Branch: refs/heads/webkitglib/2.54
Home: https://github.com/WebKit/WebKit
Commit: b7b814a80b65c13decc47efc9b6ee6629835977f
https://github.com/WebKit/WebKit/commit/b7b814a80b65c13decc47efc9b6ee6629835977f
Author: Chris Dumez <[email protected]>
Date: 2026-08-10 (Mon, 10 Aug 2026)
Changed paths:
M Source/WebCore/platform/graphics/MIMESniffer.cpp
M Tools/TestWebKitAPI/Tests/WebCore/MIMESniffer.cpp
Log Message:
-----------
Cherry-pick 318243@main (ef325e63cb21).
https://bugs.webkit.org/show_bug.cgi?id=320634
Out-of-bounds read in WebM MIME sniffer at the 0x42 0x82 DocType check
https://bugs.webkit.org/show_bug.cgi?id=320634
Reviewed by Youenn Fablet.
314498@main guarded the inner skip-NUL loop in hasSignatureForWebM(),
but a second unguarded iter + 1 read remains at the top of the loop:
```
while (iter < length && iter < 38) {
if (sequence[iter] == 0x42 && sequence[iter + 1] == 0x82) {
```
The loop guard only guarantees iter < length, not iter + 1 < length. When
iter == length - 1 and sequence[iter] == 0x42, the short-circuit && goes on
to evaluate sequence[iter + 1], reading one byte past the end of the span.
This is reachable before the skip-NUL path 314498@main fixed: a 5-byte
input of EBML magic + a trailing 0x42 (0x1A 0x45 0xDF 0xA3 0x42) enters the
loop at iter == 4 == length - 1 and reads sequence[5].
getMIMETypeFromContent()
is called on attacker-controlled response bytes via MediaResourceSniffer
with
a span sized to the exact number of received bytes, so this is a remotely
reachable crash. WebKit builds with hardened libc++, so std::span's bounds
check turns it into a safe abort on every build.
Guard the two-byte compare with iter + 1 < length so the bounds check
short-circuits the dereference, matching the guarded reads later in the
function, and extend the regression test with the truncated 5-byte input.
Test: MIMESniffer.WebMSnifferDoesNotReadPastEnd
* Source/WebCore/platform/graphics/MIMESniffer.cpp:
(WebCore::MIMESniffer::hasSignatureForWebM):
* Tools/TestWebKitAPI/Tests/WebCore/MIMESniffer.cpp:
(TestWebKitAPI::TEST(MIMESniffer, WebMSnifferDoesNotReadPastEnd)):
Canonical link: https://commits.webkit.org/318243@main
Canonical link: https://commits.webkit.org/317695.85@webkitglib/2.54
Commit: 63350dd0d8ee79bbcdc650fc5a41301332549f6d
https://github.com/WebKit/WebKit/commit/63350dd0d8ee79bbcdc650fc5a41301332549f6d
Author: Sammy Gill <[email protected]>
Date: 2026-08-10 (Mon, 10 Aug 2026)
Changed paths:
M LayoutTests/TestExpectations
M Source/WebCore/rendering/RenderBlock.cpp
M Source/WebCore/rendering/SubtreeScrollbarChangesState.cpp
Log Message:
-----------
Cherry-pick 318095@main (3b267afd25f0).
https://bugs.webkit.org/show_bug.cgi?id=320473
Unreviewed backport.
REGRESSION(314501@main): On flights.google.com, can't use backspace to
delete airport from box
https://bugs.webkit.org/show_bug.cgi?id=320473
rdar://183391399
Unreviewed, reverting 314501@main (a8c7730a75ef)
Reverted change:
GitHub.com: emoji reaction touches code box in comment.
https://bugs.webkit.org/show_bug.cgi?id=312152
rdar://174652842
314501@main (a8c7730a75ef)
Canonical link: https://commits.webkit.org/318095@main
Canonical link: https://commits.webkit.org/317695.86@webkitglib/2.54
Commit: 8399efaa43f4ea375bc508f38fe0d5890fe1af6b
https://github.com/WebKit/WebKit/commit/8399efaa43f4ea375bc508f38fe0d5890fe1af6b
Author: Jer Noble <[email protected]>
Date: 2026-08-10 (Mon, 10 Aug 2026)
Changed paths:
M Source/WebCore/Modules/modern-media-controls/media/YouTubeCaptionQuirk.js
Log Message:
-----------
Cherry-pick 317999@main (f67b7993605d).
https://bugs.webkit.org/show_bug.cgi?id=320374
REGRESSION(316238@main): YouTube captions become infinitely tall in iPhone
fullscreen
rdar://182808868
https://bugs.webkit.org/show_bug.cgi?id=320374
Reviewed by Simon Fraser.
In 316238@main, in order to work around an issue where both YouTube's
custom-rendered
subtitles and quirk-derived system subtitles were displayed simultanously,
YouTube's
own subtitle divs were hidden with `display:none`. However this broke their
ability to
detect that subtitles have grown too tall inside the video viewport, and
they fail to
remove those generated subtitles when adding new ones.
Switch from `display:none` to `visibility:hidden` so that size detection
works the way
YouTube expects, even though the subtitles are not displayed.
