Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: bbd73ca6e43642eb61c6ec6e6f1b56d7cfb189b4
https://github.com/WebKit/WebKit/commit/bbd73ca6e43642eb61c6ec6e6f1b56d7cfb189b4
Author: Youenn Fablet <[email protected]>
Date: 2026-06-29 (Mon, 29 Jun 2026)
Changed paths:
A
LayoutTests/http/wpt/background-fetch/change-documents-in-progress-event-sw.js
A
LayoutTests/http/wpt/background-fetch/change-documents-in-progress-event.window-expected.txt
A
LayoutTests/http/wpt/background-fetch/change-documents-in-progress-event.window.html
A
LayoutTests/http/wpt/background-fetch/change-documents-in-progress-event.window.js
M
Source/WebCore/workers/service/background-fetch/BackgroundFetchRegistration.cpp
Log Message:
-----------
[WebCore] heap use-after-free in
SWClientConnection::updateBackgroundFetchRegistration due to live HashTable
iterator invalidation during synchronous progress event dispatch
rdar://175673953
Reviewed by Chris Dumez.
Firing an event synchronously while iterating through documents is unsafe.
Instead we queue a task to fire the events in their own task.
This way we can iterate through documents without risking to mutate documents.
Test: http/wpt/background-fetch/change-documents-in-progress-event.window.html
*
LayoutTests/http/wpt/background-fetch/change-documents-in-progress-event-sw.js:
Added.
*
LayoutTests/http/wpt/background-fetch/change-documents-in-progress-event.window-expected.txt:
Added.
*
LayoutTests/http/wpt/background-fetch/change-documents-in-progress-event.window.html:
Added.
*
LayoutTests/http/wpt/background-fetch/change-documents-in-progress-event.window.js:
Added.
(promise_test.async t):
*
Source/WebCore/workers/service/background-fetch/BackgroundFetchRegistration.cpp:
(WebCore::BackgroundFetchRegistration::updateInformation):
Originally-landed-as: 305413.782@safari-7624-branch (1b0af7fe2393).
rdar://180427961
Canonical link: https://commits.webkit.org/316035@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
