)]}'
{
  "commit": "1366c5550d05fab3994afb41916fbc7a87350655",
  "tree": "5059123501790105fba03fb838d93d844e9a62de",
  "parents": [
    "af4b0659ee484b93af89351406e398392d7251e2"
  ],
  "author": {
    "name": "Chris Bracken",
    "email": "chris@bracken.jp",
    "time": "Sat Jul 18 06:55:29 2026 +0900"
  },
  "committer": {
    "name": "GitHub",
    "email": "noreply@github.com",
    "time": "Fri Jul 17 21:55:29 2026 +0000"
  },
  "message": "[iOS] Fix potential use-after-free in a11y bridge channel handler (#189637)\n\n`AccessibilityBridge`\u0027s constructor registers a message handler Obj-C\nblock on `accessibility_channel_` (the \"flutter/accessibility\" channel)\nthat calls the class\u0027s `HandleEvent(...)` method directly:\n\n[accessibility_channel_ setMessageHandler:^(id message, FlutterReply\nreply) {\n      HandleEvent((NSDictionary*)message);  // Implicit this capture.\n    }];\n\nThis implicitly captures `this` as a raw C++ pointer. ARC manages the\nblock and any captured Obj-C objects, but has no idea about the raw C++\n`this` pointer and we do nothing to keep the `AccessibilityBridge` alive\nor to null out `this` when it\u0027s destroyed. If a message arrives on this\nchannel while or after the bridge is being torn down (e.g. during engine\nshutdown), we\u0027ll dereference the (now garbage) dangling\n`AccessibilityBridge*`.\n\nWe fix this by capturing `fml::WeakPtr\u003cAccessibilityBridge\u003e weak_self \u003d\nGetWeakPtr()` by value in the block instead, and checking it before\ncalling `HandleEvent`. The `weak_factory_` is already declared last in\nthe `AccessibilityBridge` class member list, so it\u0027ll be invalidated\nfirst in the class destructor, so we\u0027re not at risk of using the bridge\nin a half torn-down state. Messages arriving anytime after the start of\nthe destructor are now handled as a no-op.\n\nI\u0027ve added a test which captures the message handler registered on the\nchannel, destroys the `AccessibilityBridge`, and invokes the captured\nhandler to confirm it no longer touches dealloc\u0027ed memory.\n\nIssue: b/525528671\nRelated: https://github.com/flutter/flutter/pull/189630\n\n\u003c!--\nThanks for filing a pull request!\nReviewers are typically assigned within a week of filing a request.\nTo learn more about code review, see our documentation on Tree Hygiene:\nhttps://github.com/flutter/flutter/blob/main/docs/contributing/Tree-hygiene.md\n--\u003e\n\n\n## Pre-launch Checklist\n\n- [X] I read the [Contributor Guide] and followed the process outlined\nthere for submitting PRs.\n- [X] I read the [AI contribution guidelines] and understand my\nresponsibilities, or I am not using AI tools.\n- [X] I read the [Tree Hygiene] wiki page, which explains my\nresponsibilities.\n- [X] I read and followed the [Flutter Style Guide], including [Features\nwe expect every widget to implement].\n- [X] I signed the [CLA].\n- [X] I listed at least one issue that this PR fixes in the description\nabove.\n- [X] I updated/added relevant documentation (doc comments with `///`).\n- [X] I added new tests to check the change I am making, or this PR is\n[test-exempt].\n- [X] I followed the [breaking change policy] and added [Data Driven\nFixes] where supported.\n- [X] All existing and new tests are passing.\n\nIf you need help, consider asking for advice on the #hackers-new channel\non [Discord].\n\nIf this change needs to override an active code freeze, provide a\ncomment explaining why. The code freeze workflow can be overridden by\ncode reviewers. See pinned issues for any active code freezes with\nguidance.\n\n**Note**: The Flutter team is currently trialing the use of [Gemini Code\nAssist for\nGitHub](https://developers.google.com/gemini-code-assist/docs/review-github-code).\nComments from the `gemini-code-assist` bot should not be taken as\nauthoritative feedback from the Flutter team. If you find its comments\nuseful you can update your code accordingly, but if you are unsure or\ndisagree with the feedback, please feel free to wait for a Flutter team\nmember\u0027s review for guidance on which automated comments should be\naddressed.\n\n\u003c!-- Links --\u003e\n[Contributor Guide]:\nhttps://github.com/flutter/flutter/blob/main/docs/contributing/Tree-hygiene.md#overview\n[AI contribution guidelines]:\nhttps://github.com/flutter/flutter/blob/main/docs/contributing/Tree-hygiene.md#ai-contribution-guidelines\n[Tree Hygiene]:\nhttps://github.com/flutter/flutter/blob/main/docs/contributing/Tree-hygiene.md\n[test-exempt]:\nhttps://github.com/flutter/flutter/blob/main/docs/contributing/Tree-hygiene.md#tests\n[Flutter Style Guide]:\nhttps://github.com/flutter/flutter/blob/main/docs/contributing/Style-guide-for-Flutter-repo.md\n[Features we expect every widget to implement]:\nhttps://github.com/flutter/flutter/blob/main/docs/contributing/Style-guide-for-Flutter-repo.md#features-we-expect-every-widget-to-implement\n[CLA]: https://cla.developers.google.com/\n[flutter/tests]: https://github.com/flutter/tests\n[breaking change policy]:\nhttps://github.com/flutter/flutter/blob/main/docs/contributing/Tree-hygiene.md#handling-breaking-changes\n[Discord]:\nhttps://github.com/flutter/flutter/blob/main/docs/contributing/Chat.md\n[Data Driven Fixes]:\nhttps://github.com/flutter/flutter/blob/main/docs/contributing/Data-driven-Fixes.md",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "202d54de040d8a9899f406a4d4b35facee4d91dc",
      "old_mode": 33188,
      "old_path": "engine/src/flutter/shell/platform/darwin/ios/framework/Source/accessibility_bridge.mm",
      "new_id": "38cf124ec7670d20f85bba12c723f582af70b210",
      "new_mode": 33188,
      "new_path": "engine/src/flutter/shell/platform/darwin/ios/framework/Source/accessibility_bridge.mm"
    },
    {
      "type": "modify",
      "old_id": "6f92997b63bbc39a63ad1e03b0bb8438eb2506d2",
      "old_mode": 33188,
      "old_path": "engine/src/flutter/shell/platform/darwin/ios/framework/Source/accessibility_bridge_test.mm",
      "new_id": "1074e0246df0115db88d2cbdf20dd7ca4545002e",
      "new_mode": 33188,
      "new_path": "engine/src/flutter/shell/platform/darwin/ios/framework/Source/accessibility_bridge_test.mm"
    }
  ]
}