Branch: refs/heads/webkitglib/2.52
Home: https://github.com/WebKit/WebKit
Commit: cd3c2eed07a21db422731db07d4b8fd39f943551
https://github.com/WebKit/WebKit/commit/cd3c2eed07a21db422731db07d4b8fd39f943551
Author: Chris Dumez <[email protected]>
Date: 2026-03-25 (Wed, 25 Mar 2026)
Changed paths:
M Source/WTF/wtf/ThreadSafeWeakPtr.h
Log Message:
-----------
Cherry-pick 309739@main (3a7cb2ff43f8).
https://bugs.webkit.org/show_bug.cgi?id=310500
Fix missing memory fence in
ThreadSafeRefCountedAndCanMakeThreadSafeWeakPtr::deref()
https://bugs.webkit.org/show_bug.cgi?id=310500
Reviewed by Keith Miller.
The strong-only deref path used memory_order_relaxed for the CAS that
decrements the ref count. When the count reached zero, the only fence
before object deletion was a seq_cst exchangeOr hidden inside an ASSERT,
meaning it was compiled out in release builds.
Without proper ordering, on ARM, the thread performing the deletion may
not see writes made by other threads before they released their
references, potentially causing the destructor to observe stale state.
Fix this using the standard release/acquire pattern for ref counting:
- Use memory_order_release on the decrement so each thread's writes to
the object are published before its count change becomes visible.
- Add an acquire fence before deletion so the deleting thread
synchronizes with all prior release decrements, making every other
thread's writes visible before the destructor runs.
This matches the pattern used by std::shared_ptr implementations. The
ref() increment correctly remains memory_order_relaxed since the caller
already holds a valid reference.
* Source/WTF/wtf/ThreadSafeWeakPtr.h:
(WTF::ThreadSafeRefCountedAndCanMakeThreadSafeWeakPtr::deref const):
Canonical link: https://commits.webkit.org/309739@main
Canonical link: https://commits.webkit.org/305877.309@webkitglib/2.52
Commit: 22aecb9f6c05f72a267217fce9198babbc72e7ed
https://github.com/WebKit/WebKit/commit/22aecb9f6c05f72a267217fce9198babbc72e7ed
Author: Chris Dumez <[email protected]>
Date: 2026-03-25 (Wed, 25 Mar 2026)
Changed paths:
M Source/WTF/wtf/text/StringParsingBuffer.h
M Tools/TestWebKitAPI/Tests/WTF/StringParsingBuffer.cpp
Log Message:
-----------
Cherry-pick 309749@main (7e2a2b003015).
https://bugs.webkit.org/show_bug.cgi?id=310519
StringParsingBuffer::consume() incorrectly returns the whole buffer
https://bugs.webkit.org/show_bug.cgi?id=310519
Reviewed by Anne van Kesteren.
StringParsingBuffer::consume() incorrectly returns the whole buffer,
instead of just the consumed part.
Test: Tools/TestWebKitAPI/Tests/WTF/StringParsingBuffer.cpp
* Source/WTF/wtf/text/StringParsingBuffer.h:
* Tools/TestWebKitAPI/Tests/WTF/StringParsingBuffer.cpp:
(TestWebKitAPI::TEST(WTF, StringParsingBufferConsumeCount)):
Canonical link: https://commits.webkit.org/309749@main
Canonical link: https://commits.webkit.org/305877.310@webkitglib/2.52
Commit: 2f27895bac60207056d9ec79cd97d49f78753ce1
https://github.com/WebKit/WebKit/commit/2f27895bac60207056d9ec79cd97d49f78753ce1
Author: Chris Dumez <[email protected]>
Date: 2026-03-25 (Wed, 25 Mar 2026)
Changed paths:
M Source/WTF/wtf/WeakHashMap.h
M Source/WTF/wtf/WeakHashSet.h
Log Message:
-----------
Cherry-pick 309751@main (0a35df21ef82).
https://bugs.webkit.org/show_bug.cgi?id=310505
Address small inefficiency in WeakHashSet / WeakHashMap's
hasNullReferences()
https://bugs.webkit.org/show_bug.cgi?id=310505
Reviewed by Darin Adler.
