[webkit-changes] [WebKit/WebKit] 868fdd: Use-after-free under WebCore::Scrollbar::supportsU...

[Chris Dumez]

  Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: 868fdd2f60885a5095ab3888261aed0ba002cc03
      https://github.com/WebKit/WebKit/commit/868fdd2f60885a5095ab3888261aed0ba002cc03
  Author: Chris Dumez <cdumez at apple.com>
  Date:   2023-11-01 (Wed, 01 Nov 2023)

  Changed paths:
    M Source/WebCore/platform/mac/ScrollbarsControllerMac.mm

  Log Message:
  -----------
  Use-after-free under WebCore::Scrollbar::supportsUpdateOnSecondaryThread
https://bugs.webkit.org/show_bug.cgi?id=259890
rdar://113037440

Reviewed by Ryosuke Niwa.

Use a WeakPtr for _scrollbar instead of a raw pointer and add a null-check
in [WebScrollbarPartAnimation setCurrentProgress:].

* Source/WebCore/platform/mac/ScrollbarsControllerMac.mm:
(-[WebScrollbarPartAnimation setCurrentProgress:]):
(-[WebScrollerImpDelegate setUpAlphaAnimation:scrollerPainter:part:animateAlphaTo:duration:]):
(-[WebScrollerImpDelegate scrollerImp:animateUIStateTransitionWithDuration:]):
(-[WebScrollerImpDelegate scrollerImp:animateExpansionTransitionWithDuration:]):

Originally-landed-as: 265870.236 at safari-7616-branch (bf54ee3c4df6). rdar://117809355
Canonical link: https://commits.webkit.org/270099@main