Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 76ed77ce7f2a81229f376a17a63f8e32cfd98506
https://github.com/WebKit/WebKit/commit/76ed77ce7f2a81229f376a17a63f8e32cfd98506
Author: Ahmad Saleem <[email protected]>
Date: 2026-10-07 (Wed, 07 Oct 2026)
Changed paths:
M Source/WebCore/dom/ScriptExecutionContext.cpp
Log Message:
-----------
ScriptExecutionContext::circularSequentialID() relies on signed integer
overflow to wrap
https://bugs.webkit.org/show_bug.cgi?id=326630
rdar://189373355
Reviewed by Chris Dumez.
circularSequentialID() incremented the int m_circularSequentialID and only
afterwards checked for a non-positive result to wrap back to 1. Once the
counter reaches INT_MAX, the increment is signed integer overflow, which is
undefined behavior, so the wrap check relied on behavior the compiler is
free to assume never happens.
The counter backs setTimeout()/setInterval() IDs and
Geolocation.watchPosition() IDs, so a long-lived document or worker that
creates around 2^31 timers can reach it.
Check for INT_MAX before incrementing instead. The ID sequence stays the
same: 1 to INT_MAX, then back to 1. DOMTimer::install() still retries on
collision after the wrap.
No new tests, since reaching the wrap requires around 2^31 calls.
* Source/WebCore/dom/ScriptExecutionContext.cpp:
(WebCore::ScriptExecutionContext::circularSequentialID):
Canonical link: https://commits.webkit.org/323055@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
