Branch: refs/heads/safari-7624.2.5.13-branch
Home: https://github.com/WebKit/WebKit
Commit: 7a734adb5f9d2e63821deb532a4793d34f4ee3e2
https://github.com/WebKit/WebKit/commit/7a734adb5f9d2e63821deb532a4793d34f4ee3e2
Author: Mohsin Qureshi <[email protected]>
Date: 2026-04-15 (Wed, 15 Apr 2026)
Changed paths:
M Configurations/Version.xcconfig
Log Message:
-----------
Versioning. WebKit-7624.2.5.13.1
Canonical link: https://commits.webkit.org/[email protected]
Commit: 5c1cfa110c72b7cd8a860fe6c91e5370c11de235
https://github.com/WebKit/WebKit/commit/5c1cfa110c72b7cd8a860fe6c91e5370c11de235
Author: Sihui Liu <[email protected]>
Date: 2026-04-15 (Wed, 15 Apr 2026)
Changed paths:
M Source/WebCore/Modules/indexeddb/IDBKeyData.cpp
M Source/WebCore/Modules/indexeddb/IDBKeyData.h
M Tools/TestWebKitAPI/CMakeLists.txt
M Tools/TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj
A Tools/TestWebKitAPI/Tests/WebCore/IDBKeyData.cpp
Log Message:
-----------
Cherry-pick 3efb02c6bee1. rdar://174327363
[IndexedDB] IDBKeyData operator== and operator<=> define different
equivalence classes
rdar://174327363
Reviewed by Brady Eidson.
IDBKeyData::operator== and IDBKeyData::operator<=> currently disagree in
two cases:
1. String-typed keys: operator== (via WTF::String::operator==)
distinguishes null String from empty String, but
operator<=> (via codePointCompare) treats them as equivalent.
2. Invalid-typed keys: operator== checks isNull() to distinguish nullptr_t
from Invalid{}, but operator<=> treats all
Invalid-typed keys as equivalent.
This could cause inconsistency in containers of MemoryIDBBackingStore,
specifically HashMap keyed by operator== and
std::set ordered by operator<=>, and defeats cursor-invalidation guards
(which compare with operator== while erases use
operator<). This patch makes sure IDBKeyData::operator<=> match
IDBKeyData::operator== for equality check.
API tests: IDBKeyData.NullAndInvalidAreNotEquivalentInvalidKey
IDBKeyData.NullStringAndEmptyStringAreNotEquivalentStringKey
IDBKeyData.SetDistinguishesNullAndInvalid
IDBKeyData.SetDistinguishesNullStringAndEmptyString
* Source/WebCore/Modules/indexeddb/IDBKeyData.cpp:
(WebCore::operator<=>):
* Source/WebCore/Modules/indexeddb/IDBKeyData.h:
* Tools/TestWebKitAPI/CMakeLists.txt:
* Tools/TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:
* Tools/TestWebKitAPI/Tests/WebCore/IDBKeyData.cpp: Added.
(TestWebKitAPI::TEST(IDBKeyData, NullAndInvalidAreNotEquivalentInvalidKey)):
(TestWebKitAPI::TEST(IDBKeyData,
NullStringAndEmptyStringAreNotEquivalentStringKey)):
(TestWebKitAPI::TEST(IDBKeyData, SetDistinguishesNullAndInvalid)):
(TestWebKitAPI::TEST(IDBKeyData, SetDistinguishesNullStringAndEmptyString)):
Identifier: 305413.663@safari-7624-branch
Canonical link: https://commits.webkit.org/[email protected]
Commit: a7e1743a589277948eee4dab63ee7092f568199f
https://github.com/WebKit/WebKit/commit/a7e1743a589277948eee4dab63ee7092f568199f
Author: Ryosuke Niwa <[email protected]>
Date: 2026-04-15 (Wed, 15 Apr 2026)
Changed paths:
A LayoutTests/fast/text/fontface-setstatus-crash-expected.txt
A LayoutTests/fast/text/fontface-setstatus-crash.html
M Source/WebCore/css/CSSFontFaceSet.cpp
M Source/WebCore/css/CSSFontFaceSet.h
M Source/WebCore/css/FontFaceSet.cpp
Log Message:
-----------
Cherry-pick db05eacaeb0c. rdar://174525579
Use-after-free in CSSFontFace::setStatus and CSSFontFace::pump
https://bugs.webkit.org/show_bug.cgi?id=312202
rdar://174525579
Reviewed by Simon Fraser.
