Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: c07f39302a15e19b3b83576056450bb0178512f5
https://github.com/WebKit/WebKit/commit/c07f39302a15e19b3b83576056450bb0178512f5
Author: Ari Young <[email protected]>
Date: 2026-06-17 (Wed, 17 Jun 2026)
Changed paths:
M
Source/WebKit/UIProcess/Extensions/Cocoa/API/WebExtensionContextAPITabsCocoa.mm
M Tools/TestWebKitAPI/Tests/WebKit/WKWebView/WKWebExtensionAPITabs.mm
Log Message:
-----------
WebExtensionContext::tabsRemove may call the completion handler multiple
times if passed multiple invalid tab IDs
rdar://179273354
https://bugs.webkit.org/show_bug.cgi?id=317230
Reviewed by Kiara Rose and Timothy Hatcher.
`WebExtensionContext::tabsRemove` built its list of tabs with `Vector::map`,
which visits every
identifier in the array. If any id was invalid (i.e., `getTab` returned
`nullptr` for it), then the
`map` lambda would immediately call the completion handler. If there were
multiple invalid tab
identifiers, then this would result in the completion handler being called
multiple times, crashing
the browser.
To fix this, just use a for loop instead of map. If any invalid identifiers are
found, call the
completion handler once and bail out of `tabsRemove`.
Test: Tools/TestWebKitAPI/Tests/WebKit/WKWebView/WKWebExtensionAPITabs.mm
*
Source/WebKit/UIProcess/Extensions/Cocoa/API/WebExtensionContextAPITabsCocoa.mm:
(WebKit::WebExtensionContext::tabsRemove):
* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/WKWebExtensionAPITabs.mm:
(TestWebKitAPI::TEST(WKWebExtensionAPITabs, RemoveMultipleInvalidTabs)):
Canonical link: https://commits.webkit.org/315353@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
