July 2025 - webkit-dev - lists.webkit.org

InjectedBundle deprecation
by Alex Christensen 01 Aug '25

01 Aug '25

Hello WebKit developers! We are ramping up to do some serious work on Site Isolation which includes putting cross-origin iframes in a different process than the parent frame. Similar efforts have been done in other browser engines and some related work has already been done in WebKit, but not enough. This will do strange things to the InjectedBundle APIs, which have fundamental assumptions that the whole DOM is in one process and that communication only happens with one process at a time. We have never exposed InjectedBundle APIs as public API, but some other distributors of WebKit have. As we make progress on this project, we anticipate that anything in Source/WebKit/WebProcess/InjectedBundle/API is subject to deprecation and removal. This will also allow us to tighten the sandbox on the web process, resolve security and performance issues, and have cleaner code. Would the maintainers of the GTK and WPE APIs be willing to assist in migrating from those APIs and designing replacements in the UI process? Alex Christensen

5 17

Site isolation
by Alex Christensen 01 Aug '25

01 Aug '25

The SiteIsolation feature is beginning to work in the simplest of cases, but I had to do some work in the Source/WebKit/Shared/RemoteLayerTree directory, which is platform-specific. Basically all the use of LayerHostingContextIdentifier in that directory needs an equivalent implementation for other graphics implementations, like in the CoordinatedGraphics directories. There is one layout test in LayoutTests/http/tests/site-isolation/basic-iframe.html that is currently skipped on all non-Cocoa platforms. Is someone willing to collaborate to design and implement the feature in non-Cocoa ports? We are in the early stages of the project and have a long way to go, so I imagine things will continue to come up, like deciding how to implement event handling and other platform dependent features. Alex

3 6

GPU process
by Alex Christensen 31 Jul '25

31 Jul '25

With https://commits.webkit.org/297354@main I removed the code on new Cocoa platforms that supports multi-process WebKit running without the GPU process. We are planning to remove support for such configurations in 2 years. Are there platforms that don’t support using a GPU process, and if so could they migrate in 2 years?

2 1

Proposal: Remove mixed content handling settings
by Ruthvik Konda 23 Jul '25

23 Jul '25

Hi everyone, In order to fully align with the latest Mixed Content Handling spec, bolster security, and create a better architecture for our upcoming site isolation changes, I am proposing the removal of the following settings/functions/signal below. allowRunningOrDisplayingInsecureContent isStrictMixedContentMode allowRunningOfInsecureContent allowDisplayOfInsecureContent setFoundMixedContext didDisplayInsecureContent didRunInsecureContent WebKitWebView::insecure-content-detected signal A few years ago, there was strong support for these removals here: https://github.com/WebKit/WebKit/pull/9577#discussion_r1095915718 but due to time constraints, they never happened. I’d like to restart the conversation and hopefully get these changes done. Please let me know what you think. Thanks, Ruthvik

2 1

JavaScript evaluation result abstraction
by Alex Christensen 18 Jul '25

18 Jul '25

I did most of the work on https://github.com/WebKit/WebKit/pull/47851 but a few pieces need implementing by someone who is more involved in glib API maintenance. Specifically, I had these two questions I didn’t know the answer to: 1. How long are we planning to keep ENABLE(2022_GLIB_API) in our repo? 2. What types of JavaScript value return types do we want to continue to support? Is the existing number/array/dictionary/string/date/null abstraction enough, or is there a specific need to support more types?

2 1

Tree Closure July 4th - July 5th
by Jonathan Bedard 03 Jul '25

03 Jul '25

We have an extended outage of one of the resources we rely on for post-commit continuous integration over the July 4th weekend. WebKit will need to close its tree. The WebKit repositories will be closed from 6 pm PDT on July 4th to 12 pm PDT on July 5th. During this time, WebKit's Merge-Queue will be unavailable. WebKit EWS will continue to operate, and PRs annotated with the various `merge-` labels will be processed once the tree re-opens. Jonathan Bedard WebKit Continuous Integration

1 0

Proposal: Removing ENABLE(CONTENT_EXTENSIONS)
by Basuke Suzuki 02 Jul '25

02 Jul '25

Hi WebKittens, I would like to remove ENABLE(CONTENT_EXTENSIONS) compile time flag and always enable CONTENT_EXTENSIONS. This feature has been enabled on Apple platforms for 9 years and on GTK/WPE ports for a long time. Currently, only Windows and PlayStation ports have it disabled. Even when CONTENT_EXTENSIONS is enabled at compile time, it has no runtime effect unless content extensions backend is explicitly configured through platform-specific APIs. Since Windows and PlayStation ports don't expose such APIs, enabling this flag would only affect binary size without any behavioral changes. Given that: The feature is mature and stable (9+ years in production) Most ports already have it enabled It requires explicit API usage to activate The only impact for Windows/PlayStation is binary size I believe we can simplify the codebase by removing this compile-time flag. Best regards, Basuke Suzuki

2 1