graouts
WebCore contributor
Summary
Works almost exclusively on animations in WebCore — Web Animations API, scroll-driven timelines, the new `animation-trigger`/`timeline-trigger-*` CSS properties, and the threaded time-based animations path spanning WebCore and the remote layer tree. The pattern is feature-development-driven rather than security-focused: the crash and use-after-free fixes cluster tightly around newly landed scroll-timeline and threaded-animation code, including timeline rehashing in `AnimationTimelinesController::suspendAnimations` and script-reentrancy through `CustomEffect` callbacks that mutates effect state mid-callback. Systematic-variant candidate: the `animation-trigger` and `timeline-trigger-*` parsing surface is landing behind a fresh feature flag with WPT snapshots still churning, and the adjacent scroll-timeline lifetime bugs suggest the same timeline-matching and reentrancy paths are worth sweeping again.
Components
Security Fix History
- 2026-07-01 [web-animations] accelerated animation with view progress timeline range and a scroll time yields a crash ·
- 2026-06-30 [web-animations] accelerated animation with view progress timeline range and a scroll time yields a crash ·
- 2026-06-29 [web-animations] accelerated animation with view progress timeline range but no timeline yields a crash ·
- 2026-06-29 [web-animations] use-after-free in AnimationTimelinesController::suspendAnimations: m_timelines rehashes during iteratio ·
- 2026-06-24 [threaded-animations] webanimations/threaded-animations/fill-mode-adjustment-additive.html may crash under ASan 2026-W25
- 2026-04-08 [web-animations] setting effect to null in `CustomEffect` callback leads to a crash 2026-W14
Hardening Commits
- No hardening commits recorded
Recent Commits
- 2026-07-24 [threaded-animations] disable Threaded Time-based Animations on CNN.com on iOS
- 2026-07-17 [threaded-animations] add tracing signposts for remote layer tree animation updates
- 2026-07-17 [scroll-animations] deferred timelines should be represented as null through the bindings
- 2026-07-17 [scroll-animations] only match `animation-timeline` to a timeline within the nearest `timeline-scope` element for that n
- 2026-07-16 [scroll-animations] use the last matching timeline when `animation-timeline` matches multiple timelines
- 2026-07-16 [animation-triggers] add parsing support for the `animation-trigger` CSS property
- 2026-07-16 [animation-triggers] add parsing support for the `timeline-trigger-active-range` shorthand
- 2026-07-16 [scroll-animations] update WPT snapshot
- 2026-07-14 [animation-triggers] add parsing support for the `timeline-trigger-activation-range` shorthand
- 2026-07-14 [web-animations-2] Auto-aligning the start time should apply a pending playback rate
- 2026-07-13 [animation-triggers] add parsing support for the `timeline-trigger-active-range-start` and `timeline-trigger-active-rang
- 2026-07-12 [animation-triggers] add parsing support for the `timeline-trigger-activation-range-start` and `timeline-trigger-activat
- 2026-07-09 [animation-triggers] add parsing support for the `timeline-trigger-name` and `timeline-trigger-source` coordinated value
- 2026-07-09 [threaded-animations] enable "Threaded Time-based Animations" by default (take 3)
- 2026-07-08 Remove `RemoteLayerTreeDrawingAreaProxy::setDisplayLinkWantsFullSpeedUpdates(bool)`