Branch: refs/heads/webkitglib/2.52
Home: https://github.com/WebKit/WebKit
Commit: 610b4f250cc150c9a49998917ff39d236aee1d00
https://github.com/WebKit/WebKit/commit/610b4f250cc150c9a49998917ff39d236aee1d00
Author: Keith Miller <[email protected]>
Date: 2026-09-09 (Wed, 09 Sep 2026)
Changed paths:
A
JSTests/stress/arguments-elimination-inlined-load-varargs-preserves-recoveries.js
A
JSTests/stress/arguments-elimination-load-varargs-kills-promoted-recoveries.js
M Source/JavaScriptCore/dfg/DFGArgumentsEliminationPhase.cpp
M Source/JavaScriptCore/dfg/DFGCombinedLiveness.cpp
M Source/JavaScriptCore/dfg/DFGCombinedLiveness.h
M Source/JavaScriptCore/dfg/DFGForAllKills.h
M Source/JavaScriptCore/dfg/DFGOSRAvailabilityAnalysisPhase.cpp
Log Message:
-----------
Cherry-pick [email protected] (6c004fb89bd7).
https://bugs.webkit.org/show_bug.cgi?id=318348
OSR Availability Fails to Invalidate Local Recoveries Across LoadVarargs
https://bugs.webkit.org/show_bug.cgi?id=318348
rdar://178255543
Reviewed by Yusuke Suzuki.
When a strict-mode `arguments` allocation produced by an inlined varargs
call
is eliminated to PhantomClonedArguments, OSR availability records each
argument
as a promoted heap location backed by the inlined frame's stack slots. A
second
inlined varargs call that lowers to LoadVarargs may reuse those same virtual
registers. If an OSR exit later materialises the first allocation it must
not
do so from those reused slots.
Two independent invariants were violated:
1. LocalOSRAvailabilityCalculator::executeNode() handles PutStack/KillStack
by
calling killHeaps() before replacing a stack operand's availability so
that
any promoted heap location flushed to that operand is invalidated. The
LoadVarargs / ForwardVarargs case replaced the count and argument
operands
without that invalidation, leaving stale promoted recoveries pointing at
the
overwritten slots. Apply the same killHeaps() calls before each
replacement.
2. DFG arguments-elimination interference analysis must disqualify a
candidate
whose source-frame stack slots are clobbered while the candidate is still
OSR-live. It establishes the candidate's live range using
forAllKilledNodesAtNodeIndex() plus CombinedLiveness::liveAtTail.
liveAtTail was computed only as the union of CFG successors' liveAtHead,
each of which is pruned by bytecode liveness at the successor's first
node.
A candidate that is OSR-live at the block's terminal node but whose
backing local is bytecode-dead at every CFG successor e.g.
```
// block 1
let a = ...;
try {
foo();
} catch (e) {
// block 2
use(a);
}
// block 3
```
Since DFG does not directly model exceptional control flow in the CFG
`a` would be absent from the CFG/bytecode at block 3 and therefore absent
from block 1's liveAtTail, so removeViaKill() would never be called on
`a`.
Note: For 2, we don't include the bytecodeLiveness for the tail of
CombinedLiveness because this is both misleading with respect to how tail is
used in the rest of the DFG. Additionally, it breaks
ObjectAllocationSinking.
ObjectAllocationSinking propagates its heap by pruning at each tail with
liveAtTail then merging into successors. Since we don't prune at the head we
can end up pushing phantom allocations into blocks where they don't actually
dominate.
Tests:
JSTests/stress/arguments-elimination-inlined-load-varargs-preserves-recoveries.js
JSTests/stress/arguments-elimination-load-varargs-kills-promoted-recoveries.js
Identifier: [email protected]
Canonical link: https://commits.webkit.org/305877.1168@webkitglib/2.52
Commit: 5d2821444c02ec410b6d20dcef9afaec26a863b6
https://github.com/WebKit/WebKit/commit/5d2821444c02ec410b6d20dcef9afaec26a863b6
Author: Simon Lewis <[email protected]>
Date: 2026-09-09 (Wed, 09 Sep 2026)
Changed paths:
A
LayoutTests/ipc/remote-source-buffer-remove-coded-frames-invalid-media-time-expected.txt
A
LayoutTests/ipc/remote-source-buffer-remove-coded-frames-invalid-media-time.html
M Source/WebCore/platform/graphics/SourceBufferPrivate.cpp
M Source/WebCore/platform/graphics/TrackBuffer.cpp
M Source/WebKit/GPUProcess/media/RemoteSourceBufferProxy.cpp
Log Message:
-----------
Cherry-pick [email protected] (82b25523db98).
https://bugs.webkit.org/show_bug.cgi?id=318405
Validate MediaTime arguments in RemoteSourceBufferProxy::removeCodedFrames
rdar://175520822
Reviewed by Jean-Yves Avenard.
