com/show_bug.cgi?id=2185745
-Patch3:         CVE-2023-28205.patch
-# https://bugzilla.redhat.com/show_bug.cgi?id=2209214
-Patch4:         CVE-2023-32373.patch
+# Partial revert of https://commits.webkit.org/256284@main
+Patch2:         gstreamer-1.16.1.patch
+
+# Partial revert of https://commits.webkit.org/260744@main
+Patch3:         cairo-1.15.patch
+
+# Avoid dependency on GEnumClass_autoptr
+Patch4:         glib-2.56.patch
+
+# https://bugs.webkit.org/show_bug.cgi?id=268739
+Patch5:          i686-build.patch

 BuildRequires:  bison
 BuildRequires:  cmake
 BuildRequires:  flex
 BuildRequires:  gcc-c++
+BuildRequires:  gcc-toolset-13
 BuildRequires:  gettext
 BuildRequires:  git
 BuildRequires:  gperf
 BuildRequires:  hyphen-devel
 BuildRequires:  libatomic
 BuildRequires:  ninja-build
+BuildRequires:  openssl-devel
 BuildRequires:  perl(English)
 BuildRequires:  perl(FindBin)
 BuildRequires:  perl(JSON::PP)
@ -49,6 +56,8 @@ BuildRequires:  python3
 BuildRequires:  ruby
 BuildRequires:  rubygem-json
 BuildRequires:  rubygems
+BuildRequires:  shadow-utils
+BuildRequires:  unifdef

 BuildRequires:  pkgconfig(atspi-2)
 BuildRequires:  pkgconfig(cairo)
@ -59,18 +68,20 @@ BuildRequires:  pkgconfig(enchant)
 %else
 BuildRequires:  pkgconfig(enchant-2)
 %endif
+BuildRequires:  pkgconfig(epoxy)
 BuildRequires:  pkgconfig(fontconfig)
 BuildRequires:  pkgconfig(freetype2)
-BuildRequires:  pkgconfig(gl)
+BuildRequires:  pkgconfig(gbm)
 BuildRequires:  pkgconfig(glib-2.0)
-BuildRequires:  pkgconfig(glesv2)
 BuildRequires:  pkgconfig(gobject-introspection-1.0)
 BuildRequires:  pkgconfig(gstreamer-1.0)
+BuildRequires:  pkgconfig(gstreamer-plugins-bad-1.0)
 BuildRequires:  pkgconfig(gstreamer-plugins-base-1.0)
 BuildRequires:  pkgconfig(gtk+-3.0)
 BuildRequires:  pkgconfig(harfbuzz)
 BuildRequires:  pkgconfig(icu-uc)
 BuildRequires:  pkgconfig(lcms2)
+BuildRequires:  pkgconfig(libdrm)
 BuildRequires:  pkgconfig(libjpeg)
 BuildRequires:  pkgconfig(libnotify)
 BuildRequires:  pkgconfig(libopenjp2)
@ -94,6 +105,9 @@ BuildRequires:  pkgconfig(wpe-1.0)
 BuildRequires:  pkgconfig(wpebackend-fdo-1.0)
 BuildRequires:  pkgconfig(xt)

+# libepoxy will crash when WebKit tries using GLES2 if it's not installed.
+Requires:       libGLES
+
 # If Geoclue is not running, the geolocation API will not work.
 Recommends:     geoclue2

@ -191,18 +205,27 @@ rm -rf Source/ThirdParty/qunit/
 %global optflags %(echo %{optflags} | sed 's/-g /-g1 /')
 %endif

