Branch: refs/heads/webkitglib/2.52
Home: https://github.com/WebKit/WebKit
Commit: 9d4566c36595a8a9e96d65171179925e6d4bf5c7
https://github.com/WebKit/WebKit/commit/9d4566c36595a8a9e96d65171179925e6d4bf5c7
Author: Pascoe <[email protected]>
Date: 2026-08-07 (Fri, 07 Aug 2026)
Changed paths:
M Source/WebCore/loader/FrameLoader.cpp
M Tools/TestWebKitAPI/Tests/WebKitCocoa/VerifyUserGestureFromUIProcess.mm
Log Message:
-----------
Cherry-pick 2057f457fb75. https://bugs.webkit.org/show_bug.cgi?id=316816
Popunder bypass via overlappping transient activations
https://bugs.webkit.org/show_bug.cgi?id=316816
rdar://177442177
Reviewed by Charlie Wolfe and Abrar Rahman Protyasha.
We should consume transient activations to avoid popunders.
Test:
Tools/TestWebKitAPI/Tests/WebKitCocoa/VerifyUserGestureFromUIProcess.mm
* Source/WebCore/loader/FrameLoader.cpp:
(WebCore::createWindow):
* Tools/TestWebKitAPI/Tests/WebKitCocoa/VerifyUserGestureFromUIProcess.mm:
(TestWebKitAPI::TEST(VerifyUserGesture,
PopunderPreventedViaDualEventListeners)):
Identifier: [email protected]
Canonical link: https://commits.webkit.org/[email protected]
Canonical link: https://commits.webkit.org/305877.1055@webkitglib/2.52
Commit: 9ff16dd5c8a23dff079c9b006eb81afd21d54bbb
https://github.com/WebKit/WebKit/commit/9ff16dd5c8a23dff079c9b006eb81afd21d54bbb
Author: Youenn Fablet <[email protected]>
Date: 2026-08-07 (Fri, 07 Aug 2026)
Changed paths:
M Source/ThirdParty/libwebrtc/Source/webrtc/rtc_base/event.cc
Log Message:
-----------
Cherry-pick 3c99db1f1186. https://bugs.webkit.org/show_bug.cgi?id=316816
Crash in libwebrtc.dylib: void
absl::internal_any_invocable::LocalInvoker<false, void,
webrtc::MethodCall<webrtc::PeerConnectionInterface, void,
webrtc::CreateSessionDescriptionObserver*
rdar://181124228
Reviewed by Jean-Yves Avenard and David Kilzer.
We are seeing crashes when calling Event::Wait(kForever) with the following
principles:
- Event::Wait(kForever) is returning earlier than expected as the main
thread should be blocked on the executing of the event task.
- Event::Wait(kForever) is doing a 3 seconds wait, then, if not yet
settled, a forever wait, but only in case the 3 seconds wait is ETIMEDOUT.
- Some crashes show that the process lifetime was less than 3 seconds,
which shows that the 3 seconds wait is returning earlier than 3 seconds, so not
as ETIMEDOUT.
To prevent this, we change how wait is done.
Instead of returning once pthread_cond_timedwait returns, we now only
return if pthread_cond_timedwait returns ETIMEDOUT.
Any other returned value will trigger a new pthread_cond_timedwait call so
that we wait for the actual timeout (3 seconds or forever for instance) or for
the task being executed.
We add some logging as this may help further investigations.
Looking at Chromium code, they override the webrtc::Event class with their
own version.
As a follow-up, we should probably do the same and use a simple
BinarySemaphore approach (at least for forever calls).
* Source/ThirdParty/libwebrtc/Source/webrtc/rtc_base/event.cc:
Identifier: [email protected]
Canonical link:
https://commits.webkit.org/[email protected]
Canonical link: https://commits.webkit.org/305877.1056@webkitglib/2.52
Commit: 2bc4405358f08e0b65ff19be976a03e9c355ae7d
https://github.com/WebKit/WebKit/commit/2bc4405358f08e0b65ff19be976a03e9c355ae7d
Author: Aditya Keerthi <[email protected]>
Date: 2026-08-07 (Fri, 07 Aug 2026)
Changed paths:
A
LayoutTests/fast/forms/datalist/datalist-button-change-input-type-on-click-crash-expected.txt
A
LayoutTests/fast/forms/datalist/datalist-button-change-input-type-on-click-crash.html
M Source/WebCore/html/TextFieldInputType.cpp
M Source/WebCore/html/shadow/DataListButtonElement.cpp
M Source/WebCore/html/shadow/DataListButtonElement.h
Log Message:
-----------
Cherry-pick 1207b71f0518. https://bugs.webkit.org/show_bug.cgi?id=313521
Unreviewed backport.
[WebCore] Use-after-free in `DataListButtonElement::defaultEventHandler`
https://bugs.webkit.org/show_bug.cgi?id=313521
rdar://175672489
Reviewed by Ryosuke Niwa.
`DataListButtonElement` stores its owner as a raw `DataListButtonOwner&
m_owner`.
The only `DataListButtonOwner` is `TextFieldInputType`. When the type of the
owning input element is changed, `HTMLInputElement::updateType()` calls
`removeShadowSubtree()`. This will null out `m_dataListDropdownIndicator`
but
does not clear the owner member in `DataListButtonElement`. Changing the
type
inside a `click` listener results in the `TextFieldInputType` being freed
while
event dispatch is in progress. Eventually,
`DataListButtonElement::defaultEventHandler()`
is called, calling `m_owner.dataListButtonElementWasClicked()` after
`m_owner`
was already freed.
Fix storing the owner as a `WeakPtr` and by clearing it out in
`removeShadowSubtree()`. This matches the implementation of
`SpinButtonElement`.
*
LayoutTests/fast/forms/datalist/datalist-button-change-input-type-on-click-crash-expected.txt:
Added.
*
LayoutTests/fast/forms/datalist/datalist-button-change-input-type-on-click-crash.html:
Added.
* Source/WebCore/html/TextFieldInputType.cpp:
(WebCore::TextFieldInputType::removeShadowSubtree):
* Source/WebCore/html/shadow/DataListButtonElement.cpp:
(WebCore::DataListButtonElement::defaultEventHandler):
* Source/WebCore/html/shadow/DataListButtonElement.h:
Identifier: [email protected]
Canonical link:
https://commits.webkit.org/[email protected]
Canonical link: https://commits.webkit.org/305877.1057@webkitglib/2.52
Compare: https://github.com/WebKit/WebKit/compare/99ea20c74afd...2bc4405358f0
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
