wpewebkit: update to 2.52.6, wpebackend-fdo: pull in pending shm fix

libs/wpebackend-fdo/Makefile

@@ -2,7 +2,7 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=wpebackend-fdo
 PKG_VERSION:=1.16.1
-PKG_RELEASE:=1
+PKG_RELEASE:=5
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
 PKG_SOURCE_URL:=https://wpewebkit.org/releases

libs/wpebackend-fdo/patches/001-shm-do-not-export-stale-buffer-on-commit-without-attach.patch

@@ -0,0 +1,74 @@
+From 38cbc2156017aaabd1a176b15dc660c820676a4c Mon Sep 17 00:00:00 2001
+From: Mirko Vogt <foss@mirko.in>
+Date: Sat, 18 Jul 2026 21:58:31 +0000
+Subject: [PATCH] ws: do not export a stale buffer on a commit without attach
+
+Surface::shmBuffer (and, in the EGL implementation, also dmabufBuffer)
+is set at wl_surface.attach and was never cleared: a commit without a
+fresh attach - e.g. one issued only for frame-callback pacing -
+re-exported the previous buffer pointer. Once the client had destroyed
+that buffer after its release, the embedder received a dangling
+wl_shm_buffer whose metadata reads as garbage (observed as negative
+width/stride crashing cog's drm renderer copy loop).
+
+Consume the attached buffer state at commit and export nothing when no
+buffer was attached. Apply to both ImplSHM and ImplEGL - the code is
+duplicated between ws-shm.cpp and ws-egl.cpp.
+
+Signed-off-by: Mirko Vogt <foss@mirko.in>
+---
+ src/ws-egl.cpp | 18 ++++++++++++++----
+ src/ws-shm.cpp | 15 +++++++++++++--
+ 2 files changed, 27 insertions(+), 6 deletions(-)
+
+--- a/src/ws-egl.cpp
++++ b/src/ws-egl.cpp
+@@ -102,10 +102,20 @@ void ImplEGL::surfaceCommit(Surface& sur
+     struct wl_resource* bufferResource = surface.bufferResource;
+     surface.bufferResource = nullptr;
+
+-    if (surface.dmabufBuffer)
+-        surface.apiClient->exportLinuxDmabuf(surface.dmabufBuffer);
+-    else if (surface.shmBuffer)
+-        surface.apiClient->exportShmBuffer(bufferResource, surface.shmBuffer);
++    // Consume the buffer state (see ws-shm.cpp): stale dmabuf/shm pointers
++    // must never be re-exported on a commit without a fresh attach.
++    const struct linux_dmabuf_buffer* dmabufBuffer = surface.dmabufBuffer;
++    surface.dmabufBuffer = nullptr;
++    struct wl_shm_buffer* shmBuffer = surface.shmBuffer;
++    surface.shmBuffer = nullptr;
++
++    if (!bufferResource)
++        return;
++
++    if (dmabufBuffer)
++        surface.apiClient->exportLinuxDmabuf(dmabufBuffer);
++    else if (shmBuffer)
++        surface.apiClient->exportShmBuffer(bufferResource, shmBuffer);
+     else
+         surface.apiClient->exportBufferResource(bufferResource);
+ }
+--- a/src/ws-shm.cpp
++++ b/src/ws-shm.cpp
+@@ -47,8 +47,19 @@ void ImplSHM::surfaceCommit(Surface& sur
+     struct wl_resource* bufferResource = surface.bufferResource;
+     surface.bufferResource = nullptr;
+
+-    if (surface.shmBuffer)
+-        surface.apiClient->exportShmBuffer(bufferResource, surface.shmBuffer);
++    // Consume the buffer state: it belongs to the buffer attached for THIS
++    // commit. Leaving it set would re-export a stale - and, once the client
++    // destroyed the released buffer, dangling - pointer on a commit that
++    // did not attach a new buffer (e.g. a commit issued only for
++    // frame-callback pacing), handing the embedder garbage metadata.
++    struct wl_shm_buffer* shmBuffer = surface.shmBuffer;
++    surface.shmBuffer = nullptr;
++
++    if (!bufferResource)
++        return;
++
++    if (shmBuffer)
++        surface.apiClient->exportShmBuffer(bufferResource, shmBuffer);
+     else
+         surface.apiClient->exportBufferResource(bufferResource);
+ }

