Branch: refs/heads/safari-7625.1.29.13-branch
Home: https://github.com/WebKit/WebKit
Commit: 31e7f882b8195197d4566110c8ea92903c517665
https://github.com/WebKit/WebKit/commit/31e7f882b8195197d4566110c8ea92903c517665
Author: Mohsin Qureshi <[email protected]>
Date: 2026-07-29 (Wed, 29 Jul 2026)
Changed paths:
M Configurations/Version.xcconfig
Log Message:
-----------
Versioning. WebKit-7625.1.29.13.1
Canonical link: https://commits.webkit.org/[email protected]
Commit: cc14b6969e5eda09b8f038ea05fb0917b1c937ff
https://github.com/WebKit/WebKit/commit/cc14b6969e5eda09b8f038ea05fb0917b1c937ff
Author: Sammy Gill <[email protected]>
Date: 2026-07-29 (Wed, 29 Jul 2026)
Changed paths:
M LayoutTests/TestExpectations
M Source/WebCore/rendering/RenderBlock.cpp
M Source/WebCore/rendering/SubtreeScrollbarChangesState.cpp
Log Message:
-----------
Cherry-pick 3b267afd25f0. rdar://183391399
REGRESSION(314501@main): On flights.google.com, can't use backspace to
delete airport from box
https://bugs.webkit.org/show_bug.cgi?id=320473
rdar://183391399
Unreviewed, reverting 314501@main (a8c7730a75ef)
Reverted change:
GitHub.com: emoji reaction touches code box in comment.
https://bugs.webkit.org/show_bug.cgi?id=312152
rdar://174652842
314501@main (a8c7730a75ef)
Canonical link: https://commits.webkit.org/318095@main
Canonical link: https://commits.webkit.org/[email protected]
Commit: a1205704ae23a2beac17298746eea2092b1f1b78
https://github.com/WebKit/WebKit/commit/a1205704ae23a2beac17298746eea2092b1f1b78
Author: Pouneh Bahrami <[email protected]>
Date: 2026-08-13 (Thu, 13 Aug 2026)
Changed paths:
A
LayoutTests/http/tests/websocket/tests/hybi/websocket-samesite-lax-not-sent-cross-site-expected.txt
A
LayoutTests/http/tests/websocket/tests/hybi/websocket-samesite-lax-not-sent-cross-site.html
A
LayoutTests/http/tests/websocket/tests/hybi/websocket-samesite-none-sent-cross-site-expected.txt
A
LayoutTests/http/tests/websocket/tests/hybi/websocket-samesite-none-sent-cross-site.html
A
LayoutTests/http/tests/websocket/tests/hybi/websocket-samesite-sent-same-site-expected.txt
A
LayoutTests/http/tests/websocket/tests/hybi/websocket-samesite-sent-same-site.html
A
LayoutTests/http/tests/websocket/tests/hybi/websocket-samesite-strict-not-sent-cross-site-expected.txt
A
LayoutTests/http/tests/websocket/tests/hybi/websocket-samesite-strict-not-sent-cross-site.html
M Source/WebKit/NetworkProcess/cocoa/WebSocketTaskCocoa.mm
Log Message:
-----------
Cherry-pick 7450aff7426d. rdar://184747688
WebSocket requests bypass SameSite Strict and Lax Cookies
https://bugs.webkit.org/show_bug.cgi?id=309567
rdar://172188734
Reviewed by Charlie Wolfe.
HTTP requests go through willPerformHTTPRedirection() on each
request/redirect, where updateTaskWithFirstPartyForSameSiteCookies()
sets task._siteForCookies and task._isTopLevelNavigation on the
NSURLSessionTask. This gives CFNetwork the same-site context needed
to filter SameSite=Strict and SameSite=Lax cookies on cross-site
requests.
WebSocket tasks (NSURLSessionWebSocketTask) bypass the
willPerformHTTPRedirection() path entirely. Neither _siteForCookies nor
_isTopLevelNavigation was ever set, so
CFNetwork had no same-site context and attached all matching cookies
regardless of their SameSite attribute.
In WebSocketTask::WebSocketTask(), we call
updateTaskWithFirstPartyForSameSiteCookies()
on the NSURLSessionWebSocketTask immediately after it is created and before
it is resumed. This mirrors the pattern already used for HTTP tasks in
willPerformHTTPRedirection() and for partitioned cookie identifiers in
updateTaskWithStoragePartitionIdentifier().
Tests:
http/tests/websocket/tests/hybi/websocket-samesite-lax-not-sent-cross-site.html
http/tests/websocket/tests/hybi/websocket-samesite-none-sent-cross-site.html
http/tests/websocket/tests/hybi/websocket-samesite-sent-same-site.html
http/tests/websocket/tests/hybi/websocket-samesite-strict-not-sent-cross-site.html
*
LayoutTests/http/tests/websocket/tests/hybi/websocket-samesite-lax-not-sent-cross-site-expected.txt:
Added.
*
LayoutTests/http/tests/websocket/tests/hybi/websocket-samesite-lax-not-sent-cross-site.html:
Added.
*
LayoutTests/http/tests/websocket/tests/hybi/websocket-samesite-none-sent-cross-site-expected.txt:
Added.
*
LayoutTests/http/tests/websocket/tests/hybi/websocket-samesite-none-sent-cross-site.html:
Added.
*
LayoutTests/http/tests/websocket/tests/hybi/websocket-samesite-sent-same-site-expected.txt:
Added.
*
LayoutTests/http/tests/websocket/tests/hybi/websocket-samesite-sent-same-site.html:
Added.
*
LayoutTests/http/tests/websocket/tests/hybi/websocket-samesite-strict-not-sent-cross-site-expected.txt:
Added.
*
LayoutTests/http/tests/websocket/tests/hybi/websocket-samesite-strict-not-sent-cross-site.html:
Added.
* Source/WebKit/NetworkProcess/cocoa/WebSocketTaskCocoa.mm:
(WebKit::WebSocketTask::WebSocketTask):
Identifier: 305413.769@safari-7624-branch
Canonical link: https://commits.webkit.org/[email protected]
Commit: e64b95b410a431aad5cd4e79bb7a70f406b5bcf0
https://github.com/WebKit/WebKit/commit/e64b95b410a431aad5cd4e79bb7a70f406b5bcf0
Author: Chris Dumez <[email protected]>
Date: 2026-08-13 (Thu, 13 Aug 2026)
Changed paths:
A
LayoutTests/fast/dom/trusted-types-execCommand-insertHTML-case-insensitive-expected.txt
A
LayoutTests/fast/dom/trusted-types-execCommand-insertHTML-case-insensitive.html
M Source/WebCore/dom/Document.cpp
Log Message:
-----------
Cherry-pick 0e4f1956aff4. rdar://184747341
Trusted Types enforcement in Document.execCommand should be case-insensitive
https://bugs.webkit.org/show_bug.cgi?id=314183
rdar://175852496
Reviewed by Anne van Kesteren and Ryosuke Niwa.
The Trusted Types check in Document::execCommand() was using a
case-sensitive
comparison (commandName != "insertHTML"_s) to decide whether to enforce
TrustedHTML. Since execCommand command names are case-insensitive per spec,
passing a differently-cased variant like "InsertHTML" or "inserthtml" would
bypass the Trusted Types enforcement entirely.
Fix by using equalIgnoringASCIICase() for the comparison.
Test: fast/dom/trusted-types-execCommand-insertHTML-case-insensitive.html
*
LayoutTests/fast/dom/trusted-types-execCommand-insertHTML-case-insensitive-expected.txt:
Added.
*
LayoutTests/fast/dom/trusted-types-execCommand-insertHTML-case-insensitive.html:
Added.
* Source/WebCore/dom/Document.cpp:
(WebCore::Document::execCommand):
Identifier: 305413.846@safari-7624-branch
Canonical link: https://commits.webkit.org/[email protected]
Commit: 486ccba51f4bd5cb0308e5235506fe97bde10fc6
https://github.com/WebKit/WebKit/commit/486ccba51f4bd5cb0308e5235506fe97bde10fc6
Author: Youenn Fablet <[email protected]>
Date: 2026-08-13 (Thu, 13 Aug 2026)
Changed paths:
A
LayoutTests/http/wpt/webcodecs/configure-encoder-big-frame-size-expected.txt
A LayoutTests/http/wpt/webcodecs/configure-encoder-big-frame-size.html
M Source/WebCore/Modules/webcodecs/WebCodecsVideoEncoder.cpp
Log Message:
-----------
Cherry-pick b8eb06fa26e8. rdar://184747533
Heap Buffer Overflow in WebRTC VP9 Encoder
rdar://177719944
Reviewed by Jean-Yves Avenard.
We restrict video encoder support to frames of size below 32767.
This aligns with Chrome so should not be a compat issue.
