← WebKit — 2026-W35
a7c0b0f9062b64c36bba6b192ab725c010990afb Harden `DateTimeFieldElement` by making `DateTimeFieldElementFieldOwner` ref-countable
severity low
class UAF
confidence 0.4
signal score 8.47
Source/WebCore/html
Primitive: reentrant free of m_fieldOwner during focusOnNextField/didBlurFromField
Triage note: Takes RefPtr fieldOwner before each m_fieldOwner call and migrates DateTimeFieldElementFieldOwner to AbstractRefCountedAndCanMakeWeakPtr with ref()/deref() overrides on DateTimeEditElement. Reentrancy hardening (owner can be detached during event handling) but a SaferCPP-style ref migration with no concrete bug identified in the diff.
Triage note: Takes RefPtr fieldOwner before each m_fieldOwner call and migrates DateTimeFieldElementFieldOwner to AbstractRefCountedAndCanMakeWeakPtr with ref()/deref() overrides on DateTimeEditElement. Reentrancy hardening (owner can be detached during event handling) but a SaferCPP-style ref migration with no concrete bug identified in the diff.
Structural signals: smartptr_member_added (+6.47), area:Source/WebCore/html (+2.0)
Commit message
Harden `DateTimeFieldElement` by making `DateTimeFieldElementFieldOwner` ref-countable
https://bugs.webkit.org/show_bug.cgi?id=322668
rdar://185940168
Reviewed by Chris Dumez.
This makes `DateTimeFieldElementFieldOwner` ref-countable since nothing enforces
that the owner stays alive across its virtual functions.
No new tests since there should be no behavioral changes.
* Source/WebCore/html/shadow/DateTimeEditElement.h:
* Source/WebCore/html/shadow/DateTimeFieldElement.cpp:
(WebCore::DateTimeFieldElement::defaultKeyboardEventHandler):
(WebCore::DateTimeFieldElement::isFieldOwnerDisabled const):
(WebCore::DateTimeFieldElement::isFieldOwnerReadOnly const):
(WebCore::DateTimeFieldElement::isFieldOwnerHorizontal const):
(WebCore::DateTimeFieldElement::handleBlurEvent):
(WebCore::DateTimeFieldElement::localeIdentifier const):
(WebCore::DateTimeFieldElement::updateVisibleValue):
(WebCore::DateTimeFieldElement::transferredFocusToPicker const):
(WebCore::DateTimeFieldElement::didSuppressBlurDueToPickerFocusTransfer):
* Source/WebCore/html/shadow/DateTimeFieldElement.h:
Canonical link: https://commits.webkit.org/319982@main
Before / after
Loading diff…
On This Page