libs/wpewebkit/Makefile

@@ -1,12 +1,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=wpewebkit
-PKG_VERSION:=2.52.3
+PKG_VERSION:=2.52.6
 PKG_RELEASE:=1
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
 PKG_SOURCE_URL:=https://wpewebkit.org/releases
-PKG_HASH:=b51b1db1e6ee99d1771f4a358c128fde27a77984df20ee6cb59858e520662d0b
+PKG_HASH:=b2bafef2751625b7fdf530f230ff0f542ff0eeba3590c3a989d931b2a55c858e
 
 PKG_MAINTAINER:=Daniel Golle <daniel@makrotopia.org>
 PKG_LICENSE:=LGPL-2.1-or-later BSD-2-Clause

libs/wpewebkit/patches/131-JavaScriptCore-forward-MacroAssemblerRISCV64-header.patch

@@ -1,5 +1,8 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Daniel Golle <daniel@makrotopia.org>
-Subject: [PATCH] JavaScriptCore: forward MacroAssemblerRISCV64.h and friends to PrivateHeaders
+Date: Sat, 9 May 2026 01:37:44 +0100
+Subject: [PATCH] JavaScriptCore: forward MacroAssemblerRISCV64.h and friends
+ to PrivateHeaders
 
 JSC's CMakeLists copies a curated list of assembler headers into
 PrivateHeaders/JavaScriptCore/ so that external consumers (WebCore,
@@ -27,9 +30,15 @@ Add the three RISCV64 headers to the forwarding-headers list, matching
 what is already done for the other architectures.
 
 Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+---
+ Source/JavaScriptCore/CMakeLists.txt | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/Source/JavaScriptCore/CMakeLists.txt b/Source/JavaScriptCore/CMakeLists.txt
+index 16110d15..b6b47d18 100644
 --- a/Source/JavaScriptCore/CMakeLists.txt
 +++ b/Source/JavaScriptCore/CMakeLists.txt
-@@ -609,7 +609,10 @@ set(JavaScriptCore_PRIVATE_FRAMEWORK_HEA
+@@ -626,7 +626,10 @@ set(JavaScriptCore_PRIVATE_FRAMEWORK_HEADERS
      assembler/MacroAssemblerARMv7.h
      assembler/MacroAssemblerCodeRef.h
      assembler/MacroAssemblerHelpers.h
@@ -40,3 +49,6 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
      assembler/MaxFrameExtentForSlowPathCall.h
      assembler/OSCheck.h
      assembler/Printer.h
+-- 
+2.55.0
+

libs/wpewebkit/patches/141-JavaScriptCore-BBQJIT-gate-canTierUpToOMG.patch

@@ -1,6 +1,30 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Sat, 9 May 2026 01:37:44 +0100
+Subject: [PATCH] JavaScriptCore: BBQJIT: gate canTierUpToOMG on
+ WEBASSEMBLY_OMGJIT
+
+BBQJIT::canTierUpToOMG() can be reached on architectures where the
+OMG/FTL tier is not compiled in at all (RISCV64 currently has no OMG
+JIT). Make it return false directly when !ENABLE(WEBASSEMBLY_OMGJIT),
+before touching Options::useOMGJIT() or any other OMG-only state.
+
+emitEntryTierUpCheck()'s non-OMG branch previously hit
+RELEASE_ASSERT_NOT_REACHED() unconditionally. canTierUpToOMG() is
+gated only on per-function thresholds, not on whether OMG itself is
+compiled in, so it can still legitimately return true here; skip
+emitting the tier-up counter check silently instead of aborting.
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+---
+ Source/JavaScriptCore/wasm/WasmBBQJIT.cpp | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/Source/JavaScriptCore/wasm/WasmBBQJIT.cpp b/Source/JavaScriptCore/wasm/WasmBBQJIT.cpp
+index 5bb5491e..a210845f 100644
 --- a/Source/JavaScriptCore/wasm/WasmBBQJIT.cpp
 +++ b/Source/JavaScriptCore/wasm/WasmBBQJIT.cpp
-@@ -735,6 +735,9 @@ BBQJIT::BBQJIT(CompilationContext& compi
+@@ -747,6 +747,9 @@ BBQJIT::BBQJIT(CompilationContext& compilationContext, const TypeDefinition& sig
 
