Branch: refs/heads/webkitglib/2.54
Home: https://github.com/WebKit/WebKit
Commit: a5cc6bb8a34795b6b09a20e3bca110c417186fde
https://github.com/WebKit/WebKit/commit/a5cc6bb8a34795b6b09a20e3bca110c417186fde
Author: Chris Dumez <[email protected]>
Date: 2026-09-17 (Thu, 17 Sep 2026)
Changed paths:
M Source/WTF/wtf/text/CString.h
M Source/WebKit/Platform/cocoa/WebPrivacyHelpers.mm
Log Message:
-----------
Cherry-pick 316606.77@safari-7625-branch (8cfe4260c1d1).
https://bugs.webkit.org/show_bug.cgi?id=319652
Crash under configureForAdvancedPrivacyProtections() due to thread safety
issue
https://bugs.webkit.org/show_bug.cgi?id=319652
rdar://181649240
Reviewed by David Kilzer.
setTrackerLookupCallback()'s callback runs on a background (resolver) thread
and looks up owner/host strings in TrackerAddressLookupInfo and
TrackerDomainLookupInfo. These lists are populated and refreshed on the
WebPrivacy thread, yet were accessed with no synchronization, so the
callback
could read them while they were being mutated on another thread. On top of
the
missing lock, the callback handed the networking stack raw `const char*`s
pointing directly into the lists; those would dangle as soon as the lists
were
cleared and rebuilt, and the domain lookup returned its result by value, so
the
pointer dangled the moment the temporary was destroyed.
Address the issue as follows:
- Introduce a single lock, shared by both lookup tables, guarding their
population, refresh, and lookups. The locking is encapsulated so a raw
pointer
into the lists can never outlive the lock: find() takes the lock
internally
and invokes a NOESCAPE callback with the matched entry, returning whether
a
match was found, while contains() answers existence-only queries. The
raw-pointer search (matchingInfo) and the lock itself are private to this
file.
- Add CString::isolatedCopy(), returning a copy backed by its own
CStringBuffer. Since CStringBuffer is not ThreadSafeRefCounted, this is
the
safe way to hand a CString's contents to another thread without sharing
(and
racing) the buffer's non-atomic refcount.
- The callback copies the matched owner/host into per-thread CStrings via
isolatedCopy() and hands out pointers into those, so nothing it returns
to the
networking stack is tied to the refreshable lists.
* Source/WTF/wtf/text/CString.h:
(WTF::CString::isolatedCopy):
* Source/WebKit/Platform/cocoa/WebPrivacyHelpers.mm:
(WebKit::trackerLookupLock):
(WebKit::TrackerAddressLookupInfo::find):
(WebKit::TrackerAddressLookupInfo::contains):
(WebKit::TrackerAddressLookupInfo::matchingInfo):
(WebKit::TrackerAddressLookupInfo::containsAddress):
(WebKit::TrackerDomainLookupInfo::populateIfNeeded):
(WebKit::TrackerDomainLookupInfo::find):
(WebKit::TrackerDomainLookupInfo::contains):
(WebKit::TrackerDomainLookupInfo::matchingInfo):
(WebKit::configureForAdvancedPrivacyProtections):
(WebKit::isKnownTrackerAddressOrDomain):
(WebKit::isRequestBlockable):
Identifier: 316606.77@safari-7625-branch
Canonical link: https://commits.webkit.org/317695.333@webkitglib/2.54
Commit: cf4f6035526e967b20127da2ff20dd121efee096
https://github.com/WebKit/WebKit/commit/cf4f6035526e967b20127da2ff20dd121efee096
Author: Taher Ali <[email protected]>
Date: 2026-09-17 (Thu, 17 Sep 2026)
Changed paths:
A
LayoutTests/fast/css/match-result-cache-has-style-relation-crash-expected.txt
A LayoutTests/fast/css/match-result-cache-has-style-relation-crash.html
M Source/WebCore/style/MatchResultCache.cpp
Log Message:
-----------
Cherry-pick 316606.94@safari-7625-branch (ef6da56fb892).
https://bugs.webkit.org/show_bug.cgi?id=319413
heap-use-after-free in Style::commitRelations via MatchResultCache
https://bugs.webkit.org/show_bug.cgi?id=319413
rdar://180282897
Reviewed by Brent Fulgham.
MatchResultCache::copy() deep-copied the relations vector into a long-lived
cache
entry. Style::Relation holds a raw Element*, so a stale pointer could be
committed
in commitRelations() after its target was freed. Reachable via :has() with a
featureless positional/sibling argument, where the relation target is a
descendant
that can be removed without invalidating the subject past
InlineStyleInvalid.
Stop caching relations. They aren't needed on the FullWithMatchResultCache
path,
which doesn't call resetStyleRelations(), so their flags persist from the
previous
resolution; FirstChild/LastChild bits are carried over by copyRelations().
Test: fast/css/match-result-cache-has-style-relation-crash.html
*
LayoutTests/fast/css/match-result-cache-has-style-relation-crash-expected.txt:
Added.
* LayoutTests/fast/css/match-result-cache-has-style-relation-crash.html:
Added.
* Source/WebCore/style/MatchResultCache.cpp:
(WebCore::Style::copy):
Identifier: 316606.94@safari-7625-branch
Canonical link: https://commits.webkit.org/317695.334@webkitglib/2.54
Commit: 8f84d95e352f0a15ff421eebaf52983898dba497
https://github.com/WebKit/WebKit/commit/8f84d95e352f0a15ff421eebaf52983898dba497
Author: Kimmo Kinnunen <[email protected]>
Date: 2026-09-17 (Thu, 17 Sep 2026)
Changed paths:
M Source/WebCore/platform/graphics/angle/ANGLEUtilities.cpp
M Source/WebCore/platform/graphics/angle/ANGLEUtilities.h
M Source/WebCore/platform/graphics/angle/GraphicsContextGLANGLE.cpp
M Tools/TestWebKitAPI/Tests/WebCore/cocoa/TestGraphicsContextGLCocoa.mm
Log Message:
-----------
Cherry-pick 316606.99@safari-7625-branch (69788e40ae06).
https://bugs.webkit.org/show_bug.cgi?id=317737
WebGL: Uninitialized heap memory leak via GL_READ_BUFFER desync in
readPixelsForPaintResults
https://bugs.webkit.org/show_bug.cgi?id=317737
rdar://178474070
Reviewed by Dan Glastonbury.
Reset the read buffer for the default framebuffer if client has changed it.
Test: Tools/TestWebKitAPI/Tests/WebCore/cocoa/TestGraphicsContextGLCocoa.mm
* Source/WebCore/platform/graphics/angle/ANGLEUtilities.cpp:
(WebCore::ScopedReadBuffer::ScopedReadBuffer):
(WebCore::ScopedReadBuffer::~ScopedReadBuffer):
* Source/WebCore/platform/graphics/angle/ANGLEUtilities.h:
* Source/WebCore/platform/graphics/angle/GraphicsContextGLANGLE.cpp:
(WebCore::GraphicsContextGLANGLE::readPixelsForPaintResults):
* Tools/TestWebKitAPI/Tests/WebCore/cocoa/TestGraphicsContextGLCocoa.mm:
(TestWebKitAPI::TEST_F(GraphicsContextGLCocoaTest,
CopyNativeImageWithReadBufferNoneWebGL2)):
Identifier: 316606.99@safari-7625-branch
Canonical link: https://commits.webkit.org/317695.335@webkitglib/2.54
Compare: https://github.com/WebKit/WebKit/compare/11aa4952503a...8f84d95e352f
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
