Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 95f9f59bb141325d7468be23bb9e570ad751d71a
https://github.com/WebKit/WebKit/commit/95f9f59bb141325d7468be23bb9e570ad751d71a
Author: Said Abou-Hallawa <[email protected]>
Date: 2026-06-29 (Mon, 29 Jun 2026)
Changed paths:
A
LayoutTests/fast/canvas/offscreen-worker-unsafe-isPointInStroke-call-expected.txt
A LayoutTests/fast/canvas/offscreen-worker-unsafe-isPointInStroke-call.html
M Source/WebCore/platform/graphics/cg/PathCG.cpp
Log Message:
-----------
PathCG::strokeContains() is not thread safe
https://bugs.webkit.org/show_bug.cgi?id=313935
rdar://176138322
Reviewed by Darin Adler.
PathCG::strokeContains() is not thread-safe because it accesses a global
CGContextRef managed by NeverDestroyed in scratchContext(). If multiple
offscreen
canvases call CanvasRenderingContext2D:isPointInStroke() on worker threads, they
are going to call PathCG::strokeContains(). This means the same CGContextRef
will
be used by these workers. This lake of global variable synchronization can lead
to all sort of security and correctness bugs depending on what was set in the
context when it is referenced.
The fix is to protect scratchContext() by a locker. This will allow only one
caller
to have access to the underlying CGContextRef.
Test: fast/canvas/offscreen-worker-unsafe-isPointInStroke-call.html
*
LayoutTests/fast/canvas/offscreen-worker-unsafe-isPointInStroke-call-expected.txt:
Added.
* LayoutTests/fast/canvas/offscreen-worker-unsafe-isPointInStroke-call.html:
Added.
* Source/WebCore/platform/graphics/cg/PathCG.cpp:
(WebCore::PathCG::strokeContains const):
(WebCore::PathCG::strokeBoundingRect const):
Originally-landed-as: 305413.891@safari-7624-branch (232dada9ad29).
rdar://180437343
Canonical link: https://commits.webkit.org/316037@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
