Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: ddbf9329b2ca0320f16820b18c3ea88f5a534eb9
https://github.com/WebKit/WebKit/commit/ddbf9329b2ca0320f16820b18c3ea88f5a534eb9
Author: Charlie Wolfe <[email protected]>
Date: 2025-06-03 (Tue, 03 Jun 2025)
Changed paths:
M Source/WebCore/history/BackForwardCache.cpp
M Source/WebCore/page/LocalFrameView.cpp
Log Message:
-----------
Use-after-free in `LocalFrameView::setContentsSize`
https://bugs.webkit.org/show_bug.cgi?id=290985
rdar://148564650
Reviewed by Chris Dumez.
Crash data indicates that we crash when trying to create a RefPtr to Frame in
BackForwardCache::markPagesForContentsSizeChanged. The RefPtr is new in
288208@main, but that likely just
exposed an existing UAF, since Page is not protected in setContentsSize.
Protect Page and remove the
unnecessary RefPtr, as it’s only used for address comparison.
* Source/WebCore/history/BackForwardCache.cpp:
(WebCore::BackForwardCache::markPagesForContentsSizeChanged):
* Source/WebCore/page/LocalFrameView.cpp:
(WebCore::LocalFrameView::setContentsSize):
Originally-landed-as: 289651.396@safari-7621-branch (0310ffa2dd20).
rdar://151712931
Canonical link: https://commits.webkit.org/295754@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
