Branch: refs/heads/webkitglib/2.52
Home: https://github.com/WebKit/WebKit
Commit: 5fea7e741ef8416c7f708c786038135e3718440c
https://github.com/WebKit/WebKit/commit/5fea7e741ef8416c7f708c786038135e3718440c
Author: Antti Koivisto <[email protected]>
Date: 2026-09-08 (Tue, 08 Sep 2026)
Changed paths:
A
LayoutTests/fast/images/image-load-event-in-modal-dialog-crash-expected.txt
A LayoutTests/fast/images/image-load-event-in-modal-dialog-crash.html
A LayoutTests/fast/images/resources/self-closing-modal-dialog.html
M Source/WebCore/loader/ImageLoader.cpp
Log Message:
-----------
Cherry-pick [email protected] (fe774071a22a).
https://bugs.webkit.org/show_bug.cgi?id=318348
[WebCore] Use-after-free in ImageLoader::dispatchPendingLoadEvent /
dispatchPendingErrorEvent
rdar://177909775
Reviewed by Alan Baradlay.
dispatchPendingLoadEvent() and dispatchPendingErrorEvent() dispatch author
script and then
touch `this` again via updatedHasPendingEvent(). The only thing keeping the
element alive
across the dispatch is a full-expression-scoped Ref plus the
m_protectedElement member, and
the 0s m_derefElementTimer can clear that member. A load handler can re-arm
the timer by
removing the <img> from its <picture>
(selectImageSource(RelevantMutation::Yes) calls
updatedHasPendingEvent()), then spin a nested run loop via
showModalDialog(). The timer
fires and drops m_protectedElement while the dispatch is still on the
stack. When the
dispatch returns the temporary Ref destructs as the last reference,
~HTMLImageElement frees
the loader via its unique_ptr<HTMLImageLoader>, and the trailing
updatedHasPendingEvent()
runs on freed `this`.
Hold a stack Ref to the element across the dispatch and the trailing
updatedHasPendingEvent()
in both functions. The loader is owned by the element, so keeping the
element alive keeps
this ImageLoader alive.
Test: fast/images/image-load-event-in-modal-dialog-crash.html
*
LayoutTests/fast/images/image-load-event-in-modal-dialog-crash-expected.txt:
Added.
* LayoutTests/fast/images/image-load-event-in-modal-dialog-crash.html:
Added.
* LayoutTests/fast/images/resources/self-closing-modal-dialog.html: Added.
* Source/WebCore/loader/ImageLoader.cpp:
(WebCore::ImageLoader::dispatchPendingLoadEvent):
(WebCore::ImageLoader::dispatchPendingErrorEvent):
Identifier: [email protected]
Canonical link: https://commits.webkit.org/305877.1162@webkitglib/2.52
Commit: 7280d8374096d29d1a98724e5dbaa83d5a90d114
https://github.com/WebKit/WebKit/commit/7280d8374096d29d1a98724e5dbaa83d5a90d114
Author: Phinehas Fuachie <[email protected]>
Date: 2026-09-08 (Tue, 08 Sep 2026)
Changed paths:
A LayoutTests/webaudio/mediaelementsource-clear-detached-frame-expected.txt
A LayoutTests/webaudio/mediaelementsource-clear-detached-frame.html
A
LayoutTests/webaudio/resources/mediaelementsource-clear-detached-frame-iframe.html
M Source/WebCore/html/HTMLMediaElement.cpp
Log Message:
-----------
Cherry-pick [email protected] (e186258f7967).
https://bugs.webkit.org/show_bug.cgi?id=315989
Use-after-free in MediaElementAudioSourceNode::provideInput when iframe is
detached
https://bugs.webkit.org/show_bug.cgi?id=315989
rdar://175673159
Reviewed by Chris Dumez.
HTMLMediaElement::clearMediaPlayer() resets m_player on the main thread
without holding
m_audioSourceNode->processLock(), but the audio render thread reads
m_player via
audioSourceProvider() inside MediaElementAudioSourceNode::process() while
holding that lock.
Because audioSourceProvider() returns a raw AudioSourceProvider* and drops
its local
RefPtr<MediaPlayer> on return, and MediaPlayer is DestructionThread::Main,
the main thread can
synchronously run ~MediaPlayer (destroying the RemoteAudioSourceProvider)
while the render thread
is still inside provideInput() with the now-dangling pointer.
This is reachable from HTMLMediaElement::stop() (ActiveDOMObject stop on
iframe detach) and
userCancelledLoad().
Match the contract already enforced by createMediaPlayer() and
mediaPlayerWill/DidInitializeMediaEngine() by holding the audio node's
processLock around
player->invalidate() / m_player = nullptr in clearMediaPlayer(). process()
acquires the same lock
with tryLock(), so this cannot deadlock — the render thread will simply
zero its output for one
quantum while the main thread tears down.
Test: webaudio/mediaelementsource-clear-detached-frame.html
*
LayoutTests/webaudio/mediaelementsource-clear-detached-frame-expected.txt:
Added.
* LayoutTests/webaudio/mediaelementsource-clear-detached-frame.html: Added.
*
LayoutTests/webaudio/resources/mediaelementsource-clear-detached-frame-iframe.html:
Added.
* Source/WebCore/html/HTMLMediaElement.cpp:
(WebCore::HTMLMediaElement::clearMediaPlayer): Deleted.
Identifier: [email protected]
Canonical link: https://commits.webkit.org/305877.1163@webkitglib/2.52
Commit: c17624be28184aa80c2bcde10e85ecd38c544e57
https://github.com/WebKit/WebKit/commit/c17624be28184aa80c2bcde10e85ecd38c544e57
Author: Yulun Wu <[email protected]>
Date: 2026-09-08 (Tue, 08 Sep 2026)
Changed paths:
A LayoutTests/svg/animations/smil-seek-huge-repeat-count-crash-expected.txt
A LayoutTests/svg/animations/smil-seek-huge-repeat-count-crash.html
M Source/WebCore/svg/animation/SVGSMILElement.cpp
Log Message:
-----------
Cherry-pick [email protected] (34249048d66d).
https://bugs.webkit.org/show_bug.cgi?id=318405
Clamp repeat count for SVG animation.
https://bugs.webkit.org/show_bug.cgi?id=318405
<rdar://176471329>
Reviewed by Said Abou-Hallawa.
This PR tightens the fix in 301404@main by clamping the repeat count to
an upper bound to prevent overflow.
Also coalesce the repeat events dispatched while seeking: rather than firing
one repeatEvent per skipped interval, dispatch a single repeatEvent. SVG 1.1
Animation defines a repeatEvent as raised each time the element repeats on a
normally-advancing timeline; how many events a discontinuous seek replays
for
the intervals it skips is left to SMIL Animation's timing model, which does
not
require one event per skipped interval (see also the WPT seeking-events-*
tests).
*
LayoutTests/svg/animations/smil-seek-huge-repeat-count-crash-expected.txt:
Added.
* LayoutTests/svg/animations/smil-seek-huge-repeat-count-crash.html: Added.
* Source/WebCore/svg/animation/SVGSMILElement.cpp:
(WebCore::SVGSMILElement::calculateAnimationPercentAndRepeat const):
(WebCore::SVGSMILElement::progress):
Identifier: [email protected]
Canonical link: https://commits.webkit.org/305877.1164@webkitglib/2.52
Compare: https://github.com/WebKit/WebKit/compare/71731a79be7f...c17624be2818
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
