Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 60fe8ff35a4ad47929fdd2ac017bcaea7ebc653e
https://github.com/WebKit/WebKit/commit/60fe8ff35a4ad47929fdd2ac017bcaea7ebc653e
Author: David Kilzer <[email protected]>
Date: 2026-09-18 (Fri, 18 Sep 2026)
Changed paths:
M Source/WebCore/page/Page.cpp
Log Message:
-----------
WebCore::Page::forEachPage should iterate a snapshot of allPages()
<https://bugs.webkit.org/show_bug.cgi?id=320100>
<rdar://179997790>
Reviewed by Chris Dumez.
Iterate a snapshot of the global page registry so a callback that
mutates the registry cannot invalidate the iterator. `forEachPage`
walked the live `allPages()` hash set while invoking an arbitrary
caller callback per page. A callback that synchronously creates or
destroys a `Page` mutates `allPages()` (through the constructor's
`add()` and the destructor's `remove()`), which can rehash the set and
free the bucket array the iterator is still walking, leaving the loop
dereferencing freed memory.
Build a `Vector<Ref<Page>>` snapshot first, matching the existing
pattern in `LocalDOMWindow::forEachWindowInterestedInStorageEvents`.
Holding a `Ref` to each page for the loop's duration also extends the
guarantee the previous per-element `Ref` temporary already gave the
current page to every page in the snapshot.
Also snapshot `allPages()` in the other methods that iterate it live
and could re-enter through their per-page work:
`clearPreviousItemFromAllPages`,
`updateStyleForAllPagesAfterGlobalChangeInEnvironment`, and
`updateControlTintsForAllPages`. `networkStateChanged` and
`refreshPlugins` already collect into a local container before acting,
so they are left unchanged.
* Source/WebCore/page/Page.cpp:
(WebCore::Page::forEachPage):
(WebCore::Page::clearPreviousItemFromAllPages):
(WebCore::Page::updateStyleForAllPagesAfterGlobalChangeInEnvironment):
(WebCore::Page::updateControlTintsForAllPages):
Originally-landed-as: 316606.223@safari-7625-branch (674ff0d01ca3).
rdar://187506399
Canonical link: https://commits.webkit.org/321423@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