-# bmalloc and JIT are disabled on aarch64 only in RHEL because of the nonstandard
-# page size that's causing problems there. WebKit's build system sets appropriate
-# defaults for all other architectures, and all other distros except RHEL.
+# The system GCC is too old to build WebKit, so use a GCC Toolset instead.
+# This prints warnings complaining that it should not be used except in
+# SCL scriplets, but I can't figure out any other way to make it work.
+source scl_source enable gcc-toolset-13
+
+# -DUSE_SYSTEM_MALLOC=ON is really bad for security, but libpas requires
+# __atomic_compare_exchange_16 which does not seem to be available.
 mkdir -p %{_target_platform}
 pushd %{_target_platform}
 %cmake \
  -GNinja \
  -DPORT=GTK \
  -DCMAKE_BUILD_TYPE=Release \
+  -DUSE_SYSTEM_MALLOC=ON \
+  -DENABLE_JIT=OFF \
  -DENABLE_BUBBLEWRAP_SANDBOX=OFF \
  -DUSE_SOUP2=ON \
+  -DUSE_AVIF=OFF \
  -DENABLE_DOCUMENTATION=OFF \
+  -DUSE_GSTREAMER_TRANSCODER=OFF \
+  -DUSE_JPEGXL=OFF \
  -DENABLE_GAMEPAD=OFF \
 %if 0%{?rhel}
 %ifarch aarch64
@ -219,12 +242,11 @@ export NINJA_STATUS="[%f/%t][%e] "
 %install
 %ninja_install -C %{_target_platform}

-%find_lang WebKit2GTK-4.0
+%find_lang WebKitGTK-4.0

 # Finally, copy over and rename various files for %%license inclusion
 %add_to_license_files Source/JavaScriptCore/COPYING.LIB
 %add_to_license_files Source/ThirdParty/ANGLE/LICENSE
-%add_to_license_files Source/ThirdParty/ANGLE/src/common/third_party/smhasher/LICENSE
 %add_to_license_files Source/ThirdParty/ANGLE/src/third_party/libXNVCtrl/LICENSE
 %add_to_license_files Source/WebCore/LICENSE-APPLE
 %add_to_license_files Source/WebCore/LICENSE-LGPL-2
@ -236,7 +258,7 @@ export NINJA_STATUS="[%f/%t][%e] "
 %add_to_license_files Source/WTF/wtf/dtoa/COPYING
 %add_to_license_files Source/WTF/wtf/dtoa/LICENSE

-%files -f WebKit2GTK-4.0.lang
+%files -f WebKitGTK-4.0.lang
 %license _license_files/*ThirdParty*
 %license _license_files/*WebCore*
 %license _license_files/*WebInspectorUI*
@ -280,6 +302,41 @@ export NINJA_STATUS="[%f/%t][%e] "
 %{_datadir}/gir-1.0/JavaScriptCore-4.0.gir

 %changelog
+* Mon Feb 05 2024 Michael Catanzaro <mcatanzaro@redhat.com> - 2.42.5-1
+- Update to 2.42.5
+  Resolves: RHEL-3961
+
+* Fri Dec 15 2023 Michael Catanzaro <mcatanzaro@redhat.com> - 2.42.4-1
+- Update to 2.42.4
+  Resolves: RHEL-3961
+  Resolves: RHEL-19365
+
+* Tue Dec 05 2023 Michael Catanzaro <mcatanzaro@redhat.com> - 2.42.3-1
+- Update to 2.42.3
+  Resolves: RHEL-3961
+
+* Fri Nov 10 2023 Michael Catanzaro <mcatanzaro@redhat.com> - 2.42.2-1
+- Update to 2.42.2
+  Resolves: RHEL-3961
+
+* Wed Sep 27 2023 Michael Catanzaro <mcatanzaro@redhat.com> - 2.42.1-1
+- Update to 2.42.1
+  Resolves: RHEL-3961
+
+* Wed Sep 20 2023 Michael Catanzaro <mcatanzaro@redhat.com> - 2.42.0-1
+- Upgrade to 2.42.0
+  Resolves: RHEL-3961
+
+* Tue Aug 01 2023 Michael Catanzaro <mcatanzaro@redhat.com> - 2.40.5-1
+- Upgrade to 2.40.5. Also, disable JIT
+  Resolves: #2176269
+  Resolves: #2185742
+  Resolves: #2209728
+  Resolves: #2209745
+  Resolves: #2218649
+  Resolves: #2218651
+  Resolves: #2224611
+
 * Thu May 25 2023 Michael Catanzaro <mcatanzaro@redhat.com> - 2.38.5-1.4
 - Add patch for CVE-2023-28204
  Resolves: #2209744
Author	SHA1	Message	Date
eabdullin	1790502ac6	Import from AlmaLinux stable repository	2024-05-31 18:15:10 +00:00
eabdullin	858febf09b	import AlmaLinux8 webkit2gtk3-2.40.5-1.el8	2023-12-12 11:26:30 +03:00