Branch: refs/heads/webkitglib/2.54
Home: https://github.com/WebKit/WebKit
Commit: 71a8d16813706ad8cb7ae83d32795b23049540d8
https://github.com/WebKit/WebKit/commit/71a8d16813706ad8cb7ae83d32795b23049540d8
Author: Kiet Ho <[email protected]>
Date: 2026-09-07 (Mon, 07 Sep 2026)
Changed paths:
A LayoutTests/fast/canvas/canvas-filter-fillText-crash-expected.txt
A LayoutTests/fast/canvas/canvas-filter-fillText-crash.html
M Source/WebCore/html/canvas/CanvasRenderingContext2DBase.cpp
Log Message:
-----------
Cherry-pick 320073@main (f0d5be8210e3).
https://bugs.webkit.org/show_bug.cgi?id=316996
CanvasRenderingContext2DBase::drawTextUnchecked: don't re-use pointer
returned by fontProxy()
https://bugs.webkit.org/show_bug.cgi?id=318372
rdar://175759731
Reviewed by Simon Fraser.
CanvasRenderingContext2D::fontProxy() returns the pointer to State::font
(a FontProxy) of the top State in the state stack. State stores the
FontProxy by value, so the FontProxy goes away when the State is
deallocated.
This could happen when the state stack (a Vector<State, 1>) grows beyond
the storage buffer: a new buffer is created, existing State objects are
copied/moved to the new buffer and the old copies deallocated. Hence,
pointers returned by fontProxy() aren't safe to be re-used, because
between the time when the pointer is obtained and when it's used, some
operations might've manipulated the state stack and caused the FontProxy
to go away.
CanvasRenderingContext2DBase::drawTextUnchecked is one place where it
happens:
it (1) holds on to the font cascade from the FontProxy returned by
fontProxy(),
(2) creates a CanvasFilterContextSwitcher, whose constructor calls save()
which
manipulates the state stack, then (3) uses the saved font cascade from the
FontProxy which might have been deallocated:
void CanvasRenderingContext2DBase::drawTextUnchecked(...)
{
auto& fontCascade = this->fontProxy()->fontCascade(); <-- (1)
[...]
auto targetSwitcher = CanvasFilterContextSwitcher::create(*this,
textRect); <-- (2)
[...]
auto drawText = [&](...) {
[...]
fontCascade.drawGlyphBuffer(...); <-- (3)
(actually, 317546@main indirectly fixes this by avoiding saving state when
creating CanvasFilterContextSwitcher. But as explained above, re-using
fontCascade
is unsafe, so this patch still has merits, even though it's not fixing
anything)
Fix this by not holding onto pointers returned by fontProxy(). Instead,
whenever
the FontProxy is needed, call fontProxy() so we're guaranteed to have a
pointer
to a live FontProxy. Additionally, FontCascade can be made CheckedPtr, so
wrap
it in CheckedPtr/CheckedRef whenever possible.
Future patches could improve on this by making FontProxy ref-counted, so the
pointer returned by fontProxy() is guaranteed to be alive no matter how the
State object storing it is copied/moved around.
Test: fast/canvas/canvas-filter-fillText-crash.html
* LayoutTests/fast/canvas/canvas-filter-fillText-crash-expected.txt: Added.
* LayoutTests/fast/canvas/canvas-filter-fillText-crash.html: Added.
* Source/WebCore/SaferCPPExpectations/UncheckedLocalVarsCheckerExpectations:
* Source/WebCore/html/canvas/CanvasRenderingContext2DBase.cpp:
(WebCore::CanvasRenderingContext2DBase::drawTextUnchecked):
Originally-landed-as: [email protected] (1d58c6a24867).
