Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: a93904b9771d104ee1230f7d2ce6e1024b030657
https://github.com/WebKit/WebKit/commit/a93904b9771d104ee1230f7d2ce6e1024b030657
Author: Said Abou-Hallawa <[email protected]>
Date: 2026-06-30 (Tue, 30 Jun 2026)
Changed paths:
M Source/WebCore/svg/SVGGeometryElement.cpp
M Source/WebCore/svg/SVGGeometryElement.h
Log Message:
-----------
Use-after-free in SVGGeometryElement::getPointAtLength — raw renderer pointer
held across nested updateLayout
https://bugs.webkit.org/show_bug.cgi?id=314326
rdar://175670940
Reviewed by Simon Fraser.
Between the call to `updateLayoutIgnorePendingStylesheets()` and the call to
`SVGGeometryElement::getTotalLength()`, `SVGGeometryElement::getPointAtLength()`
caches its renderer() in a raw pointer. The problem is `getTotalLength()` also
calls `updateLayoutIgnorePendingStylesheets()` which may delete the renderer.
This will make `getPointAtLength()` use-after-free the cached raw pointer
renderer.
Rearrange the code such that `updateLayoutIgnorePendingStylesheets()` is called
only once per `getPointAtLength()` and read `this->renderer()` exactly before it
is referenced.
* Source/WebCore/svg/SVGGeometryElement.cpp:
(WebCore::SVGGeometryElement::calculateTotalLength const):
(WebCore::SVGGeometryElement::getTotalLength const):
(WebCore::SVGGeometryElement::calculatePointAtLength const):
(WebCore::SVGGeometryElement::getPointAtLength const):
* Source/WebCore/svg/SVGGeometryElement.h:
Originally-landed-as: 305413.857@safari-7624-branch (d1e59347508c).
rdar://180437982
Canonical link: https://commits.webkit.org/316151@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
