Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 340be14e845960e5700085d3baa01659ae57a31c
https://github.com/WebKit/WebKit/commit/340be14e845960e5700085d3baa01659ae57a31c
Author: Chris Dumez <[email protected]>
Date: 2026-07-13 (Mon, 13 Jul 2026)
Changed paths:
M Source/WTF/wtf/Assertions.cpp
Log Message:
-----------
WTFReportBacktraceWithStackDepth may print uninitialized stack frames when
the captured stack is shallower than requested
https://bugs.webkit.org/show_bug.cgi?id=319226
Reviewed by Keith Miller.
WTFReportBacktraceWithPrefixAndStackDepth() allocates an uninitialized
Vector<void*> sized to the requested depth, then asks WTFGetBacktrace()
to fill it. WTFGetBacktrace() writes the *actual* number of captured
frames back into the `frames` variable, which may be smaller than the
request when the real stack is shallow.
The subsequent subspan() used the originally-requested `framesToShow`
as its length rather than the actual captured count, so when the stack
was shallower than requested it spanned into the uninitialized tail of
the Vector and printed garbage pointers as stack frames. The span stayed
within the allocation, so this was an uninitialized read rather than an
out-of-bounds access.
Use `frames - kDefaultFramesToSkip` for the span length, matching the
sibling functions WTFReportBacktraceWithPrefixAndPrintStream() and
WTFReportBacktrace().
* Source/WTF/wtf/Assertions.cpp:
Canonical link: https://commits.webkit.org/317034@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