Test: http/wpt/webcodecs/configure-encoder-big-frame-size.html
*
LayoutTests/http/wpt/webcodecs/configure-encoder-big-frame-size-expected.txt:
Added.
* LayoutTests/http/wpt/webcodecs/configure-encoder-big-frame-size.html:
Added.
* Source/WebCore/Modules/webcodecs/WebCodecsVideoEncoder.cpp:
(WebCore::isSupportedEncoderCodec):
(WebCore::WebCodecsVideoEncoder::configure):
(WebCore::WebCodecsVideoEncoder::isConfigSupported):
Identifier: [email protected]
Canonical link: https://commits.webkit.org/[email protected]
Commit: 958d5293efb87c0848dd68ec9891e81a14fb7295
https://github.com/WebKit/WebKit/commit/958d5293efb87c0848dd68ec9891e81a14fb7295
Author: Brent Fulgham <[email protected]>
Date: 2026-08-13 (Thu, 13 Aug 2026)
Changed paths:
M Source/WTF/Scripts/Preferences/UnifiedWebPreferences.yaml
Log Message:
-----------
Cherry-pick 2f7b2e8b7f9f. rdar://184747440
Escape key no longer guarantees cancelling fullscreen (with keyboard lock)
(311660)
https://bugs.webkit.org/show_bug.cgi?id=311660
rdar://problem/174251766
Reviewed by Brandon Stewart.
Revert 303093@main since the User Interface information to instruct the
user to hold
the ESC key for 1.5 seconds (or longer) was not completed. This can lead to
confusion
and the possibility of spoofing users. We will reland the enablement when
the UI portion
is available.
* Source/WTF/Scripts/Preferences/UnifiedWebPreferences.yaml:
Identifier: [email protected]
Canonical link: https://commits.webkit.org/[email protected]
Commit: 4e74b710e07d2e08b9817a0e2d4897f003adb0ed
https://github.com/WebKit/WebKit/commit/4e74b710e07d2e08b9817a0e2d4897f003adb0ed
Author: Said Abou-Hallawa <[email protected]>
Date: 2026-08-13 (Thu, 13 Aug 2026)
Changed paths:
A
LayoutTests/fast/canvas/offscreen-isPointInStroke-svg-stroke-bounds-race-crash-expected.txt
A
LayoutTests/fast/canvas/offscreen-isPointInStroke-svg-stroke-bounds-race-crash.html
M Source/WebCore/platform/graphics/cg/PathCG.cpp
Log Message:
-----------
Cherry-pick 6ab6f0e16b4d. rdar://184747421
PathCG should use thread-safe scratchContext
https://bugs.webkit.org/show_bug.cgi?id=316567
rdar://178176596
Reviewed by Darin Adler.
The fix of bug 313935 was incomplete. The fix was done by adding two static
Locks
to PathCG::strokeContains() and PathCG::strokeBoundingRect(). This fix
makes these
two functions be thread-safe independently. But this is not enough. It is
possible
to call PathCG::strokeContains() and PathCG::strokeBoundingRect() from two
different threads at the same time.
The fix is to make scratchContext() return a thread-specific graphics
context.
So two threads can't access the same context at the same time.
Test:
fast/canvas/offscreen-isPointInStroke-svg-stroke-bounds-race-crash.html
*
LayoutTests/fast/canvas/offscreen-isPointInStroke-svg-stroke-bounds-race-crash-expected.txt:
Added.
*
LayoutTests/fast/canvas/offscreen-isPointInStroke-svg-stroke-bounds-race-crash.html:
Added.
* Source/WebCore/platform/graphics/cg/PathCG.cpp:
(WebCore::scratchContext):
(WebCore::PathCG::strokeContains const):
(WebCore::PathCG::strokeBoundingRect const):
Identifier: [email protected]
Canonical link: https://commits.webkit.org/[email protected]
Commit: 7bdaf3af6395fde23a7b2f4ecad0c5fb81e321bc
https://github.com/WebKit/WebKit/commit/7bdaf3af6395fde23a7b2f4ecad0c5fb81e321bc
Author: Kai Tamkun <[email protected]>
Date: 2026-08-13 (Thu, 13 Aug 2026)
Changed paths:
A
JSTests/stress/ftl-osr-exit-materialize-phantom-array-with-live-butterfly.js
M Source/JavaScriptCore/ftl/FTLOSRExitCompiler.cpp
Log Message:
-----------
Cherry-pick 883cc7576689. rdar://184747346
[JSC] FTL OSR exit: handle DataFormatStorage in reboxAccordingToFormat
https://bugs.webkit.org/show_bug.cgi?id=314579
rdar://176131036
Reviewed by Marcus Plutowski.
300523@main relaxed validation so that PhantomNewArrayWithButterfly may
reference a non-phantom NewButterflyWithSize, and taught
FTLLowerDFGToB3::exitValueForNode to emit an ExitArgument with
DataFormatStorage for the live butterfly. However, the FTL OSR exit
compiler's reboxAccordingToFormat() was never updated, so when such an
exit is compiled it falls into RELEASE_ASSERT_NOT_REACHED().
The recovered storage value is the raw butterfly pointer that
operationMaterializeObjectInOSR(PhantomNewArrayWithButterfly) consumes
via std::bit_cast<Butterfly*>, so no boxing is required; treat it the
same as DataFormatJS and pass it through unchanged.
Test:
JSTests/stress/ftl-osr-exit-materialize-phantom-array-with-live-butterfly.js
*
JSTests/stress/ftl-osr-exit-materialize-phantom-array-with-live-butterfly.js:
Added.
(check):
(main.v2):
(main):
* Source/JavaScriptCore/ftl/FTLOSRExitCompiler.cpp:
(JSC::FTL::reboxAccordingToFormat):
Identifier: [email protected]
Canonical link: https://commits.webkit.org/[email protected]
Commit: 7e3bd05fd5f86e78287ae0b29ee6c65f392363d1
https://github.com/WebKit/WebKit/commit/7e3bd05fd5f86e78287ae0b29ee6c65f392363d1
Author: Said Abou-Hallawa <[email protected]>
Date: 2026-08-13 (Thu, 13 Aug 2026)
Changed paths:
A
LayoutTests/http/tests/canvas/canvas-tainted-image-capture-video-frame-expected.html
A
LayoutTests/http/tests/canvas/canvas-tainted-image-capture-video-frame.html
A
LayoutTests/http/tests/canvas/resources/cross-origin-image-capture-video-frame.html
M Source/WebCore/Modules/mediastream/CanvasCaptureMediaStreamTrack.cpp
Log Message:
-----------
Cherry-pick 723dbeacf061. rdar://184747381
When captured as a video frame, canvas has to be tainted if cross-origin
image are drawn into it
https://bugs.webkit.org/show_bug.cgi?id=316594
rdar://171846032
Reviewed by Simon Fraser.
HTMLCanvasElement::captureStream() allows streaming a canvas's output to a
<video>
element. The track frames of this video is obtained from
CanvasCaptureMediaStreamTrack
::grabFrame(). This function unconditionally gets a VideoFrame by calling
HTMLCanvasElement::toVideoFrame().
If cross-origin images are drawn into the canvas, this canvas has to be
tainted.
So no getImageData() can see the pixels of the cross-origin images.
*
LayoutTests/http/tests/canvas/canvas-tainted-image-capture-video-frame-expected.html:
Added.
*
LayoutTests/http/tests/canvas/canvas-tainted-image-capture-video-frame.html:
Added.
*
LayoutTests/http/tests/canvas/resources/cross-origin-image-capture-video-frame.html:
Added.
* Source/WebCore/Modules/mediastream/CanvasCaptureMediaStreamTrack.cpp:
(WebCore::CanvasCaptureMediaStreamTrack::Source::grabFrame):
(WebCore::CanvasCaptureMediaStreamTrack::Source::captureCanvas):
Identifier: [email protected]
Canonical link: https://commits.webkit.org/[email protected]
Commit: c9e8dad210fb7d02e929ab1617260c7e4628aa82
https://github.com/WebKit/WebKit/commit/c9e8dad210fb7d02e929ab1617260c7e4628aa82
Author: David Kilzer <[email protected]>
Date: 2026-08-13 (Thu, 13 Aug 2026)
Changed paths:
M Source/WebCore/platform/graphics/mac/controls/ControlFactoryMac.mm
Log Message:
-----------
Cherry-pick 4620ee2b5925. rdar://184747807
GPU process crash in
WebCore::ControlFactoryMac::servicesRolloverButtonCell() drawing image controls
<https://bugs.webkit.org/show_bug.cgi?id=316849>
<rdar://177901870>
Reviewed by Simon Fraser.
The GPU process can crash while drawing the image-controls (services
rollover) button on its per-connection RemoteRenderingBackend work
queues. Each RemoteGraphicsContext installs its own per-context
ControlFactory override for the duration of a draw, so the factory
itself is not shared across work-queue threads.