* Source/WebCore/Modules/modern-media-controls/media/YouTubeCaptionQuirk.js:
(CaptionMirror.prototype._handlePresentationModeChanged):
Canonical link: https://commits.webkit.org/317999@main
Canonical link: https://commits.webkit.org/317695.87@webkitglib/2.54
Commit: df743b8e3ece3b1b946304c3d1c066a7d7416a6d
https://github.com/WebKit/WebKit/commit/df743b8e3ece3b1b946304c3d1c066a7d7416a6d
Author: Sam Sneddon <[email protected]>
Date: 2026-08-10 (Mon, 10 Aug 2026)
Changed paths:
M Source/WebKit/UIProcess/Automation/SimulatedInputDispatcher.cpp
Log Message:
-----------
Cherry-pick 317834@main (e59b5d3cc487).
https://bugs.webkit.org/show_bug.cgi?id=319610
REGRESSION(283790@main): the touch path didn't adopt mouseInteraction and
no longer works
https://bugs.webkit.org/show_bug.cgi?id=319610
rdar://182438327
Reviewed by BJ Burg.
The Touch branch of transitionInputSourceToState never adopted
283790@main's change to dispatch off b.mouseInteraction: it still
infers TouchDown/LiftUp/MoveTo purely from pressedMouseButton edges.
safaridriver's paired fix for the same bug stopped clearing
pressedMouseButton on pointerUp, relying on mouseInteraction alone to
signal Up, so pressedMouseButton now stays set across the whole
pointerDown/pointerUp pair. Since the Touch branch only emits LiftUp
when pressedMouseButton goes from set to unset, no LiftUp is emitted
for the pointerUp action itself; the touch stays held until the next
command (or the Release Actions reset keyframe) lifts it late and at
the wrong coordinate.
Port 283790@main's approach to the Touch branch, mirroring the
Mouse/Pen branch exactly: dispatch off b.mouseInteraction with no
pressedMouseButton-delta fallback. This makes the Up keyframe's
resolveLocation(origin=Pointer, location=(0,0)) resolve to the down
coordinate, so LiftUp now fires in place during the pointerUp action's
own keyframe transition.
* Source/WebKit/UIProcess/Automation/SimulatedInputDispatcher.cpp:
(WebKit::touchInteractionForMouseInteraction):
(WebKit::SimulatedInputDispatcher::transitionInputSourceToState):
Canonical link: https://commits.webkit.org/317834@main
Canonical link: https://commits.webkit.org/317695.88@webkitglib/2.54
Commit: a1ead6db543ef4a4daf22260f6d38b3a60edcd45
https://github.com/WebKit/WebKit/commit/a1ead6db543ef4a4daf22260f6d38b3a60edcd45
Author: Fady Farag <[email protected]>
Date: 2026-08-10 (Mon, 10 Aug 2026)
Changed paths:
M Source/WebCore/Modules/webauthn/cbor/CBORValue.h
M Source/WebCore/SaferCPPExpectations/NoDeleteCheckerExpectations
Log Message:
-----------
Cherry-pick 317738@main (637127bb65c1).
https://bugs.webkit.org/show_bug.cgi?id=318828
Remove incorrect `NODELETE` annotation from `cbor/CBORValue.h`
https://bugs.webkit.org/show_bug.cgi?id=318828
rdar://181641564
Reviewed by Chris Dumez.
Drop `NODELETE` from a function that destroys objects since it is a lie.
* Source/WebCore/Modules/webauthn/cbor/CBORValue.h:
* Source/WebCore/SaferCPPExpectations/NoDeleteCheckerExpectations:
Canonical link: https://commits.webkit.org/317738@main
Canonical link: https://commits.webkit.org/317695.89@webkitglib/2.54
Commit: 936571551944468efa6a5e867270ff5a76fa2774
https://github.com/WebKit/WebKit/commit/936571551944468efa6a5e867270ff5a76fa2774
Author: Rupin Mittal <[email protected]>
Date: 2026-08-10 (Mon, 10 Aug 2026)
Changed paths:
M Source/WebKit/UIProcess/WebPageProxy.cpp
Log Message:
-----------
Cherry-pick 317758@main (38e3c810c7af).
https://bugs.webkit.org/show_bug.cgi?id=320013
StabilityTracer: Crash in WebKit::WebPageProxy::activityStateDidChange
https://bugs.webkit.org/show_bug.cgi?id=320013
rdar://182529810
Reviewed by Alex Christensen.
We crash in WebPageProxy::activityStateDidChange() because WebPageProxy's
m_pageClient is null and we attempt to access it. This state is possible
when the WebViewImpl is being destroyed (it's the sole owner of PageClient)
but the WebPageProxy is still alive because something else refs it. Null
checking m_pageClient is common practice in the WebPageProxy code likely
for this reason. Since activityStateDidChange() relies on data from the
PageClient, we can early return if it isn't alive.
This is a speculative fix.
* Source/WebKit/UIProcess/WebPageProxy.cpp:
(WebKit::WebPageProxy::activityStateDidChange):
Canonical link: https://commits.webkit.org/317758@main
Canonical link: https://commits.webkit.org/317695.90@webkitglib/2.54
Compare: https://github.com/WebKit/WebKit/compare/724182cc2439...936571551944
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
