Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 1d46772984f6a2857ade7cd1e2e93d04ab37780f
https://github.com/WebKit/WebKit/commit/1d46772984f6a2857ade7cd1e2e93d04ab37780f
Author: Dan Glastonbury <[email protected]>
Date: 2026-06-30 (Tue, 30 Jun 2026)
Changed paths:
A LayoutTests/webxr/xr-session-end-after-cross-realm-system-gc-expected.txt
A LayoutTests/webxr/xr-session-end-after-cross-realm-system-gc.html
Log Message:
-----------
[WebXR] Use-after-free when ending an XRSession whose owning WebXRSystem has
been garbage collected
rdar://175674872
Reviewed by REVIEWER.
WebXRSession held a raw reference (WebXRSystem&) to its owning WebXRSystem.
When a session's wrapper lives in one realm but the XRSystem belongs to a
cross-realm iframe (e.g. via XRSystem.prototype.requestSession.call(childXR,
...)),
destroying the iframe can collect the child realm's JSDOMWindow / Navigator /
WebXRSystem while the parent-realm XRSession is still alive. Calling
session.end() then dereferences the stale pointer in shutdown() when it calls
m_xrSystem.sessionEnded(*this).
Fix by changing m_xrSystem from a raw reference to a
WeakPtr<WebXRSystem, WeakPtrImplWithEventTargetData> and guarding the
sessionEnded() call with a null check.
Test: webxr/xr-session-end-after-cross-realm-system-gc.html
* LayoutTests/webxr/xr-session-end-after-cross-realm-system-gc-expected.txt:
Added.
Originally-landed-as: 305413.844@safari-7624-branch (99867d817a6d).
rdar://180436711
* LayoutTests/webxr/xr-session-end-after-cross-realm-system-gc.html: Added.
Canonical link: https://commits.webkit.org/316209@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
