Repository: WebKit/WebKit
Pull request #45447: [Model Element] Require CORS for loading model sources and environment maps
Author: login: achan00
Labels: name: WebKit Misc.
description: For miscellaneous bugs in the WebKit framework (and not JavaScriptCore or WebCore).
Created: 2025-05-15T21:28:16Z | Merged: 2025-05-21T18:31:57Z

#### 74ab595af1f056614e05dd61124a38c7288ca5a3
<pre>
[Model Element] Require CORS for loading model sources and environment maps
<a href="https://bugs.webkit.org/show_bug.cgi?id=293063">https://bugs.webkit.org/show_bug.cgi?id=293063</a>
<a href="https://rdar.apple.com/151364606">rdar://151364606</a>

Reviewed by Youenn Fablet and Anne van Kesteren.

Make sure CORS is always enabled with model source and environment
map requests, by passing a non-null crossorigin attribute to
createPotentialAccessControlRequest().

Also make sure we null out m_model once source is reset.

* LayoutTests/TestExpectations:
* LayoutTests/http/tests/security/model-element/model-element-crossorigin-allowed-with-all-access-header-expected.txt: Added.
* LayoutTests/http/tests/security/model-element/model-element-crossorigin-allowed-with-all-access-header.html: Added.
* LayoutTests/http/tests/security/model-element/model-element-crossorigin-allowed-with-header-expected.txt: Added.
* LayoutTests/http/tests/security/model-element/model-element-crossorigin-allowed-with-header.html: Added.
* LayoutTests/http/tests/security/model-element/model-element-crossorigin-allowed-with-same-origin-expected.txt: Added.
* LayoutTests/http/tests/security/model-element/model-element-crossorigin-allowed-with-same-origin.html: Added.
* LayoutTests/http/tests/security/model-element/model-element-crossorigin-blocked-with-header-expected.txt: Added.
* LayoutTests/http/tests/security/model-element/model-element-crossorigin-blocked-with-header.html: Added.
* LayoutTests/http/tests/security/model-element/model-element-crossorigin-blocked-with-use-credentials-and-all-access-header-expected.txt: Added.
* LayoutTests/http/tests/security/model-element/model-element-crossorigin-blocked-with-use-credentials-and-all-access-header.html: Added.
* LayoutTests/http/tests/security/model-element/model-element-crossorigin-blocked-without-header-expected.txt: Added.
* LayoutTests/http/tests/security/model-element/model-element-crossorigin-blocked-without-header.html: Added.
* LayoutTests/http/tests/security/resources/cube.usdz: Added.
* LayoutTests/http/tests/security/resources/model-access-control.py: Added.
* Source/WebCore/Modules/model-element/HTMLModelElement.cpp:
(WebCore::HTMLModelElement::setSourceURL):
(WebCore::HTMLModelElement::environmentMapRequestResource):

Canonical link: <a href="https://commits.webkit.org/295219@main">https://commits.webkit.org/295219@main</a>
</pre>
<!--EWS-Status-Bubble-Start-->
https://github.com/WebKit/WebKit/commit/2409c48413b3c530ecc2f61b94223ac3648676de

| Misc | iOS, visionOS, tvOS & watchOS  | macOS  | Linux |  Windows |
| ----- | ---------------------- | ------- |  ----- |  --------- |
| [✅ 🧪 style](https://ews-build.webkit.org/#/builders/38/builds/104460 "Passed style check") | [✅ 🛠 ios](https://ews-build.webkit.org/#/builders/131/builds/24169 "Built successfully") | [✅ 🛠 mac](https://ews-build.webkit.org/#/builders/138/builds/14587 "Built successfully") | [✅ 🛠 wpe](https://ews-build.webkit.org/#/builders/5/builds/109667 "Built successfully") | [  ~~🛠 win~~](https://ews-build.webkit.org/#/builders/59/builds/55131 "The change is no longer eligible for processing. Pull Request was already closed when EWS attempted to process it.") 
| [✅ 🧪 bindings](https://ews-build.webkit.org/#/builders/9/builds/106500 "Passed tests") | [✅ 🛠 ios-sim](https://ews-build.webkit.org/#/builders/130/builds/24551 "Built successfully") | [✅ 🛠 mac-AS-debug](https://ews-build.webkit.org/#/builders/123/builds/32714 "Built successfully") | [  ~~🧪 wpe-wk2~~](https://ews-build.webkit.org/#/builders/34/builds/79320 "The change is no longer eligible for processing. Commit was outdated when EWS attempted to process it.") | [  ~~🧪 win-tests~~](https://ews-build.webkit.org/#/builders/59/builds/55131 "The change is no longer eligible for processing. Pull Request was already closed when EWS attempted to process it.") 
| [✅ 🧪 webkitperl](https://ews-build.webkit.org/#/builders/11/builds/107466 "Passed tests") | [✅ 🧪 ios-wk2](https://ews-build.webkit.org/#/builders/132/builds/19094 "Passed tests") | [✅ 🧪 api-mac](https://ews-build.webkit.org/#/builders/18/builds/94282 "Passed tests") | [✅ 🧪 api-wpe](https://ews-build.webkit.org/#/builders/41/builds/59646 "Passed tests") | 
| | [  ~~🧪 ios-wk2-wpt~~](https://ews-build.webkit.org/#/builders/133/builds/18885 "The change is no longer eligible for processing. Pull Request was already closed when EWS attempted to process it.") | [✅ 🧪 mac-wk1](https://ews-build.webkit.org/#/builders/135/builds/12354 "Passed tests") | [❌ 🛠 wpe-cairo](https://ews-build.webkit.org/#/builders/65/builds/54498 "Failed to compile WebKit") | 
| | [  ~~🧪 api-ios~~](https://ews-build.webkit.org/#/builders/13/builds/88586 "The change is no longer eligible for processing. Pull Request was already closed when EWS attempted to process it.") | [✅ 🧪 mac-wk2](https://ews-build.webkit.org/#/builders/136/builds/12412 "Passed tests") | [✅ 🛠 gtk](https://ews-build.webkit.org/#/builders/2/builds/112052 "Built successfully") | 
| | [✅ 🛠 vision](https://ews-build.webkit.org/#/builders/128/builds/31621 "Built successfully") | [  ~~🧪 mac-AS-debug-wk2~~](https://ews-build.webkit.org/#/builders/122/builds/23294 "The change is no longer eligible for processing. Pull Request was already closed when EWS attempted to process it.") | [  ~~🧪 gtk-wk2~~](https://ews-build.webkit.org/#/builders/1/builds/88361 "The change is no longer eligible for processing. Commit was outdated when EWS attempted to process it.") | 
| | [✅ 🛠 vision-sim](https://ews-build.webkit.org/#/builders/121/builds/31985 "Built successfully") | [✅ 🧪 mac-wk2-stress](https://ews-build.webkit.org/#/builders/8/builds/90515 "Passed tests") | [✅ 🧪 api-gtk](https://ews-build.webkit.org/#/builders/21/builds/88026 "Passed tests") | 
| [✅ 🛠 🧪 merge](https://ews-build.webkit.org/#/builders/19/builds/22411 "Built successfully and passed tests") | [✅ 🧪 vision-wk2](https://ews-build.webkit.org/#/builders/126/builds/32919 "Passed tests") | [✅ 🧪 mac-intel-wk2](https://ews-build.webkit.org/#/builders/137/builds/10696 "Passed tests") | [✅ 🛠 playstation](https://ews-build.webkit.org/#/builders/134/builds/26096 "Built successfully") | 
| | [✅ 🛠 tv](https://ews-build.webkit.org/#/builders/127/builds/31548 "Built successfully") | [  ~~🛠 mac-safer-cpp~~](https://ews-build.webkit.org/#/builders/120/builds/36901 "The change is no longer eligible for processing. Pull Request was already closed when EWS attempted to process it.") | | 
| | [✅ 🛠 tv-sim](https://ews-build.webkit.org/#/builders/125/builds/31340 "Built successfully") | | | 
| | [✅ 🛠 watch](https://ews-build.webkit.org/#/builders/129/builds/34679 "Built successfully") | | | 
| | [  ~~🛠 watch-sim~~](https://ews-build.webkit.org/#/builders/124/builds/32900 "The change is no longer eligible for processing. Pull Request was already closed when EWS attempted to process it.") | | | 
<!--EWS-Status-Bubble-End-->


