Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 0bab5af95da144b45e240675e21391b3f5518a30
https://github.com/WebKit/WebKit/commit/0bab5af95da144b45e240675e21391b3f5518a30
Author: Chris Dumez <[email protected]>
Date: 2026-08-12 (Wed, 12 Aug 2026)
Changed paths:
A
LayoutTests/fast/shadow-dom/manual-slot-assign-renderer-teardown-crash-expected.txt
A
LayoutTests/fast/shadow-dom/manual-slot-assign-renderer-teardown-crash.html
M Source/WebCore/dom/SlotAssignment.cpp
Log Message:
-----------
UAF in ManualSlotAssignment via WeakHashMap rehash during reentrant
composed-tree teardown
https://bugs.webkit.org/show_bug.cgi?id=REDACTED
rdar://179729192
Reviewed by Anne van Kesteren.
ManualSlotAssignment::slotManualAssignmentDidChange computed effectiveCurrent
by calling assignedNodesForSlot, which returns a raw pointer to the
cachedAssignment Vector inside a Slot value stored directly in the m_slots
WeakHashMap bucket array. It then called
RenderTreeUpdater::tearDownRenderersAfterSlotChange, whose composed-tree
traversal can call HTMLSlotElement::assignedNodes on a sibling slot and
re-enter ManualSlotAssignment::assignedNodesForSlot. The reentrant
m_slots.ensure call may invoke the WeakHashMap amortized cleanup, sweep
null-keyed entries left by previously inserted, removed and GC-collected slot
elements, and rehash the table, freeing the bucket array effectiveCurrent
points into. The stale pointer was then dereferenced in
scheduleSlotChangeEventIfNeeded.
Compute effectiveCurrent as a local Vector via effectiveAssignedNodes,
mirroring effectivePrevious, so no pointer into m_slots is held across the
render-tree teardown.
*
LayoutTests/fast/shadow-dom/manual-slot-assign-renderer-teardown-crash-expected.txt:
Added.
* LayoutTests/fast/shadow-dom/manual-slot-assign-renderer-teardown-crash.html:
Added.
* Source/WebCore/dom/SlotAssignment.cpp:
(WebCore::ManualSlotAssignment::slotManualAssignmentDidChange):
Originally-landed-as: [email protected] (ddc8b3fae09f).
rdar://184744200
Canonical link: https://commits.webkit.org/319089@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
