Branch: refs/heads/safari-7624.2.5.12-branch
Home: https://github.com/WebKit/WebKit
Commit: 1e68311de6945aa2762cc91907373a6856f8a77f
https://github.com/WebKit/WebKit/commit/1e68311de6945aa2762cc91907373a6856f8a77f
Author: Mohsin Qureshi <[email protected]>
Date: 2026-04-15 (Wed, 15 Apr 2026)
Changed paths:
M Configurations/Version.xcconfig
Log Message:
-----------
Versioning. WebKit-7624.2.5.12.1
Canonical link: https://commits.webkit.org/[email protected]
Commit: 7fb37b392e51c447fad87011d22ff45f653edc46
https://github.com/WebKit/WebKit/commit/7fb37b392e51c447fad87011d22ff45f653edc46
Author: Sihui Liu <[email protected]>
Date: 2026-04-15 (Wed, 15 Apr 2026)
Changed paths:
M Source/WebCore/Modules/indexeddb/IDBKeyData.cpp
M Source/WebCore/Modules/indexeddb/IDBKeyData.h
M Tools/TestWebKitAPI/CMakeLists.txt
M Tools/TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj
A Tools/TestWebKitAPI/Tests/WebCore/IDBKeyData.cpp
Log Message:
-----------
Cherry-pick 3efb02c6bee1. rdar://174327363
[IndexedDB] IDBKeyData operator== and operator<=> define different
equivalence classes
rdar://174327363
Reviewed by Brady Eidson.
IDBKeyData::operator== and IDBKeyData::operator<=> currently disagree in
two cases:
1. String-typed keys: operator== (via WTF::String::operator==)
distinguishes null String from empty String, but
operator<=> (via codePointCompare) treats them as equivalent.
2. Invalid-typed keys: operator== checks isNull() to distinguish nullptr_t
from Invalid{}, but operator<=> treats all
Invalid-typed keys as equivalent.
This could cause inconsistency in containers of MemoryIDBBackingStore,
specifically HashMap keyed by operator== and
std::set ordered by operator<=>, and defeats cursor-invalidation guards
(which compare with operator== while erases use
operator<). This patch makes sure IDBKeyData::operator<=> match
IDBKeyData::operator== for equality check.
API tests: IDBKeyData.NullAndInvalidAreNotEquivalentInvalidKey
IDBKeyData.NullStringAndEmptyStringAreNotEquivalentStringKey
IDBKeyData.SetDistinguishesNullAndInvalid
IDBKeyData.SetDistinguishesNullStringAndEmptyString
* Source/WebCore/Modules/indexeddb/IDBKeyData.cpp:
(WebCore::operator<=>):
* Source/WebCore/Modules/indexeddb/IDBKeyData.h:
* Tools/TestWebKitAPI/CMakeLists.txt:
* Tools/TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:
* Tools/TestWebKitAPI/Tests/WebCore/IDBKeyData.cpp: Added.
(TestWebKitAPI::TEST(IDBKeyData, NullAndInvalidAreNotEquivalentInvalidKey)):
(TestWebKitAPI::TEST(IDBKeyData,
NullStringAndEmptyStringAreNotEquivalentStringKey)):
(TestWebKitAPI::TEST(IDBKeyData, SetDistinguishesNullAndInvalid)):
(TestWebKitAPI::TEST(IDBKeyData, SetDistinguishesNullStringAndEmptyString)):
Identifier: 305413.663@safari-7624-branch
Commit: 37857d261fc8350179812cbd28f78ff9996f3656
https://github.com/WebKit/WebKit/commit/37857d261fc8350179812cbd28f78ff9996f3656
Author: Ryosuke Niwa <[email protected]>
Date: 2026-04-15 (Wed, 15 Apr 2026)
Changed paths:
A LayoutTests/fast/text/fontface-setstatus-crash-expected.txt
A LayoutTests/fast/text/fontface-setstatus-crash.html
M Source/WebCore/css/CSSFontFaceSet.cpp
M Source/WebCore/css/CSSFontFaceSet.h
M Source/WebCore/css/FontFaceSet.cpp
Log Message:
-----------
Cherry-pick db05eacaeb0c. rdar://174525579
Use-after-free in CSSFontFace::setStatus and CSSFontFace::pump
https://bugs.webkit.org/show_bug.cgi?id=312202
rdar://174525579
Reviewed by Simon Fraser.