Fixed the bug by using Ref instead of std::reference_wrapper in the return
value of
CSSFontFaceSet::matchingFacesExcludingPreinstalledFonts and local variables
in
FontFaceSet::load to keep CSSFontFace objects alive long enough.
Test: fast/text/fontface-setstatus-crash.html
* LayoutTests/fast/text/fontface-setstatus-crash-expected.txt: Added.
* LayoutTests/fast/text/fontface-setstatus-crash.html: Added.
* Source/WebCore/css/CSSFontFaceSet.cpp:
(WebCore::CSSFontFaceSet::matchingFacesExcludingPreinstalledFonts):
* Source/WebCore/css/CSSFontFaceSet.h:
* Source/WebCore/css/FontFaceSet.cpp:
(WebCore::FontFaceSet::load):
Identifier: 305413.664@safari-7624-branch
Canonical link: https://commits.webkit.org/[email protected]
Commit: e104669760a456cc35b554f106cdfcabf7735fa4
https://github.com/WebKit/WebKit/commit/e104669760a456cc35b554f106cdfcabf7735fa4
Author: Ryosuke Niwa <[email protected]>
Date: 2026-04-15 (Wed, 15 Apr 2026)
Changed paths:
A
LayoutTests/fast/dom/Range/range-create-contextual-fragment-trsuted-types-crash-expected.txt
A
LayoutTests/fast/dom/Range/range-create-contextual-fragment-trsuted-types-crash.html
M Source/WebCore/dom/Range.cpp
Log Message:
-----------
Cherry-pick 4966a0d102e7. rdar://174489535
Use-after-free of Node in Range::createContextualFragment
https://bugs.webkit.org/show_bug.cgi?id=312244
rdar://174489535
Reviewed by Chris Dumez.
Fixed the bug by deploying more smart pointers.
Test:
fast/dom/Range/range-create-contextual-fragment-trsuted-types-crash.html
*
LayoutTests/fast/dom/Range/range-create-contextual-fragment-trsuted-types-crash-expected.txt:
Added.
*
LayoutTests/fast/dom/Range/range-create-contextual-fragment-trsuted-types-crash.html:
Added.
* Source/WebCore/dom/Range.cpp:
(WebCore::Range::createContextualFragment):
Identifier: 305413.665@safari-7624-branch
Canonical link: https://commits.webkit.org/[email protected]
Commit: 86a45f48548a45f5942302ba9e5a936def385179
https://github.com/WebKit/WebKit/commit/86a45f48548a45f5942302ba9e5a936def385179
Author: Ryosuke Niwa <[email protected]>
Date: 2026-04-15 (Wed, 15 Apr 2026)
Changed paths:
M Source/WebKit/UIProcess/WebProcessProxy.cpp
M Source/WebKit/UIProcess/WebProcessProxy.h
M Tools/TestWebKitAPI/Tests/WebKitCocoa/WebLocks.mm
Log Message:
-----------
Cherry-pick 4fcd36e3a363. rdar://174679141
REGRESSION(305413.548@safari-7624-branch): Crash in
WebProcessProxy::hasCommittedClientOrigin
https://bugs.webkit.org/show_bug.cgi?id=312335
rdar://174679141
Reviewed by Chris Dumez.
WebProcessProxy::hasCommittedClientOrigin has a code path for processes
running workers (isRunningWorkers())
that dereferences m_site as in *m_site. m_site is a
WTF::Expected<WebCore::Site, SiteState> — when it holds
the error value SiteState::MultipleSites, operator*() accesses the
non-existent value member, throwing
std::bad_variant_access. This propagates uncaught to the Objective-C run
loop boundary, triggering std::terminate().
