◆ WebKit WeeklyBeta

rniwa

WebCore security specialist

370 commits (10mo)
25 security fixes
2 hardening
View all commits on GitHub ↗

Summary

rniwa works primarily in WebCore, with a recent concentration in Site Isolation — specifically iOS text interaction inside cross-origin iframes (caret placement, selection endpoint adjustment, loupe positioning, long-tap word selection) — alongside ongoing safer C++ static analysis maintenance: NODELETE annotation corrections, CheckedPtr no-delete semantics, and expectation updates across WebCore and JSC. The security fixes are dominated by use-after-free in DOM and CSS object lifetime paths (LocalFrameView anchor scrolling, CSSFontFace status transitions, FocusController traversal, ClipboardItem type loaders, HTMLDialogElement::close), landed largely as one tight cluster, plus a type confusion via an unchecked jsCast<JSPromise*> in ReadableStream.cancel(). Systematic-variant candidate: two separate races in `visitAdditionalChildren` during GC (JSStyleSheet, JSSubscriber) point at a class of bug where JS wrapper visit methods touch mutable state the collector can observe concurrently — the remaining `visitAdditionalChildren` implementations across WebCore bindings are the natural sweep. The Site Isolation iOS editing work also surfaces cross-process frame lifetime handling (FrameProcess reuse in the process cache under shared process mode) that is worth reading alongside it.

Components

WebCore
40%
Site Isolation
20%
WebKit
17%
Platform
10%
JSC
4%
Other
4%

Security Fix History

1 / 3

Hardening Commits

Recent Commits

1 / 25

← All Contributors