PatchGap
← WebKit — 2026-W35

b0d927d67567bd5d7c7da14695ced80ad287c3e9  REGRESSION(316606.145@safari-7625-branch): UI process crash under DisplayLink callbacks for RemoteLayerTree DisplayLink clients

severity low class UAF confidence 0.4 signal score 6.5 Source/WebKit/UIProcess
view commit ↗
Primitive: call into possibly-null/cleared m_momentumEventDispatcher from display-link callback
Triage note: Guards startOrStopDisplayLink() behind assertIsHeld(m_momentumEventDispatcherLock) and an if (m_momentumEventDispatcher) null check in the display-link-fired path. Prevents acting on a torn-down momentum dispatcher; small defensive null/lifetime guard, no demonstrated attacker reach.
Structural signals: null_guard (+1.2), msg_strong (+3.0), msg_soft (+1.0), surgical (+1.3)

Commit message

REGRESSION(316606.145@safari-7625-branch): UI process crash under DisplayLink callbacks for RemoteLayerTree DisplayLink clients
rdar://183949932

Reviewed by Charlie Wolfe.

The UI process crashes on the CVDisplayLink thread in when calling
displayLinkFired() on a DisplayLink::Client that was freed while still
registered. Two independent teardown paths can leave a client registered
at destruction. These are:

1. A client would not be removed if existingDisplayLink() returned null,
  this was fixed in 314099@main.

2. More importantly, 316606.145@safari-7625-branch dropped the if (mED)
  guard around startOrStopDisplayLink() when stopping the
  displayDidRefresh callbacks. That method is re-entered during teardown
  since invalidate() destroys mED and its destructor calls back through
  into stopDisplayDidRefreshCallbacks(). Without the guard,
  startOrStopDisplayLink() re-adds the DisplayLink client that
  invalidate() just removed via removeDisplayLinkClient(). The client is
  then freed, so the next display refresh invokes displayLinkFired() on
  a freed client, producing a UAF.

In this patch, we fix the latter by re-introducing the if (mED) guard
dropped in the regressing commit.

* Source/WebKit/UIProcess/RemoteLayerTree/mac/RemoteLayerTreeEventDispatcher.mm:
(WebKit::RemoteLayerTreeEventDispatcher::stopDisplayDidRefreshCallbacks):

Originally-landed-as: 7a268c48ba0a. rdar://185365990
Canonical link: https://commits.webkit.org/320097@main

Before / after

Loading diff…
On This Page