|
 |
f1679e |
From 85fd2302d16a09a82d9a6e81eb286babb23c4b3c Mon Sep 17 00:00:00 2001
|
|
|
f1679e |
From: Antoine Quint <graouts@webkit.org>
|
|
|
f1679e |
Date: Mon, 22 May 2023 13:37:32 -0700
|
|
|
f1679e |
Subject: [PATCH] Potential use-after-free in WebAnimation::commitStyles
|
|
|
f1679e |
https://bugs.webkit.org/show_bug.cgi?id=254840 rdar://107444873
|
|
|
f1679e |
|
|
|
f1679e |
Reviewed by Dean Jackson and Darin Adler.
|
|
|
f1679e |
|
|
|
f1679e |
Ensure that the animation's effect and target are kept alive for the duration of this method
|
|
|
f1679e |
since it is possible that calling updateStyleIfNeeded() could call into JavaScript and thus
|
|
|
f1679e |
these two pointers could be changed to a null value using the Web Animations API.
|
|
|
f1679e |
|
|
|
f1679e |
* Source/WebCore/animation/WebAnimation.cpp:
|
|
|
f1679e |
(WebCore::WebAnimation::commitStyles):
|
|
|
f1679e |
|
|
|
f1679e |
Originally-landed-as: 259548.532@safari-7615-branch (1d6fe184ea53). rdar://107444873
|
|
|
f1679e |
Canonical link: https://commits.webkit.org/264363@main
|
|
|
f1679e |
---
|
|
|
f1679e |
Source/WebCore/animation/WebAnimation.cpp | 4 ++--
|
|
|
f1679e |
1 file changed, 2 insertions(+), 2 deletions(-)
|
|
|
f1679e |
|
|
|
f1679e |
diff --git a/Source/WebCore/animation/WebAnimation.cpp b/Source/WebCore/animation/WebAnimation.cpp
|
|
|
f1679e |
index 68ea47985807..ae20c79c36cf 100644
|
|
|
f1679e |
--- a/Source/WebCore/animation/WebAnimation.cpp
|
|
|
f1679e |
+++ b/Source/WebCore/animation/WebAnimation.cpp
|
|
|
f1679e |
@@ -1531,8 +1531,8 @@ ExceptionOr<void> WebAnimation::commitStyles()
|
|
|
f1679e |
// https://drafts.csswg.org/web-animations-1/#commit-computed-styles
|
|
|
f1679e |
|
|
|
f1679e |
// 1. Let targets be the set of all effect targets for animation effects associated with animation.
|
|
|
f1679e |
- auto* effect = dynamicDowncast<KeyframeEffect>(m_effect.get());
|
|
|
f1679e |
- auto* target = effect ? effect->target() : nullptr;
|
|
|
f1679e |
+ RefPtr effect = dynamicDowncast<KeyframeEffect>(m_effect.get());
|
|
|
f1679e |
+ RefPtr target = effect ? effect->target() : nullptr;
|
|
|
f1679e |
|
|
|
f1679e |
// 2. For each target in targets:
|
|
|
f1679e |
//
|