← WebKit — 2026-W38
8a4399c3a29617298c3b948fea393f7230a0b613 [threaded-animations] ensure remote timelines and animations are cleared when a web process crashes
severity medium
class UAF
confidence 0.45
signal score 9.06
Source/WebKit/UIProcess
Primitive: animation timelines/nodes not cleaned up when a remote web content process terminates
Triage note: On remotePageProcessDidTerminate the UIProcess now calls removeTimelines(processIdentifier) across the monotonic/progress-based timeline registries and runs animationsWereRemovedFromNode for that process's layers (plus ForTesting scaffolding and identifier validation); addresses stale per-process animation timeline state after process teardown, but is as much a leak/cleanup as a demonstrated exploitable UAF.
Triage note: On remotePageProcessDidTerminate the UIProcess now calls removeTimelines(processIdentifier) across the monotonic/progress-based timeline registries and runs animationsWereRemovedFromNode for that process's layers (plus ForTesting scaffolding and identifier validation); addresses stale per-process animation timeline state after process teardown, but is as much a leak/cleanup as a demonstrated exploitable UAF.
Structural signals: smartptr_member_added (+6.47), null_guard (+2.59)
Commit message
[threaded-animations] ensure remote timelines and animations are cleared when a web process crashes
https://bugs.webkit.org/show_bug.cgi?id=324329
rdar://187563973
Reviewed by Matt Woodrow.
Make sure that under `RemoteLayerTreeDrawingAreaProxy::remotePageProcessDidTerminate()`
we clear remote timelines and animations.
The new API test was created using LLM code assistance.
Test: Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolation.mm
* Source/WebKit/UIProcess/API/Cocoa/WKWebViewPrivateForTesting.h:
* Source/WebKit/UIProcess/API/Cocoa/WKWebViewTesting.mm:
(-[WKWebView _animationStackForLayerWithIDInMainFrame:]):
(-[WKWebView _animationStackForLayerWithID:processID:]):
(-[WKWebView _monotonicTimelinesForProcessID:]):
(-[WKWebView _animationStackForLayerWithID:]): Deleted.
* Source/WebKit/UIProcess/RemoteLayerTree/RemoteLayerTreeDrawingAreaProxy.mm:
(WebKit::RemoteLayerTreeDrawingAreaProxy::remotePageProcessDidTerminate):
* Source/WebKit/UIProcess/RemoteLayerTree/RemoteLayerTreeHost.mm:
(WebKit::RemoteLayerTreeHost::remotePageProcessDidTerminate):
* Source/WebKit/UIProcess/RemoteLayerTree/RemoteMonotonicTimelineRegistry.cpp:
(WebKit::RemoteMonotonicTimelineRegistry::remove):
(WebKit::RemoteMonotonicTimelineRegistry::timelinesForProcessForTesting const):
* Source/WebKit/UIProcess/RemoteLayerTree/RemoteMonotonicTimelineRegistry.h:
* Source/WebKit/UIProcess/RemoteLayerTree/RemoteProgressBasedTimelineRegistry.cpp:
(WebKit::RemoteProgressBasedTimelineRegistry::remove):
* Source/WebKit/UIProcess/RemoteLayerTree/RemoteProgressBasedTimelineRegistry.h:
* Source/WebKit/UIProcess/RemoteLayerTree/RemoteScrollingCoordinatorProxy.h:
(WebKit::RemoteScrollingCoordinatorProxy::removeTimelines):
(WebKit::RemoteScrollingCoordinatorProxy::monotonicTimelinesForProcessForTesting const):
* Source/WebKit/UIProcess/RemoteLayerTree/RemoteScrollingTree.cpp:
(WebKit::RemoteScrollingTree::removeTimelines):
* Source/WebKit/UIProcess/RemoteLayerTree/RemoteScrollingTree.h:
* Source/WebKit/UIProcess/RemoteLayerTree/ios/RemoteScrollingCoordinatorProxyIOS.h:
* Source/WebKit/UIProcess/RemoteLayerTree/ios/RemoteScrollingCoordinatorProxyIOS.mm:
(WebKit::RemoteScrollingCoordinatorProxyIOS::removeTimelines):
(WebKit::RemoteScrollingCoordinatorProxyIOS::monotonicTimelinesForProcessForTesting const):
* Source/WebKit/UIProcess/RemoteLayerTree/mac/RemoteLayerTreeEventDispatcher.h:
* Source/WebKit/UIProcess/RemoteLayerTree/mac/RemoteLayerTreeEventDispatcher.mm:
(WebKit::RemoteLayerTreeEventDispatcher::removeTimelines):
(WebKit::RemoteLayerTreeEventDispatcher::monotonicTimelinesForProcessForTesting const):
* Source/WebKit/UIProcess/RemoteLayerTree/mac/RemoteScrollingCoordinatorProxyMac.h:
* Source/WebKit/UIProcess/RemoteLayerTree/mac/RemoteScrollingCoordinatorProxyMac.mm:
(WebKit::RemoteScrollingCoordinatorProxyMac::removeTimelines):
(WebKit::RemoteScrollingCoordinatorProxyMac::monotonicTimelinesForProcessForTesting const):
* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolation.mm:
(TestWebKitAPI::arrayCountInJSONString):
(TestWebKitAPI::animationCountForLayer):
(TestWebKitAPI::progressBasedTimelineCount):
(TestWebKitAPI::monotonicTimelineCount):
(TestWebKitAPI::TEST(SiteIsolation, RemoteTimelinesAndAnimationsClearedWhenIframeProcessCrashes)):
* Tools/WebKitTestRunner/cocoa/UIScriptControllerCocoa.mm:
(WTR::UIScriptControllerCocoa::animationStackForLayerWithID const):
Canonical link: https://commits.webkit.org/321307@main
Before / after
Loading diff…
On This Page