Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 7224709bf0747d1cb8f7d52e65cc7900e91fdb75
https://github.com/WebKit/WebKit/commit/7224709bf0747d1cb8f7d52e65cc7900e91fdb75
Author: Antoine Quint <[email protected]>
Date: 2026-09-02 (Wed, 02 Sep 2026)
Changed paths:
A
LayoutTests/webanimations/threaded-animations/offset-path-shape-cache-thread-safety-crash-expected.txt
A
LayoutTests/webanimations/threaded-animations/offset-path-shape-cache-thread-safety-crash.html
A
LayoutTests/webanimations/threaded-animations/resources/offset-path-shape-cache-thread-safety-popup.html
M
Source/WebCore/platform/animation/values/shapes/AcceleratedEffectCircleFunction.cpp
M
Source/WebCore/platform/animation/values/shapes/AcceleratedEffectEllipseFunction.cpp
M
Source/WebCore/platform/animation/values/shapes/AcceleratedEffectInsetFunction.cpp
M
Source/WebCore/platform/animation/values/shapes/AcceleratedEffectPathFunction.cpp
M
Source/WebCore/platform/animation/values/shapes/AcceleratedEffectPolygonFunction.cpp
Log Message:
-----------
[threaded-animations] cross-thread UAF in UIProcess via unguarded static
TinyLRUCache in AcceleratedEffect polygon path cache
https://bugs.webkit.org/show_bug.cgi?id=317919
rdar://180233994
Reviewed by Chris Dumez.
Values held by AcceleratedEffectValues may be accessed both from the main thread
and the scrolling thread on macOS.
Meanwhile, the `cachedAcceleratedEffectXXXPath()` family of functions use a
process-global
`static NeverDestroyed<TinyLRUCache<..., WebCore::Path, 4, ...>>` with no
synchronization
and return a `const Path&` directly into a cache slot. TinyLRUCache::get()
move-assigns
slots whose `Path` value wraps `DataRef<PathImpl>`, a concurrent move-assignment
tears the non-atomic pointer read/swap in `Ref::operator=(Ref&&)` and produces
a stale refcounted pointer that is then deref'd, yielding a use-after-free
or double-free of `PathImpl`.
We now guard each cache with a static Lock and return Path by value so the cache
slot is copied out while the lock is held. `PathImpl` is `ThreadSafeRefCounted`
so the by-value copy is just an atomic refcount bump. This matches the existing
pattern used by `cachedCGColor()` and `UTIFromMIMEType()` for
concurrently-accessed
static `TinyLRUCache` instances.
This fix was suggested by an LLM during bug analysis, I validated its approach.
Test:
webanimations/threaded-animations/offset-path-shape-cache-thread-safety-crash.html
*
LayoutTests/webanimations/threaded-animations/offset-path-shape-cache-thread-safety-crash-expected.txt:
Added.
*
LayoutTests/webanimations/threaded-animations/offset-path-shape-cache-thread-safety-crash.html:
Added.
*
LayoutTests/webanimations/threaded-animations/resources/offset-path-shape-cache-thread-safety-popup.html:
Added.
*
Source/WebCore/platform/animation/values/shapes/AcceleratedEffectCircleFunction.cpp:
(WebCore::cachedAcceleratedEffectCirclePath):
*
Source/WebCore/platform/animation/values/shapes/AcceleratedEffectEllipseFunction.cpp:
(WebCore::cachedAcceleratedEffectEllipsePath):
*
Source/WebCore/platform/animation/values/shapes/AcceleratedEffectInsetFunction.cpp:
(WebCore::cachedRoundedInsetPath):
*
Source/WebCore/platform/animation/values/shapes/AcceleratedEffectPathFunction.cpp:
(WebCore::cachedAcceleratedEffectTransformedByteStreamPath):
*
Source/WebCore/platform/animation/values/shapes/AcceleratedEffectPolygonFunction.cpp:
(WebCore::cachedAcceleratedEffectPolygonPath):
Originally-landed-as: [email protected] (e4960726c71e).
rdar://185368955
Canonical link: https://commits.webkit.org/320360@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