Diff:
diff --git a/LayoutTests/TestExpectations b/LayoutTests/TestExpectations
index 750fc63ef23e..0ce0bc6aab9c 100644
--- a/LayoutTests/TestExpectations
+++ b/LayoutTests/TestExpectations
@@ -105,6 +105,7 @@ http/tests/ssl/curl [ Skip ]
 model-element [ Skip ]
 http/tests/model [ Skip ]
 http/wpt/model-element [ Skip ]
+http/tests/security/model-element [ Skip ]
 system-preview [ Skip ]
 editing/pasteboard/dom-paste [ Skip ]
 editing/pasteboard/mac [ Skip ]
diff --git a/LayoutTests/http/tests/security/model-element/model-element-crossorigin-allowed-with-all-access-header-expected.txt b/LayoutTests/http/tests/security/model-element/model-element-crossorigin-allowed-with-all-access-header-expected.txt
new file mode 100644
index 000000000000..577a8636b8bc
--- /dev/null
+++ b/LayoutTests/http/tests/security/model-element/model-element-crossorigin-allowed-with-all-access-header-expected.txt
@@ -0,0 +1,2 @@
+Verify that the model is allowed because the src allows access from all origins
+
diff --git a/LayoutTests/http/tests/security/model-element/model-element-crossorigin-allowed-with-all-access-header.html b/LayoutTests/http/tests/security/model-element/model-element-crossorigin-allowed-with-all-access-header.html
new file mode 100644
index 000000000000..6f2456a25c86
--- /dev/null
+++ b/LayoutTests/http/tests/security/model-element/model-element-crossorigin-allowed-with-all-access-header.html
@@ -0,0 +1,25 @@
+<!DOCTYPE html> <!-- webkit-test-runner [ ModelElementEnabled=true ModelProcessEnabled=true ] -->
+<html>
+<head>
+<title>&lt;model> allowed since Access-Control-Allow-Origin allows all</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+    if (window.testRunner)
+        testRunner.waitUntilDone();
+
+    window.addEventListener('load', async () => {
+        const model = document.getElementById("allowed-model");
+        assert_true(!!model, "Model element should exist");
+        await model.ready;
+        testRunner.notifyDone();
+    }, false);
+</script>
+</head>
+<body>
+    <div>Verify that the model is allowed because the src allows access from all origins</div>
+    <model id='allowed-model'>
+        <source src='http://localhost:8080/security/resources/model-access-control.py?file=cube.usdz&allowAll'/>
+    </model>
+</body>
+</html>
diff --git a/LayoutTests/http/tests/security/model-element/model-element-crossorigin-allowed-with-header-expected.txt b/LayoutTests/http/tests/security/model-element/model-element-crossorigin-allowed-with-header-expected.txt
new file mode 100644
index 000000000000..61b4c504be6f
--- /dev/null
+++ b/LayoutTests/http/tests/security/model-element/model-element-crossorigin-allowed-with-header-expected.txt
@@ -0,0 +1,2 @@
+Verify that the model is allowed because the src's allowed origin matches this document's origin
+
diff --git a/LayoutTests/http/tests/security/model-element/model-element-crossorigin-allowed-with-header.html b/LayoutTests/http/tests/security/model-element/model-element-crossorigin-allowed-with-header.html
new file mode 100644
index 000000000000..88bf53e60961
--- /dev/null
+++ b/LayoutTests/http/tests/security/model-element/model-element-crossorigin-allowed-with-header.html
@@ -0,0 +1,25 @@
+<!DOCTYPE html> <!-- webkit-test-runner [ ModelElementEnabled=true ModelProcessEnabled=true ] -->
+<html>
+<head>
+<title>&lt;model> allowed since Access-Control-Allow-Origin matches</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+    if (window.testRunner)
+        testRunner.waitUntilDone();
+
+    window.addEventListener('load', async () => {
+        const model = document.getElementById("allowed-model");
+        assert_true(!!model, "Model element should exist");
+        await model.ready;
+        testRunner.notifyDone();
+    }, false);
+</script>
+</head>
+<body>
+    <div>Verify that the model is allowed because the src's allowed origin matches this document's origin</div>
+    <model id='allowed-model'>
+        <source src='http://localhost:8080/security/resources/model-access-control.py?file=cube.usdz&origin=http%3A%2F%2F127.0.0.1%3A8000'/>
+    </model>
+</body>
+</html>
diff --git a/LayoutTests/http/tests/security/model-element/model-element-crossorigin-allowed-with-same-origin-expected.txt b/LayoutTests/http/tests/security/model-element/model-element-crossorigin-allowed-with-same-origin-expected.txt
new file mode 100644
index 000000000000..00ea1217a3f6
--- /dev/null
+++ b/LayoutTests/http/tests/security/model-element/model-element-crossorigin-allowed-with-same-origin-expected.txt
@@ -0,0 +1,2 @@
+Verify that the model is allowed because the src's URL and this document have the same origin
+
diff --git a/LayoutTests/http/tests/security/model-element/model-element-crossorigin-allowed-with-same-origin.html b/LayoutTests/http/tests/security/model-element/model-element-crossorigin-allowed-with-same-origin.html
new file mode 100644
index 000000000000..d51cdb87f174
--- /dev/null
+++ b/LayoutTests/http/tests/security/model-element/model-element-crossorigin-allowed-with-same-origin.html
@@ -0,0 +1,25 @@
+<!DOCTYPE html> <!-- webkit-test-runner [ ModelElementEnabled=true ModelProcessEnabled=true ] -->
+<html>
+<head>
+<title>&lt;model> allowed from same origin</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+    if (window.testRunner)
+        testRunner.waitUntilDone();
+
+    window.addEventListener('load', async () => {
+        const model = document.getElementById("allowed-model");
+        assert_true(!!model, "Model element should exist");
+        await model.ready;
+        testRunner.notifyDone();
+    }, false);
+</script>
+</head>
+<body>
+    <div>Verify that the model is allowed because the src's URL and this document have the same origin</div>
+    <model id='allowed-model'>
+        <source src='http://127.0.0.1:8000/security/resources/model-access-control.py?file=cube.usdz'/>
+    </model>
+</body>
+</html>
diff --git a/LayoutTests/http/tests/security/model-element/model-element-crossorigin-blocked-with-header-expected.txt b/LayoutTests/http/tests/security/model-element/model-element-crossorigin-blocked-with-header-expected.txt
new file mode 100644
index 000000000000..ed5fc4956784
--- /dev/null
+++ b/LayoutTests/http/tests/security/model-element/model-element-crossorigin-blocked-with-header-expected.txt
@@ -0,0 +1,3 @@
+CONSOLE MESSAGE: Origin http://127.0.0.1:8000 is not allowed by Access-Control-Allow-Origin. Status code: 200
+Verify that the model is blocked because the src's allowed origin doesn't match this document's origin
+
diff --git a/LayoutTests/http/tests/security/model-element/model-element-crossorigin-blocked-with-header.html b/LayoutTests/http/tests/security/model-element/model-element-crossorigin-blocked-with-header.html
new file mode 100644
index 000000000000..d338d73088b8
--- /dev/null
+++ b/LayoutTests/http/tests/security/model-element/model-element-crossorigin-blocked-with-header.html
@@ -0,0 +1,28 @@
+<!DOCTYPE html> <!-- webkit-test-runner [ ModelElementEnabled=true ModelProcessEnabled=true ] -->
+<html>
+<head>
+<title>&lt;model> blocked since Access-Control-Allow-Origin does not match</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+    if (window.testRunner)
+        testRunner.waitUntilDone();
+
+    window.addEventListener('load', async () => {
+        const model = document.getElementById("blocked-model");
+        assert_true(!!model, "Model element should exist");
+        await model.ready.then(
+            value => assert_unreached("Unexpected ready promise resolution."),
+            reason => assert_true(reason.toString().includes("NetworkError"), "The ready promise is rejected with a NetworkError.")
+        );
+        testRunner.notifyDone();
+    }, false);
+</script>
+</head>
+<body>
+    <div>Verify that the model is blocked because the src's allowed origin doesn't match this document's origin</div>
+    <model id='blocked-model'>
+        <source src='http://localhost:8080/security/resources/model-access-control.py?file=cube.usdz&origin=http%3A%2F%2Flocalhost%3A8080'/>
+    </model>
+</body>
+</html>
diff --git a/LayoutTests/http/tests/security/model-element/model-element-crossorigin-blocked-with-use-credentials-and-all-access-header-expected.txt b/LayoutTests/http/tests/security/model-element/model-element-crossorigin-blocked-with-use-credentials-and-all-access-header-expected.txt
new file mode 100644
index 000000000000..4c625299493f
--- /dev/null
+++ b/LayoutTests/http/tests/security/model-element/model-element-crossorigin-blocked-with-use-credentials-and-all-access-header-expected.txt
@@ -0,0 +1,3 @@
+CONSOLE MESSAGE: Cannot use wildcard in Access-Control-Allow-Origin when credentials flag is true.
+Verify that the model is blocked even when the src allows access from all origins, if crossorigin is set to use-credentials
+
diff --git a/LayoutTests/http/tests/security/model-element/model-element-crossorigin-blocked-with-use-credentials-and-all-access-header.html b/LayoutTests/http/tests/security/model-element/model-element-crossorigin-blocked-with-use-credentials-and-all-access-header.html
new file mode 100644
index 000000000000..9c1b3bab097a
--- /dev/null
+++ b/LayoutTests/http/tests/security/model-element/model-element-crossorigin-blocked-with-use-credentials-and-all-access-header.html
@@ -0,0 +1,28 @@
+<!DOCTYPE html> <!-- webkit-test-runner [ ModelElementEnabled=true ModelProcessEnabled=true ] -->
+<html>
+<head>
+<title>&lt;model> blocked with use-credentials crossorigin and Access-Control-Allow-Origin allows all</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+    if (window.testRunner)
+        testRunner.waitUntilDone();
+
+    window.addEventListener('load', async () => {
+        const model = document.getElementById("blocked-model");
+        assert_true(!!model, "Model element should exist");
+        await model.ready.then(
+            value => assert_unreached("Unexpected ready promise resolution."),
+            reason => assert_true(reason.toString().includes("NetworkError"), "The ready promise is rejected with a NetworkError.")
+        );
+        testRunner.notifyDone();
+    }, false);
+</script>
+</head>
+<body>
+    <div>Verify that the model is blocked even when the src allows access from all origins, if crossorigin is set to use-credentials</div>
+    <model id='blocked-model' crossorigin='use-credentials'>
+        <source src='http://localhost:8080/security/resources/model-access-control.py?file=cube.usdz&allowAll'/>
+    </model>
+</body>
+</html>
diff --git a/LayoutTests/http/tests/security/model-element/model-element-crossorigin-blocked-without-header-expected.txt b/LayoutTests/http/tests/security/model-element/model-element-crossorigin-blocked-without-header-expected.txt
new file mode 100644
index 000000000000..4d62158e165e
--- /dev/null
+++ b/LayoutTests/http/tests/security/model-element/model-element-crossorigin-blocked-without-header-expected.txt
@@ -0,0 +1,3 @@
+CONSOLE MESSAGE: Origin http://127.0.0.1:8000 is not allowed by Access-Control-Allow-Origin. Status code: 200
+Verify that the model is blocked because the src's URL's port number doesn't match this document's origin
+
diff --git a/LayoutTests/http/tests/security/model-element/model-element-crossorigin-blocked-without-header.html b/LayoutTests/http/tests/security/model-element/model-element-crossorigin-blocked-without-header.html
new file mode 100644
index 000000000000..ea293681aaa8
--- /dev/null
+++ b/LayoutTests/http/tests/security/model-element/model-element-crossorigin-blocked-without-header.html
@@ -0,0 +1,28 @@
+<!DOCTYPE html> <!-- webkit-test-runner [ ModelElementEnabled=true ModelProcessEnabled=true ] -->
+<html>
+<head>
+<title>&lt;model> blocked from different origin</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+    if (window.testRunner)
+        testRunner.waitUntilDone();
+
+    window.addEventListener('load', async () => {
+        const model = document.getElementById("blocked-model");
+        assert_true(!!model, "Model element should exist");
+        await model.ready.then(
+            value => assert_unreached("Unexpected ready promise resolution."),
+            reason => assert_true(reason.toString().includes("NetworkError"), "The ready promise is rejected with a NetworkError.")
+        );
+        testRunner.notifyDone();
+    }, false);
+</script>
+</head>
+<body>
+    <div>Verify that the model is blocked because the src's URL's port number doesn't match this document's origin</div>
+    <model id='blocked-model'>
+        <source src='http://localhost:8080/security/resources/model-access-control.py?file=cube.usdz'/>
+    </model>
+</body>
+</html>
diff --git a/LayoutTests/http/tests/security/resources/cube.usdz b/LayoutTests/http/tests/security/resources/cube.usdz
new file mode 100644
index 000000000000..c7426e8ea992
Binary files /dev/null and b/LayoutTests/http/tests/security/resources/cube.usdz differ
diff --git a/LayoutTests/http/tests/security/resources/model-access-control.py b/LayoutTests/http/tests/security/resources/model-access-control.py
new file mode 100755
index 000000000000..6e953927a0b1
--- /dev/null
+++ b/LayoutTests/http/tests/security/resources/model-access-control.py
@@ -0,0 +1,19 @@
+#!/usr/bin/env python3
+
+import os
+import sys
+from urllib.parse import parse_qs
+
+query = parse_qs(os.environ.get('QUERY_STRING', ''), keep_blank_values=True)
+allowAll = True if query.get('allowAll', [None])[0] is not None else False
+origin = True if query.get('origin', [None])[0] is not None else False
+
+if origin:
+    sys.stdout.write('Access-Control-Allow-Origin: {}\r\n'.format(query.get('origin', [''])[0]))
+elif allowAll:
+    sys.stdout.write('Access-Control-Allow-Origin: *\r\n')
+sys.stdout.write('Content-Type: model/vnd.usdz+zip\r\n\r\n')
+
+sys.stdout.flush()
+with open(os.path.join(os.path.dirname(__file__), query.get('file', [''])[0]), 'rb') as file:
+    sys.stdout.buffer.write(file.read())
diff --git a/Source/WebCore/Modules/model-element/HTMLModelElement.cpp b/Source/WebCore/Modules/model-element/HTMLModelElement.cpp
index 22ceb0b3674c..38c8f5af8b97 100644
--- a/Source/WebCore/Modules/model-element/HTMLModelElement.cpp
+++ b/Source/WebCore/Modules/model-element/HTMLModelElement.cpp
@@ -52,6 +52,7 @@
 #include "JSHTMLModelElementCamera.h"
 #include "LayoutRect.h"
 #include "LayoutSize.h"
+#include "LegacySchemeRegistry.h"
 #include "Logging.h"
 #include "MIMETypeRegistry.h"
 #include "Model.h"
@@ -187,6 +188,25 @@ void HTMLModelElement::sourcesChanged()
     setSourceURL(selectModelSource());
 }
 