The three conditions that must hold simultaneously for this crash to occur:
1. isRunningWorkers() is true — a service worker is running inside a web
content process (not a dedicated worker
process), so m_serviceWorkerInformation is set.
2. m_site holds MultipleSites — a cross-site navigation occurred in that
same web content process (no process swap),
so didStartProvisionalLoadForMainFrame set m_site =
makeUnexpected(SiteState::MultipleSites).
3. A RequestLock IPC from the service worker arrives after condition 2 —
the service worker's termination is
deferred (terminateRemoteWorkerContextConnectionWhenPossible instead
of the old disableRemoteWorkers), so
isRunningWorkers() remains true during a window where the worker can
still send IPCs.
Fixed the bug by adding a HashSet<WebCore::Site> m_committedSites to
WebProcessProxy, populated whenever m_site is
assigned a valid Site (in createForRemoteWorkers,
didStartProvisionalLoadForMainFrame, and
didStartUsingProcessForSiteIsolation). In hasCommittedClientOrigin, when
isRunningWorkers() is true but m_site does
not holds a value (it's MultipleSites), the check falls back to
m_committedSites instead of dereferencing m_site
in an error state. This correctly validates the worker's origin against the
sites the process has legitimately
committed — rather than crashing or incorrectly rejecting a legitimate lock
request and killing the web process.
Test: Tools/TestWebKitAPI/Tests/WebKitCocoa/WebLocks.mm
* Source/WebKit/UIProcess/WebProcessProxy.cpp:
(WebKit::WebProcessProxy::createForRemoteWorkers):
(WebKit::WebProcessProxy::hasCommittedClientOrigin const):
(WebKit::WebProcessProxy::didStartProvisionalLoadForMainFrame):
(WebKit::WebProcessProxy::didStartUsingProcessForSiteIsolation):
* Source/WebKit/UIProcess/WebProcessProxy.h:
* Tools/TestWebKitAPI/Tests/WebKitCocoa/WebLocks.mm:
(TestWebKitAPI::enableWebLocksAPI):
(TestWebKitAPI::runSnapshotAcrossPagesTest):
(TestWebKitAPI::runLockRequestWaitingOnAnotherPage):
(TestWebKitAPI::TEST(WebLocks,
ServiceWorkerLockRequestAfterCrossSiteNavigationInSameProcess)):
Identifier: 305413.672@safari-7624-branch
Canonical link: https://commits.webkit.org/[email protected]
Commit: ca2cd6ef7a21083b25150628336d61df28f84d45
https://github.com/WebKit/WebKit/commit/ca2cd6ef7a21083b25150628336d61df28f84d45
Author: Chris Dumez <[email protected]>
Date: 2026-04-15 (Wed, 15 Apr 2026)
Changed paths:
M Source/WebKit/WebProcess/WebProcess.cpp
Log Message:
-----------
Cherry-pick de77e9322dad. rdar://174830339
Null deref in WebProcess::refreshIDBConnectionForWorkers() during WebPage
construction
https://bugs.webkit.org/show_bug.cgi?id=312364
rdar://174762356
Reviewed by Ryosuke Niwa.
WebProcess::createWebPage() uses HashMap::ensure() to insert and construct
the WebPage in one step. During the WebPage constructor,
WebSocketProvider triggers ensureNetworkProcessConnection(), which may call
refreshIDBConnectionForWorkers(). That function iterates m_pageMap and
dereferences each Ref<WebPage> via operator->(). However, the Ref<WebPage>
for the page being constructed is still in its zeroed hash-table-empty
state (m_ptr == nullptr) because HashMap::ensure()'s translate function
evaluates the functor before assigning the result to the slot. This causes
a null dereference at offset 0x38 (the m_page member within WebPage).
Fix this by deferring refreshIDBConnectionForWorkers() to the next run loop
turn, matching the existing pattern used for
synchronizeCORSDisablingPatternsWithNetworkProcess() a few lines above.
