Branch: refs/heads/webkitglib/2.52
Home: https://github.com/WebKit/WebKit
Commit: 5e28547d6393e1912651f056287336dd9734d38f
https://github.com/WebKit/WebKit/commit/5e28547d6393e1912651f056287336dd9734d38f
Author: Marcus Plutowski <[email protected]>
Date: 2026-08-15 (Sat, 15 Aug 2026)
Changed paths:
M Source/WebKit/Scripts/process-entitlements.sh
M Source/bmalloc/bmalloc/TZoneHeap.cpp
M Source/bmalloc/bmalloc/TZoneHeap.h
M Source/bmalloc/bmalloc/TZoneHeapInlines.h
M Source/bmalloc/bmalloc/bmalloc.cpp
M Source/bmalloc/bmalloc/bmalloc.h
M Source/bmalloc/libpas/src/libpas/pas_bitfit_page_inlines.h
M Source/bmalloc/libpas/src/libpas/pas_mte.h
M Source/bmalloc/libpas/src/libpas/pas_mte_config.c
M Source/bmalloc/libpas/src/libpas/pas_mte_config.h
Log Message:
-----------
Cherry-pick 7509f55d43eb. https://bugs.webkit.org/show_bug.cgi?id=311800
Unreviewed backport.
[libpas] Enable retag-on-free and soft-mode as combined patch sans xrOS
https://bugs.webkit.org/show_bug.cgi?id=313680
rdar://175767115
Reviewed by Keith Miller.
This is morally a combination of changes from six radars that
originally landed on main, whose combined effect is to implement
a fixed version of retag-on-scavenge, enable it, change various
allocator configurations to strengthen that to retag-on-free,
and take WebKit processes to soft-mode. It should not be merged
back to main, as the changes herewithin are already implemented
there.
Importantly, this does NOT enable retag-on-free for visionOS.
This is because soft-mode enablement did not work correctly on that
platform when we enabled this the first time around.
The soft mode enablement is done to help insulate us from any potential
security fallout: since this patch adds a new security hardening
measure, we run the risk of turning currently-silent UaFs into actual
crashes. Enabling soft-mode obviates that risk, as those crashes would
only happen once per process, after which MTE would be disabled.
As a result, however, this patch CANNOT be taken for any actual customer
release, other than seeds and internal builds, unless paired with a
subsequent patch which disables soft-mode.
The patches included are as follows:
[libpas] Unconditionally tag-on-alloc
https://bugs.webkit.org/show_bug.cgi?id=308483
rdar://171007509
Canonical link: https://commits.webkit.org/308769@main
[libpas] Fix adjacent-tag-exclusion for bitfit objects
https://bugs.webkit.org/show_bug.cgi?id=310736
rdar://171744344
Canonical link: https://commits.webkit.org/310329@main
[libpas] Enable soft-mode and retag-on-scavenge
https://bugs.webkit.org/show_bug.cgi?id=309358
rdar://171908706
Canonical link: https://commits.webkit.org/309353@main
[libpas] Quickly use bitfit heaps (as possible) when retag-on-scavenge is
enabled
https://bugs.webkit.org/show_bug.cgi?id=309598
rdar://172220367
Canonical link: https://commits.webkit.org/309573@main
[bmalloc] Disable TZone allocations when MTE is enabled
https://bugs.webkit.org/show_bug.cgi?id=309913
rdar://172500381
Canonical link: https://commits.webkit.org/309849@main
[libpas] Fix and re-enable retag-on-scavenge
https://bugs.webkit.org/show_bug.cgi?id=305435
rdar://165772439
Canonical link: https://commits.webkit.org/306782@main
N.b.: the effect of this patch is NOT the same as that of cherry-picking
the above six patches would be, as some changes were necessary for them
to go in without other intervening patches that were landed on main but
which will not be included here.
Identifier: 305413.910@safari-7624-branch
Identifier: [email protected]
Canonical link: https://commits.webkit.org/305877.1093@webkitglib/2.52
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
