Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: d6603cdc953449101221fc35928e66efa2f8601c
https://github.com/WebKit/WebKit/commit/d6603cdc953449101221fc35928e66efa2f8601c
Author: Chris Dumez <[email protected]>
Date: 2026-07-27 (Mon, 27 Jul 2026)
Changed paths:
M Tools/WebKitTestRunner/ios/PlatformWebViewIOS.mm
Log Message:
-----------
WebKitTestRunner: Fix out-of-bounds read in iOS PlatformWebView::keyWindow()
https://bugs.webkit.org/show_bug.cgi?id=320352
Reviewed by Abrar Rahman Protyasha.
keyWindow() initialized its index to allWindows.size() and only decremented
it after indexing, so the first loop iteration accessed allWindows[size()] —
one past the end of the Vector. WTF::Vector::operator[] bounds-checks via its
default CrashOnOverflow handler, so this hits CRASH() (in both debug and
release) whenever keyWindow() runs with a non-empty window list. The last
element (index 0) was also never examined.
Decrement the index before indexing so the loop walks the valid range
[size()-1 .. 0], matching the Mac implementation in
WebKitTestRunnerWindow::_WTR_keyWindow.
* Tools/WebKitTestRunner/ios/PlatformWebViewIOS.mm:
(WTR::PlatformWebView::keyWindow):
Canonical link: https://commits.webkit.org/318024@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
