Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 8fd92b1021d310b2580eb3ac7913911eb14dc476
https://github.com/WebKit/WebKit/commit/8fd92b1021d310b2580eb3ac7913911eb14dc476
Author: Chris Dumez <[email protected]>
Date: 2026-06-30 (Tue, 30 Jun 2026)
Changed paths:
A LayoutTests/streams/transform-stream-poisoned-iterator-crash-expected.txt
A LayoutTests/streams/transform-stream-poisoned-iterator-crash.html
M Source/WebCore/Modules/streams/TransformStream.cpp
Log Message:
-----------
[WebCore] TransformStream type confusion when
Array.prototype[Symbol.iterator] is overridden
https://bugs.webkit.org/show_bug.cgi?id=314528
rdar://176568667
Reviewed by Ryosuke Niwa.
createInternalTransformStream invokes the
createInternalTransformStreamFromTransformer
builtin and converts its result via convert<IDLSequence<IDLObject>>, which uses
the JS iteration protocol. If a page overrides Array.prototype[Symbol.iterator],
it can substitute arbitrary objects for the readable/writable entries the
builtin would otherwise return. The only guard was ASSERT(results.size() == 3),
which is a no-op in release, after which jsDynamicCast<JSReadableStream*> /
jsDynamicCast<JSWritableStream*> were dereferenced unconditionally — turning a
non-matching object into a controlled type confusion (controlled deref via
m_wrapped, write-increment via Ref<>::ref(), and a vtable call on attacker
data when JS later touches .readable / .writable).
Replace the ASSERT with a runtime size check, null-check the jsDynamicCast
results, and throw a TypeError on either failure.
Test: streams/transform-stream-poisoned-iterator-crash.html
* LayoutTests/streams/transform-stream-poisoned-iterator-crash-expected.txt:
Added.
* LayoutTests/streams/transform-stream-poisoned-iterator-crash.html: Added.
* Source/WebCore/Modules/streams/TransformStream.cpp:
(WebCore::createInternalTransformStream):
Originally-landed-as: 305413.875@safari-7624-branch (cb2c361c977a).
rdar://180436852
Canonical link: https://commits.webkit.org/316203@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