  bool BBQJIT::canTierUpToOMG() const
  {
@@ -10,15 +34,15 @@
      if (!Options::useOMGJIT())
          return false;
 
-@@ -746,6 +749,7 @@ bool BBQJIT::canTierUpToOMG() const
+@@ -758,6 +761,7 @@ bool BBQJIT::canTierUpToOMG() const
          return false;
      }
      return true;
 +#endif
  }
 
  void BBQJIT::emitIncrementCallProfileCount(unsigned callProfileIndex)
-@@ -3126,7 +3130,10 @@ void BBQJIT::emitEntryTierUpCheck()
+@@ -3138,7 +3142,10 @@ void BBQJIT::emitEntryTierUpCheck()
          jit.jump(tierUpResume);
      });
  #else
@@ -30,3 +54,6 @@
  #endif
  }
 
+-- 
+2.55.0
+

libs/wpewebkit/patches/146-JavaScriptCore-Wasm-BBQ-sext-i32-ccall-args-RISCV64.patch

@@ -1,21 +1,33 @@
---- a/Source/JavaScriptCore/wasm/WasmBBQJIT.h
-+++ b/Source/JavaScriptCore/wasm/WasmBBQJIT.h
-@@ -2032,6 +2032,12 @@ public:
-     template<typename Args>
-     void saveValuesAcrossCallAndPassArguments(const Args& arguments, const CallInformation& callInfo, const TypeDefinition& signature);
-
-+    // On RISC-V the psABI requires 32-bit integer arguments to be sign-extended
-+    // in their 64-bit argument registers; BBQ otherwise zero-extends them when
-+    // loading from canonical i32 slots (lwu). Emit sext.w on any I32 arg that
-+    // ends up in a register. No-op on other architectures.
-+    void emitSignExtendI32ArgsForCCall(const CallInformation& callInfo, const TypeDefinition& signature);
-+
-     void slowPathSpillBindings(const RegisterBindings& bindings);
-     void slowPathRestoreBindings(const RegisterBindings&);
-     void restoreValuesAfterCall(const CallInformation& callInfo);
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Sat, 9 May 2026 01:37:44 +0100
+Subject: [PATCH] JavaScriptCore: RISCV64: sign-extend i32 ccall args in BBQJIT
+
+On RISC-V the lp64d psABI requires 32-bit integer arguments to be
+sign-extended in their 64-bit argument registers by the caller. BBQ's
+saveValuesAcrossCallAndPassArguments otherwise leaves them
+zero-extended when loading from canonical i32 slots (lwu), which
+callees compiled under the psABI assumption (e.g. GCC-compiled C
+helpers doing a signed comparison) misread.
+
+Add BBQJIT::emitSignExtendI32ArgsForCCall(), which walks the call's
+I32 arguments and emits sext.w (via signExtend32To64) on any that
+ended up in a register; a no-op on other architectures. Call it from
+both emitCCall overloads in WasmBBQJIT64.h, right after arguments are
+placed and before the call is materialised.
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+---
+ Source/JavaScriptCore/wasm/WasmBBQJIT.cpp | 20 ++++++++++++++++++++
+ Source/JavaScriptCore/wasm/WasmBBQJIT.h   |  6 ++++++
+ Source/JavaScriptCore/wasm/WasmBBQJIT64.h |  2 ++
+ 3 files changed, 28 insertions(+)
+
+diff --git a/Source/JavaScriptCore/wasm/WasmBBQJIT.cpp b/Source/JavaScriptCore/wasm/WasmBBQJIT.cpp
+index a210845f..785792a5 100644
 --- a/Source/JavaScriptCore/wasm/WasmBBQJIT.cpp
 +++ b/Source/JavaScriptCore/wasm/WasmBBQJIT.cpp
-@@ -4286,6 +4286,26 @@ void BBQJIT::restoreValuesAfterCall(cons
+@@ -4298,6 +4298,26 @@ void BBQJIT::restoreValuesAfterCall(const CallInformation& callInfo)
      // whenever they are next used.
  }
 
