Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 4d4fbca02bc3bd88fc79eba08bfd926127e907eb
https://github.com/WebKit/WebKit/commit/4d4fbca02bc3bd88fc79eba08bfd926127e907eb
Author: Jean Haberer <[email protected]>
Date: 2026-06-17 (Wed, 17 Jun 2026)
Changed paths:
M Source/WebKit/UIProcess/ios/fullscreen/WKFullScreenWindowControllerIOS.mm
Log Message:
-----------
Crash can occur when a video is playing in fullscreen and a second video gets
fullscreen'ed in visionOS
https://bugs.webkit.org/show_bug.cgi?id=317218
rdar://171215079
Reviewed by Aditya Keerthi.
The animationBlock and animationCompletionBlock C++ lambdas in
_performSpatialFullScreenTransition: captured self, inWindow, outWindow, and
originalState as raw Objective-C pointers. When the controller's owning ivars
were released while the animation chain was still in flight, those captures
dangled and UIKit hit a use-after-free in objc_msgSend. Capture them as
RetainPtr<> instead, matching the resizeCompletionBlock pattern right
above.
* Source/WebKit/UIProcess/ios/fullscreen/WKFullScreenWindowControllerIOS.mm:
(-[WKFullScreenWindowController
_performSpatialFullScreenTransition:completionHandler:]):
Canonical link: https://commits.webkit.org/315357@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
