bnham
WebKit contributor
Summary
bnham works primarily on Site Isolation plumbing across WebKit and WebCore: cross-process frame geometry propagation, remote frame lifetime in BrowsingContextGroup, and IPC payload reduction (TransformationMatrix encoding, coalescing per-rendering-update geometry messages, removing UpdateRemoteIntersectionObservers), alongside process-lifecycle work such as jetsam banding for prewarmed/cached processes and hidden-page throttling. The pattern is architecture and performance rather than vulnerability response — the security-adjacent commits are cross-process access-control boundaries (restricting WebPasteboardProxy to remote frames descended from the requesting frame, limiting evaluateScript to non-normal worlds), not memory-safety fixes. Where to look next: the remote-frame geometry and intersection-observer teardown paths under active churn. Messages being coalesced, removed, or moved into a new coordinate space are where stale frame references and unvalidated cross-process frame identifiers tend to survive a refactor, and the process-reuse regression fix in swap-on-navigation-response suggests the same for process assignment invariants.
Components
Security Fix History
Hardening Commits
Recent Commits
- 2026-09-18 [Site Isolation] Move layoutViewportRect out of FrameGeometry
- 2026-09-15 [Site Isolation] Move periodic memory monitor to UIProcess 2026-W37
- 2026-09-15 [cmake] Fix race between linking WebKit and codesigning dylibs
- 2026-09-15 [cmake] Race between codesigning WebKit.framework and producing development WebContent
- 2026-09-14 [Site Isolation] Avoid re-broadcasting frame geometry if nothing changed
- 2026-09-11 Remove printing support from tvOS only
- 2026-09-11 Remove printing support on tvOS and watchOS
- 2026-09-10 Speed up FrameTree::containsRemoteFrame and related methods
- 2026-09-10 [Site Isolation] Make FrameTreeSyncClient and DocumentSyncClient methods take movable types
- 2026-09-10 [Site Isolation] Disconnect remote intersection observers when owning document is destroyed
- 2026-09-05 [Site Isolation] Only broadcast frame geometry from frames with a cross-process descendant
- 2026-09-04 [Site Isolation] Change coordinate space for cross-process frame geometry
- 2026-09-02 [Site Isolation] Remove UpdateRemoteIntersectionObservers IPC
- 2026-09-02 [Site Isolation] Don't use crashed processes in BrowsingContextGroup
- 2026-09-01 Fix injected bundle tests in TestWebKitAPI CMake build