Branch: refs/heads/webkitglib/2.52
Home: https://github.com/WebKit/WebKit
Commit: fba8cb51df0521c4537718a4a9de7f94b6a344e6
https://github.com/WebKit/WebKit/commit/fba8cb51df0521c4537718a4a9de7f94b6a344e6
Author: Shu-yu Guo <[email protected]>
Date: 2026-09-03 (Thu, 03 Sep 2026)
Changed paths:
A JSTests/stress/dfg-getscope-fold-stale-cfa-state.js
M Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp
Log Message:
-----------
Cherry-pick [email protected] (3efb180e50d2).
https://bugs.webkit.org/show_bug.cgi?id=316803
[JSC] Refresh AI state when folding GetScope to Identity
https://bugs.webkit.org/show_bug.cgi?id=316803
rdar://178423757
Reviewed by Yusuke Suzuki.
A GetScope could be constant folded to Identity. When this happens, the
abstract interpreter isn't re-executed on the Identity node. If a previous
run
of the AI left the abstract value corresponding to
the
pre-replacement
GetScope
node as bottom, this stale bottom value can cause downstream consumers to
assume the Identity is unreachable when it is.
This PR re-executes AI after folding to Identity.
Test: JSTests/stress/dfg-getscope-fold-stale-cfa-state.js
* JSTests/stress/dfg-getscope-fold-stale-cfa-state.js: Added.
(try.Trans):
(try.inline):
(foo):
(C):
(opt):
(i.catch):
* Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp:
(JSC::DFG::ConstantFoldingPhase::foldConstants):
Identifier: [email protected]
Canonical link:
https://flagged.apple.com:443/proxy?t2=DR3u4h0Hf0&o=aHR0cHM6Ly9jb21taXRzLndlYmtpdC5vcmcvMzA1ODc3LjExMzlAd2Via2l0Z2xpYi8yLjUy&emid=2f9b9a72-5b75-4955-8460-8114806f9885&c=11
Commit: 3c52c9cfaecb9e2d87b986d80814140d164113a2
https://github.com/WebKit/WebKit/commit/3c52c9cfaecb9e2d87b986d80814140d164113a2
Author: Antti Koivisto <[email protected]>
Date:
2026-09-03 (Thu, 03 Sep
2026)
Changed paths:
A
LayoutTests/fast/css/font-face-worker-serialization-thread-safety-expected.txt
A LayoutTests/fast/css/font-face-worker-serialization-thread-safety.html
M Source/WebCore/css/CSSPrimitiveValue.cpp
M Source/WebCore/css/CSSValue.h
Log Message:
-----------
Cherry-pick [email protected] (bc1c6b94e762).
https://bugs.webkit.org/show_bug.cgi?id=317654
[WebCore] Unsynchronized access to process-global
serializedPrimitiveValues() HashMap in CSSPrimitiveValue::customCSSText from
Worker thread
rdar://177596584
Reviewed by Alan Baradlay.
FontFace is Exposed=(Window,Worker), so its descriptor getters serialize
CSSPrimitiveValues off the main thread via customCSSText(), racing the main
thread on the unsynchronized process-global serialization map and the
m_hasCachedCSSText flag. A concurrent HashTable rehash can free the backing
buffer while
another
thread holds a bucket
pointer, producing a
heap-use-after-free or double-free.
Only memoize on the main thread; other threads serialize directly without
touching the shared state. Move m_hasCachedCSSText out of the bit-field
group so
the main thread can set it without racing reads of the adjacent bits of a
shared
static value.
Test: fast/css/font-face-worker-serialization-thread-safety.html
*
LayoutTests/fast/css/font-face-worker-serialization-thread-safety-expected.txt:
Added.
* LayoutTests/fast/css/font-face-worker-serialization-thread-safety.html:
Added.
* Source/WebCore/css/CSSPrimitiveValue.cpp:
(WebCore::CSSPrimitiveValue::~CSSPrimitiveValue):
(WebCore::CSSPrimitiveValue::customCSSText const):
* Source/WebCore/css/CSSValue.h:
Identifier: [email protected]
Canonical
link:
https://flagged.apple.com:443/proxy?t2=Df3Y1J7EO3&o=aHR0cHM6Ly9jb21taXRzLndlYmtpdC5vcmcvMzA1ODc3LjExNDBAd2Via2l0Z2xpYi8yLjUy&emid=2f9b9a72-5b75-4955-8460-8114806f9885&c=11
Commit: a8ae94eba31199b13ea1c6323a594680fce490e0
https://github.com/WebKit/WebKit/commit/a8ae94eba31199b13ea1c6323a594680fce490e0
Author: Jean-Yves Avenard <[email protected]>
Date: 2026-09-03 (Thu, 03 Sep 2026)
Changed paths:
A
LayoutTests/webaudio/AudioParam/audioparam-cross-thread-ref-deref-crash-expected.txt
A
LayoutTests/webaudio/AudioParam/audioparam-cross-thread-ref-deref-crash.html
M Source/WebCore/Modules/webaudio/AudioParam.h
Log Message:
-----------
Cherry-pick [email protected] (62fcbfe61a49).
https://bugs.webkit.org/show_bug.cgi?id=318405
use-after-free of AudioParam via cross-thread non-atomic ref/deref in
AudioNodeOutput::disconnectAllParams()
rdar://177930032
Reviewed by Youenn Fablet.
Make AudioParam
use
thread-safe refcounted.
Test: webaudio/AudioParam/audioparam-cross-thread-ref-deref-crash.html
*
LayoutTests/webaudio/AudioParam/audioparam-cross-thread-ref-deref-crash-expected.txt:
Added.
*
LayoutTests/webaudio/AudioParam/audioparam-cross-thread-ref-deref-crash.html:
Added.
* Source/WebCore/Modules/webaudio/AudioParam.h:
Identifier: [email protected]
Canonical link:
https://flagged.apple.com:443/proxy?t2=Dt3F6z0SU8&o=aHR0cHM6Ly9jb21taXRzLndlYmtpdC5vcmcvMzA1ODc3LjExNDFAd2Via2l0Z2xpYi8yLjUy&emid=2f9b9a72-5b75-4955-8460-8114806f9885&c=11
Compare: https://github.com/WebKit/WebKit/compare/ad76efc28c94...a8ae94eba311
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
