Bug 241162 - WeakHashMap::ensure() may crash if the map contains null references
Summary: WeakHashMap::ensure() may crash if the map contains null references
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: Web Template Framework (show other bugs)
Version: WebKit Nightly Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Chris Dumez
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2022-05-31 16:30 PDT by Chris Dumez
Modified: 2022-06-01 10:00 PDT (History)
1 user (show)

See Also:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Chris Dumez 2022-05-31 16:30:23 PDT 
WeakHashMap::ensure() may crash if the map contains null references, because the WeakHashMap iterator destructor can clear null references and the AddResult constructor copies and destroys the input iterator.
Comment 1 Chris Dumez 2022-05-31 16:43:18 PDT 
Pull request: https://github.com/WebKit/WebKit/pull/1196
Comment 2 EWS 2022-06-01 09:59:30 PDT 
Committed r295092 (251187@main): <https://commits.webkit.org/251187@main>

Reviewed commits have been landed. Closing PR #1196 and removing active labels.
Comment 3 Radar WebKit Bug Importer 2022-06-01 10:00:14 PDT 
<rdar://problem/94229617>