Bug CVE-2025-43458) – REGRESSION (macOS 15.4): Eclipse crashes in BackForwardCache::markPagesForContentsSizeChanged

• Component: History
• Status: RESOLVED FIXED

The regression makes eclipse quite unstable on macos 15.4.

System Info:

OS: macOS 15.4 (Sonoma)

Architecture: Apple Silicon (ARM64)

JVM: Eclipse OpenJ9 VM 21.0.6.0 (build openj9-0.49.0, JRE 21 Mac OS X aarch64-64-Bit 20250121_371 (JIT enabled, AOT enabled)

Eclipse: 4.35.0 (Build ID: 4.35.0.20250306-0811)

SWT Library: libswt-pi-cocoa-4968r13.jnilib

System Integrity Protection: Enabled

Crash Summary:

The Eclipse application crashes with a SIGABRT due to EXC_BAD_ACCESS (null pointer dereference) in the main UI thread.

The crash originates in the WebKit engine via the SWT Cocoa integration, specifically in layout management:

WebCore::BackForwardCache::markPagesForContentsSizeChanged
WebCore::LocalFrameView::setContentsSize
...
WebHTMLView layoutToMinimumPageWidth
...
Java_org_eclipse_swt_internal_cocoa_OS_objc_msgSendSuper
Steps to Reproduce:

Launch Eclipse 4.35.0 on macOS 15.4 using an ARM64 JDK.

Interact with the editor window (key, mouse)

Eclipse abruptly terminates with a crash report indicating SIGABRT and JVM abort. (about every 20 min)

Crash Report Snippet:

Exception Type:        EXC_BAD_ACCESS (SIGABRT)
Exception Codes:       KERN_INVALID_ADDRESS at 0x0000000000000000
Termination Reason:    Namespace SIGNAL, Code 6 Abort trap: 6
...
libjvm.dylib           os::abort()
WebCore                markPagesForContentsSizeChanged
WebKitLegacy           -[WebHTMLView layoutToMinimumPageWidth:...]
libswt-pi-cocoa-4968r13 Java_org_eclipse_swt_internal_cocoa_OS_objc_msgSendSuper

Created attachment 474813 [details]
crashreport

https://github.com/eclipse-platform/eclipse.platform.swt/issues/1978

[Phil Beauvoir]

Created attachment 474814 [details]
Crash log

I can confirm this issue:


- Eclipse 2024-12 (4.34) or 2024-06 (4.32)
- OpenJDK 64-Bit Server VM Temurin-21.0.6+7
- macOS 15.4 Sequoia (not crashing on Sonoma 14.7.4)
- WebKit 20621.1.15.11.10
- Mac Mini M4

[Phil Beauvoir]

Steps to reproduce are in:

https://github.com/eclipse-platform/eclipse.platform.swt/issues/1978#issuecomment-2772065032

https://github.com/eclipse-platform/eclipse.platform.swt/issues/1978#issuecomment-2772210044

[Alexey Proskuryakov]

*** Bug 290984 has been marked as a duplicate of this bug. ***

[Radar WebKit Bug Importer]

<rdar://problem/148564650>

[Charlie Wolfe]

Pull request: https://github.com/apple/WebKit/pull/2963

[Phil Beauvoir]

Was there a background update that fixed this?

The crash was still happening after the macOS 15.4.1 release last week, but today I can no longer reproduce the crash however hard I try.

[Phil Beauvoir]

Created attachment 475206 [details]
Crash log in macOS 15.5

Apparently this is fixed in macOS 15.5.

See https://nvd.nist.gov/vuln/detail/CVE-2025-31257
See https://support.apple.com/en-us/122716

However, the crash can still occur in Eclipse if an app's .plist file contains this:

<key>WebKitCacheModelPreferenceKey</key>
<integer>1</integer>

See https://github.com/eclipse-platform/eclipse.platform.swt/issues/1978#issuecomment-2873766402

Crash log attached.

[Michael Catanzaro]

I see it's crashing in WebCore::BackForwardCache::markPagesForContentsSizeChanged both before and after the fix. :(

[Jonathan Bedard]

The fix was landed in https://commits.webkit.org/289651.396@safari-7621-branch. Sounds like the fix maybe didn't work. Following-up with folks.

