Branch: refs/heads/webkitglib/2.54
Home: https://github.com/WebKit/WebKit
Commit: 217e050243df05f627e58b21a20bb1e97a8e4bab
https://github.com/WebKit/WebKit/commit/217e050243df05f627e58b21a20bb1e97a8e4bab
Author: Yusuke Suzuki <[email protected]>
Date: 2026-09-07 (Mon, 07 Sep 2026)
Changed paths:
A JSTests/stress/object-create-check-insertion.js
M Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp
Log Message:
-----------
Cherry-pick [email protected] (ac9e40a7195b).
https://bugs.webkit.org/show_bug.cgi?id=317570
[JSC] ObjectCreate folding should emit checks
https://bugs.webkit.org/show_bug.cgi?id=317570
rdar://178248992
Reviewed by Yijia Huang.
When folding ObjectCreate(with-edge-checks), we are not emitting these
checks and converting it to NewObject. As a result, we missed the edge
filters and the subsequent code may rely on that. This patch correctly
inserts
these
checks.
Test: JSTests/stress/object-create-check-insertion.js
* JSTests/stress/object-create-check-insertion.js: Added.
(bitsToDouble):
(enforce):
(getKey):
(getK2):
(caller):
(trainGetKey):
(trainCaller):
(trainGetK2):
(ramp):
* Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp:
(JSC::DFG::ConstantFoldingPhase::foldConstants):
Identifier: [email protected]
Canonical link:
https://flagged.apple.com:443/proxy?t2=DA4x5z9gj4&o=aHR0cHM6Ly9jb21taXRzLndlYmtpdC5vcmcvMzE3Njk1LjIwOEB3ZWJraXRnbGliLzIuNTQ=&emid=b2eff566-aa75-44ea-b50f-6abdf74c34bc&c=11
Commit: 91e956415ac3836874cdd9256495aff0bb1c55e9
https://github.com/WebKit/WebKit/commit/91e956415ac3836874cdd9256495aff0bb1c55e9
Author: Anand Srinivasan <[email protected]>
Date: 2026-09-07 (Mon, 07 Sep 2026)
Changed paths:
A JSTests/wasm/stress/br-on-cast-fail-overlong-leb128.js
A
JSTests/wasm/stress/br-on-cast-overlong-leb128.js
M Source/JavaScriptCore/llint/InPlaceInterpreter64.asm
M
Source/JavaScriptCore/wasm/WasmIPIntGenerator.cpp
M Source/JavaScriptCore/wasm/WasmIPIntGenerator.h
Log Message:
-----------
Cherry-pick [email protected] (5b76326e8fc9).
https://bugs.webkit.org/show_bug.cgi?id=317349
IPInt br_on_cast/br_on_cast_fail must handle overlong LEB128 opcode
https://bugs.webkit.org/show_bug.cgi?id=317349
rdar://178289134
Reviewed by Yusuke Suzuki.
Currently IPInt implementations of br_on_cast/br_on_cast_fail assume
flags are at a fixed offset in the instruction but overlong opcodes
are legal and IPInt may use the wrong byte to load flags. This patch
makes the validator cache allowNull in metadata so IPInt no longer
loads from the instruction stream at all.
Tests: JSTests/wasm/stress/br-on-cast-fail-overlong-leb128.js
JSTests/wasm/stress/br-on-cast-overlong-leb128.js
* JSTests/wasm/stress/br-on-cast-fail-overlong-leb128.js: Added.
(uleb):
(section):
(str):
* JSTests/wasm/stress/br-on-cast-overlong-leb128.js: Added.
(uleb):
(section):
(str):
* Source/JavaScriptCore/llint/InPlaceInterpreter64.asm:
* Source/JavaScriptCore/wasm/WasmIPIntGenerator.cpp:
(JSC::Wasm::IPIntGenerator::addRefTest):
(JSC::Wasm::IPIntGenerator::addRefCast):
(JSC::Wasm::IPIntGenerator::addBranchCast):
* Source/JavaScriptCore/wasm/WasmIPIntGenerator.h:
Identifier: [email protected]
Canonical link:
https://flagged.apple.com:443/proxy?t2=DV2D2i8pY6&o=aHR0cHM6Ly9jb21taXRzLndlYmtpdC5vcmcvMzE3Njk1LjIwOUB3ZWJraXRnbGliLzIuNTQ=&emid=b2eff566-aa75-44ea-b50f-6abdf74c34bc&c=11
Commit: 9619a6b973814eac7c3a2ec638150b98c62262f5
https://github.com/WebKit/WebKit/commit/9619a6b973814eac7c3a2ec638150b98c62262f5
Author: Antti
Koivisto
<[email protected]>
Date: 2026-09-07 (Mon, 07 Sep 2026)
Changed paths:
A
LayoutTests/fast/css/font-face-worker-serialization-thread-safety-expected.txt
A LayoutTests/fast/css/font-face-worker-serialization-thread-safety.html
M
Source/WebCore/css/CSSPrimitiveValue.cpp
M Source/WebCore/css/CSSValue.h
Log Message:
-----------
Cherry-pick [email protected] (bc1c6b94e762).
https://bugs.webkit.org/show_bug.cgi?id=317654
[WebCore] Unsynchronized access to process-global
serializedPrimitiveValues() HashMap in CSSPrimitiveValue::customCSSText from
Worker thread
rdar://177596584
Reviewed by Alan Baradlay.
FontFace is Exposed=(Window,Worker), so its descriptor getters serialize
CSSPrimitiveValues off the main thread via customCSSText(), racing the main
thread on the unsynchronized process-global serialization map and the
m_hasCachedCSSText flag. A concurrent HashTable rehash can free the
backing
buffer while another thread holds a bucket pointer, producing a
heap-use-after-free or double-free.
