smfr
WebCore contributor
Summary
smfr works almost entirely in WebCore rendering and scrolling — a sustained run on `corner-shape`/`shape-outside` geometry, plus scroll-snap semantics, `RemoteLayerTreeEventDispatcher` main-thread blocking, and WPT test-infrastructure resyncs. Security-flagged work is rare and not memory-safety: the flagged change coarsens LCP `renderTime` granularity to 4ms, a timing side-channel mitigation rather than a bug fix, and there is no hardening activity. The audit angle: `corner-shape` and `shape-outside` are young geometry paths here with recurring correctness fixes (thick borders, intersecting inner corners, `<shape-box>` values, negative outline offsets), and the cross-process scrolling path yielded a crash under `WebPageProxy::sendScrollUpdateForNode()` during scrolling WPTs — both are actively churning code with attacker-reachable CSS and input surfaces.
Components
Security Fix History
Hardening Commits
- No hardening commits recorded
Recent Commits
- 2026-09-16 Allow WebKitAdditions to provide settings via WebPreferencesAdditions.yaml
- 2026-09-16 [corner-shape] Outlines with negative offset look ugly
- 2026-09-15 Make AppleInvertLightness::hueRotate a static member function
- 2026-09-15 `run-webkit-tests --layout-tests-directory` produces empty -diff.html files
- 2026-09-14 Media controls should declare their support for light & dark mode
- 2026-09-14 Remove some AX_CUSTOM_COLOR_MODE image adjustment code
- 2026-09-13 shape-outside should support path() and shape() functions
- 2026-09-10 [corner-shape] Some combinations of corner-shape with thick borders have incorrect rendering
- 2026-09-07 [corner-shape] Add some more shape-outside/corner-shape tests
- 2026-09-05 [corner-shape] `shape-outside` ignores corner-shape for <shape-box> values
- 2026-09-02 [corner-shape] Incorrect rendering when inner corners intersect
- 2026-07-28 [Scroll snap] css/css-scroll-snap/overscroll-snap.html fails in Safari
- 2026-07-25 Safari main thread can block under RemoteLayerTreeEventDispatcher::mainThreadDisplayDidRefresh()
- 2026-07-24 [Scroll snap] Fix css/css-scroll-snap/snap-after-relayout/multiple-aligned-targets/prefer-focused-element.html
- 2026-07-23 Crash under WebPageProxy::sendScrollUpdateForNode() running scrolling-related WPTs