← WebKit — 2026-W37
fcef99916e4a378f32ffc98858e691635608ed06 [Safer CPP] Address more warnings in Source/WebKit reported by the newer static analysis
not a security fix
confidence 0.12
signal score 10.22
Source/WTF/
Classified as not security-relevant.
Triage note: Adds a generic protect() template to OSObjectPtr.h and mechanically wraps dozens of unrelated call sites across WTF/WebCore/WebKit in protect()/RefPtr/OSObjectPtr locals, changes PermissionController::query from WeakPtr<Page> to Page* plumbing, and migrates toAPI(x.impl()) to toAPI(x). No single identified memory-safety or logic bug is addressed; this is a broad SaferCPP migration, an explicit false-positive class, with no RC_REMOVE_SEC_ACCEL_3 marker.
This commit was flagged by the signal scorer and reviewed by AI (not a human). It is listed only so the triage is auditable; there is no root-cause analysis because this is not a vulnerability fix.
Triage note: Adds a generic protect() template to OSObjectPtr.h and mechanically wraps dozens of unrelated call sites across WTF/WebCore/WebKit in protect()/RefPtr/OSObjectPtr locals, changes PermissionController::query from WeakPtr<Page> to Page* plumbing, and migrates toAPI(x.impl()) to toAPI(x). No single identified memory-safety or logic bug is addressed; this is a broad SaferCPP migration, an explicit false-positive class, with no RC_REMOVE_SEC_ACCEL_3 marker.
This commit was flagged by the signal scorer and reviewed by AI (not a human). It is listed only so the triage is auditable; there is no root-cause analysis because this is not a vulnerability fix.
Structural signals: smartptr_member_added (+6.47), uaf_lifetime (+4.75), area:Source/WTF/ (+1.0), large_churn (-2.0)
Before / after
Loading diff…
On This Page