Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 15c722b934e53ef7e5da1dcf30715b7b6a797a93
https://github.com/WebKit/WebKit/commit/15c722b934e53ef7e5da1dcf30715b7b6a797a93
Author: Chris Dumez <[email protected]>
Date: 2026-06-29 (Mon, 29 Jun 2026)
Changed paths:
A
LayoutTests/http/tests/site-isolation/find-string-with-cross-page-focused-frame-crash-expected.txt
A
LayoutTests/http/tests/site-isolation/find-string-with-cross-page-focused-frame-crash.html
M Source/WTF/wtf/ListHashSet.h
M Source/WebKit/UIProcess/WebFrameProxy.cpp
M Source/WebKit/UIProcess/WebPageProxy.cpp
Log Message:
-----------
[WebKit Process Model | All] Wrong-container end() comparison in
WebFrameProxy::nextSibling/previousSibling
https://bugs.webkit.org/show_bug.cgi?id=315348
rdar://176891673
Reviewed by Ryosuke Niwa.
WebFrameProxy::nextSibling() and previousSibling() obtain an iterator from
m_parentFrame->m_childFrames.find(this) but compare it against this frame's own
m_childFrames.end(). ListHashSet const_iterator equality compares only
m_position,
so the not-found guard is structurally always false in Release. They also call
last()/first() on the parent's m_childFrames without checking isEmpty(), which
dereferences the sentinel of an empty list.
A child can have a non-null m_parentFrame whose m_childFrames no longer contains
it because webProcessWillShutDown() and removeChildFrames() drop the parent's
child set without nulling each child's m_parentFrame. A compromised WebContent
process can keep such a frame alive across pages because focusedFrameChanged()
does not verify that the looked-up frame belongs to this page before storing it
in m_focusedFrame. Under Site Isolation, FindStringCallbackAggregator's
destructor
then traverses from focusedOrMainFrame() through nextSibling() on the orphaned
child, advances past the parent's sentinel, and returns &parent.m_parentFrame's
WeakPtr impl typed as WebFrameProxy*, leading to an EXC_ARM_PAC_FAIL in CFRetain
in the UI process.
Fix all four sites: compare against the parent's end(), early-return when the
parent's child set is empty, null each child's m_parentFrame when emptying
m_childFrames in webProcessWillShutDown() and removeChildFrames(), and
MESSAGE_CHECK in focusedFrameChanged() that the frame belongs to this page.
Also do hardening in ListHashSet so that calling first() / last() on an
empty set crashes safely.
Test:
http/tests/site-isolation/find-string-with-cross-page-focused-frame-crash.html
*
LayoutTests/http/tests/site-isolation/find-string-with-cross-page-focused-frame-crash-expected.txt:
Added.
*
LayoutTests/http/tests/site-isolation/find-string-with-cross-page-focused-frame-crash.html:
Added.
* Source/WTF/wtf/ListHashSet.h:
(WTF::U>::first):
(WTF::U>::first const):
(WTF::U>::last):
(WTF::U>::last const):
* Source/WebKit/UIProcess/WebFrameProxy.cpp:
(WebKit::WebFrameProxy::webProcessWillShutDown):
(WebKit::WebFrameProxy::removeChildFrames):
(WebKit::WebFrameProxy::nextSibling const):
(WebKit::WebFrameProxy::previousSibling const):
* Source/WebKit/UIProcess/WebPageProxy.cpp:
(WebKit::WebPageProxy::focusedFrameChanged):
Originally-landed-as: 305413.957@safari-7624-branch (7b5d09d5675a).
rdar://180428790
Canonical link: https://commits.webkit.org/316041@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
