Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: ea3fbf953c9b67c34da24a74cfd5331221a1beb1
https://github.com/WebKit/WebKit/commit/ea3fbf953c9b67c34da24a74cfd5331221a1beb1
Author: Timothy Hatcher <[email protected]>
Date: 2026-07-01 (Wed, 01 Jul 2026)
Changed paths:
M
Source/WebKit/UIProcess/Extensions/Cocoa/_WKWebExtensionDeclarativeNetRequestRule.mm
Log Message:
-----------
Use-after-free in -[_WKWebExtensionDeclarativeNetRequestRule
_resourcesToTargetWhenNoneAreSpecifiedInRule] on concurrent queue.
https://webkit.org/b/314567
rdar://176483583
Reviewed by Kiara Rose.
ARC zero-initialized statics don't get a compiler-generated thread-safety
guard, so concurrent
declarativeNetRequest rule compilation could retain a freed array in the UI
Process.
*
Source/WebKit/UIProcess/Extensions/Cocoa/_WKWebExtensionDeclarativeNetRequestRule.mm:
(-[_WKWebExtensionDeclarativeNetRequestRule
_resourcesToTargetWhenNoneAreSpecifiedInRule]): Use dispatch_once.
Originally-landed-as: 305413.888@safari-7624-branch (2f23765bb37e).
rdar://180438464
Canonical link: https://commits.webkit.org/316281@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
