March 2025 - webkit-dev - lists.webkit.org

InjectedBundle deprecation
by Alex Christensen 01 Aug '25

01 Aug '25

Hello WebKit developers! We are ramping up to do some serious work on Site Isolation which includes putting cross-origin iframes in a different process than the parent frame. Similar efforts have been done in other browser engines and some related work has already been done in WebKit, but not enough. This will do strange things to the InjectedBundle APIs, which have fundamental assumptions that the whole DOM is in one process and that communication only happens with one process at a time. We have never exposed InjectedBundle APIs as public API, but some other distributors of WebKit have. As we make progress on this project, we anticipate that anything in Source/WebKit/WebProcess/InjectedBundle/API is subject to deprecation and removal. This will also allow us to tighten the sandbox on the web process, resolve security and performance issues, and have cleaner code. Would the maintainers of the GTK and WPE APIs be willing to assist in migrating from those APIs and designing replacements in the UI process? Alex Christensen

5 17

Site isolation
by Alex Christensen 01 Aug '25

01 Aug '25

The SiteIsolation feature is beginning to work in the simplest of cases, but I had to do some work in the Source/WebKit/Shared/RemoteLayerTree directory, which is platform-specific. Basically all the use of LayerHostingContextIdentifier in that directory needs an equivalent implementation for other graphics implementations, like in the CoordinatedGraphics directories. There is one layout test in LayoutTests/http/tests/site-isolation/basic-iframe.html that is currently skipped on all non-Cocoa platforms. Is someone willing to collaborate to design and implement the feature in non-Cocoa ports? We are in the early stages of the project and have a long way to go, so I imagine things will continue to come up, like deciding how to implement event handling and other platform dependent features. Alex

3 6

Proposed feature: Secure Payment Confirmation
by Rick Byers 21 Mar '25

21 Mar '25

Hi WebKit! I'm sending this according to the policy to discuss new feature proposals on webkit-dev <https://trac.webkit.org/wiki/AddingFeatures>. We, the Google Chrome team, are exploring the possibility of shipping the W3C Secure Payment Confirmation API <https://www.w3.org/TR/secure-payment-confirmation/> in Chrome on iOS and would like to know if proposing patches in WebKit for an off-by-default feature which can be enabled at runtime by Chrome is an option we should be considering? We had assumed our only viable option was to attempt to implement it via injected JavaScript (as we had previously implemented PaymentRequest <https://www.w3.org/TR/payment-request/>), but this may not be technically possible without changes to the specification and has obvious downsides. Based on Apple's comments about the openness of the WebKit project to third-party prioritization of features for third-party browsers [1], I figured I should at least ask to see if our assumption was out-of-date? Discussion in the WebKit standards position <https://github.com/WebKit/standards-positions/issues/30#issuecomment-117836…> for this feature does not seem to have concluded, but we are happy to continue to engage on the details there. We'd be thrilled to collaborate with the WebKit community on this if there is interest. Thank you! Rick [1] https://assets.publishing.service.gov.uk/media/66d6c524c52d5fb4c82ddd65/202… p81

1 0

Tree Closure March 15th-16th
by Jonathan Bedard 14 Mar '25

14 Mar '25

Hey folks, There is an Apple service critical for our post-commit builds has a prolonged maintenance outage this weekend from 10 am Saturday to 6 am Sunday (Pacific time). As a consequence of this outage, WebKit will need to close our tree for the duration of the outage. From 8 am Saturday the 15th to 6 am Sunday the 16th (Pacific time), the WebKit trees will be closed. Merge-queue will just back up during this time and EWS will continue to function as it normally does. Any commits queued for landing during the outage will be picked up when the tree reopens Sunday morning. Jonathan Bedard WebKit Continuous Integration

1 0

Glib download API change request
by Alex Christensen 14 Mar '25

14 Mar '25

Since the introduction of WKDownload in 2020, I’ve been trying to make the download object creation process asynchronous in WebKit. With 290510@main I’ve removed the last caller of WebProcessPool::download from the Cocoa platform, but I noticed that the glib APIs have 3 places where a WebKitDownload* object is returned synchronously from an API call: webkit_web_context_download_uri, webkit_web_view_download_uri, and webkit_network_session_download_uri. Would the maintainers of these APIs be willing to deprecate and remove them in favor of an API design closer to WKWebView’s startDownloadUsingRequest:completionHandler:? That function is given a callback which asynchronously provides the download object to the API client. It would also be nice if webkit_download_cancel could be reshaped to look more like WKDownload.cancel: and stop using legacyDidCancel.

3 5

Patrick Griffis is now a WebKit reviewer
by Tim Nguyen 12 Mar '25

12 Mar '25

Hi everyone! I’m delighted to announce that Patrick Griffis is now a WebKit reviewer! 🎉 Patrick has showed expertise in Navigation code, maintains the GTK port and built the Linux web process sandbox. Please feel free to reach out to him for reviews. Cheers, Tim

1 0