rdar://175759731
Canonical link: https://commits.webkit.org/320073@main
Canonical link: https://commits.webkit.org/317695.217@webkitglib/2.54
Commit: 40326a5829115dd7204624cbc90aa9e0f042d816
https://github.com/WebKit/WebKit/commit/40326a5829115dd7204624cbc90aa9e0f042d816
Author: Eric Carlson <[email protected]>
Date: 2026-09-07 (Mon, 07 Sep 2026)
Changed paths:
A
LayoutTests/ipc/remote-media-session-manager-audio-hardware-listener-crash-expected.txt
A
LayoutTests/ipc/remote-media-session-manager-audio-hardware-listener-crash.html
A
LayoutTests/ipc/remote-media-session-manager-audio-hardware-listener-uaf-expected.txt
A
LayoutTests/ipc/remote-media-session-manager-audio-hardware-listener-uaf.html
M Source/WebCore/platform/audio/AudioHardwareListener.h
M Source/WebCore/platform/audio/cocoa/MediaSessionManagerCocoa.mm
M Source/WebCore/platform/audio/mac/AudioHardwareListenerMac.cpp
M Source/WebKit/GPUProcess/GPUConnectionToWebProcess.cpp
M Source/WebKit/GPUProcess/GPUConnectionToWebProcess.h
M Source/WebKit/GPUProcess/media/RemoteAudioHardwareListenerProxy.h
M Source/WebKit/UIProcess/Media/RemoteMediaSessionManagerProxy.cpp
M Source/WebKit/UIProcess/Media/RemoteMediaSessionManagerProxy.h
M Source/WebKit/WebProcess/GPU/media/RemoteAudioHardwareListener.cpp
Log Message:
-----------
Cherry-pick [email protected] (ddf732bdf8b3).
https://bugs.webkit.org/show_bug.cgi?id=319112
Hold AudioHardwareListener client weakly and stop caching listener proxies
across clients
rdar://177436036
Reviewed by Jean-Yves Avenard.
AudioHardwareListener stored its Client as a raw reference, while
RemoteMediaSessionManagerProxy::ensureAudioHardwareListenerProxy()
cached the first listener it created and reused it (with the original
client) for every subsequent caller, in addition to holding it
strongly via m_audioHardwareListenerProxy. Because each
RemoteMediaSessionManagerProxy also overwrites the process-global
AudioHardwareListener factory with a lambda capturing Ref{*this}, two
WebPageProxy instances could end up with B's cached listener bound to
A; closing A's page then made B's RemoteAudioOutputDeviceChanged
dispatch a virtual call on a freed proxy (UI-process heap-use-after-
free). Within a single page, removing the last media session cleared
MediaSessionManagerCocoa::m_audioHardwareListener but left the
strongly-held m_audioHardwareListenerProxy, so the same IPC message
null-dereferenced m_audioHardwareListener in audioOutputDeviceChanged.
Make AudioHardwareListener::Client an AbstractRefCountedAndCanMakeWeakPtr
(matching NowPlayingManagerClient), store m_client as a WeakPtr, and
upgrade to a protecting RefPtr before dispatching in every listener
subclass. In RemoteMediaSessionManagerProxy, capture *this weakly in
the creation lambda (also removing a leak of the last-constructed
proxy), always create a fresh listener per call, only stash a
ThreadSafeWeakPtr to it when the client is *this*, and dispatch IPC
through that weak pointer so the listener's lifetime is governed
solely by MediaSessionManagerCocoa::m_audioHardwareListener. Also
guard MediaSessionManagerCocoa::audioOutputDeviceChanged() against a
null m_audioHardwareListener for defense in depth, and make
RemoteAudioHardwareListenerProxy ref-counted to satisfy the new Client
contract.
Tests: ipc/remote-media-session-manager-audio-hardware-listener-crash.html
ipc/remote-media-session-manager-audio-hardware-listener-uaf.html
*
LayoutTests/ipc/remote-media-session-manager-audio-hardware-listener-crash-expected.txt:
Added.
*
LayoutTests/ipc/remote-media-session-manager-audio-hardware-listener-crash.html:
Added.
*
LayoutTests/ipc/remote-media-session-manager-audio-hardware-listener-uaf-expected.txt:
Added.
*
LayoutTests/ipc/remote-media-session-manager-audio-hardware-listener-uaf.html:
Added.
