Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 44540933ff90a0494bb2130b5cfcdb04e1d91ef8
https://github.com/WebKit/WebKit/commit/44540933ff90a0494bb2130b5cfcdb04e1d91ef8
Author: Timothy Hatcher <[email protected]>
Date: 2026-06-30 (Tue, 30 Jun 2026)
Changed paths:
M
Source/WebKit/UIProcess/Extensions/Cocoa/API/WebExtensionContextAPIRuntimeCocoa.mm
M
Source/WebKit/UIProcess/Extensions/Cocoa/API/WebExtensionContextAPITabsCocoa.mm
Log Message:
-----------
Cherry-pick 343f135c4791. rdar://175672573
Web Extensions: stack-use-after-return of &handledCount in
WebExtensionContext async-reply lambdas.
https://webkit.org/b/313465
rdar://175672573
Reviewed by Brian Weinstein.
Fix use-after-return of handledCount in runtimeConnect,
runtimeWebPageConnect, and tabsConnect. The stack-local
counter was captured by reference into async-reply lambdas that execute
after the enclosing frame returns.
Use Box<size_t> to heap-allocate the shared counter instead.
*
Source/WebKit/UIProcess/Extensions/Cocoa/API/WebExtensionContextAPIRuntimeCocoa.mm:
(WebKit::WebExtensionContext::runtimeConnect):
(WebKit::WebExtensionContext::runtimeWebPageConnect):
*
Source/WebKit/UIProcess/Extensions/Cocoa/API/WebExtensionContextAPITabsCocoa.mm:
(WebKit::WebExtensionContext::tabsConnect):
Identifier: 305413.749@safari-7624-branch
Originally-landed-as: [email protected] (634df48e0742).
rdar://180435539
Canonical link: https://commits.webkit.org/316176@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
