Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 9ca4025a7330d295a5f7931d5cbebea6788e7b46
https://github.com/WebKit/WebKit/commit/9ca4025a7330d295a5f7931d5cbebea6788e7b46
Author: Ahmad Saleem <[email protected]>
Date: 2026-06-28 (Sun, 28 Jun 2026)
Changed paths:
M Source/WebCore/platform/graphics/ImageBuffer.cpp
Log Message:
-----------
ImageBuffer::transferToNewContext() can null-deref backend()
https://bugs.webkit.org/show_bug.cgi?id=318049
rdar://180836227
Reviewed by Kimmo Kinnunen.
ImageBuffer::transferToNewContext() was the only method in ImageBuffer
that dereferenced backend() raw, while every sibling method guards with
`if (auto* backend = ensureBackend())`. Its sole caller,
RemoteRenderingBackend::moveToImageBuffer(), operates on a serialized
ImageBuffer taken from the resource cache. Backend allocation can
legitimately fail (size limits / OOM), leaving a live ImageBuffer whose
m_backend is null, so transferToNewContext() would null-deref.
Guard the access with ensureBackend(), matching the established pattern
used throughout ImageBuffer. When there is no backend there is nothing
to transfer, so skipping the call is correct.
* Source/WebCore/platform/graphics/ImageBuffer.cpp:
(WebCore::ImageBuffer::transferToNewContext):
Canonical link: https://commits.webkit.org/315982@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
