RESOLVED FIXED316154
Fix use-after-free in ~WebProcessProxy() when replying to pending IPC messages 
https://bugs.webkit.org/show_bug.cgi?id=316154
Summary Fix use-after-free in ~WebProcessProxy() when replying to pending IPC messages
zak ridouh
Reported 2026-06-02 18:57:07 PDT
When a WebProcessProxy is torn down while its process is still launching, ~AuxiliaryProcessProxy() calls replyToPendingMessages() after WebProcessProxy's own members have already been destroyed. Those reply handlers (for example the one queued by sendPageCloseMessage()) upgrade a WeakPtr<WebProcessProxy> that is still live, the WeakPtrFactory lives in a base class destroyed later and read freed members such as m_pagesPendingClose, causing a heap-use-after-free. Revoke the WeakPtrFactory at the top of ~WebProcessProxy() so those handlers see a null WeakPtr and bail out before touching destroyed state.
Attachments
Add attachment proposed patch, testcase, etc.
zak ridouh
Comment 1 2026-06-02 18:57:19 PDT
<rdar://178478856>
zak ridouh
Comment 2 2026-06-02 19:06:13 PDT
Pull request: https://github.com/WebKit/WebKit/pull/66318
EWS
Comment 3 2026-06-02 21:23:04 PDT
Committed 314426@main (9d6056753754): <https://commits.webkit.org/314426@main> Reviewed commits have been landed. Closing PR #66318 and removing active labels.
Note You need to log in before you can comment on or make changes to this bug.