Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 430a7b5b2f21c065bbf3487438516cc1e013af5f
https://github.com/WebKit/WebKit/commit/430a7b5b2f21c065bbf3487438516cc1e013af5f
Author: Tyler Wilcock <[email protected]>
Date: 2026-09-14 (Mon, 14 Sep 2026)
Changed paths:
M Source/WebKit/WebProcess/WebPage/mac/WKAccessibilityWebPageObjectBase.mm
Log Message:
-----------
AX: Fix use-after-free of accessibilityRootObjectWrapper
https://bugs.webkit.org/show_bug.cgi?id=316410
rdar://178730472
Reviewed by Chris Fleizach and Dominic Mazzoni.
The off-main-thread short-circuit in -[WKAccessibilityWebPageObjectBase
accessibilityRootObjectWrapper:] returned root->wrapper() as a raw +0
WebAccessibilityObjectWrapper*. The wrapper's only strong reference at that
moment was AXIsolatedObject::m_wrapper, kept alive transitively by the
local RefPtr<AXIsolatedTree>. Once the function returned, that RefPtr (and
the `root` it kept alive) went out of scope, freeing the wrapper before
the secondary AX thread's caller could retain it. AppKit subsequently
walked the autoreleased single-element NSArray returned by
-[WKAccessibilityWebPageObject accessibilityChildren] and called
objc_retain on the wrapper (and on the array) inside
-[__NSSingleObjectEnumerator initWithObject:collection:], crashing on
freed memory.
Wrap the returned wrapper in RetainPtr<id> { ... }.autorelease()
so it is retained synchronously while `tree`, `root`, and m_wrapper are
all still alive, and then deposited into the secondary thread's
autorelease pool. The pool keeps the wrapper alive for the rest of the
secondary thread's runloop iteration, long enough for AppKit's
ConvertOutgoingValueForElement -> objectEnumerator ->
initWithObject:collection: -> objc_retain sequence to finish safely.
* Source/WebKit/WebProcess/WebPage/mac/WKAccessibilityWebPageObjectBase.mm:
(-[WKAccessibilityWebPageObjectBase accessibilityRootObjectWrapper:]):
Originally-landed-as: [email protected] (cea3c1e1af92).
rdar://184744967
Canonical link: https://commits.webkit.org/321080@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