+CachedResourceRequest HTMLModelElement::createResourceRequest(const URL& resourceURL, FetchOptions::Destination destination)
+{
+    ResourceLoaderOptions options = CachedResourceLoader::defaultCachedResourceOptions();
+    options.destination = destination;
+    options.sameOriginDataURLFlag = SameOriginDataURLFlag::Set;
+
+    auto crossOriginAttribute = parseCORSSettingsAttribute(attributeWithoutSynchronization(HTMLNames::crossoriginAttr));
+    // Make sure CORS is always enabled by passing a non-null cross origin attribute
+    if (crossOriginAttribute.isNull()) {
+        auto documentOrigin = protectedDocument()->protectedSecurityOrigin();
+        if (LegacySchemeRegistry::shouldTreatURLSchemeAsCORSEnabled(documentOrigin->protocol()) || documentOrigin->protocol() != resourceURL.protocol())
+            crossOriginAttribute = "anonymous"_s;
+    }
+    auto request = createPotentialAccessControlRequest(ResourceRequest { URL { resourceURL } }, WTFMove(options), document(), crossOriginAttribute);
+    request.setInitiator(*this);
+
+    return request;
+}
+
 void HTMLModelElement::setSourceURL(const URL& url)
 {
     if (url == m_sourceURL)
@@ -196,6 +216,7 @@ void HTMLModelElement::setSourceURL(const URL& url)
 
     m_data.reset();
     m_dataComplete = false;
+    m_model = nullptr;
 
     if (m_resource) {
         m_resource->removeClient(*this);
@@ -221,14 +242,7 @@ void HTMLModelElement::setSourceURL(const URL& url)
         return;
     }
 
-    ResourceLoaderOptions options = CachedResourceLoader::defaultCachedResourceOptions();
-    options.destination = FetchOptions::Destination::Model;
-    // FIXME: Set other options.
-
-    auto crossOriginAttribute = parseCORSSettingsAttribute(attributeWithoutSynchronization(HTMLNames::crossoriginAttr));
-    auto request = createPotentialAccessControlRequest(ResourceRequest { URL { m_sourceURL } }, WTFMove(options), document(), crossOriginAttribute);
-    request.setInitiator(*this);
-
+    auto request = createResourceRequest(m_sourceURL, FetchOptions::Destination::Model);
     auto resource = document().protectedCachedResourceLoader()->requestModelResource(WTFMove(request));
     if (!resource.has_value()) {
         ActiveDOMObject::queueTaskToDispatchEvent(*this, TaskSource::DOMManipulation, Event::create(eventNames().errorEvent, Event::CanBubble::No, Event::IsCancelable::No));
@@ -1012,13 +1026,7 @@ URL HTMLModelElement::selectEnvironmentMapURL() const
 
 void HTMLModelElement::environmentMapRequestResource()
 {
-    ResourceLoaderOptions options = CachedResourceLoader::defaultCachedResourceOptions();
-    options.destination = FetchOptions::Destination::Environmentmap;
-
-    auto crossOriginAttribute = parseCORSSettingsAttribute(attributeWithoutSynchronization(HTMLNames::crossoriginAttr));
-    auto request = createPotentialAccessControlRequest(ResourceRequest { URL { m_environmentMapURL } }, WTFMove(options), document(), crossOriginAttribute);
-    request.setInitiator(*this);
-
+    auto request = createResourceRequest(m_environmentMapURL, FetchOptions::Destination::Environmentmap);
     auto resource = document().protectedCachedResourceLoader()->requestEnvironmentMapResource(WTFMove(request));
     if (!resource.has_value()) {
         if (!m_environmentMapReadyPromise->isFulfilled())
diff --git a/Source/WebCore/Modules/model-element/HTMLModelElement.h b/Source/WebCore/Modules/model-element/HTMLModelElement.h
index 2092489b55d7..f0853cfa1431 100644
--- a/Source/WebCore/Modules/model-element/HTMLModelElement.h
+++ b/Source/WebCore/Modules/model-element/HTMLModelElement.h
@@ -49,6 +49,7 @@
 
 namespace WebCore {
 
+class CachedResourceRequest;
 class DOMMatrixReadOnly;
 class DOMPointReadOnly;
 class Event;
@@ -197,6 +198,8 @@ class HTMLModelElement final : public HTMLElement, private CachedRawResourceClie
 
     HTMLModelElement& readyPromiseResolve();
 
+    CachedResourceRequest createResourceRequest(const URL&, FetchOptions::Destination);
+
     // ActiveDOMObject.
     bool virtualHasPendingActivity() const final;
 


