Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: d40f4efab0e0cee61e29c8540abff5285bf5275d
https://github.com/WebKit/WebKit/commit/d40f4efab0e0cee61e29c8540abff5285bf5275d
Author: Antti Koivisto <[email protected]>
Date: 2026-08-24 (Mon, 24 Aug 2026)
Changed paths:
A
LayoutTests/fast/images/image-load-event-in-modal-dialog-crash-expected.txt
A LayoutTests/fast/images/image-load-event-in-modal-dialog-crash.html
A LayoutTests/fast/images/resources/self-closing-modal-dialog.html
M Source/WebCore/loader/ImageLoader.cpp
Log Message:
-----------
[WebCore] Use-after-free in ImageLoader::dispatchPendingLoadEvent /
dispatchPendingErrorEvent
rdar://177909775
Reviewed by Alan Baradlay.
dispatchPendingLoadEvent() and dispatchPendingErrorEvent() dispatch author
script and then
touch `this` again via updatedHasPendingEvent(). The only thing keeping the
element alive
across the dispatch is a full-expression-scoped Ref plus the m_protectedElement
member, and
the 0s m_derefElementTimer can clear that member. A load handler can re-arm the
timer by
removing the <img> from its <picture> (selectImageSource(RelevantMutation::Yes)
calls
updatedHasPendingEvent()), then spin a nested run loop via showModalDialog().
The timer
fires and drops m_protectedElement while the dispatch is still on the stack.
When the
dispatch returns the temporary Ref destructs as the last reference,
~HTMLImageElement frees
the loader via its unique_ptr<HTMLImageLoader>, and the trailing
updatedHasPendingEvent()
runs on freed `this`.
Hold a stack Ref to the element across the dispatch and the trailing
updatedHasPendingEvent()
in both functions. The loader is owned by the element, so keeping the element
alive keeps
this ImageLoader alive.
Test: fast/images/image-load-event-in-modal-dialog-crash.html
* LayoutTests/fast/images/image-load-event-in-modal-dialog-crash-expected.txt:
Added.
* LayoutTests/fast/images/image-load-event-in-modal-dialog-crash.html: Added.
* LayoutTests/fast/images/resources/self-closing-modal-dialog.html: Added.
* Source/WebCore/loader/ImageLoader.cpp:
(WebCore::ImageLoader::dispatchPendingLoadEvent):
(WebCore::ImageLoader::dispatchPendingErrorEvent):
Originally-landed-as: [email protected] (fe774071a22a).
rdar://185367866
Canonical link: https://commits.webkit.org/319690@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
