[26] WKDateTimePicker SetForScope writes to freed self

Severity: Medium | Component: WebKit UIProcess iOS forms | 7b904b1

Rated Medium because the diff fixes a UAF in the UI process: a SetForScope RAII guard tied to _isDismissingDatePicker outlived self when [_datePickerController dismissViewControllerAnimated:NO completion:nil] re-entered runloop work that dropped the last reference to the WKDateTimePicker, then wrote NO into freed memory at scope exit.

Source/WebKit/UIProcess/ios/forms/WKDateTimeInputControl.mm

Use-after-free via RAII scope-guard outliving its enclosing object across an Objective-C re-entrancy boundary.

Three call sites wrapped: removeDatePickerPresentation, plus WKFormPeripheralBase's beginEditing/endEditing for the same controlBeginEditing/controlEndEditing shape. WKDatePickerPopoverController.mm similarly protects a __weak _delegate.

RAII scope guards bound to instance members are a quiet recurring Objective-C++ footgun: C++ enforces RAII destruction order, but Objective-C reference counting doesn't protect the receiver across a synchronous method call. Every SetForScope { self->_member, ... } inside a method that calls into UIKit, delegates, or callback-bearing APIs is a latent UAF unless the receiver is independently retained.

This vulnerability weakens memory safety inside the UI process — more privileged than WebContent and outside the renderer sandbox.

Audit directions

• SetForScope in -[] methods bracketing synchronous Objective-C calls. Grep SetForScope.*_ followed within scope by [_ or [self in Source/WebKit/UIProcess/ios/. Verify receiver is protect(...)-retained or held by local RetainPtr.
• Synchronous UIKit calls invoked from IPC handlers. Audit dismissViewController, endEditing:, resignFirstResponder, removeFromSuperview on member ivars without protect(...) in sibling form-peripheral classes (WKFormSelectControl, WKFormColorControl, WKFormInputSession).
• __weak ivars dereferenced multiple times in one method. Each access is an independent load that can race with dealloc.
• Stack-allocated RAII whose destructor depends on self. Check TemporaryChange, makeScopeExit([this]{...}), and any captured-this cleanup inside Objective-C methods.