← WebKit — 2026-W41
7de1b0baff8fc5e2e40b3421f2e879ea0bfd5a35 Fix safer C++ warnings in RemoteLayerTreeDrawingArea.mm and GeneratedWebKitSecureCoding.mm
severity medium
class UAF
confidence 0.5
signal score 9.75
Source/WebKit/Scripts
patch-now
Primitive: use-after-free via raw 'this' captured in PostRenderingUpdate RunLoopObserver
Triage note: RemoteLayerTreeDrawingArea's PostRenderingUpdate RunLoopObserver callback is changed from capturing raw [this] to [weakThis = WeakPtr { *this }] with a RefPtr null-check before calling postRenderingUpdateRunLoopCallback(), removing a potential use-after-free if the observer fires around drawing-area teardown. (The rest of the commit is a static-analyzer SUPPRESS_UNRETAINED_LOCAL suppression in generate-serializers.py.)
Triage note: RemoteLayerTreeDrawingArea's PostRenderingUpdate RunLoopObserver callback is changed from capturing raw [this] to [weakThis = WeakPtr { *this }] with a RefPtr null-check before calling postRenderingUpdateRunLoopCallback(), removing a potential use-after-free if the observer fires around drawing-area teardown. (The rest of the commit is a static-analyzer SUPPRESS_UNRETAINED_LOCAL suppression in generate-serializers.py.)
Structural signals: smartptr_member_added (+4.87), uaf_lifetime (+3.57), surgical (+1.3)
Commit message
Fix safer C++ warnings in RemoteLayerTreeDrawingArea.mm and GeneratedWebKitSecureCoding.mm
https://bugs.webkit.org/show_bug.cgi?id=327111
Reviewed by Alan Baradlay.
Fix two outstanding safer C++ static analyzer warnings.
No new tests since there should be no behavioral changes.
* Source/WebKit/Scripts/generate-serializers.py:
(generate_webkit_secure_coding_impl):
* Source/WebKit/Scripts/webkit/tests/GeneratedWebKitSecureCoding.cpp:
(WebKit::vectorFromArray):
* Source/WebKit/WebProcess/WebPage/RemoteLayerTree/RemoteLayerTreeDrawingArea.mm:
(WebKit::RemoteLayerTreeDrawingArea::RemoteLayerTreeDrawingArea):
Canonical link: https://commits.webkit.org/323362@main
Before / after
Loading diff…
On This Page