Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 4c7a59d2a5e1c7ecd6b137cf3a02ba24c422b44f
https://github.com/WebKit/WebKit/commit/4c7a59d2a5e1c7ecd6b137cf3a02ba24c422b44f
Author: David Kilzer <[email protected]>
Date: 2026-08-13 (Thu, 13 Aug 2026)
Changed paths:
M Source/WebCore/platform/graphics/mac/controls/ControlFactoryMac.mm
Log Message:
-----------
GPU process crash in WebCore::ControlFactoryMac::servicesRolloverButtonCell()
drawing image controls
<https://bugs.webkit.org/show_bug.cgi?id=316849>
<rdar://177901870>
Reviewed by Simon Fraser.
The GPU process can crash while drawing the image-controls (services
rollover) button on its per-connection RemoteRenderingBackend work
queues. Each RemoteGraphicsContext installs its own per-context
ControlFactory override for the duration of a draw, so the factory
itself is not shared across work-queue threads.
`ControlFactoryMac::servicesRolloverButtonCell()` is the one cell
accessor that defeats that isolation. It caches the cell returned by
`+[NSServicesRolloverButtonCell serviceRolloverButtonCellForStyle:]`,
which is a process-wide singleton, so every per-context factory ends up
caching and drawing the SAME AppKit cell. Configuring that shared cell
on one work-queue thread races with drawing it on another, and `NSCell`
is not thread-safe.
Give each factory a private copy of the cell, so it is only ever touched
by that factory's single work-queue thread. `-[NSButtonCell
copyWithZone:]` gives the copy a nil visual provider -- the state whose
concurrent mutation crashes -- so the copy shares nothing mutable with
the shared cell, and drawing it needs no lock.
The copy itself must be serialized under a process-wide lock because
`-[NSButtonCell copyWithZone:]` transiently mutates its source, so
concurrent first-access copies of the shared cell would otherwise race.
No new tests since this change is not directly testable.
* Source/WebCore/platform/graphics/mac/controls/ControlFactoryMac.mm:
(WebCore::ControlFactoryMac::servicesRolloverButtonCell const):
Originally-landed-as: [email protected] (4620ee2b5925).
rdar://184744679
Canonical link: https://commits.webkit.org/319097@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
