JavaScript

• Introduced exponentiation expressions (x ** y) from ECMAScript 2016 (r203499)
• Improved specification compatibility of use strict in functions (r203263)

Web APIs

• Moved dir attribute from HTMLDocument to Document (r203761)
• Aligned Node.isEqualNode() with the specification (r203759)
• Made DOMTokenList iterable (r203728)
• Moved properties for ClientRect to the prototype (r203702)
• Made the parameters of DOMImplementation.createDocumentType() mandatory and non-nullable (r203701)
• Made the first parameter of Window.getComputedStyle() mandatory and non-nullable (r203623)
• Fixed null handling of SVGAngle.valueAsString and SVGLength.valueAsString (r203531)
• Fixed null handling of HTMLFontElement.color (r203530)
• Fixed null handling for several HTMLTableElement attributes (r203529)
• Fixed null handling for HTMLObjectElement.border (r203528)
• Fixed null handling for td.bgColor and tr.bgColor (r203527)
• Fixed null handling for several HTMLBodyElement attributes (r203525)
• Fixed null handling of the marginWidth and marginHeight attributes for HTMLFrameElement and HTMLIFrameElement (r203474, r203524)
• Fixed null handling for HTMLImageElement.border (r203523)
• Fixed null handling of several Document attributes (r203487)
• Fixed null handling of HTMLMediaElement.mediaGroup (r203463)
• Fixed null handling of HTMLSelectElement.value attribute (r203456)
• Fixed null handling of SVGScriptElement.type attribute (r203444)
• Fixed null handling of several HTMLDocument attributes (r203443)
• Fixed null handling of HTMLScriptElement.text attribute (r203428)
• Fixed null handling of the enctype, encoding and method properties of the form element (r203401)
• Fixed null handling of formEnctype and formMethod properties for input and button elements (r203394)
• Changed the letter-case for the playsInline IDL attribute (r203511)
• Dropped the SVGElement.xmlbase attribute (r203438)
• Aligned CSSStyleDeclaration.setProperty() with the specification (r203437)
• Made the EventTarget.dispatchEvent() parameter non-nullable (r203391)

Apple Pay

• Fixed deprecated errors thrown when using requiredBillingAddressFields (r203168)
• Fixed onPaymentAuthorized callback not received when authorizing a second time (r203746)
• Fixed ending the payment session if the user closes all windows (r203741)

Web Inspector

• Fixed slowdowns when switching away from the Console tab with a lot of messages (r203636)
• Fixed filtering in the Overview timeline view (r203673)
• Fixed maintaining the selected function when switching between different profile representations (r203243)
• Improved styles for the Open Quickly and Goto Line dialogs (r203290)

MathML

• Changed the CSS display property of many MathML elements to allow page authors to override (r203163)
• Mapped “combining” to “non-combining” character equivalents (r203714)
• Improved alignment inside vertically stretched operators (r203289)
• Removed the padding and margin around the <math> element (r203171)
• Reset the font-style property on the <math> element (r203640)

Rendering

• Added support for new emoji group candidates (r203330, r203533, r203626)
• Fixed moving scrollbars to the right when the text direction changes to right-to-left (r203267)
• Fixed image zoom animations that were broken on medium.com (r203380)
• Fixed computing elements-based snap points for containers with large maximum scroll offset values (r203684)
• Fixed a rendering issue causing theguardian.co.uk crossword puzzles to sometimes not display text (r203415)

Accessibility

• Fixed an issue causing duplicate children when first-letter is being used in CSS (r203694)
• Fixed name calculation of headings from the aria-label attribute for VoiceOver (r203538)
• Added a new attribute to expose the auto-fill button type to VoiceOver (r203711)
• Fixed volume adjustments using VoiceOver and improved spoken feedback (r203669)

Security

• Changed behavior to block insecure scripts running in a data: frame when the top-level page is HTTPS (r203300)
• Changed URL handling to remove credentials when accessed through location.href (r203258)
• Changed behavior to block mixed-content synchronous XHRs (r203542)
• Improved support for multiple policies to more closely conform to the CSP Level 2 specifications (r203434)
• Applied the Content Security Policy object-src and plugin-types directives for plugin replacements (r203611)
• Changed the behavior to prevent history.pushState and history.replaceState where a username is in the URL (r203288)
• Changed behavior to allow LocalStorage access for file URLs by default (r203695)