Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 267fa38ebab73cb1b298cd198f1412e532ec74dd
https://github.com/WebKit/WebKit/commit/267fa38ebab73cb1b298cd198f1412e532ec74dd
Author: Chris Dumez <[email protected]>
Date: 2026-06-30 (Tue, 30 Jun 2026)
Changed paths:
M Source/WebKit/Platform/IPC/Connection.cpp
M Source/WebKit/Platform/IPC/Connection.h
Log Message:
-----------
Fix data race on m_outgoingMessageQueueIsGrowingLargeCallback in
IPC::Connection
https://bugs.webkit.org/show_bug.cgi?id=313533
rdar://175743852
Reviewed by Kimmo Kinnunen.
sendMessageImpl() is thread-safe but was reading and invoking
m_outgoingMessageQueueIsGrowingLargeCallback outside m_outgoingMessagesLock,
while invalidate() was clearing it on the dispatcher thread without holding
the lock. This is a data race on the Function object.
Wrap the callback in a Box<> (ThreadSafeRefCounted) so it can be safely copied
under
the lock and invoked outside it. Guard all accesses to the member with
m_outgoingMessagesLock.
* Source/WebKit/Platform/IPC/Connection.cpp:
(IPC::Connection::setOutgoingMessageQueueIsGrowingLargeCallback):
(IPC::Connection::invalidate):
(IPC::Connection::sendMessageImpl):
* Source/WebKit/Platform/IPC/Connection.h:
Originally-landed-as: 305413.761@safari-7624-branch (153d034e52b2).
rdar://180436058
Canonical link: https://commits.webkit.org/316204@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