`ControlFactoryMac::servicesRolloverButtonCell()` is the one cell
accessor that defeats that isolation. It caches the cell returned by
`+[NSServicesRolloverButtonCell serviceRolloverButtonCellForStyle:]`,
which is a process-wide singleton, so every per-context factory ends up
caching and drawing the SAME AppKit cell. Configuring that shared cell
on one work-queue thread races with drawing it on another, and `NSCell`
is not thread-safe.
Give each factory a private copy of the cell, so it is only ever touched
by that factory's single work-queue thread. `-[NSButtonCell
copyWithZone:]` gives the copy a nil visual provider -- the state whose
concurrent mutation crashes -- so the copy shares nothing mutable with
the shared cell, and drawing it needs no lock.
The copy itself must be serialized under a process-wide lock because
`-[NSButtonCell copyWithZone:]` transiently mutates its source, so
concurrent first-access copies of the shared cell would otherwise race.
No new tests since this change is not directly testable.
* Source/WebCore/platform/graphics/mac/controls/ControlFactoryMac.mm:
(WebCore::ControlFactoryMac::servicesRolloverButtonCell const):
Identifier: [email protected]
Canonical link: https://commits.webkit.org/[email protected]
Commit: c13fe5ad49473f55d9aa29ae56112a4a8c5c3596
https://github.com/WebKit/WebKit/commit/c13fe5ad49473f55d9aa29ae56112a4a8c5c3596
Author: David Kilzer <[email protected]>
Date: 2026-08-13 (Thu, 13 Aug 2026)
Changed paths:
M Source/WebKit/WebProcess/WebStorage/WebStorageNamespaceProvider.cpp
Log Message:
-----------
Cherry-pick 6254fe9499a7. rdar://184747436
REGRESSION (259876@main): Check for end iterator in
WebStorageNamespaceProvider::decrementUseCount()
<https://bugs.webkit.org/show_bug.cgi?id=317082>
<rdar://179209792>
Reviewed by Zak Ridouh.
Guard against a missing entry before dereferencing the result of
`HashMap::find()` in `decrementUseCount()`. The function relies on
`ASSERT(iterator != ...end())`, which compiles to nothing in release
builds, then reads `iterator->value` unconditionally. When the
identifier is absent, `find()` returns `end()`, and reading
`end()->value` accesses memory one entry past the table's backing
buffer.
The absent-entry case became reachable in 259876@main, which replaced
the page-group-keyed owning map of providers with a single weakly-held
provider (`existingStorageNameSpaceProvider()`). The provider is now
destroyed when the last page in a Web Content process goes away and
recreated empty for the next page, so a `WebPage` torn down after that
point decrements against a provider that never held its identifier.
Return early when the iterator is `end()`, matching the existing guard
in the sibling accessor `sessionStorageNamespace()`. The
`ASSERT(sessionStorageNamespaces.useCount)` is retained so debug builds
still flag a use-count imbalance.
No new tests since this path is reached only during web page teardown
when the session storage namespace entry has already been removed, and
is not directly testable through public API.
* Source/WebKit/WebProcess/WebStorage/WebStorageNamespaceProvider.cpp:
(WebKit::WebStorageNamespaceProvider::decrementUseCount):
Identifier: [email protected]
Canonical link: https://commits.webkit.org/[email protected]
Commit: 49172c84e0ba6e3396ffbad08dea269cb670d9dc
https://github.com/WebKit/WebKit/commit/49172c84e0ba6e3396ffbad08dea269cb670d9dc
Author: Chris Dumez <[email protected]>
Date: 2026-08-13 (Thu, 13 Aug 2026)
Changed paths:
A
LayoutTests/fast/shadow-dom/manual-slot-assign-renderer-teardown-crash-expected.txt
A
LayoutTests/fast/shadow-dom/manual-slot-assign-renderer-teardown-crash.html
M Source/WebCore/dom/SlotAssignment.cpp
Log Message:
-----------
Cherry-pick ddc8b3fae09f. rdar://184747565
UAF in ManualSlotAssignment via WeakHashMap rehash during reentrant
composed-tree teardown
https://bugs.webkit.org/show_bug.cgi?id=REDACTED
rdar://179729192
Reviewed by Anne van Kesteren.
ManualSlotAssignment::slotManualAssignmentDidChange computed
effectiveCurrent
by calling assignedNodesForSlot, which returns a raw pointer to the
cachedAssignment Vector inside a Slot value stored directly in the m_slots
WeakHashMap bucket array. It then called
RenderTreeUpdater::tearDownRenderersAfterSlotChange, whose composed-tree
traversal can call HTMLSlotElement::assignedNodes on a sibling slot and
re-enter ManualSlotAssignment::assignedNodesForSlot. The reentrant
m_slots.ensure call may invoke the WeakHashMap amortized cleanup, sweep
null-keyed entries left by previously inserted, removed and GC-collected
slot
elements, and rehash the table, freeing the bucket array effectiveCurrent
points into. The stale pointer was then dereferenced in
scheduleSlotChangeEventIfNeeded.
Compute effectiveCurrent as a local Vector via effectiveAssignedNodes,
mirroring effectivePrevious, so no pointer into m_slots is held across the
render-tree teardown.
*
LayoutTests/fast/shadow-dom/manual-slot-assign-renderer-teardown-crash-expected.txt:
Added.
*
LayoutTests/fast/shadow-dom/manual-slot-assign-renderer-teardown-crash.html:
Added.
* Source/WebCore/dom/SlotAssignment.cpp:
(WebCore::ManualSlotAssignment::slotManualAssignmentDidChange):
Identifier: [email protected]
Canonical link: https://commits.webkit.org/[email protected]
Commit: 4f07e6d8266f7ba7266d17d400e0bbc66c512344
https://github.com/WebKit/WebKit/commit/4f07e6d8266f7ba7266d17d400e0bbc66c512344
Author: David Kilzer <[email protected]>
Date: 2026-08-13 (Thu, 13 Aug 2026)
Changed paths:
M Source/WebCore/platform/graphics/avfoundation/objc/QueuedVideoOutput.mm
Log Message:
-----------
Cherry-pick f53714d59190. rdar://184747772
[Cocoa] Hold a strong reference to QueuedVideoOutput in its main run loop
callbacks
<rdar://181438985>
Reviewed by Jonathan Bedard.
The WebQueuedVideoOutputDelegate callbacks and the AVFoundation time
observer blocks hop their work to the main run loop capturing only a
WeakPtr to the QueuedVideoOutput, then dereference it as a raw pointer
after a plain null check. The null check does not keep the object
alive: addVideoFrameEntries() fires the current-image-changed
observers, which can synchronously tear down the media player and
release the last strong reference to the QueuedVideoOutput while the
callback is still on the stack, so the trailing member access reads
freed memory.
Promote the captured WeakPtr to a RefPtr inside each block before use
so the object is kept alive for the duration of the call. The sole
strong owner only ever runs on the main thread, so the non-atomic
RefPtr is sufficient and no ThreadSafeRefCounted change is needed.
No new tests since this change is not directly testable.
* Source/WebCore/platform/graphics/avfoundation/objc/QueuedVideoOutput.mm:
(-[WebQueuedVideoOutputDelegate outputMediaDataWillChange:]):
(-[WebQueuedVideoOutputDelegate outputSequenceWasFlushed:]):
(-[WebQueuedVideoOutputDelegate
observeValueForKeyPath:ofObject:change:context:]):
(WebCore::QueuedVideoOutput::QueuedVideoOutput):
(WebCore::QueuedVideoOutput::configureNextImageTimeObserver):
Identifier: [email protected]
Canonical link: https://commits.webkit.org/[email protected]
Commit: b79151a5378ef150a0eecc9e46e385bd6cdd67d4
https://github.com/WebKit/WebKit/commit/b79151a5378ef150a0eecc9e46e385bd6cdd67d4
Author: Tyler Wilcock <[email protected]>
Date: 2026-08-13 (Thu, 13 Aug 2026)
Changed paths:
M Source/WebCore/platform/PlatformSpeechSynthesizer.cpp
M Source/WebCore/platform/PlatformSpeechSynthesizer.h
M Source/WebCore/platform/cocoa/PlatformSpeechSynthesizerCocoa.mm
M Source/WebCore/platform/gstreamer/PlatformSpeechSynthesizerGStreamer.cpp
M Source/WebCore/platform/mock/PlatformSpeechSynthesizerMock.cpp
M Source/WebCore/platform/spiel/PlatformSpeechSynthesizerSpiel.cpp
M Source/WebCore/testing/Internals.cpp
Log Message:
-----------
Cherry-pick 71471a83ed2d. rdar://184747782
PlatformSpeechSynthesizerClient should prevent use-after-free via weak
back-reference to client
https://bugs.webkit.org/show_bug.cgi?id=312793
rdar://172854014
Reviewed by Joshua Hoffman.
