← WebKit Silent-Fix Report — 2026-W34
cc7a6821b7cceb7cb9e2836a9dfc11a42691683a REGRESSION(318278@main?)[macOS]: ASSERTION FAILED: !m_waitingForContentPolicy /Volumes/Data/worker/Apple-Tahoe-Debug-Build/build/Source/WebCore/loader/DocumentLoader.cpp
severity medium
class LogicError
confidence 0.55
WebKit NetworkResourceLoader
Primitive: Unserialized multipart/x-mixed-replace response flow control in NetworkResourceLoader
Triage note: CFNetwork delivers multipart parts/data/end without awaiting the prior part's response completion (ContinueDidReceiveResponse), tripping ASSERT(!m_waitingForContentPolicy) and requiring the loader to serialize itself; fix defers messages, caps them (100MB/1024) to bound network-process memory, and cancelDeferredMessages() in the destructor. State-machine/DoS hardening around the content-policy check.
Triage note: CFNetwork delivers multipart parts/data/end without awaiting the prior part's response completion (ContinueDidReceiveResponse), tripping ASSERT(!m_waitingForContentPolicy) and requiring the loader to serialize itself; fix defers messages, caps them (100MB/1024) to bound network-process memory, and cancelDeferredMessages() in the destructor. State-machine/DoS hardening around the content-policy check.
Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.
Before / after
Loading diff…