Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 6c291d01ba2f455787d406fc7dfb584172bdcd57
https://github.com/WebKit/WebKit/commit/6c291d01ba2f455787d406fc7dfb584172bdcd57
Author: Claudio Saavedra <[email protected]>
Date: 2026-07-14 (Tue, 14 Jul 2026)
Changed paths:
A
LayoutTests/compositing/scrolling/layer-churn-during-async-scroll-crash-expected.txt
A
LayoutTests/compositing/scrolling/layer-churn-during-async-scroll-crash.html
M
Source/WebKit/WebProcess/WebPage/CoordinatedGraphics/CoordinatedSceneState.cpp
M
Source/WebKit/WebProcess/WebPage/CoordinatedGraphics/CoordinatedSceneState.h
Log Message:
-----------
REGRESSION(315356@main): Data race on CoordinatedSceneState::m_layers between
the main and scrolling threads
https://bugs.webkit.org/show_bug.cgi?id=319255
Reviewed by Carlos Garcia Campos.
Before 315356@main, m_layers was only used from the main thread, so it was
accessed without a lock. That change started iterating it in
flushPendingState(),
which can also run on the scrolling thread: when the main thread's rendering
update overruns the scrolling tree's synchronization timeout, the scrolling
thread commits layer positions concurrently and its iteration races the
main-thread mutations in addLayer(), removeLayer() and invalidate(), corrupting
the hash table.
Protect m_layers with a dedicated lock, taken by the mutators and by
flushPendingState(). The state lock keeps guarding only the pending and
compositing state flushes, so adding or removing layers on the main thread does
not block the compositor thread.
Test: compositing/scrolling/layer-churn-during-async-scroll-crash.html
*
LayoutTests/compositing/scrolling/layer-churn-during-async-scroll-crash-expected.txt:
Added.
* LayoutTests/compositing/scrolling/layer-churn-during-async-scroll-crash.html:
Added.
*
Source/WebKit/WebProcess/WebPage/CoordinatedGraphics/CoordinatedSceneState.cpp:
(WebKit::CoordinatedSceneState::addLayer):
(WebKit::CoordinatedSceneState::removeLayer):
(WebKit::CoordinatedSceneState::flush):
(WebKit::CoordinatedSceneState::flushPendingState):
(WebKit::CoordinatedSceneState::invalidate):
* Source/WebKit/WebProcess/WebPage/CoordinatedGraphics/CoordinatedSceneState.h:
Canonical link: https://commits.webkit.org/317141@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
