This fixes a use-after-free caused by mutating an event-listener list while iterating it during dispatch in the WebKit web-extension APIs. Three dispatch routines iterated their listener collections by reference and invoked each listener’s JS callback: WebExtensionContextProxy::dispatchDevToolsExtensionPanelShownEvent looped over extensionPanel->onShown().listeners(), and WebExtensionAPIPort::fireMessageEventIfNeeded / fireDisconnectEventIfNeeded looped over m_onMessage->listeners() / m_onDisconnect->listeners(), each calling listener->call(…). Calling into JS can run extension code that adds or removes listeners, mutating the very collection being iterated; the reference-based range-for then walks invalidated iterators / freed listener objects — a use-after-free.

The fix takes a copy of the listener list before iterating (auto listenersCopy = …listeners()) and iterates it as for (RefPtr listener : listenersCopy), so iteration proceeds over a stable snapshot and each listener is retained (RefPtr) across its call().

The restored invariant is that dispatch iterates an immutable snapshot and keeps every listener alive across the callback, regardless of listener mutations triggered by the callback. The regression test registers many onMessage/onDisconnect listeners, and inside a firing listener adds 1024 more, asserting the dispatch counts match the listeners present when the event fired (i.e. no crash and snapshot semantics).

A use-after-free in the WebContent process (extension content world), reachable by a malicious web extension that mutates its own listener set during event dispatch. It requires an installed/malicious extension, narrowing reach, but the UAF is attacker-controlled and can escalate beyond the advisory’s crash with grooming.