@@ -42,21 +54,43 @@
  template<size_t N>
  void BBQJIT::returnValuesFromCall(Vector<Value, N>& results, const FunctionSignature& functionType, const CallInformation& callInfo)
  {
+diff --git a/Source/JavaScriptCore/wasm/WasmBBQJIT.h b/Source/JavaScriptCore/wasm/WasmBBQJIT.h
+index 2e23ad7d..db872fa1 100644
+--- a/Source/JavaScriptCore/wasm/WasmBBQJIT.h
++++ b/Source/JavaScriptCore/wasm/WasmBBQJIT.h
+@@ -2034,6 +2034,12 @@ public:
+     template<typename Args>
+     void saveValuesAcrossCallAndPassArguments(const Args& arguments, const CallInformation& callInfo, const TypeDefinition& signature);
+
++    // On RISC-V the psABI requires 32-bit integer arguments to be sign-extended
++    // in their 64-bit argument registers; BBQ otherwise zero-extends them when
++    // loading from canonical i32 slots (lwu). Emit sext.w on any I32 arg that
++    // ends up in a register. No-op on other architectures.
++    void emitSignExtendI32ArgsForCCall(const CallInformation& callInfo, const TypeDefinition& signature);
++
+     void slowPathSpillBindings(const RegisterBindings& bindings);
+     void slowPathRestoreBindings(const RegisterBindings&);
+     void restoreValuesAfterCall(const CallInformation& callInfo);
+diff --git a/Source/JavaScriptCore/wasm/WasmBBQJIT64.h b/Source/JavaScriptCore/wasm/WasmBBQJIT64.h
+index a42391b8..01ae6061 100644
 --- a/Source/JavaScriptCore/wasm/WasmBBQJIT64.h
 +++ b/Source/JavaScriptCore/wasm/WasmBBQJIT64.h
-@@ -505,6 +505,7 @@ void BBQJIT::emitCCall(Func function, co
+@@ -506,6 +506,7 @@ void BBQJIT::emitCCall(Func function, const Vector<Value, N>& arguments)
      // Preserve caller-saved registers and other info
      prepareForExceptions();
      saveValuesAcrossCallAndPassArguments(arguments, callInfo, *functionType);
 +    emitSignExtendI32ArgsForCCall(callInfo, *functionType);
 
      // Materialize address of native function and call register
      void* taggedFunctionPtr = tagCFunctionPtr<void*, OperationPtrTag>(function);
-@@ -534,6 +535,7 @@ void BBQJIT::emitCCall(Func function, co
+@@ -535,6 +536,7 @@ void BBQJIT::emitCCall(Func function, const Vector<Value, N>& arguments, Value&
      // Preserve caller-saved registers and other info
      prepareForExceptions();
      saveValuesAcrossCallAndPassArguments(arguments, callInfo, *functionType);
 +    emitSignExtendI32ArgsForCCall(callInfo, *functionType);
 
      // Materialize address of native function and call register
      void* taggedFunctionPtr = tagCFunctionPtr<void*, OperationPtrTag>(function);
+-- 
+2.55.0
+