Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 984f3c499a525b20dec24480796813d87ee665f7
https://github.com/WebKit/WebKit/commit/984f3c499a525b20dec24480796813d87ee665f7
Author: Basuke Suzuki <[email protected]>
Date: 2026-06-23 (Tue, 23 Jun 2026)
Changed paths:
M Source/WebCore/page/Navigation.cpp
Log Message:
-----------
[Navigation API] Crash in
MethodTrackerRegistry::promoteUpcomingTraverseToOngoing with null destination
key
https://bugs.webkit.org/show_bug.cgi?id=317623
rdar://180282129
Reviewed by Per Arne Vollan.
Navigation::dispatchTraversalNavigateEvent constructs a NavigationDestination
whose key() returns a null String when the destination has no associated
NavigationHistoryEntry, or when the entry's document is no longer fully
active. innerDispatchNavigateEvent then forwards that null key into
MethodTrackerRegistry::promoteUpcomingTraverseToOngoing(), which calls
HashMap<String, ...>::take() with it. HashTraits<String>::isEmptyValue(s)
is defined as s.isNull(), so a null String is the HashTable empty-value
sentinel; passing it to take() violates the HashTable invariant and ends
up running StringHash::hash() on a null StringImpl*, producing a null
deref reading m_hashAndFlags at offset 16 (ASan SEGV at 0x10).
Guard the MethodTrackerRegistry boundary so a null key never reaches the
HashMap, mirroring the existing null-key guard in unregister(). Returning
nullptr is the correct semantic: callers in innerDispatchNavigateEvent
already handle apiMethodTracker == nullptr.
Covered by existing tests.
* Source/WebCore/page/Navigation.cpp:
(WebCore::Navigation::MethodTrackerRegistry::upcomingTraverse const):
(WebCore::Navigation::MethodTrackerRegistry::promoteUpcomingTraverseToOngoing):
Canonical link: https://commits.webkit.org/315685@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
