Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: c5036aadbde48318a52ffe639cb603aaeea8cce7
https://github.com/WebKit/WebKit/commit/c5036aadbde48318a52ffe639cb603aaeea8cce7
Author: Ryosuke Niwa <[email protected]>
Date: 2026-07-01 (Wed, 01 Jul 2026)
Changed paths:
A
LayoutTests/editing/async-clipboard/clipboard-write-item-crash-expected.txt
A LayoutTests/editing/async-clipboard/clipboard-write-item-crash.html
M Source/WebCore/Modules/async-clipboard/ClipboardItemBindingsDataSource.cpp
Log Message:
-----------
Heap use-after-free in ClipboardItemBindingsDataSource::clearItemTypeLoaders()
https://bugs.webkit.org/show_bug.cgi?id=313691
rdar://174651164
Reviewed by Wenson Hsieh.
Avoid the use-after-free by moving the contents of Vector to a local variable.
Test: editing/async-clipboard/clipboard-write-item-crash.html
* LayoutTests/editing/async-clipboard/clipboard-write-item-crash-expected.txt:
Added.
* LayoutTests/editing/async-clipboard/clipboard-write-item-crash.html: Added.
* Source/WebCore/Modules/async-clipboard/ClipboardItemBindingsDataSource.cpp:
(WebCore::ClipboardItemBindingsDataSource::clearItemTypeLoaders):
Originally-landed-as: 305413.812@safari-7624-branch (061b1c5b4012).
rdar://180437605
Canonical link: https://commits.webkit.org/316278@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