Fixed the bug by using Ref instead of std::reference_wrapper in the return
value of
CSSFontFaceSet::matchingFacesExcludingPreinstalledFonts and local variables
in
FontFaceSet::load to keep CSSFontFace objects alive long enough.
Test: fast/text/fontface-setstatus-crash.html
* LayoutTests/fast/text/fontface-setstatus-crash-expected.txt: Added.
* LayoutTests/fast/text/fontface-setstatus-crash.html: Added.
* Source/WebCore/css/CSSFontFaceSet.cpp:
(WebCore::CSSFontFaceSet::matchingFacesExcludingPreinstalledFonts):
* Source/WebCore/css/CSSFontFaceSet.h:
* Source/WebCore/css/FontFaceSet.cpp:
(WebCore::FontFaceSet::load):
Identifier: 305413.664@safari-7624-branch
Commit: 43fca8bfc13f32a46415a578b4eb35fa963980b9
https://github.com/WebKit/WebKit/commit/43fca8bfc13f32a46415a578b4eb35fa963980b9
Author: Ryosuke Niwa <[email protected]>
Date: 2026-04-15 (Wed, 15 Apr 2026)
Changed paths:
A
LayoutTests/fast/dom/Range/range-create-contextual-fragment-trsuted-types-crash-expected.txt
A
LayoutTests/fast/dom/Range/range-create-contextual-fragment-trsuted-types-crash.html
M Source/WebCore/dom/Range.cpp
Log Message:
-----------
Cherry-pick 4966a0d102e7. rdar://174489535
Use-after-free of Node in Range::createContextualFragment
https://bugs.webkit.org/show_bug.cgi?id=312244
rdar://174489535
Reviewed by Chris Dumez.
Fixed the bug by deploying more smart pointers.
Test:
fast/dom/Range/range-create-contextual-fragment-trsuted-types-crash.html
*
LayoutTests/fast/dom/Range/range-create-contextual-fragment-trsuted-types-crash-expected.txt:
Added.
*
LayoutTests/fast/dom/Range/range-create-contextual-fragment-trsuted-types-crash.html:
Added.
* Source/WebCore/dom/Range.cpp:
(WebCore::Range::createContextualFragment):
Identifier: 305413.665@safari-7624-branch
Commit: 6a2fbadd184ed94654a9c1959bb58971a5f19151
https://github.com/WebKit/WebKit/commit/6a2fbadd184ed94654a9c1959bb58971a5f19151
Author: Ryosuke Niwa <[email protected]>
Date: 2026-04-15 (Wed, 15 Apr 2026)
Changed paths:
M Source/WebKit/UIProcess/WebProcessProxy.cpp
M Source/WebKit/UIProcess/WebProcessProxy.h
M Tools/TestWebKitAPI/Tests/WebKitCocoa/WebLocks.mm
Log Message:
-----------
Cherry-pick 4fcd36e3a363. rdar://174679141
REGRESSION(305413.548@safari-7624-branch): Crash in
WebProcessProxy::hasCommittedClientOrigin
https://bugs.webkit.org/show_bug.cgi?id=312335
rdar://174679141
Reviewed by Chris Dumez.
WebProcessProxy::hasCommittedClientOrigin has a code path for processes
running workers (isRunningWorkers())
that dereferences m_site as in *m_site. m_site is a
WTF::Expected<WebCore::Site, SiteState> — when it holds
the error value SiteState::MultipleSites, operator*() accesses the
non-existent value member, throwing
std::bad_variant_access. This propagates uncaught to the Objective-C run
loop boundary, triggering std::terminate().
The three conditions that must hold simultaneously for this crash to occur:
1. isRunningWorkers() is true — a service worker is running inside a web
content process (not a dedicated worker
process), so m_serviceWorkerInformation is set.