* Source/WebCore/platform/audio/AudioHardwareListener.h:
(WebCore::AudioHardwareListener::client const):
* Source/WebCore/platform/audio/cocoa/MediaSessionManagerCocoa.mm:
(WebCore::MediaSessionManagerCocoa::audioOutputDeviceChanged):
* Source/WebCore/platform/audio/mac/AudioHardwareListenerMac.cpp:
(WebCore::AudioHardwareListenerMac::processIsRunningChanged):
(WebCore::AudioHardwareListenerMac::outputDeviceChanged):
* Source/WebKit/GPUProcess/GPUConnectionToWebProcess.cpp:
(WebKit::GPUConnectionToWebProcess::createAudioHardwareListener):
* Source/WebKit/GPUProcess/GPUConnectionToWebProcess.h:
* Source/WebKit/GPUProcess/media/RemoteAudioHardwareListenerProxy.h:
* Source/WebKit/UIProcess/Media/RemoteMediaSessionManagerProxy.cpp:
(WebKit::RemoteMediaSessionManagerProxy::RemoteMediaSessionManagerProxy):
(WebKit::RemoteMediaSessionManagerProxy::remoteAudioHardwareDidBecomeActive):
(WebKit::RemoteMediaSessionManagerProxy::remoteAudioHardwareDidBecomeInactive):
(WebKit::RemoteMediaSessionManagerProxy::remoteAudioOutputDeviceChanged):
(WebKit::RemoteMediaSessionManagerProxy::ensureAudioHardwareListenerProxy):
* Source/WebKit/UIProcess/Media/RemoteMediaSessionManagerProxy.h:
* Source/WebKit/WebProcess/GPU/media/RemoteAudioHardwareListener.cpp:
(WebKit::RemoteAudioHardwareListener::audioHardwareDidBecomeActive):
(WebKit::RemoteAudioHardwareListener::audioHardwareDidBecomeInactive):
(WebKit::RemoteAudioHardwareListener::audioOutputDeviceChanged):
Identifier: [email protected]
Canonical link: https://commits.webkit.org/317695.218@webkitglib/2.54
Commit: 93656e85b73070b5153aed02e2e8ecb245f4a0a7
https://github.com/WebKit/WebKit/commit/93656e85b73070b5153aed02e2e8ecb245f4a0a7
Author: Jer Noble <[email protected]>
Date: 2026-09-07 (Mon, 07 Sep 2026)
Changed paths:
A
LayoutTests/fast/webcodecs/audio-data-copy-to-zero-frames-crash-expected.txt
A LayoutTests/fast/webcodecs/audio-data-copy-to-zero-frames-crash.html
M Source/WebCore/platform/audio/cocoa/PlatformRawAudioDataCocoa.cpp
Log Message:
-----------
Cherry-pick [email protected] (6b8717a224a0).
https://bugs.webkit.org/show_bug.cgi?id=318500
[WebCore] Memory underflow in PlatformRawAudioData::copyTo()
rdar://176473804
https://bugs.webkit.org/show_bug.cgi?id=318500
Reviewed by Jean-Yves Avenard
When PlatformRawAudioData::copyTo() is told to copy zero samples, just bail
out early. This
avoids a calculation where the number of samples has 1 subtracted from it,
causing a math
underflow.
Cherry-pick https://commits.webkit.org/314451@main for test to pass.
Test: fast/webcodecs/audio-data-copy-to-zero-frames-crash.html
*
LayoutTests/fast/webcodecs/audio-data-copy-to-zero-frames-crash-expected.txt:
Added.
* LayoutTests/fast/webcodecs/audio-data-copy-to-zero-frames-crash.html:
Added.
*
LayoutTests/imported/w3c/web-platform-tests/webcodecs/audio-data-copyTo.any-expected.txt:
*
LayoutTests/imported/w3c/web-platform-tests/webcodecs/audio-data-copyTo.any.js:
(test):
*
LayoutTests/imported/w3c/web-platform-tests/webcodecs/audio-data-copyTo.any.worker-expected.txt:
* Source/WebCore/Modules/webcodecs/WebCodecsAudioDataAlgorithms.cpp:
(WebCore::computeCopyElementCount):
* Source/WebCore/platform/audio/cocoa/PlatformRawAudioDataCocoa.cpp:
(WebCore::PlatformRawAudioData::copyTo):
Identifier: [email protected]
Canonical link: https://commits.webkit.org/317695.219@webkitglib/2.54
Compare: https://github.com/WebKit/WebKit/compare/ec2f180698e1...93656e85b730
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
