← WebKit — 2026-W41
37be53d3c310a06934b74614e41c0ef4ea6d07ca Fix lambda capture warnings in Source/WebCore after 2026-10-06 rollout
severity low
class UAF
confidence 0.3
signal score 15.02
Source/WebCore/Modules/mediastream
Primitive: potential UAF from raw `this` captured in async callbacks
Triage note: SaferCPP cleanup converting raw this captures to WeakPtr/ThreadSafeWeakPtr/pendingActivity guards (RTCDTMFSender::onTonePlayed, AudioContext postTask, Page m_lowPowerModeNotifier, LocalSampleBufferDisplayLayer/MediaPlayerPrivateWebM callbacks) and clearing checker expectations; defensive lifetime hardening, no concrete attacker-reachable bug demonstrated in the diff.
Triage note: SaferCPP cleanup converting raw this captures to WeakPtr/ThreadSafeWeakPtr/pendingActivity guards (RTCDTMFSender::onTonePlayed, AudioContext postTask, Page m_lowPowerModeNotifier, LocalSampleBufferDisplayLayer/MediaPlayerPrivateWebM callbacks) and clearing checker expectations; defensive lifetime hardening, no concrete attacker-reachable bug demonstrated in the diff.
Structural signals: smartptr_member_added (+6.47), uaf_lifetime (+4.75), clamp_saturate (+1.8), area:Source/WebCore/Modules/mediastream (+2.0)
Commit message
Fix lambda capture warnings in Source/WebCore after 2026-10-06 rollout
https://bugs.webkit.org/show_bug.cgi?id=327117
Reviewed by Anne van Kesteren.
Fixed new safer C++ static analyzer warnings for UncountedLambdaCapturesChecker
and UncheckedLambdaCapturesChecker in Source/WebCore.
No new tests since there should be no behavioral changes.
* Source/WebCore/Modules/mediastream/RTCDTMFSender.cpp:
(WebCore::RTCDTMFSender::RTCDTMFSender):
* Source/WebCore/Modules/webaudio/AudioContext.cpp:
(WebCore::AudioContext::AudioContext):
* Source/WebCore/SaferCPPExpectations/UncheckedLambdaCapturesCheckerExpectations:
* Source/WebCore/SaferCPPExpectations/UncountedLambdaCapturesCheckerExpectations:
* Source/WebCore/dom/Document.cpp:
(WebCore::Document::Document):
(WebCore::Document::styleRecalcTimerFired):
* Source/WebCore/dom/Document.h:
* Source/WebCore/page/OpportunisticTaskScheduler.cpp:
(WebCore::OpportunisticTaskScheduler::FullGCActivityCallback::FullGCActivityCallback):
(WebCore::OpportunisticTaskScheduler::FullGCActivityCallback::createRunLoopObserver):
(WebCore::OpportunisticTaskScheduler::EdenGCActivityCallback::EdenGCActivityCallback):
(WebCore::OpportunisticTaskScheduler::EdenGCActivityCallback::createRunLoopObserver):
* Source/WebCore/page/OpportunisticTaskScheduler.h:
* Source/WebCore/page/Page.cpp:
(WebCore::Page::Page):
* Source/WebCore/platform/audio/AudioDestinationResampler.cpp:
(WebCore::m_fifo):
* Source/WebCore/platform/graphics/avfoundation/objc/LocalSampleBufferDisplayLayer.mm:
(WebCore::LocalSampleBufferDisplayLayer::LocalSampleBufferDisplayLayer):
* Source/WebCore/platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaStreamAVFObjC.mm:
(WebCore::m_videoLayerManager):
* Source/WebCore/platform/graphics/cocoa/MediaPlayerPrivateWebM.mm:
(WebCore::MediaPlayerPrivateWebM::MediaPlayerPrivateWebM):
* Source/WebCore/platform/mediastream/RealtimeIncomingVideoSource.cpp:
(WebCore::m_videoTrack):
* Source/WebCore/rendering/BorderPainter.cpp:
(WebCore::BorderPainter::drawLineForBoxSide):
* Source/WebCore/rendering/RenderGrid.cpp:
* Source/WebCore/rendering/RenderListBox.cpp:
(WebCore::RenderListBox::updateFromElement):
Canonical link: https://commits.webkit.org/323389@main
Before / after
Loading diff…
On This Page