2. m_site holds MultipleSites — a cross-site navigation occurred in that
same web content process (no process swap),
so didStartProvisionalLoadForMainFrame set m_site =
makeUnexpected(SiteState::MultipleSites).
3. A RequestLock IPC from the service worker arrives after condition 2 —
the service worker's termination is
deferred (terminateRemoteWorkerContextConnectionWhenPossible instead
of the old disableRemoteWorkers), so
isRunningWorkers() remains true during a window where the worker can
still send IPCs.
Fixed the bug by adding a HashSet<WebCore::Site> m_committedSites to
WebProcessProxy, populated whenever m_site is
assigned a valid Site (in createForRemoteWorkers,
didStartProvisionalLoadForMainFrame, and
didStartUsingProcessForSiteIsolation). In hasCommittedClientOrigin, when
isRunningWorkers() is true but m_site does
not holds a value (it's MultipleSites), the check falls back to
m_committedSites instead of dereferencing m_site
in an error state. This correctly validates the worker's origin against the
sites the process has legitimately
committed — rather than crashing or incorrectly rejecting a legitimate lock
request and killing the web process.
Test: Tools/TestWebKitAPI/Tests/WebKitCocoa/WebLocks.mm
* Source/WebKit/UIProcess/WebProcessProxy.cpp:
(WebKit::WebProcessProxy::createForRemoteWorkers):
(WebKit::WebProcessProxy::hasCommittedClientOrigin const):
(WebKit::WebProcessProxy::didStartProvisionalLoadForMainFrame):
(WebKit::WebProcessProxy::didStartUsingProcessForSiteIsolation):
* Source/WebKit/UIProcess/WebProcessProxy.h:
* Tools/TestWebKitAPI/Tests/WebKitCocoa/WebLocks.mm:
(TestWebKitAPI::enableWebLocksAPI):
(TestWebKitAPI::runSnapshotAcrossPagesTest):
(TestWebKitAPI::runLockRequestWaitingOnAnotherPage):
(TestWebKitAPI::TEST(WebLocks,
ServiceWorkerLockRequestAfterCrossSiteNavigationInSameProcess)):
Identifier: 305413.672@safari-7624-branch
Commit: fd238ab26d8fb43b8f8f3cb4227c2883709b7971
https://github.com/WebKit/WebKit/commit/fd238ab26d8fb43b8f8f3cb4227c2883709b7971
Author: Chris Dumez <[email protected]>
Date: 2026-04-15 (Wed, 15 Apr 2026)
Changed paths:
M Source/WebKit/WebProcess/WebProcess.cpp
Log Message:
-----------
Cherry-pick de77e9322dad. rdar://174830339
Null deref in WebProcess::refreshIDBConnectionForWorkers() during WebPage
construction
https://bugs.webkit.org/show_bug.cgi?id=312364
rdar://174762356
Reviewed by Ryosuke Niwa.
WebProcess::createWebPage() uses HashMap::ensure() to insert and construct
the WebPage in one step. During the WebPage constructor,
WebSocketProvider triggers ensureNetworkProcessConnection(), which may call
refreshIDBConnectionForWorkers(). That function iterates m_pageMap and
dereferences each Ref<WebPage> via operator->(). However, the Ref<WebPage>
for the page being constructed is still in its zeroed hash-table-empty
state (m_ptr == nullptr) because HashMap::ensure()'s translate function
evaluates the functor before assigning the result to the slot. This causes
a null dereference at offset 0x38 (the m_page member within WebPage).
Fix this by deferring refreshIDBConnectionForWorkers() to the next run loop
turn, matching the existing pattern used for
synchronizeCORSDisablingPatternsWithNetworkProcess() a few lines above.
