Branch: refs/heads/webkitglib/2.52
Home: https://github.com/WebKit/WebKit
Commit: a9bfb79a0956e18e86eefa0ce9f3314a93651440
https://github.com/WebKit/WebKit/commit/a9bfb79a0956e18e86eefa0ce9f3314a93651440
Author: Brady Eidson <[email protected]>
Date: 2026-08-20 (Thu, 20 Aug 2026)
Changed paths:
M Source/WebKit/UIProcess/WebBackForwardList.cpp
M Tools/TestWebKitAPI/Tests/WebKit/WKBackForwardListTests.mm
Log Message:
-----------
Cherry-pick [email protected] (ce08c270d322).
https://bugs.webkit.org/show_bug.cgi?id=317142
Incomplete fix of WebKit bug 315528 (Message check file urls in
back/forward list messages)
rdar://177953315
Reviewed by Chris Dumez.
Apply the message check to sub-items in the history item tree, and other
validations of the tree.
Test: Tools/TestWebKitAPI/Tests/WebKit/WKBackForwardListTests.mm
* Source/WebKit/UIProcess/WebBackForwardList.cpp:
(WebKit::messageCheckItemURLs):
* Tools/TestWebKitAPI/Tests/WebKit/WKBackForwardListTests.mm:
((WKBackForwardList, MessageCheckRejectsNestedFileURLChild)):
((WKBackForwardList, MessageCheckRejectsDeeplyNestedFileURLChild)):
((WKBackForwardList, MessageCheckRejectsExcessiveChildDepth)):
((WKBackForwardList, MessageCheckAcceptsBenignNestedChildren)):
Identifier: [email protected]
Canonical link: https://commits.webkit.org/305877.1107@webkitglib/2.52
Commit: 782ee5a34a0b5882d0b53288c390c45b3f8f02fc
https://github.com/WebKit/WebKit/commit/782ee5a34a0b5882d0b53288c390c45b3f8f02fc
Author: Chris Dumez <[email protected]>
Date: 2026-08-20 (Thu, 20 Aug 2026)
Changed paths:
A
LayoutTests/http/tests/webshare/shareddatareader-didfinishloading-crash-expected.txt
A
LayoutTests/http/tests/webshare/shareddatareader-didfinishloading-crash.html
M Source/WebCore/page/ShareDataReader.cpp
M Source/WebCore/page/ShareDataReader.h
Log Message:
-----------
Cherry-pick [email protected] (890fde552386).
https://bugs.webkit.org/show_bug.cgi?id=317270
[WebCore] use-after-free in ShareDataReader::didFinishLoading: cancel()
called on freed this after completionHandler destruction
https://bugs.webkit.org/show_bug.cgi?id=317270
rdar://177909918
Reviewed by Per Arne Vollan and Ben Nham.
Make sure we capture `weakThis` in the lambda instead of `this`, then
convert to a RefPtr before calling `didfinishLoading()` so that `this`
cannot be destroyed *while* running `didfinishLoading()`.
Test: http/tests/webshare/shareddatareader-didfinishloading-crash.html
*
LayoutTests/http/tests/webshare/shareddatareader-didfinishloading-crash-expected.txt:
Added.
*
LayoutTests/http/tests/webshare/shareddatareader-didfinishloading-crash.html:
Added.
* Source/WebCore/page/ShareDataReader.cpp:
(WebCore::ShareDataReader::start):
* Source/WebCore/page/ShareDataReader.h:
Identifier: [email protected]
Canonical link: https://commits.webkit.org/305877.1108@webkitglib/2.52
Commit: 6733d583efbd3537b1d1d18b7b409bfb5ed22ed0
https://github.com/WebKit/WebKit/commit/6733d583efbd3537b1d1d18b7b409bfb5ed22ed0
Author: Youenn Fablet <[email protected]>
Date: 2026-08-20 (Thu, 20 Aug 2026)
Changed paths:
M Source/ThirdParty/libwebrtc/Source/webrtc/p2p/dtls/dtls_transport.cc
Log Message:
-----------
Cherry-pick [email protected] (17b41f27a761).
https://bugs.webkit.org/show_bug.cgi?id=317270
missing UnsubscribeReadyToSend/NetworkRouteChanged in LibWebRTC
~DtlsTransportInternalImpl causes use-after-free
rdar://177131722
Reviewed by Eric Carlson.
We unregister all callbacks that were registered when connecting to the ICE
transport.
Test validated with a specific STUN server.
* Source/ThirdParty/libwebrtc/Source/webrtc/p2p/dtls/dtls_transport.cc:
Identifier: [email protected]
Canonical link: https://commits.webkit.org/305877.1109@webkitglib/2.52
Compare: https://github.com/WebKit/WebKit/compare/46c2bf82724f...6733d583efbd
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
