311493 2026-04-04 12:16:24 -0700 Crash due to nullptr deref in WebCore::SQLiteIDBBackingStore::openCursor() via infoForObjectStore() 2026-04-05 18:23:08 -0700 1 1 1 Unclassified WebKit Website Storage WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED https://bugs.webkit.org/show_bug.cgi?id=209976 https://bugs.webkit.org/show_bug.cgi?id=242257 https://bugs.webkit.org/show_bug.cgi?id=270137 InRadar P2 Normal --- 1 ddkilzer ddkilzer sihui_liu webkit-bug-importer oldest_to_newest 2196902 0 ddkilzer 2026-04-04 12:16:24 -0700 `WebCore::SQLiteIDBBackingStore::openCursor()` crashes due to a nullptr dereference when `infoForObjectStore()` returns nullptr because `m_databaseInfo->m_objectStoreMap` is empty. The function calls `infoForObjectStore()`, which can return nullptr when the object store identifier is not found in the HashMap. The return value is guarded only by `ASSERT(objectStoreInfo)` -- a no-op in release builds -- and then unconditionally dereferenced via `objectStoreInfo->keyPath()`. The unconditional dereference is undefined behavior (UB) with nullptr. The compiler backward-propagates from the UB to eliminate all nullptr checks in the entire inlined `HashMap::find()` chain, including the internal `if (!m_table)` check in `HashTable::inlineLookup()`. This causes the crash to manifest as a read from address 0xfffffffffffffff8 (null minus 8 bytes) inside `tableSizeMask()`. The same pattern (Debug ASSERT without a nullptr check) also exists in `getIndexRecord()`, `uncheckedGetIndexRecordForOneKey()`, and `iterateCursor()`. Four other call sites in the same file (`getRecord()`, `getAllObjectStoreRecords()`, `getAllIndexRecords()`, `addIndex()`) already properly check for nullptr. Stack trace: 0 WebCore: WTF::HashTable::tableSizeMask 1 WebCore: WTF::HashTable::inlineLookup 2 WebCore: WTF::HashTable::find 3 WebCore: WTF::HashMap::find 4 WebCore: WebCore::IDBDatabaseInfo::getInfoForExistingObjectStore 5 WebCore: WebCore::IDBServer::SQLiteIDBBackingStore::infoForObjectStore 6 WebCore: WebCore::IDBServer::SQLiteIDBBackingStore::openCursor 7 WebCore: WebCore::IDBServer::UniqueIDBDatabase::performOpenCursor [...] 2196903 1 ddkilzer 2026-04-04 12:16:26 -0700 <rdar://problem/168962352> 2197096 2 ddkilzer 2026-04-05 14:19:16 -0700 Pull request: https://github.com/WebKit/WebKit/pull/62088 2197128 3 ews-feeder 2026-04-05 18:23:06 -0700 Committed 310618@main (acf3ca6f197b): <https://commits.webkit.org/310618@main> Reviewed commits have been landed. Closing PR #62088 and removing active labels.