[Charlie Wolfe]

I haven't been able to reproduce this yet. The code change associated with this bug was a speculative fix for a potential use-after-free that seemed like it could have caused a crash matching this stack trace. If the crash still occurs in macOS 15.5, then apparently that isn’t the case.

[Phil Beauvoir]

In the case of the crash in Eclipse when it uses WebKit to render, the crash occurs when the following key pair is present in Eclipse's *.plist file in ~/Library/Preferences/<appid>.plist:

   <key>WebKitCacheModelPreferenceKey</key>
   <integer>1</integer>

If that is not present the crash does not occur.

[Charlie Wolfe]

(In reply to Phil Beauvoir from comment #13)
> In the case of the crash in Eclipse when it uses WebKit to render, the crash
> occurs when the following key pair is present in Eclipse's *.plist file in
> ~/Library/Preferences/<appid>.plist:
> 
>    <key>WebKitCacheModelPreferenceKey</key>
>    <integer>1</integer>
> 
> If that is not present the crash does not occur.

That preference is enabled. I've been trying to reproduce the crash using the steps provided in the linked GitHub issue for quite some time now, but I haven't been able to. How consistently are you getting this crash? Could you please provide a screen recording showing the exact steps needed to crash Eclipse? You can either attach it here or email it to me at [e-mail].

[Charlie Wolfe]

For now, I’ll land another change that I expect should prevent this crash from happening. Making that change in https://bugs.webkit.org/show_bug.cgi?id=292956

[Phil Beauvoir]

(In reply to Charlie Wolfe from comment #14)
> That preference is enabled. I've been trying to reproduce the crash using
> the steps provided in the linked GitHub issue for quite some time now, but I
> haven't been able to. How consistently are you getting this crash? Could you
> please provide a screen recording showing the exact steps needed to crash
> Eclipse? You can either attach it here or email it to me at
> [e-mail].

Basically it's these steps:

1. Ensure Eclipse's Javadoc View is closed
2. In a Java Editor hover over code so that the Javadoc displays in a popup, and ensure to move the mouse into the Javadoc popup so that it gets focus and scrollbars are shown in the popup.
3. Open the Javadoc View
4. Now click into the Java Editor so that the JavaDoc View is updated. You may need to do this a few times.

I'll work on a screen recording soon.

[Phil Beauvoir]

Created attachment 475219 [details]
Screen Recording of Crash

Attached is a screen recording of the crash. I'm following the steps in my previous comment.

[Robert Jenner]

<rdar://problem/151712931>

[Robert Jenner]

Pull request: https://github.com/WebKit/WebKit/pull/46079

[Charlie Wolfe]

A fix has landed in macOS 15.6 beta 1. Please verify that the crash no longer occurs there.

[Phil Beauvoir]

A user of Eclipse is reporting a crash with 15.6 beta 3:

https://github.com/eclipse-platform/eclipse.platform.swt/issues/1978#issuecomment-3022643158

Date/Time:             2025-07-01 09:46:42.7596 +0200
OS Version:            macOS 15.6 (24G5065c)
Report Version:        12
Anonymous UUID:        8794E885-785D-FE3B-6C3F-4542E188CA41

Sleep/Wake UUID:       E418DA16-58E5-474D-8C94-AC32FF85B5FE

Time Awake Since Boot: 2800 seconds

System Integrity Protection: enabled

Notes:
RIP register does not match crashing frame (0x0 vs 0x7FF89564AAE0)

Crashed Thread:        0  Dispatch queue: com.apple.main-thread

Exception Type:        EXC_BAD_ACCESS (SIGABRT)
Exception Codes:       KERN_INVALID_ADDRESS at 0x0000000000000018
Exception Codes:       0x0000000000000001, 0x0000000000000018

Termination Reason:    Namespace SIGNAL, Code 6 Abort trap: 6
Terminating Process:   eclipse [5002]

VM Region Info: 0x18 is not in any region.  Bytes before following region: 77463528
      REGION TYPE                    START - END         [ VSIZE] PRT/MAX SHRMOD  REGION DETAIL
      UNUSED SPACE AT START
--->  
      __TEXT                        49e0000-49e4000      [   16K] r-x/r-x SM=COW  /Applications/2023-12.app/Contents/MacOS/eclipse