Reviews:
user: login: annevk
body: This looks good to me, but let's wait for Youenn as well to be sure.
state: APPROVED
author_association: CONTRIBUTOR
submitted_at: 2025-05-16T08:00:04Z
user: login: youennf
body: LGTM with a test where load would fail.
state: APPROVED
author_association: CONTRIBUTOR
submitted_at: 2025-05-16T08:04:41Z
user: login: youennf
body: LGTM.
If you have some time, we could add a few additional tests:
- a data URL load from a HTTP origin (should succeed)
- a blob URL load from a HTTP origin (should succeed)
- a file URL load from a file origin (should succeed)
- a file URL load with a crossorigin attribute (whatever value, should fail)
- a HTTP URL load with an empty crossorigin attribute (should be the same as anonymous).

state: APPROVED
author_association: CONTRIBUTOR
submitted_at: 2025-05-21T06:40:26Z
user: login: achan00
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-21T16:46:00Z
user: login: achan00
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-21T16:49:31Z

Review comments:
diff_hunk: @@ -187,6 +188,22 @@ void HTMLModelElement::sourcesChanged()
     setSourceURL(selectModelSource());
 }
 
+CachedResourceRequest HTMLModelElement::createResourceRequest(const URL& resourceURL, const FetchOptions::Destination& destination)
path: Source/WebCore/Modules/model-element/HTMLModelElement.cpp
user: login: youennf
body: ```suggestion
CachedResourceRequest HTMLModelElement::createResourceRequest(const URL& resourceURL, FetchOptions::Destination destination)
```
created_at: 2025-05-21T06:34:52Z
author_association: CONTRIBUTOR
diff_hunk: @@ -187,6 +188,22 @@ void HTMLModelElement::sourcesChanged()
     setSourceURL(selectModelSource());
 }
 
+CachedResourceRequest HTMLModelElement::createResourceRequest(const URL& resourceURL, const FetchOptions::Destination& destination)
path: Source/WebCore/Modules/model-element/HTMLModelElement.cpp
user: login: achan00
body: I'll add more tests in a separate PR.
created_at: 2025-05-21T16:46:00Z
author_association: CONTRIBUTOR
diff_hunk: @@ -187,6 +188,22 @@ void HTMLModelElement::sourcesChanged()
     setSourceURL(selectModelSource());
 }
 
+CachedResourceRequest HTMLModelElement::createResourceRequest(const URL& resourceURL, const FetchOptions::Destination& destination)
path: Source/WebCore/Modules/model-element/HTMLModelElement.cpp
user: login: achan00
body: Filed: https://bugs.webkit.org/show_bug.cgi?id=293371 (Add more tests around model source loading across different origins)
created_at: 2025-05-21T16:49:31Z
author_association: CONTRIBUTOR

PR comments:
user: login: webkit-early-warning-system
created_at: 2025-05-15T21:28:25Z
body: EWS run on previous version of this PR (hash https://github.com/WebKit/WebKit/commit/c45724a91d38a31772cac7b1803d05454c9b7454)<details>

| Misc | iOS, visionOS, tvOS & watchOS  | macOS  | Linux |  Windows |
| ----- | ---------------------- | ------- |  ----- |  --------- |
| [✅ 🧪 style](https://ews-build.webkit.org/#/builders/38/builds/103689 "Passed style check") | [✅ 🛠 ios](https://ews-build.webkit.org/#/builders/131/builds/23391 "Built successfully") | [✅ 🛠 mac](https://ews-build.webkit.org/#/builders/138/builds/13711 "Built successfully") | [  ~~🛠 wpe~~](https://ews-build.webkit.org/#/builders/5/builds/108879 "The change is no longer eligible for processing. Commit was outdated when EWS attempted to process it.") | [  ~~🛠 win~~](https://ews-build.webkit.org/#/builders/59/builds/54341 "The change is no longer eligible for processing. Commit was outdated when EWS attempted to process it.") 
| [✅ 🧪 bindings](https://ews-build.webkit.org/#/builders/9/builds/105729 "Passed tests") | [✅ 🛠 ios-sim](https://ews-build.webkit.org/#/builders/130/builds/23735 "Built successfully") | [✅ 🛠 mac-AS-debug](https://ews-build.webkit.org/#/builders/123/builds/31937 "Built successfully") | [  ~~🧪 wpe-wk2~~](https://ews-build.webkit.org/#/builders/5/builds/108879 "The change is no longer eligible for processing. Commit was outdated when EWS attempted to process it.") | [  ~~🧪 win-tests~~](https://ews-build.webkit.org/#/builders/59/builds/54341 "The change is no longer eligible for processing. Commit was outdated when EWS attempted to process it.") 
| [✅ 🧪 webkitperl](https://ews-build.webkit.org/#/builders/11/builds/106695 "Passed tests") | [  ~~🧪 ios-wk2~~](https://ews-build.webkit.org/#/builders/132/builds/18416 "The change is no longer eligible for processing. Commit was outdated when EWS attempted to process it.") | [  ~~🧪 api-mac~~](https://ews-build.webkit.org/#/builders/18/builds/93540 "The change is no longer eligible for processing. Commit was outdated when EWS attempted to process it.") | [  ~~🧪 api-wpe~~](https://ews-build.webkit.org/#/builders/5/builds/108879 "The change is no longer eligible for processing. Commit was outdated when EWS attempted to process it.") | 
| | [  ~~🧪 ios-wk2-wpt~~](https://ews-build.webkit.org/#/builders/133/builds/18223 "The change is no longer eligible for processing. Commit was outdated when EWS attempted to process it.") | [  ~~🧪 mac-wk1~~](https://ews-build.webkit.org/#/builders/135/builds/11588 "The change is no longer eligible for processing. Commit was outdated when EWS attempted to process it.") | [  ~~🛠 wpe-cairo~~](https://ews-build.webkit.org/#/builders/65/builds/53717 "The change is no longer eligible for processing. Commit was outdated when EWS attempted to process it.") | 
| | [  ~~🧪 api-ios~~](https://ews-build.webkit.org/#/builders/13/builds/88006 "The change is no longer eligible for processing. Commit was outdated when EWS attempted to process it.") | [  ~~🧪 mac-wk2~~](https://ews-build.webkit.org/#/builders/136/builds/11647 "The change is no longer eligible for processing. Commit was outdated when EWS attempted to process it.") | [  ~~🛠 gtk~~](https://ews-build.webkit.org/#/builders/2/builds/111268 "The change is no longer eligible for processing. Commit was outdated when EWS attempted to process it.") | 
| | [✅ 🛠 vision](https://ews-build.webkit.org/#/builders/128/builds/30845 "Built successfully") | [  ~~🧪 mac-AS-debug-wk2~~](https://ews-build.webkit.org/#/builders/122/builds/22745 "The change is no longer eligible for processing. Commit was outdated when EWS attempted to process it.") | [  ~~🧪 gtk-wk2~~](https://ews-build.webkit.org/#/builders/2/builds/111268 "The change is no longer eligible for processing. Commit was outdated when EWS attempted to process it.") | 
| | [✅ 🛠 vision-sim](https://ews-build.webkit.org/#/builders/121/builds/31206 "Built successfully") | [  ~~🧪 mac-wk2-stress~~](https://ews-build.webkit.org/#/builders/8/builds/89741 "The change is no longer eligible for processing. Commit was outdated when EWS attempted to process it.") | [  ~~🧪 api-gtk~~](https://ews-build.webkit.org/#/builders/2/builds/111268 "The change is no longer eligible for processing. Commit was outdated when EWS attempted to process it.") | 
| | [  ~~🧪 vision-wk2~~](https://ews-build.webkit.org/#/builders/126/builds/32309 "The change is no longer eligible for processing. Commit was outdated when EWS attempted to process it.") | [  ~~🧪 mac-intel-wk2~~](https://ews-build.webkit.org/#/builders/137/builds/10041 "The change is no longer eligible for processing. Commit was outdated when EWS attempted to process it.") | [  ~~🛠 playstation~~](https://ews-build.webkit.org/#/builders/134/builds/25202 "The change is no longer eligible for processing. Commit was outdated when EWS attempted to process it.") | 
| | [✅ 🛠 tv](https://ews-build.webkit.org/#/builders/127/builds/30773 "Built successfully") | [✅ 🛠 mac-safer-cpp](https://ews-build.webkit.org/#/builders/120/builds/36076 "Built successfully") | | 