* Source/WebKit/WebProcess/WebProcess.cpp:
(WebKit::WebProcess::ensureNetworkProcessConnection):
Canonical link: https://commits.webkit.org/311278@main
Commit: 0cb11b2295190d177af50a37c905fe694bdc5260
https://github.com/WebKit/WebKit/commit/0cb11b2295190d177af50a37c905fe694bdc5260
Author: Ryosuke Niwa <[email protected]>
Date: 2026-04-15 (Wed, 15 Apr 2026)
Changed paths:
A
LayoutTests/fast/events/blur-window-with-focus-in-shadow-tree-crash-expected.txt
A LayoutTests/fast/events/blur-window-with-focus-in-shadow-tree-crash.html
M Source/WebCore/page/FocusController.cpp
Log Message:
-----------
Cherry-pick f045966f731c. rdar://174646151
Use-after-free in Element::dispatchBlurEvent
https://bugs.webkit.org/show_bug.cgi?id=312365
rdar://174646151
Reviewed by Rupin Mittal, Chris Dumez, and Anne van Kesteren.
Deployed more smart pointers to fix the bug.
Test: fast/events/blur-window-with-focus-in-shadow-tree-crash.html
*
LayoutTests/fast/events/blur-window-with-focus-in-shadow-tree-crash-expected.txt:
Added.
* LayoutTests/fast/events/blur-window-with-focus-in-shadow-tree-crash.html:
Added.
* Source/WebCore/page/FocusController.cpp:
(WebCore::dispatchEventsOnWindowAndFocusedElement):
Identifier: 305413.673@safari-7624-branch
Commit: 54dc71f9568ba1c673a3a8d1c5805ed408cfb829
https://github.com/WebKit/WebKit/commit/54dc71f9568ba1c673a3a8d1c5805ed408cfb829
Author: Ryosuke Niwa <[email protected]>
Date: 2026-04-15 (Wed, 15 Apr 2026)
Changed paths:
A LayoutTests/streams/readable-stream-fake-promise-crash-expected.txt
A LayoutTests/streams/readable-stream-fake-promise-crash.html
M Source/WebCore/Modules/streams/StreamPipeToUtilities.cpp
Log Message:
-----------
Cherry-pick 86716cafbc99. rdar://174652787
Type confusion in ReadableStream when cancel returns a fake Promise object
https://bugs.webkit.org/show_bug.cgi?id=312357
rdar://174652787
Reviewed by Chris Dumez.
Use jsDynamicCast in place of jsCast to avoid type confusion.
Test: streams/readable-stream-fake-promise-crash.html
* LayoutTests/streams/readable-stream-fake-promise-crash-expected.txt:
Added.
* LayoutTests/streams/readable-stream-fake-promise-crash.html: Added.
* Source/WebCore/Modules/streams/StreamPipeToUtilities.cpp:
(WebCore::cancelReadableStream):
(WebCore::StreamPipeToState::globalObject):
(WebCore::StreamPipeToState::handleSignal):
(WebCore::StreamPipeToState::errorsMustBePropagatedForward):
(WebCore::StreamPipeToState::closingMustBePropagatedBackward):
Identifier: 305413.674@safari-7624-branch
Commit: f2089fba3789282875fe271d0c1b2bc95414616b
https://github.com/WebKit/WebKit/commit/f2089fba3789282875fe271d0c1b2bc95414616b
Author: Yijia Huang <[email protected]>
Date: 2026-04-15 (Wed, 15 Apr 2026)
Changed paths:
A JSTests/wasm/stress/deferred-work-timer-cancel-duplicate-ticket.js
M Source/JavaScriptCore/runtime/DeferredWorkTimer.cpp
Log Message:
-----------
Cherry-pick 09af279a99da. rdar://174738881
[JSC] Remove unneeded m_tasks append in
DeferredWorkTimer::cancelPendingWorkSafe
https://bugs.webkit.org/show_bug.cgi?id=312314
rdar://174738881
Reviewed by Keith Miller.
cancelPendingWorkSafe() was unconditionally appending a (ticket, noop)
entry to
m_tasks for every weak ticket of a dying global. This is unnecessary because
doWork() already has a removeIf(isCancelled) pass at the end that purges
cancelled
tickets from m_pendingTickets without needing a m_tasks entry, and
setTimeUntilFire(0_s) already ensures doWork() fires to run that cleanup.
