← WebKit — 2026-W36
d3e5e156482fdbdd56bbb62c9f47f20291265818 Harden `PlatformXR::Device` by making `TrackingAndRenderingClient` ref-countable
severity low
class UAF
confidence 0.3
signal score 7.77
Source/WebCore/platform
Primitive: TrackingAndRenderingClient dereferenced without protecting it, so it could be destroyed mid-callback.
Triage note: Migrates TrackingAndRenderingClient from CanMakeWeakPtr to AbstractRefCountedAndCanMakeWeakPtr and wraps each m_trackingAndRenderingClient->/trackingAndRenderingClient() deref in a RefPtr client = ... before use. This is a SaferCPP-style refcount/protect() hardening with no identified attacker-reachable bug, and WebFakeXRDevice is test-only.
Triage note: Migrates TrackingAndRenderingClient from CanMakeWeakPtr to AbstractRefCountedAndCanMakeWeakPtr and wraps each m_trackingAndRenderingClient->/trackingAndRenderingClient() deref in a RefPtr client = ... before use. This is a SaferCPP-style refcount/protect() hardening with no identified attacker-reachable bug, and WebFakeXRDevice is test-only.
Structural signals: smartptr_member_added (+6.47), surgical (+1.3)
Commit message
Harden `PlatformXR::Device` by making `TrackingAndRenderingClient` ref-countable
https://bugs.webkit.org/show_bug.cgi?id=323161
rdar://186410747
Reviewed by Dan Glastonbury and Chris Dumez.
This makes `TrackingAndRenderingClient` ref-countable since nothing enforces
that the client stays alive across its virtual functions.
No new tests, no behavior change.
* Source/WebCore/platform/xr/PlatformXR.h:
* Source/WebCore/testing/WebFakeXRDevice.cpp:
(WebCore::SimulatedXRDevice::setVisibilityState):
(WebCore::SimulatedXRDevice::simulateShutdownCompleted):
(WebCore::SimulatedXRDevice::initializeTrackingAndRendering):
* Source/WebKit/Shared/XR/XRDeviceProxy.cpp:
(WebKit::XRDeviceProxy::sessionDidEnd):
(WebKit::XRDeviceProxy::updateSessionVisibilityState):
(WebKit::XRDeviceProxy::sessionDidInitializeRendering):
(WebKit::XRDeviceProxy::initializeTrackingAndRendering):
Canonical link: https://commits.webkit.org/320347@main
Before / after
Loading diff…
On This Page