Branch: refs/heads/webkitglib/2.54
Home: https://github.com/WebKit/WebKit
Commit: 5e01f586357f4132e3cc8a252e3c76a4250d4dca
https://github.com/WebKit/WebKit/commit/5e01f586357f4132e3cc8a252e3c76a4250d4dca
Author: Brady Eidson <[email protected]>
Date: 2026-09-03 (Thu, 03 Sep 2026)
Changed paths:
M Source/WebKit/UIProcess/WebBackForwardList.cpp
Log Message:
-----------
Cherry-pick [email protected] (ce08c270d322).
https://bugs.webkit.org/show_bug.cgi?id=317142
Incomplete fix of WebKit bug 315528 (Message check file urls in
back/forward list messages)
rdar://177953315
Reviewed by Chris Dumez.
Apply the message check to sub-items in the history item tree, and other
validations of the tree.
Test: Tools/TestWebKitAPI/Tests/WebKit/WKBackForwardListTests.mm
* Source/WebKit/UIProcess/WebBackForwardList.cpp:
(WebKit::messageCheckItemURLs):
*
Tools/TestWebKitAPI/Tests/WebKit/WKBackForwardListTests.mm:
((WKBackForwardList, MessageCheckRejectsNestedFileURLChild)):
((WKBackForwardList, MessageCheckRejectsDeeplyNestedFileURLChild)):
((WKBackForwardList, MessageCheckRejectsExcessiveChildDepth)):
((WKBackForwardList, MessageCheckAcceptsBenignNestedChildren)):
Identifier: [email protected]
Canonical link:
https://flagged.apple.com:443/proxy?t2=Di2s1a2fv1&o=aHR0cHM6Ly9jb21taXRzLndlYmtpdC5vcmcvMzE3Njk1LjE4OUB3ZWJraXRnbGliLzIuNTQ=&emid=93b7cb9d-4ce0-4939-babd-6573460a5892&c=11
Commit: 17e7d4e6383c64971b5c0f28b783ab0bc1c15ee9
https://github.com/WebKit/WebKit/commit/17e7d4e6383c64971b5c0f28b783ab0bc1c15ee9
Author: Chris Dumez <[email protected]>
Date: 2026-09-03 (Thu, 03 Sep 2026)
Changed paths:
A
LayoutTests/http/tests/webshare/shareddatareader-didfinishloading-crash-expected.txt
A
LayoutTests/http/tests/webshare/shareddatareader-didfinishloading-crash.html
M Source/WebCore/page/ShareDataReader.cpp
M Source/WebCore/page/ShareDataReader.h
Log Message:
-----------
Cherry-pick [email protected] (890fde552386).
https://bugs.webkit.org/show_bug.cgi?id=317270
[WebCore] use-after-free in ShareDataReader::didFinishLoading: cancel()
called on freed this after completionHandler destruction
https://bugs.webkit.org/show_bug.cgi?id=317270
rdar://177909918
Reviewed by Per Arne Vollan and Ben Nham.
Make sure we capture `weakThis` in the lambda instead of `this`, then
convert to a RefPtr before calling `didfinishLoading()` so that `this`
cannot be destroyed *while* running `didfinishLoading()`.
Test: http/tests/webshare/shareddatareader-didfinishloading-crash.html
*
LayoutTests/http/tests/webshare/shareddatareader-didfinishloading-crash-expected.txt:
Added.
*
LayoutTests/http/tests/webshare/shareddatareader-didfinishloading-crash.html:
Added.
* Source/WebCore/page/ShareDataReader.cpp:
(WebCore::ShareDataReader::start):
* Source/WebCore/page/ShareDataReader.h:
Identifier: [email protected]
Canonical link:
https://flagged.apple.com:443/proxy?t2=Dg6w2l1WY2&o=aHR0cHM6Ly9jb21taXRzLndlYmtpdC5vcmcvMzE3Njk1LjE5MEB3ZWJraXRnbGliLzIuNTQ=&emid=93b7cb9d-4ce0-4939-babd-6573460a5892&c=11
Commit: 1b78c03f880e0ab78dc98b24d598608f4798b1bf
https://github.com/WebKit/WebKit/commit/1b78c03f880e0ab78dc98b24d598608f4798b1bf
Author: Per Arne Vollan <[email protected]>
Date: 2026-09-03 (Thu, 03 Sep 2026)
Changed paths:
A
LayoutTests/fast/html/trusted-types-set-attribute-iframe-removal-crash-expected.txt
A
LayoutTests/fast/html/trusted-types-set-attribute-iframe-removal-crash.html
M Source/WebCore/dom/Attr.cpp
Log Message:
-----------
Cherry-pick
[email protected] (a26cf8dc190a).
https://bugs.webkit.org/show_bug.cgi?id=317320
Use-after-free of ScriptExecutionContext in trustedTypeCompliantString
https://bugs.webkit.org/show_bug.cgi?id=317320
rdar://177766868
Reviewed by Chris Dumez.
The method processValueWithDefaultPolicy can end up deleting the
ScriptExecutionContext passed as parameter.
This patch fixes this by adding protection of ScriptExecutionContext.
Test: fast/html/trusted-types-set-attribute-iframe-removal-crash.html
*
LayoutTests/fast/html/trusted-types-set-attribute-iframe-removal-crash.html:
Added.
*
LayoutTests/fast/html/trusted-types-set-attribute-iframe-removal-crash-expected.txt:
Added.
* Source/WebCore/dom/Attr.cpp:
(WebCore::Attr::setValue):
* Source/WebCore/dom/Element.cpp:
(WebCore::Element::setAttribute):
(WebCore::Element::setAttributeNode):
(WebCore::Element::setAttributeNodeNS):
(WebCore::Element::setAttributeNS):
* Source/WebCore/dom/TrustedType.cpp:
(WebCore::trustedTypeCompliantString):
(WebCore::requireTrustedTypesForPreNavigationCheckPasses):
Identifier:
[email protected]
Canonical
link:
https://flagged.apple.com:443/proxy?t2=dZ7y5S3ZJ9&o=aHR0cHM6Ly9jb21taXRzLndlYmtpdC5vcmcvMzE3Njk1LjE5MUB3ZWJraXRnbGliLzIuNTQ=&emid=93b7cb9d-4ce0-4939-babd-6573460a5892&c=11
Compare: https://github.com/WebKit/WebKit/compare/7dd70bdbdf3c...1b78c03f880e
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
