David Kilzer (unlinked)
WebCore security specialist
Summary
David Kilzer's work spans the tree rather than concentrating in one component — WebCore and platform code lead, but a substantial share lands in build configuration and developer tooling: check-webkit-style filter rules and diff handling, crash-log collection in run-webkit-tests for ServiceWorkerProcess, and ASan crash logs on failed IPC message checks. The bug fixes cluster tightly on thread-safety and object lifetime: a use-after-free of a RunLoop::Timer on the scrolling thread, a data race reading the process-global TrackerDomainLookupInfo map from the network resolver thread, a ring-buffer race in IPC::MessageLog, and a main-thread assertion added to WebAVSampleBufferListener's client access. Systematic-variant candidate: process-global or main-thread-owned state reached from WebKit's secondary threads — scrolling, network resolver, media listener — which is where the recent fixes concentrate and where the same shape likely repeats.
Components
Security Fix History
- 2026-09-18 WebCore::Page::forEachPage should iterate a snapshot of allPages() 2026-W37
- 2026-09-10 [Cocoa] Hold a strong reference to QueuedVideoOutput in its main run loop callbacks 2026-W36
- 2026-08-25 Add missing inherited build settings that CommonBase.xcconfig sets
- 2026-08-23 Heap-use-after-free of RemoteLayerTreeEventDispatcher's RunLoop::Timer on the scrolling thread ·
- 2026-08-13 GPU process crash in WebCore::ControlFactoryMac::servicesRolloverButtonCell() drawing image controls ·
- 2026-08-12 Data race reading the process-global TrackerDomainLookupInfo map from the network resolver thread in WebPrivacyHelpers ·
- 2026-07-12 WebSpeechSynthesisWrapper crashes on voice change notification 2026-W28
- 2026-07-02 [CoreIPC][GPU] Queue::writeTexture() 1D replaceRegion fast-path should return early when copyExtent.height is zero ·
- 2026-06-30 Crash in CanvasRenderingContext::deref after reentrant getContext() ·
- 2026-06-01 WebPageProxy crash in dispatchSetObscuredContentInsets() and clearTextIndicatorWithAnimation() ·
Hardening Commits
- 2026-08-12 WebAVSampleBufferListener should assert the main thread when accessing _client in ensureOnMainThread blocks
- 2026-05-23 Adopt SaferCPP rules for workerOrWorkletThread() in WorkerOrWorkletGlobalScope
- 2026-05-21 Fix crashes in RealtimeIncoming*Source destructors by ensuring sink removal before member destruction 2026-W20
- 2026-04-07 Add nullptr checks for m_objectStore.get() in WebCore::IDBServer::MemoryIndex
- 2026-03-05 Re-land: Enable PAC (return address signing) when building boringssl
Recent Commits
- 2026-09-18 WebCore::Page::forEachPage should iterate a snapshot of allPages() 2026-W37
- 2026-09-11 Null-pointer crash in `FileSystemWritableFileStreamSink::write()` when the document is detached from its frame
- 2026-09-10 [Cocoa] Hold a strong reference to QueuedVideoOutput in its main run loop callbacks 2026-W36
- 2026-09-09 [ANGLE] Re-enable PoolAllocator under AddressSanitizer
- 2026-09-09 REGRESSION (320694@main): DownloadCocoa.mm fails to build: inline function 'IPC::MessageSender::send' is not defined
- 2026-09-09 REGRESSION (320694@main): WebEventConversion.cpp fails to build: use of undeclared identifier 'DoublePoint'
- 2026-09-01 [Cocoa] Apply -Wthread-safety to all Xcode targets via CommonBase.xcconfig
- 2026-08-27 WAKAppKitStubs.h declares duplicate CGRect and CGSize type aliases when building against the public SDK
- 2026-08-25 Add missing inherited build settings that CommonBase.xcconfig sets
- 2026-08-24 MESSAGE_CHECK failure in WebLockRegistryProxy::requestLock for a worker registered by a third-party frame
- 2026-08-24 REGRESSION (319410@main): WebCore::ISOOriginalFormatBox::parse() is no longer exported from WebCore
- 2026-08-23 Heap-use-after-free of RemoteLayerTreeEventDispatcher's RunLoop::Timer on the scrolling thread ·
- 2026-08-19 REGRESSION (259876@main): Check for end iterator in WebStorageNamespaceProvider::decrementUseCount()
- 2026-08-15 REGRESSION (319224@main): Fix -Wc++11-narrowing warning in NativeWebGestureEvent::Init
- 2026-08-15 [WebCore] ASSERT(m_decodedSize >= decodedSize) in BitmapImageSource::decodedSizeReset()