djg
WebCore security specialist
Summary
Primarily graphics and rendering: GraphicsContext/CoreGraphics stroking paths, color conversion and gradient interpolation, ANGLE, and WebXR compositor integration on Cocoa/visionOS, with a large share of the work driven by MotionMark 1.3 performance regressions. The pattern is performance-first — caching, IPC batching, allocation avoidance — and the security fixes fall out of that same work: both use-after-frees involve WebXRSystem lifetime across re-posted callbacks and garbage-collected owners, and the per-thread sampled gradient cache change addresses cross-thread sharing of color transform state. Systematic-variant candidate: the WebXR object graph (WebXRSystem, XRSession, PlatformXRCompositor) has produced repeated lifetime bugs in async callback paths, and the thread-local caching rework in the color pipeline is recent enough that adjacent shared-state paths are worth a sweep.
Components
Security Fix History
- 2026-07-03 [WebXR] Use-after-free of WebXRSystem in callbacks re-posted from ensureImmersiveXRDeviceIsSelected 2026-W26
- 2026-06-30 [WebXR] Use-after-free when ending an XRSession whose owning WebXRSystem has been garbage collected ·
- 2026-05-14 Give each thread its own sampled gradient cache to avoid cross-thread thrashing 2026-W19
- 2026-04-02 Draw non-sRGB gradients via CGGradient using sampling
- 2026-03-17 Fix WebContent jetsam when pinch-zooming reddit.com
Hardening Commits
- No hardening commits recorded
Recent Commits
- 2026-08-31 [visionOS] Log the negotiated cp_layer_renderer_layout in CompositorCoordinator
- 2026-08-24 Avoid a redundant matrix multiply in SVGTransformList::concatenate()
- 2026-08-24 Avoid an out-of-line call per stream IPC send to check whether signposts are enabled
- 2026-08-22 Avoid constructing a Timeout on the common stream IPC send path
- 2026-08-22 Remove redundant paint state save/restore around SVG gradient fill/stroke
- 2026-08-21 Make RenderView::frameView() inline
- 2026-08-18 Make WebCore::appleVisualEffectNeedsBackdrop inline.
- 2026-07-30 [ANGLE] ScopedDisableOcclusionQuery helper doesn't write mResultOut
- 2026-07-30 REGRESSION(318113@main): MotionMark 1.3 Leaves 19.5% worse than baseline
- 2026-07-29 Avoid recomputing anonymousWrappers on removal of out-of-flow elements.
- 2026-07-19 [WebXR] Clamp minimum depth for PlatformXRCompositor
- 2026-07-16 [WebXR] Remove check for CompositorServices support of forward-Z
- 2026-07-16 REGRESSION (310405@main): Oklch gradients sometimes have random bands of colour in them
- 2026-07-03 [WebXR] Use-after-free of WebXRSystem in callbacks re-posted from ensureImmersiveXRDeviceIsSelected 2026-W26
- 2026-06-30 [WebXR] Use-after-free when ending an XRSession whose owning WebXRSystem has been garbage collected ·