szewai
Site Isolation contributor
Summary
szewai works primarily on Site Isolation and the process model surrounding it, with a secondary concentration in storage and networking internals — IndexedDB cursors and transaction handling, network cache record traversal, cookie versioning, and NetworkProcess lifecycle races. A recurring thread is shared-process eligibility policy: successive commits carve first-party, autofilled, and loopback/local-network sites out of the shared web process, meaning the criteria for which origins may be co-resident have been actively changing rather than stable. The security-labeled work fits the same footprint — an IndexedDB use-after-free from `-0.0` key hashing and an IPC endpoint gated behind `AllowTestOnlyIPC` — alongside adjacent changes that soften MESSAGE_CHECK into RELEASE_LOG_FAULT with early return and remove stale assertions. Systematic-variant candidate: the shared-process admission checks, where each exclusion landed separately and the remaining categories may not be covered; also worth sweeping for other IndexedDB key-normalization edge cases and for release-build behavior where MESSAGE_CHECK enforcement was relaxed.
Components
Security Fix History
Hardening Commits
- No hardening commits recorded
Recent Commits
- 2026-08-07 Network cache traversal decodes every record in full just to read its URL
- 2026-08-07 [Site Isolation] First-party sites should not enter shared process
- 2026-08-07 Web Extensions load with significant delay on iOS 26.6 when Safari is cold launched
- 2026-08-06 [Site Isolation] WebProcessProxy::m_sharedProcessDomains only tracks the first domain loaded in shared process
- 2026-08-06 [macOS] ASSERTION FAILED: callback.version < m_cookiesVersion /Volumes/Data/worker/macOS-Tahoe-Debug-Build-EWS/build/Sou
- 2026-08-04 Add a "pid=" label and stagger frame process indicators by nesting depth
- 2026-07-31 [Site Isolation] Cross-site iframe does not render after same-site top-level navigation
- 2026-07-30 REGRESSION(315609@main): Aborting many in-progress transactions of a suspended process can cause stack overflow
- 2026-07-29 [Site Isolation] Autofilled sites should not enter shared process
- 2026-07-24 [Site Isolation] Loopback/local-network sites should not enter shared process
- 2026-07-23 NEW TEST(316740@main): [macOS] TestWebKitAPI.PasteImage.PasteFileWhileNetworkProcessIsLaunching is a constant failure
- 2026-07-23 [Site Isolation] Fix TestWebKitAPI.SiteIsolation.QueryFramesStateAfterNavigating
- 2026-07-20 [IndexedDB] Opening a 'nextunique'/'prevunique' cursor over an empty key range fails with an UnknownError
- 2026-07-17 [Site Isolation] Fix TestWebKitAPI.ProcessSwap.NavigateToDataURLThenBack
- 2026-07-15 Remove stale assertion in NetworkProcess::destroySession