Application Specific Information:
abort() called


Error Formulating Crash Report:
RIP register does not match crashing frame (0x0 vs 0x7FF89564AAE0)

Thread 0 Crashed::  Dispatch queue: com.apple.main-thread
0   ???                           	    0x7ff89564aae0 ???
1   libsystem_kernel.dylib        	    0x7ff808a8e846 __pthread_kill + 10
2   libsystem_pthread.dylib       	    0x7ff808ac9b66 pthread_kill + 259
3   libsystem_c.dylib             	    0x7ff8089e85e6 abort + 126
4   libjvm.dylib                  	         0xcc27a91 os::abort(bool, void*, void const*) + 49
5   libjvm.dylib                  	         0xce7d0ac VMError::report_and_die(int, char const*, char const*, __va_list_tag*, Thread*, unsigned char*, void*, void*, char const*, int, unsigned long) + 2924
6   libjvm.dylib                  	         0xce7c515 VMError::report_and_die(Thread*, unsigned int, unsigned char*, void*, void*, char const*, ...) + 149
7   libjvm.dylib                  	         0xce7d141 VMError::report_and_die(Thread*, unsigned int, unsigned char*, void*, void*) + 33
8   libjvm.dylib                  	         0xcd4496e JVM_handle_bsd_signal + 270
9   libsystem_platform.dylib      	    0x7ff808b0231d _sigtramp + 29
10  CoreFoundation                	    0x7ff808b3e444 CFBasicHashFindBucket + 76
11  ???                           	               0x0 ???
12  WebCore                       	    0x7ff90e53c1ad WebCore::LocalFrameView::setContentsSize(WebCore::IntSize const&) + 381
13  WebCore                       	    0x7ff90e53cb06 WebCore::LocalFrameView::adjustViewSize() + 118
14  WebCore                       	    0x7ff90e559481 WebCore::LocalFrameViewLayoutContext::performLayout(bool) + 3889
15  WebCore                       	    0x7ff90e53f6d2 WebCore::LocalFrameViewLayoutContext::layout(bool) + 50
16  WebKitLegacy                  	    0x7ff8269010b4 -[WebHTMLView layoutToMinimumPageWidth:height:originalPageWidth:originalPageHeight:maximumShrinkRatio:adjustingViewSize:] + 324
17  WebKitLegacy                  	    0x7ff8268fcd82 -[WebDynamicScrollBarsView(WebInternal) updateScrollers] + 130
18  WebCore                       	    0x7ff90d41347b WebCore::ScrollView::platformSetScrollbarModes() + 43
19  WebCore                       	    0x7ff90c17d29e WebCore::ScrollView::setScrollbarModes(WebCore::ScrollbarMode, WebCore::ScrollbarMode, bool, bool) + 206
20  WebCore                       	    0x7ff90e559842 WebCore::LocalFrameViewLayoutContext::performLayout(bool) + 4850
21  WebCore                       	    0x7ff90e53f6d2 WebCore::LocalFrameViewLayoutContext::layout(bool) + 50
22  WebKitLegacy                  	    0x7ff8269010b4 -[WebHTMLView layoutToMinimumPageWidth:height:originalPageWidth:originalPageHeight:maximumShrinkRatio:adjustingViewSize:] + 324
23  WebKitLegacy                  	    0x7ff8268fd283 -[WebDynamicScrollBarsView(WebInternal) updateScrollers] + 1411
24  WebCore                       	    0x7ff90d41347b WebCore::ScrollView::platformSetScrollbarModes() + 43
25  WebCore                       	    0x7ff90c17d29e WebCore::ScrollView::setScrollbarModes(WebCore::ScrollbarMode, WebCore::ScrollbarMode, bool, bool) + 206
26  WebCore                       	    0x7ff90e53aeff WebCore::LocalFrameView::~LocalFrameView() + 95
27  WebCore                       	    0x7ff90e53bcfe WebCore::LocalFrameView::~LocalFrameView() + 14
28  WebCore                       	    0x7ff90c2a057a WebCore::CachedFrame::clear() + 346
29  WebCore                       	    0x7ff90c2a0264 WebCore::CachedFrame::destroy() + 436
30  WebCore                       	    0x7ff90c29ffec WebCore::CachedPage::~CachedPage() + 28
31  WebCore                       	    0x7ff90df8f994 decltype(auto)

[Phil Beauvoir]

Created attachment 476213 [details]
Crash log

This is NOT fixed in 15.6 released today.

