Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 9950c65f596093c9eb7f4beb1276f41828089fbe
https://github.com/WebKit/WebKit/commit/9950c65f596093c9eb7f4beb1276f41828089fbe
Author: David Kilzer <[email protected]>
Date: 2026-08-12 (Wed, 12 Aug 2026)
Changed paths:
M Source/WebKit/Platform/cocoa/WebPrivacyHelpers.mm
Log Message:
-----------
Data race reading the process-global TrackerDomainLookupInfo map from the
network resolver thread in WebPrivacyHelpers
<https://bugs.webkit.org/show_bug.cgi?id=317163>
<rdar://164366001>
Reviewed by Charlie Wolfe.
The tracker-lookup callback installed by
`configureForAdvancedPrivacyProtections()` reads the process-global
`MemoryCompactRobinHoodHashMap` returned by `list()` on a network
resolver dispatch thread, but the `requestTrackerDomainNamesData`
completion handler inserts into that same map on every WebPrivacy
update from a different thread. Nothing serializes the two, so an
update can rehash and free the map's backing store while the resolver
thread is reading it, leaving the resolver thread reading freed memory.
The `find()` method already returns the matched entry by value, so no
signature change is needed. The lock must still cover the `list().get()`
read because the read itself races the writer's rehash.
No new tests since this is a data race with no deterministic
reproduction. The `WTF_REQUIRES_LOCK` annotation on the list accessor
makes any access that does not hold the lock a compile error, which is
the load-bearing guarantee that the race cannot reappear.
* Source/WebKit/Platform/cocoa/WebPrivacyHelpers.mm:
(WebKit::TrackerDomainLookupInfo::populateIfNeeded):
(WebKit::TrackerDomainLookupInfo::find):
(WebKit::TrackerDomainLookupInfo::list):
Originally-landed-as: [email protected] (f1ce3d547a23).
rdar://184745157
Canonical link: https://commits.webkit.org/319069@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