| | [  ~~🛠 tv-sim~~](https://ews-build.webkit.org/#/builders/125/builds/30567 "The change is no longer eligible for processing. Commit was outdated when EWS attempted to process it.") | | | 
| | [✅ 🛠 watch](https://ews-build.webkit.org/#/builders/129/builds/33902 "Built successfully") | | | 
| | [  ~~🛠 watch-sim~~](https://ews-build.webkit.org/#/builders/124/builds/32128 "The change is no longer eligible for processing. Commit was outdated when EWS attempted to process it.") | | | </details>
author_association: COLLABORATOR
user: login: webkit-early-warning-system
created_at: 2025-05-15T21:30:54Z
body: EWS run on previous version of this PR (hash https://github.com/WebKit/WebKit/commit/f57ea62416315f979e6c121c9eb32c337bc1e41c)<details>

| Misc | iOS, visionOS, tvOS & watchOS  | macOS  | Linux |  Windows |
| ----- | ---------------------- | ------- |  ----- |  --------- |
| [✅ 🧪 style](https://ews-build.webkit.org/#/builders/38/builds/103690 "Passed style check") | [✅ 🛠 ios](https://ews-build.webkit.org/#/builders/131/builds/23392 "Built successfully") | [✅ 🛠 mac](https://ews-build.webkit.org/#/builders/138/builds/13712 "Built successfully") | [✅ 🛠 wpe](https://ews-build.webkit.org/#/builders/5/builds/108880 "Built successfully") | [✅ 🛠 win](https://ews-build.webkit.org/#/builders/59/builds/54342 "Built successfully") 
| [✅ 🧪 bindings](https://ews-build.webkit.org/#/builders/9/builds/105730 "Passed tests") | [✅ 🛠 ios-sim](https://ews-build.webkit.org/#/builders/130/builds/23736 "Built successfully") | [✅ 🛠 mac-AS-debug](https://ews-build.webkit.org/#/builders/123/builds/31938 "Built successfully") | [✅ 🧪 wpe-wk2](https://ews-build.webkit.org/#/builders/34/builds/78788 "Passed tests") | [⏳ 🧪 win-tests](https://ews-build.webkit.org/#/builders/Win-Tests-EWS "Waiting to run tests") 
| [✅ 🧪 webkitperl](https://ews-build.webkit.org/#/builders/11/builds/106696 "Passed tests") | [✅ 🧪 ios-wk2](https://ews-build.webkit.org/#/builders/132/builds/18411 "Passed tests") | [✅ 🧪 api-mac](https://ews-build.webkit.org/#/builders/18/builds/93539 "Passed tests") | [✅ 🧪 api-wpe](https://ews-build.webkit.org/#/builders/41/builds/59122 "Passed tests") | 
| | [⏳ 🧪 ios-wk2-wpt](https://ews-build.webkit.org/#/builders/iOS-18-Simulator-WPT-WK2-Tests-EWS "Waiting to run tests") | [✅ 🧪 mac-wk1](https://ews-build.webkit.org/#/builders/135/builds/11587 "Passed tests") | [✅ 🛠 wpe-cairo](https://ews-build.webkit.org/#/builders/65/builds/53718 "Built successfully") | 
| | [⏳ 🧪 api-ios](https://ews-build.webkit.org/#/builders/API-Tests-iOS-Simulator-EWS "Waiting to run tests") | [✅ 🧪 mac-wk2](https://ews-build.webkit.org/#/builders/136/builds/11646 "Passed tests") | [✅ 🛠 gtk](https://ews-build.webkit.org/#/builders/2/builds/111269 "Built successfully") | 
| | [✅ 🛠 vision](https://ews-build.webkit.org/#/builders/128/builds/30846 "Built successfully") | [⏳ 🧪 mac-AS-debug-wk2](https://ews-build.webkit.org/#/builders/macOS-Sequoia-Debug-WK2-Tests-EWS "Waiting to run tests") | [✅ 🧪 gtk-wk2](https://ews-build.webkit.org/#/builders/1/builds/87783 "Passed tests") | 
| | [✅ 🛠 vision-sim](https://ews-build.webkit.org/#/builders/121/builds/31207 "Built successfully") | [✅ 🧪 mac-wk2-stress](https://ews-build.webkit.org/#/builders/8/builds/89740 "Passed tests") | [✅ 🧪 api-gtk](https://ews-build.webkit.org/#/builders/21/builds/87439 "Passed tests") | 
| | [✅ 🧪 vision-wk2](https://ews-build.webkit.org/#/builders/126/builds/32310 "Passed tests") | [⏳ 🧪 mac-intel-wk2](https://ews-build.webkit.org/#/builders/macOS-Sonoma-Release-WK2-Intel-Tests-EWS "Waiting to run tests") | [✅ 🛠 playstation](https://ews-build.webkit.org/#/builders/134/builds/25203 "Built successfully") | 
| | [✅ 🛠 tv](https://ews-build.webkit.org/#/builders/127/builds/30774 "Built successfully") | [✅ 🛠 mac-safer-cpp](https://ews-build.webkit.org/#/builders/120/builds/36077 "Built successfully") | | 
| | [✅ 🛠 tv-sim](https://ews-build.webkit.org/#/builders/125/builds/30568 "Built successfully") | | | 
| | [✅ 🛠 watch](https://ews-build.webkit.org/#/builders/129/builds/33903 "Built successfully") | | | 
| | [✅ 🛠 watch-sim](https://ews-build.webkit.org/#/builders/124/builds/32129 "Built successfully") | | | </details>
author_association: COLLABORATOR
user: login: achan00
created_at: 2025-05-16T03:01:14Z
body: Actually, this is not correct yet. I need to look more into this.
author_association: CONTRIBUTOR
user: login: annevk
created_at: 2025-05-16T06:11:17Z
body: Yeah, this will hit an assert in `createPotentialAccessControlRequest()`. Not sure what @youennf thinks, but one thing that comes to mind is that when `parseCORSSettingsAttribute` returns `nullString()`, you use `"anonymous"_s` instead.
author_association: CONTRIBUTOR
user: login: webkit-early-warning-system
created_at: 2025-05-16T07:56:15Z
body: EWS run on previous version of this PR (hash https://github.com/WebKit/WebKit/commit/0eb5c744b6080417d390c5e1a23fde4668d0491f)<details>

| Misc | iOS, visionOS, tvOS & watchOS  | macOS  | Linux |  Windows |
| ----- | ---------------------- | ------- |  ----- |  --------- |
| [✅ 🧪 style](https://ews-build.webkit.org/#/builders/38/builds/103781 "Passed style check") | [✅ 🛠 ios](https://ews-build.webkit.org/#/builders/131/builds/23483 "Built successfully") | [✅ 🛠 mac](https://ews-build.webkit.org/#/builders/138/builds/13803 "Built successfully") | [✅ 🛠 wpe](https://ews-build.webkit.org/#/builders/5/builds/108972 "Built successfully") | [✅ 🛠 win](https://ews-build.webkit.org/#/builders/59/builds/54433 "Built successfully") 
| [✅ 🧪 bindings](https://ews-build.webkit.org/#/builders/9/builds/105821 "Passed tests") | [✅ 🛠 ios-sim](https://ews-build.webkit.org/#/builders/130/builds/23833 "Built successfully") | [✅ 🛠 mac-AS-debug](https://ews-build.webkit.org/#/builders/123/builds/32029 "Built successfully") | [✅ 🧪 wpe-wk2](https://ews-build.webkit.org/#/builders/34/builds/78846 "Passed tests") | [⏳ 🧪 win-tests](https://ews-build.webkit.org/#/builders/Win-Tests-EWS "Waiting to run tests") 
| [✅ 🧪 webkitperl](https://ews-build.webkit.org/#/builders/11/builds/106787 "Passed tests") | [✅ 🧪 ios-wk2](https://ews-build.webkit.org/#/builders/132/builds/18496 "Passed tests") | [✅ 🧪 api-mac](https://ews-build.webkit.org/#/builders/18/builds/93622 "Passed tests") | [✅ 🧪 api-wpe](https://ews-build.webkit.org/#/builders/41/builds/59180 "Passed tests") | 
| | [✅ 🧪 ios-wk2-wpt](https://ews-build.webkit.org/#/builders/133/builds/18314 "Passed tests") | [✅ 🧪 mac-wk1](https://ews-build.webkit.org/#/builders/135/builds/11671 "Passed tests") | [✅ 🛠 wpe-cairo](https://ews-build.webkit.org/#/builders/65/builds/53809 "Built successfully") | 
| | [  ~~🧪 api-ios~~](https://ews-build.webkit.org/#/builders/13/builds/88076 "Build was cancelled. Recent messages:OS: Sequoia (15.2), Xcode: 16.2; Skipping applying patch since patch_id isn't provided; Checked out pull request; run-api-tests (cancelled)") | [✅ 🧪 mac-wk2](https://ews-build.webkit.org/#/builders/136/builds/11728 "Passed tests") | [✅ 🛠 gtk](https://ews-build.webkit.org/#/builders/2/builds/111361 "Built successfully") | 
| | [✅ 🛠 vision](https://ews-build.webkit.org/#/builders/128/builds/30937 "Built successfully") | [✅ 🧪 mac-AS-debug-wk2](https://ews-build.webkit.org/#/builders/122/builds/22808 "Passed tests") | [✅ 🧪 gtk-wk2](https://ews-build.webkit.org/#/builders/1/builds/87848 "Passed tests") | 
| | [✅ 🛠 vision-sim](https://ews-build.webkit.org/#/builders/121/builds/31298 "Built successfully") | [✅ 🧪 mac-wk2-stress](https://ews-build.webkit.org/#/builders/8/builds/89823 "Passed tests") | [✅ 🧪 api-gtk](https://ews-build.webkit.org/#/builders/21/builds/87502 "Passed tests") | 
