← WebKit — 2026-W36
54c6c8c8bb2304befbb3d09771797654d8bce688 CSSStyleSheet::forEachStyleScope: iterate through a copy of m_adoptingTreeScopes
severity medium
class UAF
confidence 0.65
signal score 6.3
Source/WebCore/css
patch-now
Primitive: Iterator/collection invalidation while iterating m_adoptingTreeScopes
Triage note: forEachStyleScope now iterates copyToVectorOf<Ref<ContainerNode>>(m_adoptingTreeScopes) instead of the live set, because apply(styleScopeFor(...)) can mutate m_adoptingTreeScopes during iteration. RC_REMOVE_SEC_ACCEL_3-gated use-after-invalidation fix.
Triage note: forEachStyleScope now iterates copyToVectorOf<Ref<ContainerNode>>(m_adoptingTreeScopes) instead of the live set, because apply(styleScopeFor(...)) can mutate m_adoptingTreeScopes during iteration. RC_REMOVE_SEC_ACCEL_3-gated use-after-invalidation fix.
Structural signals: smartptr_member_added (+3.0), area:Source/WebCore/css (+2.0), surgical (+1.3)
Commit message
CSSStyleSheet::forEachStyleScope: iterate through a copy of m_adoptingTreeScopes
rdar://182736547
https://bugs.webkit.org/show_bug.cgi?id=322916
Reviewed by David Kilzer.
In CSSStyleSheet::forEachStyleScope, while iterating through m_adoptingTreeScopes,
it's possible for the `apply` lambda to modify the hash set itself. Fix this by
using copyToVectorOf to make a Vector copy of the hash set, and iterate through
that instead.
* Source/WebCore/css/CSSStyleSheet.cpp:
(WebCore::CSSStyleSheet::forEachStyleScope):
Identifier: 316606.641@safari-7625-branch
Before / after
Loading diff…
On This Page