PlatformSpeechSynthesizer held a raw C++ reference
(PlatformSpeechSynthesizerClient&) back to its client
(SpeechSynthesis). When cancel() was made asynchronous via
callOnMainThread in 309349@main, the deferred lambda could fire after
SpeechSynthesis had been destroyed, dereferencing freed memory. ASan
caught this as a heap-use-after-free in 131 media/track layout tests.
This commit makes PlatformSpeechSynthesizerClient inherit from
AbstractRefCountedAndCanMakeWeakPtr so it supports both WeakPtr (for
the non-owning back-reference) and RefPtr (for strong promotion at
call sites). Convert the raw reference member to a WeakPtr, and update
all ~29 call sites across all platform implementations to promote to
RefPtr before calling through the client.
This also fixes two latent async bugs with the same pattern: the Cocoa
voicesDidChange async callback and the Spiel initializeVoiceList
lambda both accessed the client in a deferred context without lifetime
protection.
* Source/WebCore/platform/PlatformSpeechSynthesizer.cpp:
(WebCore::PlatformSpeechSynthesizer::voicesDidChange):
* Source/WebCore/platform/PlatformSpeechSynthesizer.h:
* Source/WebCore/platform/cocoa/PlatformSpeechSynthesizerCocoa.mm:
(-[WebSpeechSynthesisWrapper speakUtterance:]):
(-[WebSpeechSynthesisWrapper speechSynthesizer:didStartSpeechUtterance:]):
(-[WebSpeechSynthesisWrapper speechSynthesizer:didFinishSpeechUtterance:]):
(-[WebSpeechSynthesisWrapper speechSynthesizer:didPauseSpeechUtterance:]):
(-[WebSpeechSynthesisWrapper
speechSynthesizer:didContinueSpeechUtterance:]):
(-[WebSpeechSynthesisWrapper speechSynthesizer:didCancelSpeechUtterance:]):
(-[WebSpeechSynthesisWrapper
speechSynthesizer:willSpeakRangeOfSpeechString:utterance:]):
(WebCore::PlatformSpeechSynthesizer::initializeVoiceList):
* Source/WebCore/platform/gstreamer/PlatformSpeechSynthesizerGStreamer.cpp:
(WebCore::GstSpeechSynthesisWrapper::pause):
(WebCore::GstSpeechSynthesisWrapper::resume):
(WebCore::GstSpeechSynthesisWrapper::speakUtterance):
(WebCore::GstSpeechSynthesisWrapper::cancel):
* Source/WebCore/platform/mock/PlatformSpeechSynthesizerMock.cpp:
(WebCore::PlatformSpeechSynthesizerMock::speakingFinished):
(WebCore::PlatformSpeechSynthesizerMock::speak):
(WebCore::PlatformSpeechSynthesizerMock::cancel):
(WebCore::PlatformSpeechSynthesizerMock::pause):
(WebCore::PlatformSpeechSynthesizerMock::resume):
* Source/WebCore/platform/spiel/PlatformSpeechSynthesizerSpiel.cpp:
(WebCore::SpielSpeechWrapper::finishSpeakerInitialization):
(WebCore::SpielSpeechWrapper::speakUtterance):
(WebCore::PlatformSpeechSynthesizer::initializeVoiceList):
* Source/WebCore/testing/Internals.cpp:
(WebCore::Internals::simulateSpeechSynthesizerVoiceListChange):
Identifier: 305413.715@safari-7624-branch
(cherry picked from commit a9e3e8ac8256cb388e44e0376d92e8ebebf0c311)
Canonical link: https://commits.webkit.org/[email protected]
Commit: f77d03ef028259e0b591e21b61bed17de06516e2
https://github.com/WebKit/WebKit/commit/f77d03ef028259e0b591e21b61bed17de06516e2
Author: Sihui Liu <[email protected]>
Date: 2026-08-13 (Thu, 13 Aug 2026)
Changed paths:
M Source/WebCore/Modules/indexeddb/client/IDBConnectionProxy.cpp
M Tools/TestWebKitAPI/Tests/WebKit/WKWebView/IndexedDBPersistence.mm
Log Message:
-----------
Cherry-pick 01cef20028da. rdar://184747400
indexedDB.databases() leaks database names across storage partitions due to
swapped ClientOrigin
rdar://176596477
Reviewed by Chris Dumez.
IDBConnectionProxy::getAllDatabaseNamesAndVersions constructs a
ClientOrigin with topOrigin and clientOrigin swapped.
ClientOrigin expects {topOrigin, clientOrigin}, but the code was passing
{securityOrigin (client), topOrigin} instead.
Test: IndexedDB.IndexedDBGetDatabasesFromCrossOriginIframe
* Source/WebCore/Modules/indexeddb/client/IDBConnectionProxy.cpp:
(WebCore::IDBClient::IDBConnectionProxy::getAllDatabaseNamesAndVersions):
* Tools/TestWebKitAPI/Tests/WebKitCocoa/IndexedDBPersistence.mm:
((IndexedDB, IndexedDBGetDatabasesFromCrossOriginIframe)):
Identifier: 305413.871@safari-7624-branch
(cherry picked from commit ea034a5eefd5a03c31c040354048f6d1fc3e1038)
Canonical link: https://commits.webkit.org/[email protected]
Commit: bc99e6377c52d55737c96a6fdca1a1c163e1cdf0
https://github.com/WebKit/WebKit/commit/bc99e6377c52d55737c96a6fdca1a1c163e1cdf0
Author: Tyler Wilcock <[email protected]>
Date: 2026-08-13 (Thu, 13 Aug 2026)
Changed paths:
M Source/WebKit/WebProcess/WebPage/mac/WKAccessibilityWebPageObjectBase.mm
Log Message:
-----------
Cherry-pick cea3c1e1af92. rdar://184747479
AX: Fix use-after-free of accessibilityRootObjectWrapper
https://bugs.webkit.org/show_bug.cgi?id=316410
rdar://178730472
Reviewed by Chris Fleizach and Dominic Mazzoni.
The off-main-thread short-circuit in -[WKAccessibilityWebPageObjectBase
accessibilityRootObjectWrapper:] returned root->wrapper() as a raw +0
WebAccessibilityObjectWrapper*. The wrapper's only strong reference at that
moment was AXIsolatedObject::m_wrapper, kept alive transitively by the
local RefPtr<AXIsolatedTree>. Once the function returned, that RefPtr (and
the `root` it kept alive) went out of scope, freeing the wrapper before
the secondary AX thread's caller could retain it. AppKit subsequently
walked the autoreleased single-element NSArray returned by
-[WKAccessibilityWebPageObject accessibilityChildren] and called
objc_retain on the wrapper (and on the array) inside
-[__NSSingleObjectEnumerator initWithObject:collection:], crashing on
freed memory.
Wrap the returned wrapper in RetainPtr<id> { ... }.autorelease()
so it is retained synchronously while `tree`, `root`, and m_wrapper are
all still alive, and then deposited into the secondary thread's
autorelease pool. The pool keeps the wrapper alive for the rest of the
secondary thread's runloop iteration, long enough for AppKit's
ConvertOutgoingValueForElement -> objectEnumerator ->
initWithObject:collection: -> objc_retain sequence to finish safely.
* Source/WebKit/WebProcess/WebPage/mac/WKAccessibilityWebPageObjectBase.mm:
(-[WKAccessibilityWebPageObjectBase accessibilityRootObjectWrapper:]):
Identifier: [email protected]
(cherry picked from commit 74bb47f23c411623b4d4e29d641277b81b118de8)
Canonical link: https://commits.webkit.org/[email protected]
Commit: 25a7517ed90944929c4346dcb38488ac0fff6a6c
https://github.com/WebKit/WebKit/commit/25a7517ed90944929c4346dcb38488ac0fff6a6c
Author: Gerald Squelart <[email protected]>
Date: 2026-08-13 (Thu, 13 Aug 2026)
Changed paths:
M Source/WebCore/platform/graphics/cocoa/IOSurface.h
M Source/WebCore/platform/graphics/cocoa/IOSurface.mm
M Source/WebKit/UIProcess/WebPageProxy.cpp
M Tools/TestWebKitAPI/Tests/WebCore/cocoa/IOSurfaceTests.mm
Log Message:
-----------
Cherry-pick 5126b6a5a9e2. rdar://184747345
In WebPageProxy::takeSnapshot(), validate IOSurface from MachSendRight
rdar://176886608
Reviewed by Mike Wyrzykowski.
WebPageProxy::takeSnapshot() now uses the new
IOSurface::createFromUntrustedSendRight(), which has stronger checks of
the MachSendRight-provided IOSurface, expecting a valid IOSurface as
produced uncompressed and uni-planar from IOSurface::create().
