Branch: refs/heads/webkitglib/2.54
Home: https://github.com/WebKit/WebKit
Commit: 48cd5ac71dd3b546cf23e1be5f5817141ede4b93
https://github.com/WebKit/WebKit/commit/48cd5ac71dd3b546cf23e1be5f5817141ede4b93
Author: Antti Koivisto <[email protected]>
Date: 2026-09-08 (Tue, 08 Sep 2026)
Changed paths:
A
LayoutTests/fast/images/image-load-event-in-modal-dialog-crash-expected.txt
A LayoutTests/fast/images/image-load-event-in-modal-dialog-crash.html
A LayoutTests/fast/images/resources/self-closing-modal-dialog.html
M Source/WebCore/loader/ImageLoader.cpp
Log Message:
-----------
Cherry-pick [email protected] (fe774071a22a).
https://bugs.webkit.org/show_bug.cgi?id=318348
[WebCore] Use-after-free in ImageLoader::dispatchPendingLoadEvent /
dispatchPendingErrorEvent
rdar://177909775
Reviewed by Alan Baradlay.
dispatchPendingLoadEvent() and dispatchPendingErrorEvent() dispatch author
script and then
touch `this` again via updatedHasPendingEvent(). The only thing keeping the
element alive
across the dispatch is a full-expression-scoped Ref plus the
m_protectedElement member, and
the 0s m_derefElementTimer can clear that member. A load handler can re-arm
the timer by
removing the <img> from its <picture>
(selectImageSource(RelevantMutation::Yes) calls
updatedHasPendingEvent()), then spin a nested run loop via
showModalDialog(). The timer
fires and drops m_protectedElement while the dispatch is still on the
stack. When the
dispatch returns the temporary Ref destructs as the last reference,
~HTMLImageElement frees
the loader via its unique_ptr<HTMLImageLoader>, and the trailing
updatedHasPendingEvent()
runs on freed `this`.
Hold a stack Ref to the element across the dispatch and the trailing
updatedHasPendingEvent()
in both functions. The loader is owned by the element, so keeping the
element alive keeps
this ImageLoader alive.
Test: fast/images/image-load-event-in-modal-dialog-crash.html
*
LayoutTests/fast/images/image-load-event-in-modal-dialog-crash-expected.txt:
Added.
* LayoutTests/fast/images/image-load-event-in-modal-dialog-crash.html:
Added.
* LayoutTests/fast/images/resources/self-closing-modal-dialog.html: Added.
* Source/WebCore/loader/ImageLoader.cpp:
(WebCore::ImageLoader::dispatchPendingLoadEvent):
(WebCore::ImageLoader::dispatchPendingErrorEvent):
Identifier: [email protected]
Canonical link: https://commits.webkit.org/317695.220@webkitglib/2.54
Commit: 1508f0c86e8eeb5d50f8126772ad48093465a3a8
https://github.com/WebKit/WebKit/commit/1508f0c86e8eeb5d50f8126772ad48093465a3a8
Author: Phinehas Fuachie <[email protected]>
Date: 2026-09-08 (Tue, 08 Sep 2026)
Changed paths:
A LayoutTests/webaudio/mediaelementsource-clear-detached-frame-expected.txt
A LayoutTests/webaudio/mediaelementsource-clear-detached-frame.html
A
LayoutTests/webaudio/resources/mediaelementsource-clear-detached-frame-iframe.html
M Source/WebCore/html/HTMLMediaElement.cpp
Log Message:
-----------
Cherry-pick [email protected] (e186258f7967).
https://bugs.webkit.org/show_bug.cgi?id=315989
Use-after-free in MediaElementAudioSourceNode::provideInput when iframe is
detached
https://bugs.webkit.org/show_bug.cgi?id=315989
rdar://175673159
Reviewed by Chris Dumez.
HTMLMediaElement::clearMediaPlayer() resets m_player on the main thread
without holding
m_audioSourceNode->processLock(), but the audio render thread reads
m_player via
audioSourceProvider() inside MediaElementAudioSourceNode::process() while
holding that lock.
Because audioSourceProvider() returns a raw AudioSourceProvider* and drops
its local
RefPtr<MediaPlayer> on return, and MediaPlayer is DestructionThread::Main,
the main thread can
synchronously run ~MediaPlayer (destroying the RemoteAudioSourceProvider)
while the render thread
is still inside provideInput() with the now-dangling pointer.