* Source/WebKit/WebProcess/WebProcess.cpp:
(WebKit::WebProcess::ensureNetworkProcessConnection):
Canonical link: https://commits.webkit.org/311278@main
Canonical link: https://commits.webkit.org/[email protected]
Commit: 487d6bbc24d98914ac0d138ac6e115387b1b2282
https://github.com/WebKit/WebKit/commit/487d6bbc24d98914ac0d138ac6e115387b1b2282
Author: Ryosuke Niwa <[email protected]>
Date: 2026-04-15 (Wed, 15 Apr 2026)
Changed paths:
A
LayoutTests/fast/events/blur-window-with-focus-in-shadow-tree-crash-expected.txt
A LayoutTests/fast/events/blur-window-with-focus-in-shadow-tree-crash.html
M Source/WebCore/page/FocusController.cpp
Log Message:
-----------
Cherry-pick f045966f731c. rdar://174646151
Use-after-free in Element::dispatchBlurEvent
https://bugs.webkit.org/show_bug.cgi?id=312365
rdar://174646151
Reviewed by Rupin Mittal, Chris Dumez, and Anne van Kesteren.
Deployed more smart pointers to fix the bug.
Test: fast/events/blur-window-with-focus-in-shadow-tree-crash.html
*
LayoutTests/fast/events/blur-window-with-focus-in-shadow-tree-crash-expected.txt:
Added.
* LayoutTests/fast/events/blur-window-with-focus-in-shadow-tree-crash.html:
Added.
* Source/WebCore/page/FocusController.cpp:
(WebCore::dispatchEventsOnWindowAndFocusedElement):
Identifier: 305413.673@safari-7624-branch
Canonical link: https://commits.webkit.org/[email protected]
Commit: c777438394822678f6e3a304b38ea6f84f50a619
https://github.com/WebKit/WebKit/commit/c777438394822678f6e3a304b38ea6f84f50a619
Author: Ryosuke Niwa <[email protected]>
Date: 2026-04-15 (Wed, 15 Apr 2026)
Changed paths:
A LayoutTests/streams/readable-stream-fake-promise-crash-expected.txt
A LayoutTests/streams/readable-stream-fake-promise-crash.html
M Source/WebCore/Modules/streams/StreamPipeToUtilities.cpp
Log Message:
-----------
Cherry-pick 86716cafbc99. rdar://174652787
Type confusion in ReadableStream when cancel returns a fake Promise object
https://bugs.webkit.org/show_bug.cgi?id=312357
rdar://174652787
Reviewed by Chris Dumez.
Use jsDynamicCast in place of jsCast to avoid type confusion.
Test: streams/readable-stream-fake-promise-crash.html
* LayoutTests/streams/readable-stream-fake-promise-crash-expected.txt:
Added.
* LayoutTests/streams/readable-stream-fake-promise-crash.html: Added.
* Source/WebCore/Modules/streams/StreamPipeToUtilities.cpp:
(WebCore::cancelReadableStream):
(WebCore::StreamPipeToState::globalObject):
(WebCore::StreamPipeToState::handleSignal):
(WebCore::StreamPipeToState::errorsMustBePropagatedForward):
(WebCore::StreamPipeToState::closingMustBePropagatedBackward):
Identifier: 305413.674@safari-7624-branch
Canonical link: https://commits.webkit.org/[email protected]
Commit: fd848d1b99cb8c2bb7510501b8bc2c332d6fd1c7
https://github.com/WebKit/WebKit/commit/fd848d1b99cb8c2bb7510501b8bc2c332d6fd1c7
Author: Yijia Huang <[email protected]>
Date: 2026-04-15 (Wed, 15 Apr 2026)
Changed paths:
A JSTests/wasm/stress/deferred-work-timer-cancel-duplicate-ticket.js
M Source/JavaScriptCore/runtime/DeferredWorkTimer.cpp
Log Message:
-----------
Cherry-pick 09af279a99da. rdar://174738881
[JSC] Remove unneeded m_tasks append in
DeferredWorkTimer::cancelPendingWorkSafe
https://bugs.webkit.org/show_bug.cgi?id=312314
rdar://174738881
Reviewed by Keith Miller.
cancelPendingWorkSafe() was unconditionally appending a (ticket, noop)
entry to
m_tasks for every weak ticket of a dying global. This is unnecessary because
doWork() already has a removeIf(isCancelled) pass at the end that purges
cancelled
tickets from m_pendingTickets without needing a m_tasks entry, and
setTimeUntilFire(0_s) already ensures doWork() fires to run that cleanup.
