lukewarlow
WebCore contributor
Summary
Works almost entirely in WebCore DOM/HTML, concentrated on two spec surfaces: `moveBefore()` atomic node moves and the Close Watcher API with its dialog and popover integrations. The commit stream is feature implementation rather than security work — no fixes classified as security or hardening — but a notable share of the `moveBefore()` entries are follow-up corrections for state that survives a move incorrectly (live ranges and node iterator pre-remove steps, selections, shadow root traversal, mutation records, `:dir()`/`:lang()` and tree-based style invalidation). Systematic-variant candidate: `moveBefore()` reparents nodes without the remove/insert pair, so every subsystem holding a node reference or cached tree-derived state needs its own explicit handling, and the pattern here shows those were found one at a time. Sweeping for subsystems not yet covered — plus the cross-iframe user-activation path in `CloseWatcherManager` that feeds popover light dismiss — is the higher-yield direction.
Components
Security Fix History
- No security fixes recorded
Hardening Commits
Recent Commits
- 2026-09-02 Make MoveBeforeEnabled flag testable
- 2026-08-28 Add new ChildChange types for moveBefore
- 2026-08-28 Change movingSteps isSubtreeRoot parameter to an enum
- 2026-08-19 Implement moving steps for HTMLOptionElement
- 2026-08-06 Implement moving steps for source and img elements
- 2026-08-06 moveBefore() isn't updating web inspector
- 2026-07-28 moveBefore() doesn't iterate through shadow roots
- 2026-07-07 Enable Close Watcher API and dialog closedby in stable
- 2026-06-17 moveBefore() needs to invalidate tree based styles
- 2026-06-16 test driver send_keys() throws an error in UI script on iOS
- 2026-06-12 Enable Close Watcher API in preview
- 2026-06-10 moveBefore() needs to handle selections
- 2026-06-10 CloseWatcherManagers inside iframes aren't notified about user activation
- 2026-06-06 moveBefore() needs to reset :lang() and :dir()
- 2026-06-02 Popover light dismiss doesn't account for disabled command buttons