Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: fc4afc4f03fcd3d301ae127f22ae4099c05b5ebc
https://github.com/WebKit/WebKit/commit/fc4afc4f03fcd3d301ae127f22ae4099c05b5ebc
Author: Zak Ridouh <[email protected]>
Date: 2026-07-06 (Mon, 06 Jul 2026)
Changed paths:
A LayoutTests/ipc/nested-display-list-draw-control-part-crash-expected.txt
A LayoutTests/ipc/nested-display-list-draw-control-part-crash.html
M LayoutTests/platform/glib/TestExpectations
M Source/WebCore/platform/graphics/controls/ControlPart.cpp
M Source/WebCore/platform/graphics/controls/ControlPart.h
M Source/WebCore/platform/graphics/displaylists/DisplayListItem.cpp
M Source/WebCore/platform/graphics/displaylists/DisplayListItems.cpp
M Source/WebCore/platform/graphics/displaylists/DisplayListItems.h
Log Message:
-----------
[CoreIPC] [GPUP] Nested DrawDisplayList Replay Falls Back to
ControlFactory::singleton() Leads to Concurrent NSCell UAF
<https://bugs.webkit.org/show_bug.cgi?id=314581>
<rdar://174674075>
Reviewed by Simon Fraser.
DisplayList::applyItem() only special-cases DrawControlPart, so a nested
DrawDisplayList item falls through to item.apply(context) and calls the
single-arg GraphicsContext::drawDisplayList, which substitutes
ControlFactory::singleton(). A compromised WCP can wrap DrawControlPart
items in a nested DrawDisplayList and replay it on multiple
RemoteRenderingBackends, racing the singleton ControlFactoryMac's shared
NSCell state across GPU-process work-queue threads.
Thread ControlFactory through DrawDisplayList::apply() and special-case
DrawDisplayList in applyItem() so nested replay uses the per-context
factory.
* LayoutTests/ipc/nested-display-list-draw-control-part-crash-expected.txt:
Added.
* LayoutTests/ipc/nested-display-list-draw-control-part-crash.html: Added.
* LayoutTests/platform/glib/TestExpectations:
* Source/WebCore/platform/graphics/controls/ControlPart.cpp:
(WebCore::ControlPart::setOverrideControlFactory):
* Source/WebCore/platform/graphics/controls/ControlPart.h:
(WebCore::ControlPart::setOverrideControlFactory): Deleted.
* Source/WebCore/platform/graphics/displaylists/DisplayListItem.cpp:
(WebCore::DisplayList::applyItem):
* Source/WebCore/platform/graphics/displaylists/DisplayListItems.cpp:
(WebCore::DisplayList::DrawDisplayList::apply const):
* Source/WebCore/platform/graphics/displaylists/DisplayListItems.h:
Originally-landed-as: 305413.904@safari-7624-branch (28d3cd063035).
rdar://180437330
Canonical link: https://commits.webkit.org/316592@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