Test: JSTests/wasm/stress/deferred-work-timer-cancel-duplicate-ticket.js
Identifier: 305413.677@safari-7624-branch
Canonical link: https://commits.webkit.org/[email protected]
Commit: c32f829aebdd7dd5bc600e7774550c34f0e09032
https://github.com/WebKit/WebKit/commit/c32f829aebdd7dd5bc600e7774550c34f0e09032
Author: Mohsin Qureshi <[email protected]>
Date: 2026-04-17 (Fri, 17 Apr 2026)
Changed paths:
M Configurations/Version.xcconfig
Log Message:
-----------
Versioning. WebKit-7624.2.5.13.2
Canonical link: https://commits.webkit.org/[email protected]
Commit: b374392ecd3376d3fc24cebad932fb45bfb807c3
https://github.com/WebKit/WebKit/commit/b374392ecd3376d3fc24cebad932fb45bfb807c3
Author: Ryosuke Niwa <[email protected]>
Date: 2026-04-17 (Fri, 17 Apr 2026)
Changed paths:
A
LayoutTests/fast/shadow-dom/named-slot-assignment-resolve-after-mutation-crash-expected.txt
A
LayoutTests/fast/shadow-dom/named-slot-assignment-resolve-after-mutation-crash.html
M Source/WebCore/dom/SlotAssignment.cpp
Log Message:
-----------
Cherry-pick cbcbdcfa297d. rdar://175020528
Use-after-free in NamedSlotAssignment::resolveSlotsAfterSlotMutation
https://bugs.webkit.org/show_bug.cgi?id=312247
rdar://174493428
Reviewed by Chris Dumez and Anne van Kesteren.
The bug was caused by hasAssignedNodes updating m_slots as a part of
resolving slot assignments while
we're iterating over m_slots in
NamedSlotAssignment::resolveSlotsAfterSlotMutation. Fixed the bug by
avoiding updating slot assignments upfront and simply checking
slot->assignedNodes.isEmpty() instead.
Test:
fast/shadow-dom/named-slot-assignment-resolve-after-mutation-crash.html
*
LayoutTests/fast/shadow-dom/named-slot-assignment-resolve-after-mutation-crash-expected.txt:
Added.
*
LayoutTests/fast/shadow-dom/named-slot-assignment-resolve-after-mutation-crash.html:
Added.
* Source/WebCore/dom/SlotAssignment.cpp:
(WebCore::NamedSlotAssignment::resolveSlotsAfterSlotMutation):
Identifier: 305413.669@safari-7624-branch
Canonical link: https://commits.webkit.org/[email protected]
Commit: 3d1b6050da566ae2fec3e7ef2cdf64fd64a209af
https://github.com/WebKit/WebKit/commit/3d1b6050da566ae2fec3e7ef2cdf64fd64a209af
Author: Ryosuke Niwa <[email protected]>
Date: 2026-04-17 (Fri, 17 Apr 2026)
Changed paths:
A LayoutTests/fast/forms/radio-checked-detached-tree-gc-crash-expected.txt
A LayoutTests/fast/forms/radio-checked-detached-tree-gc-crash.html
M Source/WebCore/dom/ContainerNodeAlgorithms.cpp
M Source/WebCore/dom/Node.h
Log Message:
-----------
Cherry-pick 7058101b207d. rdar://174490518
Heap use-after-free in Node::rootNode via stale m_shadowIncludingRoot
https://bugs.webkit.org/show_bug.cgi?id=312426
rdar://174490518
Reviewed by Geoffrey Garen.
The bug was caused by Node::m_shadowIncludingRoot not getting reset in
removeDetachedChildrenInContainer. Fixed the bug by resetting it to this in
the function.
Test: fast/forms/radio-checked-detached-tree-gc-crash.html
* LayoutTests/fast/forms/radio-checked-detached-tree-gc-crash-expected.txt:
Added.
* LayoutTests/fast/forms/radio-checked-detached-tree-gc-crash.html: Added.