Test: Tools/TestWebKitAPI/Tests/WebCore/cocoa/IOSurfaceTests.mm
* Source/WebCore/platform/graphics/cocoa/IOSurface.h:
* Source/WebCore/platform/graphics/cocoa/IOSurface.mm:
(WebCore::validateAndCreateFromUntrustedSurface):
(WebCore::IOSurface::createFromUntrustedUncompressedWebKitSendRight):
* Source/WebKit/UIProcess/WebPageProxy.cpp:
(WebKit::WebPageProxy::takeSnapshot):
* Tools/TestWebKitAPI/Tests/WebCore/cocoa/IOSurfaceTests.mm:
(TestWebKitAPI::TEST(IOSurfaceTest,
createFromUntrustedUncompressedWebKitSendRightSRGB)):
(TestWebKitAPI::TEST(IOSurfaceTest,
createFromUntrustedUncompressedWebKitSendRightRGBA16F)):
(TestWebKitAPI::TEST(IOSurfaceTest,
createFromUntrustedUncompressedWebKitSendRightYUV422)):
Identifier: [email protected]
(cherry picked from commit ad19c98423d04bb3602ca9a961d99e53b933948b)
Canonical link: https://commits.webkit.org/[email protected]
Commit: aaed6e34caf917bc1365eea4e30331a11f1287ac
https://github.com/WebKit/WebKit/commit/aaed6e34caf917bc1365eea4e30331a11f1287ac
Author: Charlie Wolfe <[email protected]>
Date: 2026-08-13 (Thu, 13 Aug 2026)
Changed paths:
M Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.cpp
Log Message:
-----------
Cherry-pick 8d9bf389bc0f. rdar://184747528
Validate several ITP and storage access IPC messages
https://bugs.webkit.org/show_bug.cgi?id=318244
rdar://180785498
Reviewed by Matthew Finkel.
This relands the validation that was reverted in rdar://180738421.
Telemetry indicates the
LogUserInteraction MESSAGE_CHECK could rarely fail. It is unclear how this
could happen, so it has
been replaced with an early return and assertion to avoid crashing the
WebContent process.
Test: ipc/forged-resource-load-statistics-storage-access.html
*
LayoutTests/ipc/forged-resource-load-statistics-storage-access-expected.txt:
Added.
* LayoutTests/ipc/forged-resource-load-statistics-storage-access.html:
Added.
* Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.cpp:
(WebKit::NetworkConnectionToWebProcess::logUserInteraction):
(WebKit::resourceLoadStatisticsContainsOnlyObservableFields):
(WebKit::NetworkConnectionToWebProcess::resourceLoadStatisticsUpdated):
(WebKit::NetworkConnectionToWebProcess::requestStorageAccessUnderOpener):
Identifier: [email protected]
(cherry picked from commit a810bf736945dea451085f03f561ef8718b91a43)
Canonical link: https://commits.webkit.org/[email protected]
Commit: f5bc0b381e69d1589f40985576530a07273e51e1
https://github.com/WebKit/WebKit/commit/f5bc0b381e69d1589f40985576530a07273e51e1
Author: Matthew Finkel <[email protected]>
Date: 2026-08-13 (Thu, 13 Aug 2026)
Changed paths:
A
LayoutTests/http/tests/cookies/same-site/fetch-in-srcdoc-iframe-inside-cross-origin-iframe-expected.txt
A
LayoutTests/http/tests/cookies/same-site/fetch-in-srcdoc-iframe-inside-cross-origin-iframe.html
A
LayoutTests/http/tests/cookies/same-site/img-from-srcdoc-iframe-inside-cross-origin-iframe-expected.txt
A
LayoutTests/http/tests/cookies/same-site/img-from-srcdoc-iframe-inside-cross-origin-iframe.html
A LayoutTests/http/tests/cookies/same-site/resources/record-image-cookies.py
A
LayoutTests/http/tests/cookies/same-site/resources/srcdoc-creator-img-inside-cross-origin-iframe.html
A
LayoutTests/http/tests/cookies/same-site/resources/srcdoc-creator-inside-cross-origin-iframe.html
M Source/WebCore/loader/FrameLoader.cpp
Log Message:
-----------
Cherry-pick edd74642a6ef. rdar://184747426
Srcdoc iframes bypass SameSite Strict and Lax cookies
https://bugs.webkit.org/show_bug.cgi?id=313220
rdar://175498842
Reviewed by Charlie Wolfe.
When we set firstPartyForCookies on a subframe, we check if either:
1) shouldInheritSecurityOriginFromOwner is true for the current document's
URL, or
2) if the current document's URL is same-registrable-domain as the
top-level document URL
In the case of an iframe with srcdoc, shouldInheritSecurityOriginFromOwner
returns true (as documented), and this causes us to set the page's
mainFrameURL
as the firstPartyForCookies. We need a conditional exception for
shouldInheritSecurityOriginFromOwner, but it should take nested iframes into
account. This patch adjusts the logic so we inherit the ancestor frame's
siteForCookies instead of the page's URL. The same-registrable-domain check
remains unchanged.
Test:
http/tests/cookies/same-site/fetch-in-srcdoc-iframe-inside-cross-origin-iframe.html
*
LayoutTests/http/tests/cookies/same-site/fetch-in-srcdoc-iframe-inside-cross-origin-iframe-expected.txt:
Added.
*
LayoutTests/http/tests/cookies/same-site/fetch-in-srcdoc-iframe-inside-cross-origin-iframe.html:
Added.
*
LayoutTests/http/tests/cookies/same-site/img-from-srcdoc-iframe-inside-cross-origin-iframe-expected.txt:
Added.
*
LayoutTests/http/tests/cookies/same-site/img-from-srcdoc-iframe-inside-cross-origin-iframe.html:
Added.
*
LayoutTests/http/tests/cookies/same-site/resources/record-image-cookies.py:
Added.
*
LayoutTests/http/tests/cookies/same-site/resources/srcdoc-creator-img-inside-cross-origin-iframe.html:
Added.
*
LayoutTests/http/tests/cookies/same-site/resources/srcdoc-creator-inside-cross-origin-iframe.html:
Added.
* Source/WebCore/loader/FrameLoader.cpp:
(WebCore::FrameLoader::setFirstPartyForCookies):
Identifier: [email protected]
(cherry picked from commit 5020fc768893ba78bd86481ddd288097d2e41808)
Canonical link: https://commits.webkit.org/[email protected]
Commit: 322716375241776cd78765e5d235e1b603559992
https://github.com/WebKit/WebKit/commit/322716375241776cd78765e5d235e1b603559992
Author: Sihui Liu <[email protected]>
Date: 2026-08-13 (Thu, 13 Aug 2026)
Changed paths:
M Source/WebKit/NetworkProcess/storage/NetworkStorageManager.cpp
M Source/WebKit/UIProcess/WebsiteData/WebsiteDataStore.h
Log Message:
-----------
Cherry-pick b2b34862739c. rdar://184747515
Enable storage site validation
rdar://172706201
Reviewed by Chris Dumez.
Enable WebsiteDataStore::m_storageSiteValidationEnabled by default so
NetworkStorageManager validates the site on
messages it receives.
Replace MESSAGE_CHECK with STORAGE_MESSAGE_CHECK for site validation
checks. STORAGE_MESSAGE_CHECK generates a simulated
crash and returns an error instead of terminating the sender process. This
blocks storage access from compromised
processes while allowing us to monitor for false positives before upgrading
to MESSAGE_CHECK.
