Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: f457aa2ebeca6492031580b2288bb19e22b5e921
https://github.com/WebKit/WebKit/commit/f457aa2ebeca6492031580b2288bb19e22b5e921
Author: Taher Ali <[email protected]>
Date: 2026-09-18 (Fri, 18 Sep 2026)
Changed paths:
A
LayoutTests/fast/css/match-result-cache-has-style-relation-crash-expected.txt
A LayoutTests/fast/css/match-result-cache-has-style-relation-crash.html
M Source/WebCore/style/MatchResultCache.cpp
Log Message:
-----------
heap-use-after-free in Style::commitRelations via MatchResultCache
https://bugs.webkit.org/show_bug.cgi?id=319413
rdar://180282897
Reviewed by Brent Fulgham.
MatchResultCache::copy() deep-copied the relations vector into a long-lived
cache
entry. Style::Relation holds a raw Element*, so a stale pointer could be
committed
in commitRelations() after its target was freed. Reachable via :has() with a
featureless positional/sibling argument, where the relation target is a
descendant
that can be removed without invalidating the subject past InlineStyleInvalid.
Stop caching relations. They aren't needed on the FullWithMatchResultCache path,
which doesn't call resetStyleRelations(), so their flags persist from the
previous
resolution; FirstChild/LastChild bits are carried over by copyRelations().
Test: fast/css/match-result-cache-has-style-relation-crash.html
*
LayoutTests/fast/css/match-result-cache-has-style-relation-crash-expected.txt:
Added.
* LayoutTests/fast/css/match-result-cache-has-style-relation-crash.html: Added.
* Source/WebCore/style/MatchResultCache.cpp:
(WebCore::Style::copy):
Originally-landed-as: 316606.94@safari-7625-branch (ef6da56fb892).
rdar://187506623
Canonical link: https://commits.webkit.org/321402@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
