← WebKit — 2026-W36
3534a993db5d1f84c500f4238b42923c93661c23 Use after free of DocumentFragment through m_shadowIncludingRoot
severity medium
class LogicError
confidence 0.4
signal score 8.3
Source/WebCore/dom
Primitive: Shadow-including-root bookkeeping for the reused innerHTML/outerHTML document fragment
Triage note: Under the shipping #else of RC_REMOVE_SEC_ACCEL_3, updateShadowIncludingRoot stops inheriting the root across a DocumentFragmentForInnerOuterHTML parent and markup.cpp always reuses documentFragmentForInnerOuterHTML; a realRootFromShadowIncludingRoot helper keeps the invariant. DOM tree-state correctness around fragment reuse, but no concrete memory-safety primitive shown.
Triage note: Under the shipping #else of RC_REMOVE_SEC_ACCEL_3, updateShadowIncludingRoot stops inheriting the root across a DocumentFragmentForInnerOuterHTML parent and markup.cpp always reuses documentFragmentForInnerOuterHTML; a realRootFromShadowIncludingRoot helper keeps the invariant. DOM tree-state correctness around fragment reuse, but no concrete memory-safety primitive shown.
Structural signals: msg_strong (+3.0), msg_medium (+2.0), area:Source/WebCore/dom (+2.0), surgical (+1.3)
Commit message
Use after free of DocumentFragment through m_shadowIncludingRoot
https://bugs.webkit.org/show_bug.cgi?id=323216
rdar://185533761
Reviewed by Chris Dumez and Wenson Hsieh.
The bug was caused by the optimization for innerHTML/outerHTML setter to avoid calling removingSteps
which updates m_shadowIncludingRoot to point to the root node which had been removed from
the shared document fragment used for innerHTML / outerHTML.
Instead of updating m_shadowIncludingRoot upon removal which will be too expensive for Speedometer,
make insertionStep preemptively point to the node below document fragment. This will avoid having to
do O(n) node traversal to update m_shadowIncludingRoot when the node is removed from the fragment.
This PR also reverts 316606.427@safari-7625-branch which limited this optimization to HTML parser
since the new fix works for both HTML and XML parsers.
Test: sar3/fast/dom/detach-innerhtml-fragment-during-img-error-crash.html
* LayoutTests/sar3/fast/dom/detach-innerhtml-fragment-during-img-error-crash-expected.txt: Added.
* LayoutTests/sar3/fast/dom/detach-innerhtml-fragment-during-img-error-crash.html: Added.
* Source/WebCore/dom/Node.cpp:
(WebCore::realRootFromShadowIncludingRoot):
(WebCore::Node::updateShadowIncludingRoot):
* Source/WebCore/editing/markup.cpp:
(WebCore::createFragmentForMarkup):
Identifier: 316606.637@safari-7625-branch
Before / after
Loading diff…
On This Page