* Source/WebKit/NetworkProcess/storage/NetworkStorageManager.cpp:
(WebKit::NetworkStorageManager::persisted):
(WebKit::NetworkStorageManager::persist):
(WebKit::NetworkStorageManager::estimate):
(WebKit::NetworkStorageManager::fileSystemGetDirectory):
(WebKit::NetworkStorageManager::connectToStorageArea):
(WebKit::NetworkStorageManager::cancelConnectToStorageArea):
(WebKit::NetworkStorageManager::disconnectFromStorageArea):
(WebKit::NetworkStorageManager::setItem):
(WebKit::NetworkStorageManager::removeItem):
(WebKit::NetworkStorageManager::clear):
(WebKit::NetworkStorageManager::openDBRequestCancelled):
(WebKit::NetworkStorageManager::deleteDatabase):
(WebKit::NetworkStorageManager::databaseConnectionClosed):
(WebKit::NetworkStorageManager::getAllDatabaseNamesAndVersions):
(WebKit::NetworkStorageManager::cacheStorageOpenCache):
(WebKit::NetworkStorageManager::cacheStorageRemoveCache):
(WebKit::NetworkStorageManager::cacheStorageAllCaches):
(WebKit::NetworkStorageManager::cacheStorageReference):
(WebKit::NetworkStorageManager::cacheStorageDereference):
(WebKit::NetworkStorageManager::lockCacheStorage):
(WebKit::NetworkStorageManager::unlockCacheStorage):
(WebKit::NetworkStorageManager::cacheStorageRetrieveRecords):
(WebKit::NetworkStorageManager::cacheStorageRemoveRecords):
(WebKit::NetworkStorageManager::cacheStoragePutRecords):
(WebKit::NetworkStorageManager::cacheStorageClearMemoryRepresentation):
* Source/WebKit/UIProcess/WebsiteData/WebsiteDataStore.h:
Identifier: 305413.905@safari-7624-branch
(cherry picked from commit 8a2c164606499ac2c14a259b18055655d7316772)
Canonical link: https://commits.webkit.org/[email protected]
Commit: 2da068b6128c69b1d69107d33de2b22286c5c7f8
https://github.com/WebKit/WebKit/commit/2da068b6128c69b1d69107d33de2b22286c5c7f8
Author: Ryosuke Niwa <[email protected]>
Date: 2026-08-13 (Thu, 13 Aug 2026)
Changed paths:
M Source/WebCore/html/track/TrackBase.cpp
M Source/WebCore/html/track/TrackBase.h
Log Message:
-----------
Cherry-pick 33be61fed07c. rdar://184747619
Data race in TrackBase::opaqueRoot during GC leading to use-after-free
https://bugs.webkit.org/show_bug.cgi?id=311800
rdar://173766033
Reviewed by Jer Noble.
Store the opaque root value separately from m_trackList to avoid data race
during GC.
No new tests since there is no reliable way to test this data race.
* Source/WebCore/html/track/TrackBase.cpp:
(WebCore::TrackBase::setTrackList):
(WebCore::TrackBase::clearTrackList):
(WebCore::TrackBase::opaqueRoot): Deleted.
* Source/WebCore/html/track/TrackBase.h:
(WebCore::TrackBase::opaqueRoot const):
Identifier: 305413.636@safari-7624-branch
(cherry picked from commit 8d086397730a901ec402b1467c21c5ef06b381e3)
Canonical link: https://commits.webkit.org/[email protected]
Commit: 7d17467ed8266c4a3b63dbb91c17482d7b546911
https://github.com/WebKit/WebKit/commit/7d17467ed8266c4a3b63dbb91c17482d7b546911
Author: Roberto Rodriguez <[email protected]>
Date: 2026-08-13 (Thu, 13 Aug 2026)
Changed paths:
A
LayoutTests/imported/w3c/web-platform-tests/content-security-policy/inheritance/about-blank-from-javascript-url-inherits-csp-from-initiator.sub-expected.txt
A
LayoutTests/imported/w3c/web-platform-tests/content-security-policy/inheritance/about-blank-from-javascript-url-inherits-csp-from-initiator.sub.html
A
LayoutTests/imported/w3c/web-platform-tests/content-security-policy/inheritance/support/page-with-csp-marker.html
A
LayoutTests/imported/w3c/web-platform-tests/content-security-policy/inheritance/support/page-with-csp-marker.html.headers
M LayoutTests/platform/ios-site-isolation/TestExpectations
M LayoutTests/platform/mac-site-isolation/TestExpectations
M Source/WebCore/loader/NavigationRequester.cpp
Log Message:
-----------
Cherry-pick 45512c517789. rdar://184747598
about:blank inherits cross-origin policy container due to empty document URL
https://bugs.webkit.org/show_bug.cgi?id=316512
rdar://176188073
Reviewed by Alex Christensen.
Documents created via javascript: URL have an empty internal URL.
Document::setURL() would
normally normalize this to aboutBlankURL(), but the call is conditionally
skipped during
document creation.
When one of these documents creates a cross-origin iframe and then
navigates it to about:blank,
the empty URL passes through NavigationRequester into
NavigationAction::isEmpty(), which
mistakes it for an action that was never set. The fallback in
FrameLoader::loadWithDocumentLoader
incorrectly rebuilds the action from the target frame's cross-origin
document rather than the
original initiator (the javascript: URL document). The about:blank then
inherits that document's
policy container instead of the initiator's, leaking its CSP and referrer
via
SecurityPolicyViolationEvent.
Fix by normalizing empty document URLs to aboutBlankURL() in
NavigationRequester::from(),
matching what Document::setURL() and Document::urlForBindings() already do.
Tests:
imported/w3c/web-platform-tests/content-security-policy/inheritance/about-blank-from-javascript-url-inherits-csp-from-initiator.sub.html
imported/w3c/web-platform-tests/content-security-policy/inheritance/support/page-with-csp-marker.html
*
LayoutTests/imported/w3c/web-platform-tests/content-security-policy/inheritance/about-blank-from-javascript-url-inherits-csp-from-initiator.sub-expected.txt:
Added.
*
LayoutTests/imported/w3c/web-platform-tests/content-security-policy/inheritance/about-blank-from-javascript-url-inherits-csp-from-initiator.sub.html:
Added.
*
LayoutTests/imported/w3c/web-platform-tests/content-security-policy/inheritance/support/page-with-csp-marker.html:
Added.
*
LayoutTests/imported/w3c/web-platform-tests/content-security-policy/inheritance/support/page-with-csp-marker.html.headers:
Added.
* LayoutTests/platform/ios-site-isolation/TestExpectations:
* LayoutTests/platform/mac-site-isolation/TestExpectations:
* Source/WebCore/loader/NavigationRequester.cpp:
(WebCore::NavigationRequester::from):
Identifier: [email protected]
(cherry picked from commit 1bff10b94fdfbc5a4ae88d723bdf1d482465b18e)
Canonical link: https://commits.webkit.org/[email protected]
Commit: de54be0d321ada20ae8b2710acb9bd34ee2ca0cb
https://github.com/WebKit/WebKit/commit/de54be0d321ada20ae8b2710acb9bd34ee2ca0cb
Author: Mohsin Qureshi <[email protected]>
Date: 2026-08-13 (Thu, 13 Aug 2026)
Changed paths:
M Source/WebCore/html/track/TrackBase.cpp
M Source/WebCore/html/track/TrackBase.h
Log Message:
-----------
Revert 33be61fed07c. rdar://184747619
This reverts commit 259686c37cedbe51d5344e403facc083c3b5a0f3.
Canonical link: https://commits.webkit.org/[email protected]
Commit: d15c9ab035cde8fcc0a1e6316019e5ef48bc675f
https://github.com/WebKit/WebKit/commit/d15c9ab035cde8fcc0a1e6316019e5ef48bc675f
Author: Mohsin Qureshi <[email protected]>
Date: 2026-08-13 (Thu, 13 Aug 2026)
Changed paths:
M Source/WTF/wtf/PlatformEnableCocoa.h
M Source/WTF/wtf/cocoa/RuntimeApplicationChecksCocoa.h
M Source/WTF/wtf/cocoa/RuntimeApplicationChecksCocoa.mm
M Source/WTF/wtf/spi/darwin/dyldSPI.h
M Source/WebKit/NetworkProcess/cocoa/NetworkProcessCocoa.mm
M Source/WebKit/NetworkProcess/mac/com.apple.WebKit.NetworkProcess.sb.in
M Source/WebKit/Scripts/process-entitlements.sh
Log Message:
-----------
Cherry-pick 8f582cb. rdar://184747435
[macOS] The Networking process sandbox should inherit network access from
the UI process
https://bugs.webkit.org/show_bug.cgi?id=311807
rdar://171541375
Reviewed by Chris Dumez.
This was already fixed for iOS in rdar://159116963. This patch enables the
feature on macOS
with an additional link check.
No new tests, since both WebKitTestRunner and TestWebKitAPI are not
blocking network access.
