Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: db743cc33964a7d107f4f1c3ccd8d6122bb9f79e
https://github.com/WebKit/WebKit/commit/db743cc33964a7d107f4f1c3ccd8d6122bb9f79e
Author: Ryosuke Niwa <[email protected]>
Date: 2026-06-17 (Wed, 17 Jun 2026)
Changed paths:
M Source/WebCore/bindings/js/JSSubscriberCustom.cpp
M Source/WebCore/dom/Subscriber.cpp
M Source/WebCore/dom/Subscriber.h
Log Message:
-----------
Race condition in JSSubscriber::visitAdditionalChildren during GC
https://bugs.webkit.org/show_bug.cgi?id=309773
<rdar://172278544>
Reviewed by Chris Dumez.
This PR fixes a race condition in JSSubscriber::visitAdditionalChildren which
results in
a use-after-free of VoidCallback objects in
JSSubscriber::visitAdditionalChildren.
While Subscriber::teardownCallbacksConcurrently grabs a lock and creates a
Vector of
VoidCallback*, the main thread can still go ahead and destroy VoidCallback while
a GC thread is calling visitJSFunction on that VoidCallback.
No new tests since there is no reliable reproduction.
* Source/WebCore/bindings/js/JSSubscriberCustom.cpp:
(WebCore::JSSubscriber::visitAdditionalChildren):
* Source/WebCore/dom/Subscriber.cpp:
(WebCore::Subscriber::visitAdditionalChildren):
(): Deleted.
(WebCore::Subscriber::observerConcurrently): Deleted.
* Source/WebCore/dom/Subscriber.h:
Originally-landed-as: 305413.461@safari-7624-branch (498a2ef7689e).
rdar://176061111
Canonical link: https://commits.webkit.org/315368@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
