Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: b2c29f67e8c72fe3c0150e69b2e430f64b115481
https://github.com/WebKit/WebKit/commit/b2c29f67e8c72fe3c0150e69b2e430f64b115481
Author: Antti Koivisto <[email protected]>
Date: 2026-08-25 (Tue, 25 Aug 2026)
Changed paths:
A
LayoutTests/fast/css/font-face-worker-serialization-thread-safety-expected.txt
A LayoutTests/fast/css/font-face-worker-serialization-thread-safety.html
M Source/WebCore/css/CSSPrimitiveValue.cpp
M Source/WebCore/css/CSSValue.h
Log Message:
-----------
[WebCore] Unsynchronized access to process-global serializedPrimitiveValues()
HashMap in CSSPrimitiveValue::customCSSText from Worker thread
rdar://177596584
Reviewed by Alan Baradlay.
FontFace is Exposed=(Window,Worker), so its descriptor getters serialize
CSSPrimitiveValues off the main thread via customCSSText(), racing the main
thread on the unsynchronized process-global serialization
map and the
m_hasCachedCSSText flag. A concurrent HashTable rehash can free the backing
buffer while another thread still holds a bucket pointer into it.
Only memoize on the main thread; other threads serialize directly without
touching the shared state. Move m_hasCachedCSSText out of the bit-field group so
the main thread can set it without racing reads of the adjacent bits of a shared
static value.
Test: fast/css/font-face-worker-serialization-thread-safety.html
*
LayoutTests/fast/css/font-face-worker-serialization-thread-safety-expected.txt:
Added.
* LayoutTests/fast/css/font-face-worker-serialization-thread-safety.html: Added.
* Source/WebCore/css/CSSPrimitiveValue.cpp:
(WebCore::CSSPrimitiveValue::~CSSPrimitiveValue):
(WebCore::CSSPrimitiveValue::customCSSText const):
* Source/WebCore/css/CSSValue.h:
Originally-landed-as: [email protected] (bc1c6b94e762).
rdar://185366777
Canonical link:
https://flagged.apple.com:443/proxy?t2=Do8U8S4vl9&o=aHR0cHM6Ly9jb21taXRzLndlYmtpdC5vcmcvMzE5Nzk0QG1haW4=&emid=efc17549-7d95-4f9f-9f4b-66c58620b7a0&c=11
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
