Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 8b661b920bebf0ba48bf772db0f98c28891b4dd9
https://github.com/WebKit/WebKit/commit/8b661b920bebf0ba48bf772db0f98c28891b4dd9
Author: Adrian Taylor <[email protected]>
Date: 2026-08-10 (Mon, 10 Aug 2026)
Changed paths:
M Source/WTF/wtf/Vector.h
M Source/WebKit/WebProcess/Plugins/PDF/PDFIncrementalLoader.mm
M Tools/TestWebKitAPI/CMakeLists.txt
M Tools/TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj
A Tools/TestWebKitAPI/Tests/WTF/VectorBorrow.cpp
Log Message:
-----------
crashIfBorrowed in Vector
https://bugs.webkit.org/show_bug.cgi?id=318672
rdar://181484944
Reviewed by Geoffrey Garen.
WTF::Vector already supports the WTF::CanBorrow protocol, by which code can
indicate that the vector's data is temporarily borrowed and in use elsewhere -
thus the vector should not be structurally changed (reallocated/resized/etc.)
during that period. The intention of the CanBorrow protocol is that such
interior destructions should cause a clean crash rather than an exploitable
memory safety bug.
This change does the last bit of the work, which is to actually call
crashIfBorrowed at such mutation sites.
We had an over-long borrow in PDFIncrementalLoader.mm which needed to be fixed
for enforcement to succeed. This was a false-positive, not a real
vulnerability.
Test: Tools/TestWebKitAPI/Tests/WTF/Borrow.cpp
Canonical link: https://commits.webkit.org/318890@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
