← WebKit — 2026-W41
5365d75de10aa8723b53fb051d8ea8e70a28310e Fix unchecked warnings in Source/WebKit after 2026-10-06 rollout
severity low
class UAF
confidence 0.3
signal score 7.67
Source/WebKit/NetworkProcess
Primitive: potential use of unprotected call args / captured raw pointers
Triage note: SaferCPP UncheckedCallArgs/UncountedLambdaCaptures cleanup: blob-URL retain lambda in NetworkConnectionToWebProcess now takes a RefPtr before use, and protect()/Ref wrapping added in RemoteObjectRegistry, BrowsingContextGroup, MemoryFootprintMonitor, WebPageProxy siteIsolatedProcess sends, WebAutomationSessionProxy; defensive lifetime hardening, no concrete attacker-reachable bug in the diff.
Triage note: SaferCPP UncheckedCallArgs/UncountedLambdaCaptures cleanup: blob-URL retain lambda in NetworkConnectionToWebProcess now takes a RefPtr before use, and protect()/Ref wrapping added in RemoteObjectRegistry, BrowsingContextGroup, MemoryFootprintMonitor, WebPageProxy siteIsolatedProcess sends, WebAutomationSessionProxy; defensive lifetime hardening, no concrete attacker-reachable bug in the diff.
Structural signals: smartptr_member_added (+6.47), null_guard (+1.2)
Commit message
Fix unchecked warnings in Source/WebKit after 2026-10-06 rollout
https://bugs.webkit.org/show_bug.cgi?id=327040
Reviewed by Rupin Mittal.
Deployed more smart pointers to fix safer C++ unchecked warnings
(UncheckedCallArgsChecker and UncheckedLocalVarsChecker).
No new tests since there should be no observable behavior changes.
* Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.cpp:
(WebKit::NetworkConnectionToWebProcess::retainBlobURLsWhileMessageIsInFlight):
* Source/WebKit/SaferCPPExpectations/UncheckedCallArgsCheckerExpectations:
* Source/WebKit/SaferCPPExpectations/UncheckedLocalVarsCheckerExpectations:
* Source/WebKit/Shared/API/Cocoa/RemoteObjectRegistry.mm:
(WebKit::RemoteObjectRegistry::send):
* Source/WebKit/UIProcess/BrowsingContextGroup.cpp:
(WebKit::BrowsingContextGroup::addPage):
* Source/WebKit/UIProcess/MemoryFootprintMonitor.cpp:
(WebKit::MemoryFootprintMonitor::measurementTimerFired):
* Source/WebKit/UIProcess/WebPageProxy.cpp:
(WebKit::WebPageProxy::sendWithAsyncReplyToProcessContainingFrame):
(WebKit::WebPageProxy::sendWithAsyncReplyToProcessContainingFrameWithoutDestinationIdentifier):
(WebKit::WebPageProxy::sendToProcessContainingFrame):
(WebKit::WebPageProxy::sendSyncToProcessContainingFrame):
* Source/WebKit/UIProcess/WebPermissionControllerProxy.cpp:
(WebKit::WebPermissionControllerProxy::mostReasonableWebPageProxy const):
* Source/WebKit/WebProcess/Automation/WebAutomationSessionProxy.cpp:
(WebKit::WebAutomationSessionProxy::setFilesForInputFileUpload):
* Source/WebKit/SaferCPPExpectations/UncountedCallArgsCheckerExpectations:
* Source/WebKit/SaferCPPExpectations/UncountedLocalVarsCheckerExpectations:
Canonical link: https://commits.webkit.org/323317@main
Before / after
Loading diff…
On This Page