Attached is the crash log.

Will this bug be re-opened or do I have to create a new one?

[Phil Beauvoir]

As the request to re-open this bug has been ignored I opened a new one:

https://bugs.webkit.org/show_bug.cgi?id=296693

[Michael Catanzaro]

*** Bug 296693 has been marked as a duplicate of this bug. ***

[Michael Catanzaro]

Reopening.

[Phil Beauvoir]

Does this bug still need to be classed as "Security"? There are Eclipse people on the Eclipse bug (https://github.com/eclipse-platform/eclipse.platform.swt/issues/1978) who would like to comment and or view progress here.

[Charlie Wolfe]

I’ve looked into this further and don’t believe it’s a security issue. I’ll remove the security classification.

[Charlie Wolfe]

rdar://157132323

[Charlie Wolfe]

I still have not been able to reproduce this locally, but I think I see an issue that could be causing it. I’ll upload another speculative fix soon.

[Charlie Wolfe]

Pull request: https://github.com/WebKit/WebKit/pull/50087

[Phil Beauvoir]

(In reply to Charlie Wolfe from comment #27)
> I’ve looked into this further and don’t believe it’s a security issue. I’ll
> remove the security classification.

Thanks!

(In reply to Charlie Wolfe from comment #29)
> I still have not been able to reproduce this locally, but I think I see an
> issue that could be causing it. I’ll upload another speculative fix soon.

Is the screen recording helpful? https://bug-290985-attachments.webkit.org/attachment.cgi?id=475219

[EWS]

Committed 299363@main (3b9e70010b83): <https://commits.webkit.org/299363@main>

Reviewed commits have been landed. Closing PR #50087 and removing active labels.

[Charlie Wolfe]

(In reply to Phil Beauvoir from comment #31)
> Is the screen recording helpful?
> https://bug-290985-attachments.webkit.org/attachment.cgi?id=475219

These are the steps I followed when trying to reproduce, but I wasn't able to.

[Phil Beauvoir]

Hi, as of macOS Sequoia 15.7.1 and maOS Tahoe 26.0.1 the crash is still occurring.

Hello, this issue occurs endlessly, about every 20 minutes, in the following environment.

Spring Tools for Eclipse (Version: 4.32.0.RELEASE / Build ID: 202509051843)
macOS Tahoe 26.0.1 (25A362)

[Phil Beauvoir]

Hi, I tested on macOS 26.1 RC (25B77) and the issue seems to be fixed. Thanks!

[Michael Catanzaro]

This bug report has now received a second CVE, CVE-2025-43458, in addition to the original CVE-2025-31257.

[Phil Beauvoir]

Created attachment 477287 [details]
Crash log on macOS 15.7.2

(In reply to Michael Catanzaro from comment #37)
> This bug report has now received a second CVE, CVE-2025-43458, in addition
> to the original CVE-2025-31257.

When I check on the status of that CVE, reports say "This issue is fixed in Safari 26.1".

I have Safari version 26.1 (20622.2.11.119.1) on macOS 15.7.2 (24G325) and it still crashes (log attached).

[Phil Beauvoir]

> I have Safari version 26.1 (20622.2.11.119.1) on macOS 15.7.2 (24G325) and it still crashes (log attached).


On macOS Tahoe 26.1 (25B78), where this is fixed, it has a different version of Safari - version 26.1 (21622.2.11.11.9)

[Michael Catanzaro]

I'm not familiar with Apple platforms, but WebKit is a system dependency, so I presume the Safari version does not actually matter.

[Phil Beauvoir]

(In reply to Michael Catanzaro from comment #40)
> I'm not familiar with Apple platforms, but WebKit is a system dependency, so I presume the Safari version does not actually matter.

Perhaps the the different Safari versions use different WebKit builds.