Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 4e721b046f9e0d2445eb476e4d0d56d7306c6add
https://github.com/WebKit/WebKit/commit/4e721b046f9e0d2445eb476e4d0d56d7306c6add
Author: Timothy Hatcher <[email protected]>
Date: 2026-07-01 (Wed, 01 Jul 2026)
Changed paths:
M Source/WebKit/Shared/Extensions/WebExtensionSQLiteDatabase.h
Log Message:
-----------
Cherry-pick 0a9952c703a7. rdar://176483124
Use-after-free in WebExtensionSQLiteDatabase via cross-thread non-atomic
RefCounted race.
https://webkit.org/b/314569
rdar://176483124
Reviewed by Abrar Rahman Protyasha.
WebExtensionSQLiteDatabase used a non-atomic RefCounted base despite its
refcount being accessed
concurrently from both the WKWebExtensionSQLiteStore WorkQueue and the UI
main thread, so
concurrent ref/deref operations could corrupt the count and cause a
premature free.
* Source/WebKit/Shared/Extensions/WebExtensionSQLiteDatabase.h: Use
ThreadSafeRefCounted.
Identifier: 305413.879@safari-7624-branch
Originally-landed-as: [email protected] (957a87db434a).
rdar://180436843
Canonical link: https://commits.webkit.org/316314@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