Only memoize on the main thread; other threads serialize directly without
touching the shared state. Move m_hasCachedCSSText out of
the bit-field group so
the main thread can set it without racing reads of the adjacent bits of a
shared
static value.
Test: fast/css/font-face-worker-serialization-thread-safety.html
*
LayoutTests/fast/css/font-face-worker-serialization-thread-safety-expected.txt:
Added.
* LayoutTests/fast/css/font-face-worker-serialization-thread-safety.html:
Added.
* Source/WebCore/css/CSSPrimitiveValue.cpp:
(WebCore::CSSPrimitiveValue::~CSSPrimitiveValue):
(WebCore::CSSPrimitiveValue::customCSSText const):
* Source/WebCore/css/CSSValue.h:
Identifier:
[email protected]
Canonical
link:
https://flagged.apple.com:443/proxy?t2=DF3H4Z9Pv4&o=aHR0cHM6Ly9jb21taXRzLndlYmtpdC5vcmcvMzE3Njk1LjIxMEB3ZWJraXRnbGliLzIuNTQ=&emid=b2eff566-aa75-44ea-b50f-6abdf74c34bc&c=11
Commit: 9d899104d9b0ba8409f810a342d07c83b6116ba6
https://github.com/WebKit/WebKit/commit/9d899104d9b0ba8409f810a342d07c83b6116ba6
Author: Antoine Quint
<[email protected]>
Date: 2026-09-07 (Mon, 07 Sep 2026)
Changed paths:
A
LayoutTests/webanimations/threaded-animations/offset-path-shape-cache-thread-safety-crash-expected.txt
A
LayoutTests/webanimations/threaded-animations/offset-path-shape-cache-thread-safety-crash.html
A
LayoutTests/webanimations/threaded-animations/resources/offset-path-shape-cache-thread-safety-popup.html
M
Source/WebCore/platform/animation/values/shapes/AcceleratedEffectCircleFunction.cpp
M
Source/WebCore/platform/animation/values/shapes/AcceleratedEffectEllipseFunction.cpp
M
Source/WebCore/platform/animation/values/shapes/AcceleratedEffectInsetFunction.cpp
M
Source/WebCore/platform/animation/values/shapes/AcceleratedEffectPathFunction.cpp
M
Source/WebCore/platform/animation/values/shapes/AcceleratedEffectPolygonFunction.cpp
Log Message:
-----------
Cherry-pick [email protected] (e4960726c71e).
https://bugs.webkit.org/show_bug.cgi?id=317919
[threaded-animations] cross-thread UAF in UIProcess via unguarded static
TinyLRUCache in AcceleratedEffect polygon path cache
https://bugs.webkit.org/show_bug.cgi?id=317919
rdar://180233994
Reviewed by Chris Dumez.
Values held by AcceleratedEffectValues may be accessed both from the main
thread
and the scrolling thread on macOS.
Meanwhile, the `cachedAcceleratedEffectXXXPath()` family of functions use a
process-global
`static NeverDestroyed<TinyLRUCache<..., WebCore::Path, 4, ...>>` with no
synchronization
and return
a
`const
Path&` directly into a cache slot. TinyLRUCache::get() move-assigns
slots whose `Path` value wraps `DataRef<PathImpl>`, a concurrent
move-assignment
tears the non-atomic pointer read/swap in `Ref::operator=(Ref&&)` and
produces
a stale refcounted pointer that is then deref'd, yielding a use-after-free
or double-free of `PathImpl`.
We now
guard each cache with a static Lock and return Path by value so the cache
slot is copied out while the lock is held. `PathImpl` is
`ThreadSafeRefCounted`
so the by-value copy is just an atomic refcount bump. This matches the
existing
pattern used by `cachedCGColor()` and `UTIFromMIMEType()` for
concurrently-accessed
static `TinyLRUCache` instances.
This fix was suggested by an LLM during bug analysis, I validated its
approach.
Test:
webanimations/threaded-animations/offset-path-shape-cache-thread-safety-crash.html
*
LayoutTests/webanimations/threaded-animations/offset-path-shape-cache-thread-safety-crash-expected.txt:
Added.
*
LayoutTests/webanimations/threaded-animations/offset-path-shape-cache-thread-safety-crash.html:
Added.
*
LayoutTests/webanimations/threaded-animations/resources/offset-path-shape-cache-thread-safety-popup.html:
Added.
*
Source/WebCore/platform/animation/values/shapes/AcceleratedEffectCircleFunction.cpp:
(WebCore::cachedAcceleratedEffectCirclePath):
*
Source/WebCore/platform/animation/values/shapes/AcceleratedEffectEllipseFunction.cpp:
(WebCore::cachedAcceleratedEffectEllipsePath):
*
Source/WebCore/platform/animation/values/shapes/AcceleratedEffectInsetFunction.cpp:
(WebCore::cachedRoundedInsetPath):
*
Source/WebCore/platform/animation/values/shapes/AcceleratedEffectPathFunction.cpp:
(WebCore::cachedAcceleratedEffectTransformedByteStreamPath):
*
Source/WebCore/platform/animation/values/shapes/AcceleratedEffectPolygonFunction.cpp:
(WebCore::cachedAcceleratedEffectPolygonPath):
Identifier: [email protected]
Canonical link:
https://flagged.apple.com:443/proxy?t2=DL7y0V0Dt3&o=aHR0cHM6Ly9jb21taXRzLndlYmtpdC5vcmcvMzE3Njk1LjIxMUB3ZWJraXRnbGliLzIuNTQ=&emid=b2eff566-aa75-44ea-b50f-6abdf74c34bc&c=11
Compare: https://github.com/WebKit/WebKit/compare/fead9841406b...9d899104d9b0
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
