Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: ccb3ee3ebe364b5b8df6a7e100ae682496f3c6a7
https://github.com/WebKit/WebKit/commit/ccb3ee3ebe364b5b8df6a7e100ae682496f3c6a7
Author: Chris Dumez <[email protected]>
Date: 2026-06-30 (Tue, 30 Jun 2026)
Changed paths:
A
LayoutTests/http/tests/workers/service/navigate-client-from-service-worker-expected.txt
A
LayoutTests/http/tests/workers/service/navigate-client-from-service-worker.html
A
LayoutTests/http/tests/workers/service/resources/navigate-client-from-service-worker-child.html
A
LayoutTests/http/tests/workers/service/resources/navigate-client-from-service-worker-dest.html
A
LayoutTests/http/tests/workers/service/resources/navigate-client-from-service-worker-target.html
A
LayoutTests/http/tests/workers/service/resources/navigate-client-from-service-worker-worker.js
M Source/WebCore/dom/Document.cpp
Log Message:
-----------
Use-after-free on SecurityOrigin in
NavigationScheduler::scheduleLocationChange
https://bugs.webkit.org/show_bug.cgi?id=313612
rdar://175673312
Reviewed by Ryosuke Niwa and Rupin Mittal.
protect the security origin before passing it to scheduleLocationChange().
The Safer CPP bot was reporting this already but we had not ported
Document.cpp yet.
*
LayoutTests/http/tests/workers/service/navigate-client-from-service-worker-expected.txt:
Added.
*
LayoutTests/http/tests/workers/service/navigate-client-from-service-worker.html:
Added.
*
LayoutTests/http/tests/workers/service/resources/navigate-client-from-service-worker-child.html:
Added.
*
LayoutTests/http/tests/workers/service/resources/navigate-client-from-service-worker-dest.html:
Added.
*
LayoutTests/http/tests/workers/service/resources/navigate-client-from-service-worker-target.html:
Added.
*
LayoutTests/http/tests/workers/service/resources/navigate-client-from-service-worker-worker.js:
Added.
* Source/WebCore/dom/Document.cpp:
(WebCore::Document::navigateFromServiceWorker):
Originally-landed-as: 305413.771@safari-7624-branch (b401d77db3cf).
rdar://180437578
Canonical link: https://commits.webkit.org/316217@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
