[23] XMLHttpRequest GC-thread UAF on m_responseDocument

Severity: Medium | Component: WebCore XMLHttpRequest bindings | a814080

Rated Medium because the diff fixes a cross-thread race where the JSC GC marking thread dereferenced m_responseDocument without synchronization while the main thread could null it via responseXML()/clearResponseBuffers().

JSXMLHttpRequest::visitAdditionalChildrenInGCThread read wrapped().optionalResponseXML() and optionalUpload() with no synchronization while the main thread could perform m_responseDocument = nullptr; — a RefPtr reassignment that drops the previous ref.

Source/WebCore/xml/XMLHttpRequest.h

+    Lock m_gcLock;
+    const std::unique_ptr<XMLHttpRequestUpload> m_upload WTF_GUARDED_BY_LOCK(m_gcLock);
-    RefPtr<Document> m_responseDocument;
+    RefPtr<Document> m_responseDocument WTF_GUARDED_BY_LOCK(m_gcLock);

+template<typename Visitor>
+void XMLHttpRequest::visitAdditionalChildrenInGCThread(Visitor& visitor)
+{
+    Locker locker { m_gcLock };
+    if (m_upload)
+        addWebCoreOpaqueRoot(visitor, *m_upload);
+    if (auto* document = m_responseDocument.get())
+        addWebCoreOpaqueRoot(visitor, *document);
+}

Unsynchronized GC-thread read of refcounted DOM pointers that the main thread can null or reassign without barriers, producing a data-race UAF on a JS opaque root.

Every main-thread reader/writer of those two members is wrapped in Locker { m_gcLock }. The header drops the now-unused inline getters optionalResponseXML() and optionalUpload().

The GC thread can load a non-null Document*, then call addWebCoreOpaqueRoot(visitor, *document) on a Document whose last Ref was just dropped by the main thread — UAF on the marked object. Recurring class: any wrapper exposing opaque roots via the GC-thread visitor must use either immutable members or lock-guarded access.

This vulnerability weakens memory safety inside the WebContent renderer by breaking the thread-safety invariant between GC marking and main-thread DOM mutation.

Audit directions

Other visitAdditionalChildrenInGCThread / isReachableFromOpaqueRoots overrides. Grep Source/WebCore/bindings/js; check whether every member they dereference is immutable, lock-guarded, or main-thread-only mutated. Start with fetch, EventSource, MessagePort, MediaSource, FileReader.
const std::unique_ptr<T> / const RefPtr<T> members. Grep lazyInitialize( in classes implementing the GC visitor.
addWebCoreOpaqueRoot(visitor, *ptr) patterns. Verify load and deref are bracketed by the same lock that serializes the writer.
Lock ordering with ScriptExecutionContext/loader locks. Review nested lock invariants for XMLHttpRequest::createRequest, responseXML, didSendData, dispatchErrorEvents.