Test: JSTests/wasm/stress/deferred-work-timer-cancel-duplicate-ticket.js
Identifier: 305413.677@safari-7624-branch
Commit: 7431d51d14dc6652f05db2f9b031fa6caa509f40
https://github.com/WebKit/WebKit/commit/7431d51d14dc6652f05db2f9b031fa6caa509f40
Author: Mohsin Qureshi <[email protected]>
Date: 2026-04-17 (Fri, 17 Apr 2026)
Changed paths:
M Configurations/Version.xcconfig
Log Message:
-----------
Versioning. WebKit-7624.2.5.12.2
Canonical link: https://commits.webkit.org/[email protected]
Commit: 0440ab819335dd2608098cd8db0b735e64b568c5
https://github.com/WebKit/WebKit/commit/0440ab819335dd2608098cd8db0b735e64b568c5
Author: Ryosuke Niwa <[email protected]>
Date: 2026-04-17 (Fri, 17 Apr 2026)
Changed paths:
A
LayoutTests/fast/shadow-dom/named-slot-assignment-resolve-after-mutation-crash-expected.txt
A
LayoutTests/fast/shadow-dom/named-slot-assignment-resolve-after-mutation-crash.html
M Source/WebCore/dom/SlotAssignment.cpp
Log Message:
-----------
Cherry-pick cbcbdcfa297d. rdar://175020528
Use-after-free in NamedSlotAssignment::resolveSlotsAfterSlotMutation
https://bugs.webkit.org/show_bug.cgi?id=312247
rdar://174493428
Reviewed by Chris Dumez and Anne van Kesteren.
The bug was caused by hasAssignedNodes updating m_slots as a part of
resolving slot assignments while
we're iterating over m_slots in
NamedSlotAssignment::resolveSlotsAfterSlotMutation. Fixed the bug by
avoiding updating slot assignments upfront and simply checking
slot->assignedNodes.isEmpty() instead.
Test:
fast/shadow-dom/named-slot-assignment-resolve-after-mutation-crash.html
*
LayoutTests/fast/shadow-dom/named-slot-assignment-resolve-after-mutation-crash-expected.txt:
Added.
*
LayoutTests/fast/shadow-dom/named-slot-assignment-resolve-after-mutation-crash.html:
Added.
* Source/WebCore/dom/SlotAssignment.cpp:
(WebCore::NamedSlotAssignment::resolveSlotsAfterSlotMutation):
Identifier: 305413.669@safari-7624-branch
Canonical link: https://commits.webkit.org/[email protected]
Commit: cf5bf81d46ad3117c8ec6c6771564ade6b222f35
https://github.com/WebKit/WebKit/commit/cf5bf81d46ad3117c8ec6c6771564ade6b222f35
Author: Ryosuke Niwa <[email protected]>
Date: 2026-04-17 (Fri, 17 Apr 2026)
Changed paths:
A LayoutTests/fast/forms/radio-checked-detached-tree-gc-crash-expected.txt
A LayoutTests/fast/forms/radio-checked-detached-tree-gc-crash.html
M Source/WebCore/dom/ContainerNodeAlgorithms.cpp
M Source/WebCore/dom/Node.h
Log Message:
-----------
Cherry-pick 7058101b207d. rdar://174490518
Heap use-after-free in Node::rootNode via stale m_shadowIncludingRoot
https://bugs.webkit.org/show_bug.cgi?id=312426
rdar://174490518
Reviewed by Geoffrey Garen.
The bug was caused by Node::m_shadowIncludingRoot not getting reset in
removeDetachedChildrenInContainer. Fixed the bug by resetting it to this in
the function.
Test: fast/forms/radio-checked-detached-tree-gc-crash.html
* LayoutTests/fast/forms/radio-checked-detached-tree-gc-crash-expected.txt:
Added.
* LayoutTests/fast/forms/radio-checked-detached-tree-gc-crash.html: Added.