* Source/WebCore/dom/ContainerNodeAlgorithms.cpp:
(WebCore::removeDetachedChildrenInContainer):
* Source/WebCore/dom/Node.h:
(WebCore::Node::resetShadowIncludingRoot):
Identifier: 305413.681@safari-7624-branch
Canonical link: https://commits.webkit.org/[email protected]
Commit: 3136cbffd30373f046063b1c9dcc94e8a0b043f1
https://github.com/WebKit/WebKit/commit/3136cbffd30373f046063b1c9dcc94e8a0b043f1
Author: Mohsin Qureshi <[email protected]>
Date: 2026-04-21 (Tue, 21 Apr 2026)
Changed paths:
M Configurations/Version.xcconfig
Log Message:
-----------
Versioning. WebKit-7624.2.5.13.3
Canonical link: https://commits.webkit.org/[email protected]
Commit: 90cb73300b56bbf647e66ccbf717a2e39fbcd98e
https://github.com/WebKit/WebKit/commit/90cb73300b56bbf647e66ccbf717a2e39fbcd98e
Author: Ryosuke Niwa <[email protected]>
Date: 2026-04-21 (Tue, 21 Apr 2026)
Changed paths:
M Source/WebCore/dom/ContainerNodeAlgorithms.cpp
M Source/WebCore/dom/Node.cpp
M Source/WebCore/dom/Node.h
Log Message:
-----------
Cherry-pick 5d07bda85f02. rdar://175103172
REGRESSION: Use-after-free in Node::m_shadowIncludingRoot via destructor
cascade not propagating into shadow roots
https://bugs.webkit.org/show_bug.cgi?id=312712
rdar://175103172
Reviewed by Geoffrey Garen.
When a document is torn down via Document::removedLastRef through
removeDetachedChildrenInContainer,
the <html> element is removed from the document. Since <html> is still in
tree scope at this point,
notifyChildNodeRemoved is called, which walks the entire subtree -
including shadow roots - and sets
m_shadowIncludingRoot to <html> for all descendants. This is correct at
that moment.
Then <html> is freed when the loop's RefPtr releases it (children don't
ref-count their parents -
m_parentNode is CheckedPtr). This triggers a destructor cascade:
~ContainerNode(<html>) via
removeDetachedChildrenInContainer(<html>) processes <body>, then
~ContainerNode(<body>) processes
the <video> element, and so on. Each step calls resetShadowIncludingRoot()
on the direct child,
fixing that node's cache. However, since IsConnected and IsInShadowTree
flags were cleared during
the initial notifyChildNodeRemoved walk, isInTreeScope() returns false, so
notifyChildNodeRemoved
is skipped in this case. This means the shadow root and its descendants are
never updated -
m_shadowIncludingRoot of these nodes still point to the now-freed <html>.
Nodes kept alive by mechanisms other than JS wrappers - such as
HTMLMediaElement which survives as
an ActiveDOMObject - retain their shadow DOM with dangling
m_shadowIncludingRoot pointers. When
these nodes are subsequently used (e.g., VTT cue display tree updates via
an event loop task), the
stale pointer is dereferenced, causing an use-after-free.
This PR fixes this use-after-free bug by updating m_shadowIncludingRoot for
removed subtrees when
the root's refCount is greater than 1 (i.e. there is an external reference
to the node beyond the
RefPtr in removeDetachedChildrenInContainer).
No new tests since existing media tests such as
media/track/webvtt-parser-does-not-leak.html would
hit debug assertions without this fix, and this bug requires a node to be
kept alive by C++ code.
* Source/WebCore/dom/ContainerNodeAlgorithms.cpp:
(WebCore::removeDetachedChildrenInContainer):
* Source/WebCore/dom/Node.cpp:
(WebCore::Node::updateShadowIncludingRootForSubtree):
* Source/WebCore/dom/Node.h:
Identifier: 305413.700@safari-7624-branch
Canonical link: https://commits.webkit.org/[email protected]
Compare: https://github.com/WebKit/WebKit/compare/7a734adb5f9d%5E...90cb73300b56
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
