PatchGap
← WebKit — 2026-W37

92a274ec73ed0b046d5821b8a49c309e95becfea  [JSC] Wasm BreakpointManager is returning Breakpoint* of HashMap and not guaranteeing it becomes stale

severity low class UAF confidence 0.4 signal score 6.47 Source/JavaScriptCore/wasm
view commit ↗
Primitive: findBreakpoint() returned a raw Breakpoint* into a HashMap value that could dangle if the map mutated while the pointer was held.
Triage note: Breakpoint becomes ThreadSafeRefCounted and the Wasm BreakpointManager map stores Ref<Breakpoint>; findBreakpoint() now returns RefPtr<Breakpoint>, keeping it alive across stopTheWorld()/map mutation. Real lifetime fix, but the Wasm debugger is remote-debug tooling, not web-content reachable.
Structural signals: smartptr_member_added (+6.47)

Commit message

[JSC] Wasm BreakpointManager is returning Breakpoint* of HashMap and not guaranteeing it becomes stale
https://bugs.webkit.org/show_bug.cgi?id=323910
rdar://187146401

Reviewed by Yijia Huang.

BreakpointManager is having UncheckedKeyHashMap<VirtualAddress, Breakpoint> and
returning Breakpoint*. But there is no guarantee that someone is modifying
this map while someone is using this Breakpoint*. If rehashing happens,
this pointer becomes stale. This patch makes Breakpoint Ref<> managed.

* Source/JavaScriptCore/wasm/debugger/WasmBreakpointManager.cpp:
(JSC::Wasm::BreakpointManager::setBreakpoint):
(JSC::Wasm::BreakpointManager::findBreakpoint):
(JSC::Wasm::BreakpointManager::removeBreakpointImpl):
(JSC::Wasm::BreakpointManager::clearAllBreakpoints):
* Source/JavaScriptCore/wasm/debugger/WasmBreakpointManager.h:
* Source/JavaScriptCore/wasm/debugger/WasmDebugServerUtilities.cpp:
* Source/JavaScriptCore/wasm/debugger/WasmDebugServerUtilities.h:
(JSC::Wasm::Breakpoint::Breakpoint):
(JSC::Wasm::Breakpoint::patchBreakpoint): Deleted.
(JSC::Wasm::Breakpoint::restorePatch): Deleted.
(JSC::Wasm::Breakpoint::isOneTimeBreakpoint): Deleted.
(JSC::Wasm::Breakpoint::dump const): Deleted.
* Source/JavaScriptCore/wasm/debugger/WasmExecutionHandler.cpp:
(JSC::Wasm::ExecutionHandler::handleDebuggerTrapIfNeeded):
(JSC::Wasm::ExecutionHandler::stepAtBytecode):
(JSC::Wasm::ExecutionHandler::setBreakpointAtPC):
(JSC::Wasm::ExecutionHandler::setBreakpoint):
* Source/JavaScriptCore/wasm/debugger/tests/ExecutionHandlerTest.cpp:
(ExecutionHandlerTest::testBreakpointSingleStepping):

Canonical link: https://commits.webkit.org/320884@main

Before / after

Loading diff…
On This Page