This is reachable from HTMLMediaElement::stop() (ActiveDOMObject stop on
iframe detach) and
userCancelledLoad().
Match the contract already enforced by createMediaPlayer() and
mediaPlayerWill/DidInitializeMediaEngine() by holding the audio node's
processLock around
player->invalidate() / m_player = nullptr in clearMediaPlayer(). process()
acquires the same lock
with tryLock(), so this cannot deadlock — the render thread will simply
zero its output for one
quantum while the main thread tears down.
Test: webaudio/mediaelementsource-clear-detached-frame.html
*
LayoutTests/webaudio/mediaelementsource-clear-detached-frame-expected.txt:
Added.
* LayoutTests/webaudio/mediaelementsource-clear-detached-frame.html: Added.
*
LayoutTests/webaudio/resources/mediaelementsource-clear-detached-frame-iframe.html:
Added.
* Source/WebCore/html/HTMLMediaElement.cpp:
(WebCore::HTMLMediaElement::clearMediaPlayer): Deleted.
Identifier: [email protected]
Canonical link: https://commits.webkit.org/317695.221@webkitglib/2.54
Commit: b0e7c826df35210daa6f6f75b8be10b5992da299
https://github.com/WebKit/WebKit/commit/b0e7c826df35210daa6f6f75b8be10b5992da299
Author: Simon Lewis <[email protected]>
Date: 2026-09-08 (Tue, 08 Sep 2026)
Changed paths:
A
LayoutTests/ipc/remote-source-buffer-remove-coded-frames-invalid-media-time-expected.txt
A
LayoutTests/ipc/remote-source-buffer-remove-coded-frames-invalid-media-time.html
M Source/WebCore/platform/graphics/SourceBufferPrivate.cpp
M Source/WebCore/platform/graphics/TrackBuffer.cpp
Log Message:
-----------
Cherry-pick [email protected] (82b25523db98).
https://bugs.webkit.org/show_bug.cgi?id=318405
Validate MediaTime arguments in RemoteSourceBufferProxy::removeCodedFrames
rdar://175520822
Reviewed by Jean-Yves Avenard.
RemoteSourceBufferProxy::removeCodedFrames forwarded its three MediaTime IPC
arguments to SourceBufferPrivate::removeCodedFramesInternal without
validation,
and the generated ArgumentCoder<MediaTime> has no [Validator=], so a
MediaTime
with timeFlags == 0 (isInvalid()) survived decode. The release-mode guard
"if (start >= end) return" in removeCodedFramesInternal was defeated because
valid <=> invalid is std::partial_ordering::unordered, so start >= end is
false.
In TrackBuffer::removeCodedFrames, lower_bound(invalid) on the
std::map<MediaTime, ...> walked left to begin() while a valid mid-range
start
resolved to a mid-map iterator; the inverted [mid, begin()) range was
passed to
std::minmax_element, which incremented past end() and dereferenced
out-of-range
tree pointers, crashing the GPU process. A compromised WebContent process
could
trigger this deterministically.
Reject invalid or unordered start/end at the IPC boundary with
MESSAGE_CHECK_COMPLETION, and harden
SourceBufferPrivate::removeCodedFramesInternal
and TrackBuffer::removeCodedFrames to early-return when either bound is
invalid
or start is not strictly less than end, mirroring the existing guard in
SourceBufferPrivate::evictFrames.
*
LayoutTests/ipc/remote-source-buffer-remove-coded-frames-invalid-media-time-expected.txt:
Added.
*
LayoutTests/ipc/remote-source-buffer-remove-coded-frames-invalid-media-time.html:
Added.
* Source/WebCore/platform/graphics/SourceBufferPrivate.cpp:
(WebCore::SourceBufferPrivate::removeCodedFramesInternal):
* Source/WebCore/platform/graphics/TrackBuffer.cpp:
(WebCore::TrackBuffer::removeCodedFrames):
* Source/WebKit/GPUProcess/media/RemoteSourceBufferProxy.cpp:
(WebKit::RemoteSourceBufferProxy::removeCodedFrames):
Identifier: [email protected]
Canonical link: https://commits.webkit.org/317695.222@webkitglib/2.54
Compare: https://github.com/WebKit/WebKit/compare/93656e85b730...b0e7c826df35
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
