Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: ccf04bde47571298cd62d79f0bcd83c2cd3a3db0
https://github.com/WebKit/WebKit/commit/ccf04bde47571298cd62d79f0bcd83c2cd3a3db0
Author: Chris Dumez <[email protected]>
Date: 2026-06-29 (Mon, 29 Jun 2026)
Changed paths:
M Source/WebCore/page/ResourceUsageThread.cpp
M Source/WebCore/page/ResourceUsageThread.h
Log Message:
-----------
ResourceUsageThread reads m_collectionMode off-thread without holding its lock
https://bugs.webkit.org/show_bug.cgi?id=318087
Reviewed by Darin Adler.
m_collectionMode is written by recomputeCollectionMode() while holding
m_observersLock
(from addObserver()/removeObserver() on the main thread), but the dedicated
resource-usage
sampling thread read it in threadBody() without acquiring the lock.
waitUntilObservers()
releases the lock before threadBody() reaches the read, so the locked
main-thread write and
the unlocked background-thread read could run concurrently on a non-atomic
variable, which is
a data race / undefined behavior. The field was also not annotated, so Clang's
thread-safety
analysis could not catch the unguarded access.
Synchronize m_collectionMode with the same lock that already guards the
m_observers set it is
derived from: annotate it WTF_GUARDED_BY_LOCK(m_observersLock) so unguarded
accesses become a
build error, and read it under a short Locker scope in threadBody() (without
holding the lock
across the platformCollect* calls). recomputeCollectionMode() now accumulates
into a local and
performs a single store, which it already does under the lock.
* Source/WebCore/page/ResourceUsageThread.cpp:
(WebCore::ResourceUsageThread::recomputeCollectionMode):
(WebCore::ResourceUsageThread::threadBody):
* Source/WebCore/page/ResourceUsageThread.h:
(WebCore::ResourceUsageThread::WTF_GUARDED_BY_LOCK):
Canonical link: https://commits.webkit.org/316090@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
