From 827068bf9f5c9e087cecb790491cd657aae2705b Mon Sep 17 00:00:00 2001
From: Etienne Bergeron <[email protected]>
Date: Thu, 23 Jul 2026 08:21:04 -0700
Subject: [PATCH] Fix potential Use-After-Free in WorkletAnimationController via animation ID overflow

In AnimationWorklet::NextWorkletAnimationId(), add a
CHECK_GT(last_animation_id_, 0) guard after incrementing
last_animation_id_. This prevents 32-bit signed integer overflow from
wrapping around to 0 or -1, which collides with the reserved
DeletedValue sentinel in WTF::IntHashTraits<int> used by
HeapHashMap<int, Member<WorkletAnimationBase>> animations_ in
WorkletAnimationController.

Fixed: 523572877
Change-Id: I225c015e2b96994202abb34a3bc7dc547ac30fdc
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8132941
Reviewed-by: Robert Flack <[email protected]>
Commit-Queue: Etienne Bergeron <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1667116}
---

diff --git a/third_party/blink/renderer/modules/animationworklet/animation_worklet.cc b/third_party/blink/renderer/modules/animationworklet/animation_worklet.cc
index 4182efc..86bc2295 100644
--- a/third_party/blink/renderer/modules/animationworklet/animation_worklet.cc
+++ b/third_party/blink/renderer/modules/animationworklet/animation_worklet.cc
@@ -60,7 +60,9 @@
 WorkletAnimationId AnimationWorklet::NextWorkletAnimationId() {
   // Id starts from 1. This way it safe to use it as key in hashmap with default
   // key traits.
-  return WorkletAnimationId(worklet_id_, ++last_animation_id_);
+  last_animation_id_++;
+  CHECK_GT(last_animation_id_, 0);
+  return WorkletAnimationId(worklet_id_, last_animation_id_);
 }
 
 void AnimationWorklet::Trace(Visitor* visitor) const {
diff --git a/third_party/blink/renderer/modules/animationworklet/animation_worklet_global_scope_test.cc b/third_party/blink/renderer/modules/animationworklet/animation_worklet_global_scope_test.cc
index 8f2b008..f86d758 100644
--- a/third_party/blink/renderer/modules/animationworklet/animation_worklet_global_scope_test.cc
+++ b/third_party/blink/renderer/modules/animationworklet/animation_worklet_global_scope_test.cc
@@ -471,4 +471,13 @@
   worklet->WaitForShutdownForTesting();
 }
 
+TEST_F(AnimationWorkletGlobalScopeTest, NextWorkletAnimationId) {
+  AnimationWorklet* worklet =
+      MakeGarbageCollected<AnimationWorklet>(*GetDocument().domWindow());
+  WorkletAnimationId id1 = worklet->NextWorkletAnimationId();
+  WorkletAnimationId id2 = worklet->NextWorkletAnimationId();
+  EXPECT_GT(id1.animation_id, 0);
+  EXPECT_GT(id2.animation_id, id1.animation_id);
+}
+
 }  // namespace blink

diff --git a/third_party/blink/renderer/modules/animationworklet/animation_worklet_global_scope_test.cc b/third_party/blink/renderer/modules/animationworklet/animation_worklet_global_scope_test.cc
index 8f2b008..f86d758 100644
--- a/third_party/blink/renderer/modules/animationworklet/animation_worklet_global_scope_test.cc
+++ b/third_party/blink/renderer/modules/animationworklet/animation_worklet_global_scope_test.cc
@@ -471,4 +471,13 @@
   worklet->WaitForShutdownForTesting();
 }
 
+TEST_F(AnimationWorkletGlobalScopeTest, NextWorkletAnimationId) {
+  AnimationWorklet* worklet =
+      MakeGarbageCollected<AnimationWorklet>(*GetDocument().domWindow());
+  WorkletAnimationId id1 = worklet->NextWorkletAnimationId();
+  WorkletAnimationId id2 = worklet->NextWorkletAnimationId();
+  EXPECT_GT(id1.animation_id, 0);
+  EXPECT_GT(id2.animation_id, id1.animation_id);
+}
+
 }  // namespace blink