← WebKit — 2026-W35
9972b95bf01bb57cb62406e1cbaa769721d560da Harden `SpinButtonElement` by making `SpinButtonOwner` ref-countable
severity low
class UAF
confidence 0.4
signal score 10.97
Source/WebCore/html
Primitive: reentrant free of m_spinButtonOwner during focusAndSelectSpinButtonOwner()
Triage note: Takes RefPtr spinButtonOwner before calling m_spinButtonOwner->focusAndSelectSpinButtonOwner()/spinButtonStepUp() which can run JS, and migrates SpinButtonOwner to AbstractRefCountedAndCanMakeWeakPtr. Reentrancy hardening consistent with the existing protectedThis pattern, but no concrete proven bug in this diff; reads as a SaferCPP-style ref migration.
Triage note: Takes RefPtr spinButtonOwner before calling m_spinButtonOwner->focusAndSelectSpinButtonOwner()/spinButtonStepUp() which can run JS, and migrates SpinButtonOwner to AbstractRefCountedAndCanMakeWeakPtr. Reentrancy hardening consistent with the existing protectedThis pattern, but no concrete proven bug in this diff; reads as a SaferCPP-style ref migration.
Structural signals: smartptr_member_added (+6.47), null_guard (+1.2), area:Source/WebCore/html (+2.0), surgical (+1.3)
Commit message
Harden `SpinButtonElement` by making `SpinButtonOwner` ref-countable
https://bugs.webkit.org/show_bug.cgi?id=322456
rdar://185740189
Reviewed by Chris Dumez.
This makes SpinButtonOwner ref-countable since nothing enforces that
the owner stays alive across its virtual functions.
No new tests since there should be no behavioral changes.
* Source/WebCore/html/shadow/SpinButtonElement.cpp:
(WebCore::SpinButtonElement::defaultEventHandler):
(WebCore::SpinButtonElement::doStepAction):
(WebCore::SpinButtonElement::shouldRespondToMouseEvents const):
* Source/WebCore/html/shadow/SpinButtonElement.h:
Canonical link: https://commits.webkit.org/319792@main
Before / after
Loading diff…
On This Page