* Source/WTF/wtf/PlatformEnableCocoa.h:
* Source/WTF/wtf/cocoa/RuntimeApplicationChecksCocoa.h:
* Source/WTF/wtf/cocoa/RuntimeApplicationChecksCocoa.mm:
(WTF::computeSDKAlignedBehaviors):
* Source/WTF/wtf/spi/darwin/dyldSPI.h:
* Source/WebKit/NetworkProcess/cocoa/NetworkProcessCocoa.mm:
(WebKit::blockNetworkAccessIfNeeded):
(WebKit::NetworkProcess::platformInitializeNetworkProcessCocoa):
* Source/WebKit/NetworkProcess/mac/com.apple.WebKit.NetworkProcess.sb.in:
* Source/WebKit/Scripts/process-entitlements.sh:
Identifier: 305413.701@safari-7624-branch
* Source/WTF/wtf/PlatformEnableCocoa.h:
* Source/WTF/wtf/cocoa/RuntimeApplicationChecksCocoa.h:
* Source/WTF/wtf/cocoa/RuntimeApplicationChecksCocoa.mm:
(WTF::computeSDKAlignedBehaviors):
* Source/WTF/wtf/spi/darwin/dyldSPI.h:
* Source/WebKit/NetworkProcess/cocoa/NetworkProcessCocoa.mm:
(WebKit::blockNetworkAccessIfNeeded):
(WebKit::NetworkProcess::platformInitializeNetworkProcessCocoa):
* Source/WebKit/NetworkProcess/mac/com.apple.WebKit.NetworkProcess.sb.in:
* Source/WebKit/Scripts/process-entitlements.sh:
(cherry picked from commit 4efb9daa5f616b57bc3904b50ffc6035ac5d10ff)
Canonical link: https://commits.webkit.org/[email protected]
Commit: f6082f74a5c3a3545a68b0f2bf2e237258a23f90
https://github.com/WebKit/WebKit/commit/f6082f74a5c3a3545a68b0f2bf2e237258a23f90
Author: Sihui Liu <[email protected]>
Date: 2026-08-13 (Thu, 13 Aug 2026)
Changed paths:
M Source/WebKit/NetworkProcess/storage/FileSystemStorageHandle.cpp
M Source/WebKit/NetworkProcess/storage/FileSystemStorageHandle.h
M Source/WebKit/NetworkProcess/storage/FileSystemStorageManager.cpp
M Source/WebKit/NetworkProcess/storage/FileSystemStorageManager.h
M Source/WebKit/NetworkProcess/storage/NetworkStorageManager.cpp
M Source/WebKit/NetworkProcess/storage/NetworkStorageManager.h
M Source/WebKit/NetworkProcess/storage/OriginStorageManager.cpp
M Source/WebKit/NetworkProcess/storage/OriginStorageManager.h
M Tools/TestWebKitAPI/Tests/WebKit/WKWebView/IPCTestingAPI.mm
Log Message:
-----------
Cherry-pick 9945ade1f70a. rdar://184747450
Validate connection access to FileSystem storage with
FileSystemHandleIdentifier
rdar://176773267
Reviewed by Chris Dumez.
Many FileSystem-related messages sent to NetworkStorageManager only carries
FileSystemHandleIdentifier when asking to
operate on FileSystem storage, and NetworkStorageManager does not check
whether the sender process actually has access
to requested handle. This lets a compromised process forge
FileSystemHandleIdentifier and access data from other
origins. To fix it, this patch stores the origin in
FileSystemStorageManager and adding an origin accessor to
FileSystemStorageHandle, so that NetworkStorageManager can run
isSiteAllowedForConnection in FileSystem-related message
handlers.
API test: IPCTestingAPI.FileSystemForgedHandleIdentifierRejected
* Source/WebKit/NetworkProcess/storage/FileSystemStorageHandle.cpp:
(WebKit::FileSystemStorageHandle::origin const):
* Source/WebKit/NetworkProcess/storage/FileSystemStorageHandle.h:
* Source/WebKit/NetworkProcess/storage/FileSystemStorageManager.cpp:
(WebKit::FileSystemStorageManager::create):
(WebKit::FileSystemStorageManager::FileSystemStorageManager):
* Source/WebKit/NetworkProcess/storage/FileSystemStorageManager.h:
* Source/WebKit/NetworkProcess/storage/NetworkStorageManager.cpp:
(WebKit::NetworkStorageManager::fileSystemGetDirectory):
(WebKit::NetworkStorageManager::closeHandle):
(WebKit::NetworkStorageManager::isSameEntry):
(WebKit::NetworkStorageManager::move):
(WebKit::NetworkStorageManager::getFileHandle):
(WebKit::NetworkStorageManager::getDirectoryHandle):
(WebKit::NetworkStorageManager::removeEntry):
(WebKit::NetworkStorageManager::resolve):
(WebKit::NetworkStorageManager::getFile):
(WebKit::NetworkStorageManager::createSyncAccessHandle):
(WebKit::NetworkStorageManager::closeSyncAccessHandle):
(WebKit::NetworkStorageManager::requestNewCapacityForSyncAccessHandle):
(WebKit::NetworkStorageManager::createWritable):
(WebKit::NetworkStorageManager::closeWritable):
(WebKit::NetworkStorageManager::executeCommandForWritable):
(WebKit::NetworkStorageManager::getHandleNames):
(WebKit::NetworkStorageManager::getHandle):
(WebKit::NetworkStorageManager::canConnectionAccessFileSystemHandle const):
* Source/WebKit/NetworkProcess/storage/NetworkStorageManager.h:
* Source/WebKit/NetworkProcess/storage/OriginStorageManager.cpp:
(WebKit::OriginStorageManager::StorageBucket::fileSystemStorageManager):
(WebKit::OriginStorageManager::fileSystemStorageManager):
* Source/WebKit/NetworkProcess/storage/OriginStorageManager.h:
* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/IPCTestingAPI.mm:
(function):
((IPCTestingAPI, FileSystemForgedHandleIdentifierRejected)):
Identifier: [email protected]
(cherry picked from commit bdb293f4b35d0e6654a9fe1088cab27ab4834c15)
Canonical link: https://commits.webkit.org/[email protected]
Commit: ced49f2a60a1caaefe3a9f6fba124691a85278ca
https://github.com/WebKit/WebKit/commit/ced49f2a60a1caaefe3a9f6fba124691a85278ca
Author: Pascoe <[email protected]>
Date: 2026-08-13 (Thu, 13 Aug 2026)
Changed paths:
M Source/WebCore/loader/FrameLoader.cpp
M
Tools/TestWebKitAPI/Tests/WebKit/WKWebView/VerifyUserGestureFromUIProcess.mm
Log Message:
-----------
Cherry-pick 2057f457fb75. rdar://184747505
Popunder bypass via overlappping transient activations
https://bugs.webkit.org/show_bug.cgi?id=316816
rdar://177442177
Reviewed by Charlie Wolfe and Abrar Rahman Protyasha.
We should consume transient activations to avoid popunders.
Test:
Tools/TestWebKitAPI/Tests/WebKitCocoa/VerifyUserGestureFromUIProcess.mm
* Source/WebCore/loader/FrameLoader.cpp:
(WebCore::createWindow):
* Tools/TestWebKitAPI/Tests/WebKitCocoa/VerifyUserGestureFromUIProcess.mm:
(TestWebKitAPI::TEST(VerifyUserGesture,
PopunderPreventedViaDualEventListeners)):
Identifier: [email protected]
(cherry picked from commit 8179d5db9408e9fb3636a2a6b64229e21d5f7a45)
Canonical link: https://commits.webkit.org/[email protected]
Commit: 4cba292b1c7e0adfb61d6ce5981d6d2901eaa553
https://github.com/WebKit/WebKit/commit/4cba292b1c7e0adfb61d6ce5981d6d2901eaa553
Author: Ryosuke Niwa <[email protected]>
Date: 2026-08-13 (Thu, 13 Aug 2026)
Changed paths:
M Source/WebCore/Modules/mediasource/SourceBuffer.cpp
M Source/WebCore/Modules/mediasource/SourceBuffer.h
M Source/WebCore/Sources.txt
M Source/WebCore/WebCore.xcodeproj/project.pbxproj
A Source/WebCore/bindings/js/JSHTMLMediaElementCustom.cpp
M Source/WebCore/html/HTMLMediaElement.cpp
M Source/WebCore/html/HTMLMediaElement.h
M Source/WebCore/html/HTMLMediaElement.idl
M Source/WebCore/html/track/TextTrackList.cpp
M Source/WebCore/html/track/TextTrackList.h
M Source/WebCore/html/track/TrackBase.cpp
M Source/WebCore/html/track/TrackBase.h
M Source/WebCore/html/track/TrackListBase.cpp
M Source/WebCore/html/track/TrackListBase.h
A Source/WebCore/html/track/TrackOpaqueRoot.h
Log Message:
-----------
Cherry-pick 3cbf2f5adfe0. rdar://184747619
Data race in TrackBase::opaqueRoot during GC leading to use-after-free
https://bugs.webkit.org/show_bug.cgi?id=311800
rdar://176058579
Reviewed by Geoffrey Garen.
To fix the data race, we introduce SourceBuffer and HTMLMediaElement as
opaque roots for Track* classes
and *TrackList classes instead of using the root node of HTMLMediaElement
which can change over time.
We introduce TrackOpaqueRoot, which is a thin ThreadSafeRefCounted wrapper
around WebCoreOpaqueRoot,
and initialize it with WebCoreOpaqueRoot pointing to SourceBuffer or
HTMLMediaElement.
Each Track and TrackList class will have RefPtr<TrackOpaqueRoot> and reads
the opaque root directly
from a GC thread without relying on any pointer indirections.
No new tests since there is no reliable way to test this data race.