Use `auto&` instead of `auto` in the loop to avoid copying WeakPtrs,
which resulted in unnecessary atomic refcount churn.
* Source/WTF/wtf/WeakHashMap.h:
* Source/WTF/wtf/WeakHashSet.h:
Canonical link: https://commits.webkit.org/309751@main
Canonical link: https://commits.webkit.org/305877.311@webkitglib/2.52
Commit: fb2339a4aa208ccdb28726a58f108433b37f3c46
https://github.com/WebKit/WebKit/commit/fb2339a4aa208ccdb28726a58f108433b37f3c46
Author: Chris Dumez <[email protected]>
Date: 2026-03-26 (Thu, 26 Mar 2026)
Changed paths:
M Source/WTF/wtf/CheckedPtr.h
M Source/WTF/wtf/CheckedRef.h
Log Message:
-----------
Cherry-pick 309714@main (883de0d12b90).
https://bugs.webkit.org/show_bug.cgi?id=310471
IsSmartPtr::isNullable values are swapped between CheckedPtr and CheckedRef
https://bugs.webkit.org/show_bug.cgi?id=310471
Reviewed by Darin Adler.
IsSmartPtr::isNullable drives the NullableSmartPtr / NonNullableSmartPtr
concepts in GetPtr.h, which gate reference-taking convenience overloads
in HashCountedSet.
With the swap:
- HashCountedSet<CheckedRef<T>> cannot use find(myObj) with a reference
(the overload is gated on NonNullableSmartPtr, but CheckedRef
incorrectly doesn't satisfy it)
- HashCountedSet<CheckedPtr<T>> gets reference overloads it shouldn't have
* Source/WTF/wtf/CheckedPtr.h:
* Source/WTF/wtf/CheckedRef.h:
Canonical link: https://commits.webkit.org/309714@main
Canonical link: https://commits.webkit.org/305877.312@webkitglib/2.52
Commit: 22094ab15d221d4d4e756319ec80bb49baf392ea
https://github.com/WebKit/WebKit/commit/22094ab15d221d4d4e756319ec80bb49baf392ea
Author: Chris Dumez <[email protected]>
Date: 2026-03-26 (Thu, 26 Mar 2026)
Changed paths:
M Source/WTF/wtf/Deque.h
M Tools/TestWebKitAPI/Tests/WTF/Deque.cpp
Log Message:
-----------
Cherry-pick 309715@main (18b2f1f3724b).
https://bugs.webkit.org/show_bug.cgi?id=310473
Value returned by Deque::removeAllMatching() is incorrect
https://bugs.webkit.org/show_bug.cgi?id=310473
Reviewed by Darin Adler and Ryosuke Niwa.
The logic was reversed in Deque::removeAllMatching() when computing the
number of items removed. The substraction would underflow.
Test: Tools/TestWebKitAPI/Tests/WTF/Deque.cpp
* Source/WTF/wtf/Deque.h:
* Tools/TestWebKitAPI/Tests/WTF/Deque.cpp:
(TestWebKitAPI::TEST(WTF_Deque, RemoveAllMatching)):
(TestWebKitAPI::TEST(WTF_Deque, RemoveAllMatchingNone)):
(TestWebKitAPI::TEST(WTF_Deque, RemoveAllMatchingAll)):
(TestWebKitAPI::TEST(WTF_Deque, RemoveAllMatchingSingleElement)):
(TestWebKitAPI::TEST(WTF_Deque, RemoveFirstMatching)):
Canonical link: https://commits.webkit.org/309715@main
Canonical link: https://commits.webkit.org/305877.313@webkitglib/2.52
Compare: https://github.com/WebKit/WebKit/compare/70817fb20a36...22094ab15d22
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