| | [✅ 🧪 vision-wk2](https://ews-build.webkit.org/#/builders/126/builds/32388 "Passed tests") | [✅ 🧪 mac-intel-wk2](https://ews-build.webkit.org/#/builders/137/builds/10111 "Passed tests") | [✅ 🛠 playstation](https://ews-build.webkit.org/#/builders/134/builds/25294 "Built successfully") | 
| | [✅ 🛠 tv](https://ews-build.webkit.org/#/builders/127/builds/30865 "Built successfully") | [✅ 🛠 mac-safer-cpp](https://ews-build.webkit.org/#/builders/120/builds/36168 "Built successfully") | | 
| | [✅ 🛠 tv-sim](https://ews-build.webkit.org/#/builders/125/builds/30659 "Built successfully") | | | 
| | [✅ 🛠 watch](https://ews-build.webkit.org/#/builders/129/builds/33994 "Built successfully") | | | 
| | [✅ 🛠 watch-sim](https://ews-build.webkit.org/#/builders/124/builds/32220 "Built successfully") | | | </details>
author_association: COLLABORATOR
user: login: webkit-early-warning-system
created_at: 2025-05-17T23:33:37Z
body: EWS run on previous version of this PR (hash https://github.com/WebKit/WebKit/commit/282b48bc06f8d9bb4180f12be68bf28b348490c1)<details>

| Misc | iOS, visionOS, tvOS & watchOS  | macOS  | Linux |  Windows |
| ----- | ---------------------- | ------- |  ----- |  --------- |
| [✅ 🧪 style](https://ews-build.webkit.org/#/builders/38/builds/104013 "Passed style check") | [✅ 🛠 ios](https://ews-build.webkit.org/#/builders/131/builds/23717 "Built successfully") | [✅ 🛠 mac](https://ews-build.webkit.org/#/builders/138/builds/14037 "Built successfully") | [✅ 🛠 wpe](https://ews-build.webkit.org/#/builders/5/builds/109209 "Built successfully") | [✅ 🛠 win](https://ews-build.webkit.org/#/builders/59/builds/54680 "Built successfully") 
| [✅ 🧪 bindings](https://ews-build.webkit.org/#/builders/9/builds/106053 "Passed tests") | [✅ 🛠 ios-sim](https://ews-build.webkit.org/#/builders/130/builds/24076 "Built successfully") | [✅ 🛠 mac-AS-debug](https://ews-build.webkit.org/#/builders/123/builds/32261 "Built successfully") | [✅ 🧪 wpe-wk2](https://ews-build.webkit.org/#/builders/34/builds/79013 "Passed tests") | [⏳ 🧪 win-tests](https://ews-build.webkit.org/#/builders/Win-Tests-EWS "Waiting to run tests") 
| [✅ 🧪 webkitperl](https://ews-build.webkit.org/#/builders/11/builds/107019 "Passed tests") | [✅ 🧪 ios-wk2](https://ews-build.webkit.org/#/builders/132/builds/18701 "Passed tests") | [✅ 🧪 api-mac](https://ews-build.webkit.org/#/builders/18/builds/93825 "Passed tests") | [✅ 🧪 api-wpe](https://ews-build.webkit.org/#/builders/41/builds/59341 "Passed tests") | 
| | [✅ 🧪 ios-wk2-wpt](https://ews-build.webkit.org/#/builders/133/builds/18493 "Passed tests") | [✅ 🧪 mac-wk1](https://ews-build.webkit.org/#/builders/135/builds/11876 "Passed tests") | [✅ 🛠 wpe-cairo](https://ews-build.webkit.org/#/builders/65/builds/54041 "Built successfully") | 
| | [❌ 🧪 api-ios](https://ews-build.webkit.org/#/builders/13/builds/88220 "Found 2 new API test failures: TestWebKitAPI.DragAndDropTests.CanStartDragOnModel, TestWebKitAPI.CARingBufferTest.FetchTimeBoundsConsistent (failure)") | [✅ 🧪 mac-wk2](https://ews-build.webkit.org/#/builders/136/builds/11934 "Passed tests") | [✅ 🛠 gtk](https://ews-build.webkit.org/#/builders/2/builds/111593 "Built successfully") | 
| | [✅ 🛠 vision](https://ews-build.webkit.org/#/builders/128/builds/31169 "Built successfully") | [✅ 🧪 mac-AS-debug-wk2](https://ews-build.webkit.org/#/builders/122/builds/22971 "Passed tests") | [✅ 🧪 gtk-wk2](https://ews-build.webkit.org/#/builders/1/builds/88027 "Passed tests") | 
| | [✅ 🛠 vision-sim](https://ews-build.webkit.org/#/builders/121/builds/31533 "Built successfully") | [✅ 🧪 mac-wk2-stress](https://ews-build.webkit.org/#/builders/8/builds/90025 "Passed tests") | [✅ 🧪 api-gtk](https://ews-build.webkit.org/#/builders/21/builds/87683 "Passed tests") | 
| | [✅ 🧪 vision-wk2](https://ews-build.webkit.org/#/builders/126/builds/32570 "Passed tests") | [✅ 🧪 mac-intel-wk2](https://ews-build.webkit.org/#/builders/137/builds/10312 "Passed tests") | [✅ 🛠 playstation](https://ews-build.webkit.org/#/builders/134/builds/25584 "Built successfully") | 
| | [✅ 🛠 tv](https://ews-build.webkit.org/#/builders/127/builds/31098 "Built successfully") | [✅ 🛠 mac-safer-cpp](https://ews-build.webkit.org/#/builders/120/builds/36410 "Built successfully") | | 
| | [✅ 🛠 tv-sim](https://ews-build.webkit.org/#/builders/125/builds/30891 "Built successfully") | | | 
| | [✅ 🛠 watch](https://ews-build.webkit.org/#/builders/129/builds/34228 "Built successfully") | | | 
| | [✅ 🛠 watch-sim](https://ews-build.webkit.org/#/builders/124/builds/32452 "Built successfully") | | | </details>
author_association: COLLABORATOR
user: login: webkit-early-warning-system
created_at: 2025-05-19T06:54:55Z
body: EWS run on previous version of this PR (hash https://github.com/WebKit/WebKit/commit/3aa42ef1c477805222a32ddeeed7838625ffa9d0)<details>

| Misc | iOS, visionOS, tvOS & watchOS  | macOS  | Linux |  Windows |
| ----- | ---------------------- | ------- |  ----- |  --------- |
| [✅ 🧪 style](https://ews-build.webkit.org/#/builders/38/builds/104070 "Passed style check") | [✅ 🛠 ios](https://ews-build.webkit.org/#/builders/131/builds/23774 "Built successfully") | [✅ 🛠 mac](https://ews-build.webkit.org/#/builders/138/builds/14094 "Built successfully") | [✅ 🛠 wpe](https://ews-build.webkit.org/#/builders/5/builds/109266 "Built successfully") | [✅ 🛠 win](https://ews-build.webkit.org/#/builders/59/builds/54738 "Built successfully") 
| [✅ 🧪 bindings](https://ews-build.webkit.org/#/builders/9/builds/106110 "Passed tests") | [✅ 🛠 ios-sim](https://ews-build.webkit.org/#/builders/130/builds/24141 "Built successfully") | [✅ 🛠 mac-AS-debug](https://ews-build.webkit.org/#/builders/123/builds/32318 "Built successfully") | [✅ 🧪 wpe-wk2](https://ews-build.webkit.org/#/builders/34/builds/79061 "Passed tests") | [⏳ 🧪 win-tests](https://ews-build.webkit.org/#/builders/Win-Tests-EWS "Waiting to run tests") 
| [✅ 🧪 webkitperl](https://ews-build.webkit.org/#/builders/11/builds/107076 "Passed tests") | [✅ 🧪 ios-wk2](https://ews-build.webkit.org/#/builders/132/builds/18748 "Passed tests") | [✅ 🧪 api-mac](https://ews-build.webkit.org/#/builders/18/builds/93876 "Passed tests") | [✅ 🧪 api-wpe](https://ews-build.webkit.org/#/builders/41/builds/59388 "Passed tests") | 
| | [✅ 🧪 ios-wk2-wpt](https://ews-build.webkit.org/#/builders/133/builds/18549 "Passed tests") | [✅ 🧪 mac-wk1](https://ews-build.webkit.org/#/builders/135/builds/11923 "Passed tests") | [✅ 🛠 wpe-cairo](https://ews-build.webkit.org/#/builders/65/builds/54098 "Built successfully") | 
| | [❌ 🧪 api-ios](https://ews-build.webkit.org/#/builders/13/builds/88305 "Found 2 new API test failures: TestWebKitAPI.DragAndDropTests.CanStartDragOnModel, TestWebKitAPI.CARingBufferTest.FetchTimeBoundsConsistent (failure)") | [✅ 🧪 mac-wk2](https://ews-build.webkit.org/#/builders/136/builds/11981 "Passed tests") | [✅ 🛠 gtk](https://ews-build.webkit.org/#/builders/2/builds/111652 "Built successfully") | 
| | [✅ 🛠 vision](https://ews-build.webkit.org/#/builders/128/builds/31226 "Built successfully") | [✅ 🧪 mac-AS-debug-wk2](https://ews-build.webkit.org/#/builders/122/builds/23018 "Passed tests") | [✅ 🧪 gtk-wk2](https://ews-build.webkit.org/#/builders/1/builds/88101 "Passed tests") | 
| | [✅ 🛠 vision-sim](https://ews-build.webkit.org/#/builders/121/builds/31590 "Built successfully") | [✅ 🧪 mac-wk2-stress](https://ews-build.webkit.org/#/builders/8/builds/90072 "Passed tests") | [✅ 🧪 api-gtk](https://ews-build.webkit.org/#/builders/21/builds/87760 "Passed tests") | 
