squelart
WebCore contributor
Summary
Works almost entirely in WebCore's canvas and pixel-buffer layer — the ArrayPixelBuffer/TypedArrayPixelBuffer refactor, Float16/RGBA16F canvas and ImageData support, ShareableBitmapConfiguration pixel formats, and canvas text drawing caches. The pattern is feature plumbing rather than security work, but the bug fixes cluster around size and format validation on that new pixel path: multiplication overflow in the bytesPerRow() validator, Float16 buffer size checks before conversion, mismatched pixelFormats reaching the ImageData JS constructor, and an OffscreenCanvas crash in page-less worker processes. Systematic-variant candidate: the RGBA16F/Float16 canvas surface is recent and still being widened across ImageData, ShareableBitmap, and convertImagePixels — the format- and length-agreement checks between JS-visible typed arrays and the underlying buffers are the place to sweep.
Components
Security Fix History
Hardening Commits
- No hardening commits recorded
Recent Commits
- 2026-08-07 Accelerated convertImagePixels for PixelFormat::RGBA16F
- 2026-08-04 CanvasRenderingContext2DBase should cache a generic ArrayPixelBuffer
- 2026-08-03 Float16 canvas and ImageData require RGBA16F
- 2026-07-31 Make ImageData work with non-Typed ArrayPixelBuffer
- 2026-07-29 Catch mismatched pixelFormats in ImageData JS constructor
- 2026-07-28 Add float16 canvas tests with all predefined color spaces
- 2026-07-23 Add PixelFormat to ShareableBitmapConfiguration
- 2026-07-19 ArrayPixelBuffer superclass of TypedArrayPixelBuffer
- 2026-07-15 Canvas drawTextUnchecked does't always draw when using maxWidth
- 2026-07-14 Refactor {Byte,Float16}ArrayPixelBuffer into a TypedArrayPixelBuffer template
- 2026-07-06 Worker OffscreenCanvas crashes in a page-less worker process
- 2026-06-11 Check Float16 buffer sizes before conversion
- 2026-05-21 StyleOriginatedTimelinesController::documentDidResolveStyle: Use removeIf
- 2026-04-01 Cache display lists for Canvas drawText's
- 2026-03-25 Cull simple non-empty canvas text drawing outside of the clip