Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 7a5ee54cd51a6c3aa25ca7f40f440d8ec7dc43cb
https://github.com/WebKit/WebKit/commit/7a5ee54cd51a6c3aa25ca7f40f440d8ec7dc43cb
Author: Chris Dumez <[email protected]>
Date: 2026-06-30 (Tue, 30 Jun 2026)
Changed paths:
A LayoutTests/workers/weblock-manager-query-crash-expected.txt
A LayoutTests/workers/weblock-manager-query-crash.html
M Source/WebCore/Modules/web-locks/WebLockManager.cpp
M Source/WebCore/Modules/web-locks/WebLockManager.h
Log Message:
-----------
UAF due to cross-thread destruction of worker DeferredPromise in
WebLockManager::query()
https://bugs.webkit.org/show_bug.cgi?id=312456
rdar://174652399
Reviewed by Ryosuke Niwa.
WebLockManager::MainThreadBridge::query() was taking in a CompletionHandler
but it may sometimes fail to call its completion handler. This happened
when the worker thread is exiting, causing
`ScriptExecutionContext::ensureOnContextThread()`
to fail. Not calling the completion handler is bad but what's worse is that
the completion handler would end up getting destroyed on the main thread.
The completion handler was capturing a promise from the worker thread,
which led to security bugs.
To address the issue:
1. Have WebLockManager::MainThreadBridge::query() take in a Function
instead of a CompletionHandler given that it cannot always call
its callback.
2. Have WebLockManager store the promise in a HashMap and only capture
a promise identifier in the MainThreadBridge::query() lambda instead
of the promise itself. This pattern was already used for other
promises in this class.
Test: workers/weblock-manager-query-crash.html
* LayoutTests/workers/weblock-manager-query-crash-expected.txt: Added.
* LayoutTests/workers/weblock-manager-query-crash.html: Added.
* Source/WebCore/Modules/web-locks/WebLockManager.cpp:
(WebCore::WebLockManager::MainThreadBridge::abortLockRequest):
(WebCore::WebLockManager::MainThreadBridge::query):
(WebCore::WebLockManager::query):
(WebCore::WebLockManager::clientIsGoingAway):
* Source/WebCore/Modules/web-locks/WebLockManager.h:
Originally-landed-as: 305413.688@safari-7624-branch (0b964ced2532).
rdar://180436136
Canonical link: https://commits.webkit.org/316195@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
