Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 034f2fbd9b69edba4969f7f336283e8ce3d8e09f
https://github.com/WebKit/WebKit/commit/034f2fbd9b69edba4969f7f336283e8ce3d8e09f
Author: Roberto Rodriguez <[email protected]>
Date: 2026-06-30 (Tue, 30 Jun 2026)
Changed paths:
A
LayoutTests/fast/canvas/webgl/context-restore-concurrent-gc-no-crash-expected.txt
A LayoutTests/fast/canvas/webgl/context-restore-concurrent-gc-no-crash.html
M Source/WebCore/html/canvas/WebGL2RenderingContext.h
M Source/WebCore/html/canvas/WebGLRenderingContext.h
M Source/WebCore/html/canvas/WebGLRenderingContextBase.cpp
M Source/WebCore/html/canvas/WebGLRenderingContextBase.h
Log Message:
-----------
[WebGL] Missing objectGraphLock on WebGL context restore races with GC
https://bugs.webkit.org/show_bug.cgi?id=315161
rdar://177359720
Reviewed by Kimmo Kinnunen.
All mutators of the WebGL bound-object graph hold objectGraphLock to
synchronize with
addMembersToOpaqueRoots on the GC helper thread, except for
initializeContextState and
initializeDefaultObjects on the WEBGL_lose_context restore path. That path
reassigns
binding points for the default WebGLTransformFeedback and
WebGLVertexArrayObject, freeing
them while the GC marker may still be traversing them.
Fix by holding objectGraphLock in initializeNewContext around both calls and add
WTF_REQUIRES_LOCK annotations to catch this at compile time.
Test: fast/canvas/webgl/context-restore-concurrent-gc-no-crash.html
*
LayoutTests/fast/canvas/webgl/context-restore-concurrent-gc-no-crash-expected.txt:
Added.
* LayoutTests/fast/canvas/webgl/context-restore-concurrent-gc-no-crash.html:
Added.
* Source/WebCore/html/canvas/WebGL2RenderingContext.h:
* Source/WebCore/html/canvas/WebGLRenderingContext.h:
* Source/WebCore/html/canvas/WebGLRenderingContextBase.cpp:
(WebCore::WebGLRenderingContextBase::initializeNewContext):
* Source/WebCore/html/canvas/WebGLRenderingContextBase.h:
Originally-landed-as: 305413.940@safari-7624-branch (6d64b1760e9a).
rdar://180429453
Canonical link: https://commits.webkit.org/316223@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
