Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: ffe2ea6689b543ec54a86570650be46c723f309d
https://github.com/WebKit/WebKit/commit/ffe2ea6689b543ec54a86570650be46c723f309d
Author: Abrar Rahman Protyasha <[email protected]>
Date: 2026-07-01 (Wed, 01 Jul 2026)
Changed paths:
A LayoutTests/ipc/pointer-lock-double-lock-uaf-expected.txt
A LayoutTests/ipc/pointer-lock-double-lock-uaf.html
M LayoutTests/platform/wk2/TestExpectations
M Source/WebKit/UIProcess/WebPageProxy.cpp
M Source/WebKit/UIProcess/ios/WKMouseInteraction.mm
M Tools/WebKitTestRunner/Configurations/WebKitTestRunnerApp.xcconfig
M Tools/WebKitTestRunner/TestController.h
M Tools/WebKitTestRunner/ios/TestControllerIOS.mm
Log Message:
-----------
REGRESSION(298821@main): [iOS] RequestPointerLock IPC twice in succession can
produce use-after-free of unretained GCMouseMoved block in WKMouseInteraction
rdar://175672657
Reviewed by Wenson Hsieh.
In 298821@main, we taught WKMouseInteraction to copy the
mouseMovedHandler block from the current GCMouse. However, since
WKMouseInteraction does not have ARC, the bare copy did not increase the
retain count of the block in question. Given we set a new block
immediately afterwards, the block we had just copied is released.
On a second RequestPointerLock IPC, the original mouseMovedHandler block
points to freed memory from the earlier IPC dance, and we end up with a
use-after-free.
To address this issue, we change the bare GCMouseMoved instance held on
by WKMouseInteraction to a BlockPtr. This ensures that the handler is
retained across the setter. Also, we add a pointerLockState.isActive gate
at the start of -beginPointerLockMouseTracking, so successive pointer
lock IPC messages would not be able to read a mouseMovedHandler block
from a previous lock regardless. Finally, we promote our UI process
m_isPointerLocked debug assertions into MESSAGE_CHECK invariants, which
would surface issues more readily in non-debug configurations (and,
importantly, without leading to a use-after-free in the process).
Test: ipc/pointer-lock-double-lock-uaf.html
* LayoutTests/ipc/pointer-lock-double-lock-uaf-expected.txt: Added.
* LayoutTests/ipc/pointer-lock-double-lock-uaf.html: Added.
* LayoutTests/platform/wk2/TestExpectations:
* Source/WebKit/UIProcess/WebPageProxy.cpp:
(WebKit::WebPageProxy::requestPointerLock):
(WebKit::WebPageProxy::didAllowPointerLock):
(WebKit::WebPageProxy::didDenyPointerLock):
* Source/WebKit/UIProcess/ios/WKMouseInteraction.mm:
(-[WKMouseInteraction beginPointerLockMouseTracking]):
(-[WKMouseInteraction endPointerLockMouseTracking]):
(-[WKMouseInteraction _setupMouseMovedHandlerForMouse:]):
* Tools/WebKitTestRunner/Configurations/WebKitTestRunnerApp.xcconfig:
* Tools/WebKitTestRunner/TestController.h:
* Tools/WebKitTestRunner/ios/TestControllerIOS.mm:
(WTR::FakeMouseDevice::FakeMouseDevice):
(WTR::FakeMouseDevice::~FakeMouseDevice):
(WTR::TestController::platformResetStateToConsistentValues):
(WTR::TestController::setHasMouseDeviceForTesting):
Enhance TestRunner.setHasMouseDeviceForTesting() to also swizzle a
fake GCMouse instance for testing, so that the system thinks an
external mouse input device is connected. This matches TWKAPI's
pointer lock test capabilities, and allows pointer lock tests to
get past the GCMouse gate in -beginPointerLockMouseTracking.
Originally-landed-as: 305413.755@safari-7624-branch (3927a3556654).
rdar://181074364
Canonical link: https://commits.webkit.org/316240@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
