[7] WTF Vector growImpl Release Assert Hardening

Severity: Medium | Component: WTF Vector | 3b05441

Rated Medium because the observable effect in release builds is silent invariant violation (size regression in a foundational container) that could lead to OOB access or stale-data exposure, but there is no commit-backed evidence of a specific caller that actually triggers the regression — the upgrade is a hardening measure, not a targeted bug fix.

Patch Details

Upgrades a debug-only assertion in Vector::growImpl from ASSERT_WITH_SECURITY_IMPLICATION to RELEASE_ASSERT_WITH_SECURITY_IMPLICATION. The assertion checks that the requested new size parameter is ≥ the current m_size.

Source/WTF/wtf/Vector.h

Security-critical invariant enforced only in debug builds, leaving release builds unprotected against caller-supplied size regression in a foundational container.

Background

WTF::Vector is WebKit's primary dynamic array, used throughout all WebKit processes. growImpl is the internal method backing grow() operations — it adjusts the vector's logical size and expands capacity if needed. ASSERT_WITH_SECURITY_IMPLICATION is a debug-only assertion compiled out in release builds. RELEASE_ASSERT_WITH_SECURITY_IMPLICATION is its release-build counterpart that triggers a controlled process termination in all configurations.

Analysis

In release builds, the size >= m_size invariant was not enforced. If any caller of grow() passed a size smaller than the vector's current m_size, the vector's logical size would shrink without destructing elements between the new and old sizes, and subsequent operations would operate on a vector whose m_size was decreased but whose backing store still contained stale objects. Depending on element type and usage, this could expose stale data, corrupt vector bookkeeping, or cause out-of-bounds access when later code assumes monotonic growth.

Audit directions