* Source/WebCore/Modules/mediasource/SourceBuffer.cpp:
(WebCore::SourceBuffer::SourceBuffer):
(WebCore::SourceBuffer::~SourceBuffer):
(WebCore::SourceBuffer::videoTracks):
(WebCore::SourceBuffer::audioTracks):
(WebCore::SourceBuffer::textTracks):
(WebCore::m_logIdentifier): Deleted.
* Source/WebCore/Modules/mediasource/SourceBuffer.h:
* Source/WebCore/Sources.txt:
* Source/WebCore/WebCore.xcodeproj/project.pbxproj:
* Source/WebCore/bindings/js/JSHTMLMediaElementCustom.cpp: Added.
(WebCore::JSHTMLMediaElement::visitAdditionalChildren):
* Source/WebCore/html/HTMLMediaElement.cpp:
(WebCore::m_trackOpaqueRoot):
(WebCore::HTMLMediaElement::~HTMLMediaElement):
(WebCore::HTMLMediaElement::ensureAudioTracks):
(WebCore::HTMLMediaElement::ensureTextTracks):
(WebCore::HTMLMediaElement::ensureVideoTracks):
(WebCore::m_opaqueRootProvider): Deleted.
* Source/WebCore/html/HTMLMediaElement.h:
(WebCore::HTMLMediaElement::trackOpaqueRoot):
* Source/WebCore/html/HTMLMediaElement.idl:
* Source/WebCore/html/track/TextTrackList.cpp:
(WebCore::TextTrackList::setOpaqueRoot):
* Source/WebCore/html/track/TextTrackList.h:
* Source/WebCore/html/track/TrackBase.cpp:
(WebCore::TrackBase::setOpaqueRoot):
(WebCore::TrackBase::opaqueRoot):
(WebCore::TrackBase::setTrackList):
(WebCore::TrackBase::clearTrackList):
* Source/WebCore/html/track/TrackBase.h:
* Source/WebCore/html/track/TrackListBase.cpp:
(WebCore::TrackListBase::setOpaqueRoot):
(WebCore::TrackListBase::opaqueRoot):
* Source/WebCore/html/track/TrackListBase.h:
(WebCore::TrackListBase::trackOpaqueRoot):
(WebCore::TrackListBase::setOpaqueRootObserver): Deleted.
* Source/WebCore/html/track/TrackOpaqueRoot.h: Added.
(WebCore::TrackOpaqueRoot::create):
(WebCore::TrackOpaqueRoot::opaqueRoot const):
(WebCore::TrackOpaqueRoot::clear):
(WebCore::TrackOpaqueRoot::TrackOpaqueRoot):
Identifier: [email protected]
* Source/WebCore/Modules/mediasource/SourceBuffer.cpp:
(WebCore::SourceBuffer::SourceBuffer):
(WebCore::SourceBuffer::~SourceBuffer):
(WebCore::SourceBuffer::videoTracks):
(WebCore::SourceBuffer::audioTracks):
(WebCore::SourceBuffer::textTracks):
(WebCore::m_logIdentifier): Deleted.
* Source/WebCore/Modules/mediasource/SourceBuffer.h:
* Source/WebCore/Sources.txt:
* Source/WebCore/WebCore.xcodeproj/project.pbxproj:
* Source/WebCore/bindings/js/JSHTMLMediaElementCustom.cpp: Added.
(WebCore::JSHTMLMediaElement::visitAdditionalChildrenInGCThread):
* Source/WebCore/html/HTMLMediaElement.cpp:
(WebCore::m_trackOpaqueRoot):
(WebCore::HTMLMediaElement::~HTMLMediaElement):
(WebCore::HTMLMediaElement::ensureAudioTracks):
(WebCore::HTMLMediaElement::ensureTextTracks):
(WebCore::HTMLMediaElement::ensureVideoTracks):
(WebCore::m_opaqueRootProvider): Deleted.
* Source/WebCore/html/HTMLMediaElement.h:
(WebCore::HTMLMediaElement::trackOpaqueRoot):
* Source/WebCore/html/HTMLMediaElement.idl:
* Source/WebCore/html/track/TextTrackList.cpp:
(WebCore::TextTrackList::setOpaqueRoot):
* Source/WebCore/html/track/TextTrackList.h:
* Source/WebCore/html/track/TrackBase.cpp:
(WebCore::TrackBase::setOpaqueRoot):
(WebCore::TrackBase::opaqueRoot const):
(WebCore::TrackBase::setTrackList):
(WebCore::TrackBase::clearTrackList):
* Source/WebCore/html/track/TrackBase.h:
* Source/WebCore/html/track/TrackListBase.cpp:
(WebCore::TrackListBase::setOpaqueRoot):
(WebCore::TrackListBase::opaqueRoot const):
* Source/WebCore/html/track/TrackListBase.h:
(WebCore::TrackListBase::trackOpaqueRoot):
(WebCore::TrackListBase::setOpaqueRootObserver): Deleted.
* Source/WebCore/html/track/TrackOpaqueRoot.h: Added.
(WebCore::TrackOpaqueRoot::create):
(WebCore::TrackOpaqueRoot::opaqueRoot const):
(WebCore::TrackOpaqueRoot::clear):
(WebCore::TrackOpaqueRoot::TrackOpaqueRoot):
(cherry picked from commit ed5961bd18f9cba1b74106052b07e09513d5ae3c)
Canonical link: https://commits.webkit.org/[email protected]
Commit: 083e3fb1ef853584b06a4f483f85824792be78c8
https://github.com/WebKit/WebKit/commit/083e3fb1ef853584b06a4f483f85824792be78c8
Author: Sihui Liu <[email protected]>
Date: 2026-08-13 (Thu, 13 Aug 2026)
Changed paths:
M Source/WebKit/NetworkProcess/storage/CacheStorageCache.cpp
M Source/WebKit/NetworkProcess/storage/CacheStorageCache.h
M Source/WebKit/NetworkProcess/storage/CacheStorageManager.cpp
M Source/WebKit/NetworkProcess/storage/CacheStorageManager.h
M Source/WebKit/NetworkProcess/storage/NetworkStorageManager.cpp
M Source/WebKit/NetworkProcess/storage/NetworkStorageManager.h
M Source/WebKit/NetworkProcess/storage/OriginStorageManager.cpp
Log Message:
-----------
Cherry-pick d4dc872e5bf9. rdar://184747554
Validate connection access to DOMCache with DOMCacheIdentifier
rdar://176470206
Reviewed by Chris Dumez.
Many CacheStorage-related messages sent to NetworkStorageManager only
carries DOMCacheIdentifier when asking to operate
on DOMCache storage, and NetworkStorageManager does not check whether the
sender process actually has access to
requested cache. This lets a compromised process forge DOMCacheIdentifier
and access data from other origins. To fix it,
this patch stores the origin in CacheStorageManager and adding an origin
accessor to CacheStorageCache, so that
NetworkStorageManager can run isSiteAllowedForConnection in
CacheStorage-related message handlers.
* Source/WebKit/NetworkProcess/storage/CacheStorageCache.cpp:
(WebKit::CacheStorageCache::origin const):
* Source/WebKit/NetworkProcess/storage/CacheStorageCache.h:
* Source/WebKit/NetworkProcess/storage/CacheStorageManager.cpp:
(WebKit::CacheStorageManager::create):
(WebKit::CacheStorageManager::CacheStorageManager):
* Source/WebKit/NetworkProcess/storage/CacheStorageManager.h:
(WebKit::CacheStorageManager::origin const):
* Source/WebKit/NetworkProcess/storage/NetworkStorageManager.cpp:
(WebKit::NetworkStorageManager::cacheStorageRemoveCache):
(WebKit::NetworkStorageManager::cacheStorageReference):
(WebKit::NetworkStorageManager::cacheStorageRetrieveRecords):
(WebKit::NetworkStorageManager::cacheStorageRemoveRecords):
(WebKit::NetworkStorageManager::cacheStoragePutRecords):
* Source/WebKit/NetworkProcess/storage/NetworkStorageManager.h:
* Source/WebKit/NetworkProcess/storage/OriginStorageManager.cpp:
(WebKit::OriginStorageManager::StorageBucket::cacheStorageManager):
Identifier: [email protected]
(cherry picked from commit 116b1f39484f1822a7ccb064e879ef00aab04dac)
Canonical link: https://commits.webkit.org/[email protected]
Commit: 43e54dbade9f9bf1045a48514cd568dcdc1955f7
https://github.com/WebKit/WebKit/commit/43e54dbade9f9bf1045a48514cd568dcdc1955f7
Author: Mohsin Qureshi <[email protected]>
Date: 2026-08-13 (Thu, 13 Aug 2026)
Changed paths:
M Configurations/Version.xcconfig
Log Message:
-----------
Versioning. WebKit-7625.1.29.13.2
Canonical link: https://commits.webkit.org/[email protected]
Compare: https://github.com/WebKit/WebKit/compare/31e7f882b819%5E...43e54dbade9f
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