| [  ~~🛠 🧪 merge~~](https://ews-build.webkit.org/#/builders/19/builds/22350 "Build was cancelled. Recent messages:OS: Sonoma (14.7.3), Xcode: 15.4; Checked out pull request; Reviewed by Youenn Fablet and Anne van Kesteren; Compiled WebKit (cancelled)") | [✅ 🧪 vision-wk2](https://ews-build.webkit.org/#/builders/126/builds/32609 "Passed tests") | [✅ 🧪 mac-intel-wk2](https://ews-build.webkit.org/#/builders/137/builds/10359 "Passed tests") | [✅ 🛠 playstation](https://ews-build.webkit.org/#/builders/134/builds/25671 "Built successfully") | 
| | [✅ 🛠 tv](https://ews-build.webkit.org/#/builders/127/builds/31155 "Built successfully") | [✅ 🛠 mac-safer-cpp](https://ews-build.webkit.org/#/builders/120/builds/36467 "Built successfully") | | 
| | [✅ 🛠 tv-sim](https://ews-build.webkit.org/#/builders/125/builds/30949 "Built successfully") | | | 
| | [✅ 🛠 watch](https://ews-build.webkit.org/#/builders/129/builds/34285 "Built successfully") | | | 
| | [✅ 🛠 watch-sim](https://ews-build.webkit.org/#/builders/124/builds/32509 "Built successfully") | | | </details>
author_association: COLLABORATOR
user: login: webkit-early-warning-system
created_at: 2025-05-20T19:02:38Z
body: EWS run on previous version of this PR (hash https://github.com/WebKit/WebKit/commit/2ec5bbde650ac55ac943b9d3e2fb488d2a920186)<details>

| Misc | iOS, visionOS, tvOS & watchOS  | macOS  | Linux |  Windows |
| ----- | ---------------------- | ------- |  ----- |  --------- |
| [✅ 🧪 style](https://ews-build.webkit.org/#/builders/38/builds/104300 "Passed style check") | [✅ 🛠 ios](https://ews-build.webkit.org/#/builders/131/builds/24004 "Built successfully") | [✅ 🛠 mac](https://ews-build.webkit.org/#/builders/138/builds/14417 "Built successfully") | [  ~~🛠 wpe~~](https://ews-build.webkit.org/#/builders/5/builds/109501 "The change is no longer eligible for processing. Commit was outdated when EWS attempted to process it.") | [  ~~🛠 win~~](https://ews-build.webkit.org/#/builders/59/builds/54968 "The change is no longer eligible for processing. Commit was outdated when EWS attempted to process it.") 
| [✅ 🧪 bindings](https://ews-build.webkit.org/#/builders/9/builds/106340 "Passed tests") | [✅ 🛠 ios-sim](https://ews-build.webkit.org/#/builders/130/builds/24376 "Built successfully") | [✅ 🛠 mac-AS-debug](https://ews-build.webkit.org/#/builders/123/builds/32551 "Built successfully") | [  ~~🧪 wpe-wk2~~](https://ews-build.webkit.org/#/builders/5/builds/109501 "The change is no longer eligible for processing. Commit was outdated when EWS attempted to process it.") | [  ~~🧪 win-tests~~](https://ews-build.webkit.org/#/builders/59/builds/54968 "The change is no longer eligible for processing. Commit was outdated when EWS attempted to process it.") 
| [✅ 🧪 webkitperl](https://ews-build.webkit.org/#/builders/11/builds/107306 "Passed tests") | [  ~~🧪 ios-wk2~~](https://ews-build.webkit.org/#/builders/132/builds/18943 "The change is no longer eligible for processing. Commit was outdated when EWS attempted to process it.") | [  ~~🧪 api-mac~~](https://ews-build.webkit.org/#/builders/18/builds/94126 "The change is no longer eligible for processing. Commit was outdated when EWS attempted to process it.") | [  ~~🧪 api-wpe~~](https://ews-build.webkit.org/#/builders/5/builds/109501 "The change is no longer eligible for processing. Commit was outdated when EWS attempted to process it.") | 
| | [⏳ 🧪 ios-wk2-wpt](https://ews-build.webkit.org/#/builders/iOS-18-Simulator-WPT-WK2-Tests-EWS "Waiting to run tests") | [  ~~🧪 mac-wk1~~](https://ews-build.webkit.org/#/builders/135/builds/12194 "The change is no longer eligible for processing. Commit was outdated when EWS attempted to process it.") | [✅ 🛠 wpe-cairo](https://ews-build.webkit.org/#/builders/65/builds/54328 "Built successfully") | 
| | [⏳ 🧪 api-ios](https://ews-build.webkit.org/#/builders/API-Tests-iOS-Simulator-EWS "Waiting to run tests") | [  ~~🧪 mac-wk2~~](https://ews-build.webkit.org/#/builders/136/builds/12252 "The change is no longer eligible for processing. Commit was outdated when EWS attempted to process it.") | [✅ 🛠 gtk](https://ews-build.webkit.org/#/builders/2/builds/111882 "Built successfully") | 
| [![loading](https://user-images.githubusercontent.com/3098702/171232313-daa606f1-8fd6-4b0f-a20b-2cb93c43d19b.png) 🛠 🧪 jsc-arm64](https://ews-build.webkit.org/#/builders/12/builds/102911 "Build is in progress. Recent messages:") | [  ~~🛠 vision~~](https://ews-build.webkit.org/#/builders/128/builds/31457 "The change is no longer eligible for processing. Commit was outdated when EWS attempted to process it.") | [⏳ 🧪 mac-AS-debug-wk2](https://ews-build.webkit.org/#/builders/macOS-Sequoia-Debug-WK2-Tests-EWS "Waiting to run tests") | [  ~~🧪 gtk-wk2~~](https://ews-build.webkit.org/#/builders/1/builds/88232 "The change is no longer eligible for processing. Commit was outdated when EWS attempted to process it.") | 
| [![loading](https://user-images.githubusercontent.com/3098702/171232313-daa606f1-8fd6-4b0f-a20b-2cb93c43d19b.png) 🧪 services](https://ews-build.webkit.org/#/builders/28/builds/103855 "Build is in progress. Recent messages:") | [✅ 🛠 vision-sim](https://ews-build.webkit.org/#/builders/121/builds/31821 "Built successfully") | [  ~~🧪 mac-wk2-stress~~](https://ews-build.webkit.org/#/builders/8/builds/90366 "The change is no longer eligible for processing. Commit was outdated when EWS attempted to process it.") | [  ~~🧪 api-gtk~~](https://ews-build.webkit.org/#/builders/21/builds/87895 "The change is no longer eligible for processing. Commit was outdated when EWS attempted to process it.") | 
| | [  ~~🧪 vision-wk2~~](https://ews-build.webkit.org/#/builders/126/builds/32794 "The change is no longer eligible for processing. Commit was outdated when EWS attempted to process it.") | [⏳ 🧪 mac-intel-wk2](https://ews-build.webkit.org/#/builders/macOS-Sonoma-Release-WK2-Intel-Tests-EWS "Waiting to run tests") | [  ~~🛠 playstation~~](https://ews-build.webkit.org/#/builders/134/builds/25925 "The change is no longer eligible for processing. Commit was outdated when EWS attempted to process it.") | 
| | [✅ 🛠 tv](https://ews-build.webkit.org/#/builders/127/builds/31385 "Built successfully") | [✅ 🛠 mac-safer-cpp](https://ews-build.webkit.org/#/builders/120/builds/36700 "Built successfully") | | 
| | [  ~~🛠 tv-sim~~](https://ews-build.webkit.org/#/builders/125/builds/31179 "The change is no longer eligible for processing. Commit was outdated when EWS attempted to process it.") | | | 
| | [  ~~🛠 watch~~](https://ews-build.webkit.org/#/builders/129/builds/34515 "The change is no longer eligible for processing. Commit was outdated when EWS attempted to process it.") | | | 
| | [  ~~🛠 watch-sim~~](https://ews-build.webkit.org/#/builders/124/builds/32739 "The change is no longer eligible for processing. Commit was outdated when EWS attempted to process it.") | | | </details>
author_association: COLLABORATOR
user: login: webkit-early-warning-system
created_at: 2025-05-20T19:07:45Z
body: EWS run on previous version of this PR (hash https://github.com/WebKit/WebKit/commit/40d70b3b2f6d91ca34875a62259cb66e5c002a57)<details>

| Misc | iOS, visionOS, tvOS & watchOS  | macOS  | Linux |  Windows |
| ----- | ---------------------- | ------- |  ----- |  --------- |
| [✅ 🧪 style](https://ews-build.webkit.org/#/builders/38/builds/104302 "Passed style check") | [✅ 🛠 ios](https://ews-build.webkit.org/#/builders/131/builds/24006 "Built successfully") | [✅ 🛠 mac](https://ews-build.webkit.org/#/builders/138/builds/14419 "Built successfully") | [✅ 🛠 wpe](https://ews-build.webkit.org/#/builders/5/builds/109503 "Built successfully") | [✅ 🛠 win](https://ews-build.webkit.org/#/builders/59/builds/54970 "Built successfully") 