RemoteSourceBufferProxy::removeCodedFrames forwarded its three MediaTime IPC
arguments to SourceBufferPrivate::removeCodedFramesInternal without
validation,
and the generated ArgumentCoder<MediaTime> has no [Validator=], so a
MediaTime
with timeFlags == 0 (isInvalid()) survived decode. The release-mode guard
"if (start >= end) return" in removeCodedFramesInternal was defeated because
valid <=> invalid is std::partial_ordering::unordered, so start >= end is
false.
In TrackBuffer::removeCodedFrames, lower_bound(invalid) on the
std::map<MediaTime, ...> walked left to begin() while a valid mid-range
start
resolved to a mid-map iterator; the inverted [mid, begin()) range was
passed to
std::minmax_element, which incremented past end() and dereferenced
out-of-range
tree pointers, crashing the GPU process. A compromised WebContent process
could
trigger this deterministically.
Reject invalid or unordered start/end at the IPC boundary with
MESSAGE_CHECK_COMPLETION, and harden
SourceBufferPrivate::removeCodedFramesInternal
and TrackBuffer::removeCodedFrames to early-return when either bound is
invalid
or start is not strictly less than end, mirroring the existing guard in
SourceBufferPrivate::evictFrames.
*
LayoutTests/ipc/remote-source-buffer-remove-coded-frames-invalid-media-time-expected.txt:
Added.
*
LayoutTests/ipc/remote-source-buffer-remove-coded-frames-invalid-media-time.html:
Added.
* Source/WebCore/platform/graphics/SourceBufferPrivate.cpp:
(WebCore::SourceBufferPrivate::removeCodedFramesInternal):
* Source/WebCore/platform/graphics/TrackBuffer.cpp:
(WebCore::TrackBuffer::removeCodedFrames):
* Source/WebKit/GPUProcess/media/RemoteSourceBufferProxy.cpp:
(WebKit::RemoteSourceBufferProxy::removeCodedFrames):
Identifier: [email protected]
Canonical link: https://commits.webkit.org/305877.1169@webkitglib/2.52
Commit: 1a02b444ed81bbc8d6631b9ff01b356c96279172
https://github.com/WebKit/WebKit/commit/1a02b444ed81bbc8d6631b9ff01b356c96279172
Author: Jean-Yves Avenard <[email protected]>
Date: 2026-09-09 (Wed, 09 Sep 2026)
Changed paths:
A
LayoutTests/ipc/display-capture-source-configuration-change-uaf-expected.txt
A LayoutTests/ipc/display-capture-source-configuration-change-uaf.html
M Source/WebKit/GPUProcess/webrtc/UserMediaCaptureManagerProxy.cpp
Log Message:
-----------
Cherry-pick [email protected] (a06fd51c1706).
https://bugs.webkit.org/show_bug.cgi?id=318405
[CoreIPC][GPUP] UserMediaCaptureManagerProxySourceProxy can leave a
dangling VideoFrameObserver* in RealtimeMediaSource
rdar://174702504
Reviewed by Jer Noble.
UserMediaCaptureManagerProxySourceProxy::sourceConfigurationChanged()
re-registers
the proxy as a VideoFrameObserver of its RealtimeMediaSource via
removeVideoFrameObserver()/addVideoFrameObserver() without consulting
m_isObservingMedia.
Since the proxy is registered as a RealtimeMediaSourceObserver
unconditionally in its
constructor, this callback can fire on a stopped (or never-started) proxy
and insert a
raw VideoFrameObserver* into m_videoFrameObservers while m_isObservingMedia
remains
false. The destructor's unobserveMedia() then early-returns without
removing the entry.
DisplayCaptureSourceCocoa does not override clone(), so
UserMediaCaptureManagerProxy::clone()
yields two proxies sharing the same RealtimeMediaSource; the surviving
clone keeps the
source (and its dangling raw key) alive after the first proxy is freed, and
the next
videoFrameAvailable() virtual-dispatches through freed memory in the GPU
process. This
is reachable from a compromised WebContent process over
UserMediaCaptureManagerProxy IPC
once the page has been granted getDisplayMedia.
Guard the observer re-registration in sourceConfigurationChanged() on
m_isObservingMedia
so a stopped proxy is never re-inserted into m_videoFrameObservers.
*
LayoutTests/ipc/display-capture-source-configuration-change-uaf-expected.txt:
Added.
* LayoutTests/ipc/display-capture-source-configuration-change-uaf.html:
Added.
* Source/WebKit/GPUProcess/webrtc/UserMediaCaptureManagerProxy.cpp:
(WebKit::UserMediaCaptureManagerProxySourceProxy::sourceConfigurationChanged):
Identifier: [email protected]
Canonical link: https://commits.webkit.org/305877.1170@webkitglib/2.52
Compare: https://github.com/WebKit/WebKit/compare/958472e57ad7...1a02b444ed81
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
