Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 3238a81fbf2be9bf05ff044416d78a1d52e423ff
https://github.com/WebKit/WebKit/commit/3238a81fbf2be9bf05ff044416d78a1d52e423ff
Author: Tyler Wilcock <[email protected]>
Date: 2026-05-08 (Fri, 08 May 2026)
Changed paths:
M Source/WebCore/accessibility/AXTextMarker.cpp
Log Message:
-----------
AX: Protect against infinite loops in various AXTextMarker functions
https://bugs.webkit.org/show_bug.cgi?id=314360
rdar://176510664
Reviewed by Dominic Mazzoni.
Six functions in AXTextMarker.cpp walk the AX tree forward via findMarker(),
findObjectWithRuns(), or nextInPreOrder() inside a while loop, terminating only
when the walked pointer/marker reaches a target or becomes null. If the
underlying advance ever returns its input each of these loops would spin
forever on the AX thread.
Add a one-branch no-progress guard to each loop: snapshot the previous
pointer/marker, compare to the post-advance value, and break (with
AX_ASSERT_NOT_REACHED to surface the bug in debug builds) if they're equal. Each
guard is gated with [[unlikely]] since it _should_ never happen.
Functions hardened:
* AXTextMarkerRange::toString — findObjectWithRuns walk to end's objectID
* AXTextMarker::offsetFromRoot — findMarker / nextInPreOrder walk to *this
* AXTextMarker::nextMarkerFromOffset — findMarker countdown walk
* AXTextMarker::findLastBefore — findObjectWithRuns walk to stopAtID
* AXTextMarkerRange::viewportRelativeFrame — findObjectWithRuns walk to end
* AXTextMarker::toTextRunMarker — findObjectWithRuns walk by accumulator
* Source/WebCore/accessibility/AXTextMarker.cpp:
(WebCore::AXTextMarkerRange::toString const):
(WebCore::AXTextMarker::offsetFromRoot const):
(WebCore::AXTextMarker::nextMarkerFromOffset const):
(WebCore::AXTextMarker::findLastBefore const):
(WebCore::AXTextMarkerRange::viewportRelativeFrame const):
(WebCore::AXTextMarker::toTextRunMarker const):
Canonical link: https://commits.webkit.org/312879@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