* Source/WebCore/dom/ContainerNodeAlgorithms.cpp:
(WebCore::removeDetachedChildrenInContainer):
* Source/WebCore/dom/Node.h:
(WebCore::Node::resetShadowIncludingRoot):
Identifier: 305413.681@safari-7624-branch
Canonical link: https://commits.webkit.org/[email protected]
Commit: 8cc15ec5647e2b2640cbb6ef8c3f2316f18ac264
https://github.com/WebKit/WebKit/commit/8cc15ec5647e2b2640cbb6ef8c3f2316f18ac264
Author: Mohsin Qureshi <[email protected]>
Date: 2026-04-21 (Tue, 21 Apr 2026)
Changed paths:
M Configurations/Version.xcconfig
Log Message:
-----------
Versioning. WebKit-7624.2.5.12.3
Canonical link: https://commits.webkit.org/[email protected]
Commit: 37a3a7a63e865b67a6bd001da7b6e861a470cc9e
https://github.com/WebKit/WebKit/commit/37a3a7a63e865b67a6bd001da7b6e861a470cc9e
Author: Ryosuke Niwa <[email protected]>
Date: 2026-04-21 (Tue, 21 Apr 2026)
Changed paths:
M Source/WebCore/dom/ContainerNodeAlgorithms.cpp
M Source/WebCore/dom/Node.cpp
M Source/WebCore/dom/Node.h
Log Message:
-----------
Cherry-pick 5d07bda85f02. rdar://175103172
REGRESSION: Use-after-free in Node::m_shadowIncludingRoot via destructor
cascade not propagating into shadow roots
https://bugs.webkit.org/show_bug.cgi?id=312712
rdar://175103172
Reviewed by Geoffrey Garen.
When a document is torn down via Document::removedLastRef through
removeDetachedChildrenInContainer,
the <html> element is removed from the document. Since <html> is still in
tree scope at this point,
notifyChildNodeRemoved is called, which walks the entire subtree -
including shadow roots - and sets
m_shadowIncludingRoot to <html> for all descendants. This is correct at
that moment.
Then <html> is freed when the loop's RefPtr releases it (children don't
ref-count their parents -
m_parentNode is CheckedPtr). This triggers a destructor cascade:
~ContainerNode(<html>) via
removeDetachedChildrenInContainer(<html>) processes <body>, then
~ContainerNode(<body>) processes
the <video> element, and so on. Each step calls resetShadowIncludingRoot()
on the direct child,
fixing that node's cache. However, since IsConnected and IsInShadowTree
flags were cleared during
the initial notifyChildNodeRemoved walk, isInTreeScope() returns false, so
notifyChildNodeRemoved
is skipped in this case. This means the shadow root and its descendants are
never updated -
m_shadowIncludingRoot of these nodes still point to the now-freed <html>.
Nodes kept alive by mechanisms other than JS wrappers - such as
HTMLMediaElement which survives as
an ActiveDOMObject - retain their shadow DOM with dangling
m_shadowIncludingRoot pointers. When
these nodes are subsequently used (e.g., VTT cue display tree updates via
an event loop task), the
stale pointer is dereferenced, causing an use-after-free.
This PR fixes this use-after-free bug by updating m_shadowIncludingRoot for
removed subtrees when
the root's refCount is greater than 1 (i.e. there is an external reference
to the node beyond the
RefPtr in removeDetachedChildrenInContainer).
No new tests since existing media tests such as
media/track/webvtt-parser-does-not-leak.html would
hit debug assertions without this fix, and this bug requires a node to be
kept alive by C++ code.
* Source/WebCore/dom/ContainerNodeAlgorithms.cpp:
(WebCore::removeDetachedChildrenInContainer):
* Source/WebCore/dom/Node.cpp:
(WebCore::Node::updateShadowIncludingRootForSubtree):
* Source/WebCore/dom/Node.h:
Identifier: 305413.700@safari-7624-branch
Canonical link: https://commits.webkit.org/[email protected]
Compare: https://github.com/WebKit/WebKit/compare/1e68311de694%5E...37a3a7a63e86
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