| [✅ 🧪 bindings](https://ews-build.webkit.org/#/builders/9/builds/106342 "Passed tests") | [✅ 🛠 ios-sim](https://ews-build.webkit.org/#/builders/130/builds/24453 "Built successfully") | [✅ 🛠 mac-AS-debug](https://ews-build.webkit.org/#/builders/123/builds/32553 "Built successfully") | [✅ 🧪 wpe-wk2](https://ews-build.webkit.org/#/builders/34/builds/79208 "Passed tests") | [⏳ 🧪 win-tests](https://ews-build.webkit.org/#/builders/Win-Tests-EWS "Waiting to run tests") 
| [✅ 🧪 webkitperl](https://ews-build.webkit.org/#/builders/11/builds/107308 "Passed tests") | [✅ 🧪 ios-wk2](https://ews-build.webkit.org/#/builders/132/builds/19007 "Passed tests") | [✅ 🧪 api-mac](https://ews-build.webkit.org/#/builders/18/builds/94130 "Passed tests") | [✅ 🧪 api-wpe](https://ews-build.webkit.org/#/builders/41/builds/59542 "Passed tests") | 
| | [  ~~🧪 ios-wk2-wpt~~](https://ews-build.webkit.org/#/builders/133/builds/18821 "The change is no longer eligible for processing. Commit was outdated when EWS attempted to process it.") | [✅ 🧪 mac-wk1](https://ews-build.webkit.org/#/builders/135/builds/12198 "Passed tests") | [✅ 🛠 wpe-cairo](https://ews-build.webkit.org/#/builders/65/builds/54330 "Built successfully") | 
| | [✅ 🧪 api-ios](https://ews-build.webkit.org/#/builders/13/builds/88504 "Passed tests") | [✅ 🧪 mac-wk2](https://ews-build.webkit.org/#/builders/136/builds/12256 "Passed tests") | [✅ 🛠 gtk](https://ews-build.webkit.org/#/builders/2/builds/111884 "Built successfully") | 
| | [✅ 🛠 vision](https://ews-build.webkit.org/#/builders/128/builds/31459 "Built successfully") | [✅ 🧪 mac-AS-debug-wk2](https://ews-build.webkit.org/#/builders/122/builds/23178 "Passed tests") | [✅ 🧪 gtk-wk2](https://ews-build.webkit.org/#/builders/1/builds/88234 "Passed tests") | 
| | [✅ 🛠 vision-sim](https://ews-build.webkit.org/#/builders/121/builds/31823 "Built successfully") | [✅ 🧪 mac-wk2-stress](https://ews-build.webkit.org/#/builders/8/builds/90370 "Passed tests") | [✅ 🧪 api-gtk](https://ews-build.webkit.org/#/builders/21/builds/87897 "Passed tests") | 
| | [✅ 🧪 vision-wk2](https://ews-build.webkit.org/#/builders/126/builds/32791 "Passed tests") | [✅ 🧪 mac-intel-wk2](https://ews-build.webkit.org/#/builders/137/builds/10562 "Passed tests") | [✅ 🛠 playstation](https://ews-build.webkit.org/#/builders/134/builds/25927 "Built successfully") | 
| | [✅ 🛠 tv](https://ews-build.webkit.org/#/builders/127/builds/31387 "Built successfully") | [✅ 🛠 mac-safer-cpp](https://ews-build.webkit.org/#/builders/120/builds/36702 "Built successfully") | | 
| | [✅ 🛠 tv-sim](https://ews-build.webkit.org/#/builders/125/builds/31181 "Built successfully") | | | 
| | [✅ 🛠 watch](https://ews-build.webkit.org/#/builders/129/builds/34517 "Built successfully") | | | 
| | [✅ 🛠 watch-sim](https://ews-build.webkit.org/#/builders/124/builds/32741 "Built successfully") | | | </details>
author_association: COLLABORATOR
user: login: webkit-early-warning-system
created_at: 2025-05-21T16:43:50Z
body: EWS run on current version of this PR (hash https://github.com/WebKit/WebKit/commit/2409c48413b3c530ecc2f61b94223ac3648676de)<details>

| Misc | iOS, visionOS, tvOS & watchOS  | macOS  | Linux |  Windows |
| ----- | ---------------------- | ------- |  ----- |  --------- |
| [✅ 🧪 style](https://ews-build.webkit.org/#/builders/38/builds/104460 "Passed style check") | [✅ 🛠 ios](https://ews-build.webkit.org/#/builders/131/builds/24169 "Built successfully") | [✅ 🛠 mac](https://ews-build.webkit.org/#/builders/138/builds/14587 "Built successfully") | [✅ 🛠 wpe](https://ews-build.webkit.org/#/builders/5/builds/109667 "Built successfully") | [  ~~🛠 win~~](https://ews-build.webkit.org/#/builders/59/builds/55131 "The change is no longer eligible for processing. Pull Request was already closed when EWS attempted to process it.") 
| [✅ 🧪 bindings](https://ews-build.webkit.org/#/builders/9/builds/106500 "Passed tests") | [✅ 🛠 ios-sim](https://ews-build.webkit.org/#/builders/130/builds/24551 "Built successfully") | [✅ 🛠 mac-AS-debug](https://ews-build.webkit.org/#/builders/123/builds/32714 "Built successfully") | [  ~~🧪 wpe-wk2~~](https://ews-build.webkit.org/#/builders/34/builds/79320 "The change is no longer eligible for processing. Commit was outdated when EWS attempted to process it.") | [  ~~🧪 win-tests~~](https://ews-build.webkit.org/#/builders/59/builds/55131 "The change is no longer eligible for processing. Pull Request was already closed when EWS attempted to process it.") 
| [✅ 🧪 webkitperl](https://ews-build.webkit.org/#/builders/11/builds/107466 "Passed tests") | [✅ 🧪 ios-wk2](https://ews-build.webkit.org/#/builders/132/builds/19094 "Passed tests") | [✅ 🧪 api-mac](https://ews-build.webkit.org/#/builders/18/builds/94282 "Passed tests") | [✅ 🧪 api-wpe](https://ews-build.webkit.org/#/builders/41/builds/59646 "Passed tests") | 
| | [  ~~🧪 ios-wk2-wpt~~](https://ews-build.webkit.org/#/builders/133/builds/18885 "The change is no longer eligible for processing. Pull Request was already closed when EWS attempted to process it.") | [✅ 🧪 mac-wk1](https://ews-build.webkit.org/#/builders/135/builds/12354 "Passed tests") | [❌ 🛠 wpe-cairo](https://ews-build.webkit.org/#/builders/65/builds/54498 "Failed to compile WebKit") | 
| | [  ~~🧪 api-ios~~](https://ews-build.webkit.org/#/builders/13/builds/88586 "The change is no longer eligible for processing. Pull Request was already closed when EWS attempted to process it.") | [✅ 🧪 mac-wk2](https://ews-build.webkit.org/#/builders/136/builds/12412 "Passed tests") | [✅ 🛠 gtk](https://ews-build.webkit.org/#/builders/2/builds/112052 "Built successfully") | 
| | [✅ 🛠 vision](https://ews-build.webkit.org/#/builders/128/builds/31621 "Built successfully") | [  ~~🧪 mac-AS-debug-wk2~~](https://ews-build.webkit.org/#/builders/122/builds/23294 "The change is no longer eligible for processing. Pull Request was already closed when EWS attempted to process it.") | [  ~~🧪 gtk-wk2~~](https://ews-build.webkit.org/#/builders/1/builds/88361 "The change is no longer eligible for processing. Commit was outdated when EWS attempted to process it.") | 
| | [✅ 🛠 vision-sim](https://ews-build.webkit.org/#/builders/121/builds/31985 "Built successfully") | [✅ 🧪 mac-wk2-stress](https://ews-build.webkit.org/#/builders/8/builds/90515 "Passed tests") | [✅ 🧪 api-gtk](https://ews-build.webkit.org/#/builders/21/builds/88026 "Passed tests") | 
| [✅ 🛠 🧪 merge](https://ews-build.webkit.org/#/builders/19/builds/22411 "Built successfully and passed tests") | [✅ 🧪 vision-wk2](https://ews-build.webkit.org/#/builders/126/builds/32919 "Passed tests") | [✅ 🧪 mac-intel-wk2](https://ews-build.webkit.org/#/builders/137/builds/10696 "Passed tests") | [✅ 🛠 playstation](https://ews-build.webkit.org/#/builders/134/builds/26096 "Built successfully") | 
| | [✅ 🛠 tv](https://ews-build.webkit.org/#/builders/127/builds/31548 "Built successfully") | [  ~~🛠 mac-safer-cpp~~](https://ews-build.webkit.org/#/builders/120/builds/36901 "The change is no longer eligible for processing. Pull Request was already closed when EWS attempted to process it.") | | 
| | [✅ 🛠 tv-sim](https://ews-build.webkit.org/#/builders/125/builds/31340 "Built successfully") | | | 
| | [✅ 🛠 watch](https://ews-build.webkit.org/#/builders/129/builds/34679 "Built successfully") | | | 
| | [  ~~🛠 watch-sim~~](https://ews-build.webkit.org/#/builders/124/builds/32900 "The change is no longer eligible for processing. Pull Request was already closed when EWS attempted to process it.") | | | </details>
author_association: COLLABORATOR
user: login: webkit-commit-queue
created_at: 2025-05-21T18:31:56Z
body: Committed 295219@main (74ab595af1f0): <https://commits.webkit.org/295219@main>

Reviewed commits have been landed. Closing PR #45447 and removing active labels.
author_association: COLLABORATOR