Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: 576ee4a20b0e79ffd48d34c6f3b3b03bd999db94
      
https://github.com/WebKit/WebKit/commit/576ee4a20b0e79ffd48d34c6f3b3b03bd999db94
  Author: Jer Noble <[email protected]>
  Date:   2026-07-02 (Thu, 02 Jul 2026)

  Changed paths:
    M Source/WebCore/platform/graphics/MIMETypeCache.cpp
    M Source/WebCore/platform/graphics/MIMETypeCache.h
    M 
Source/WebCore/platform/graphics/avfoundation/objc/AVStreamDataParserMIMETypeCache.h
    M 
Source/WebCore/platform/graphics/avfoundation/objc/AVStreamDataParserMIMETypeCache.mm

  Log Message:
  -----------
  Data race on MIMETypeCache::m_cachedResults / m_supportedTypes in 
MIMETypeCache::canDecodeType
rdar://175674693
https://bugs.webkit.org/show_bug.cgi?id=313842

Reviewed by Eric Carlson.

It's unsafe to return a raw reference to an inner data member (without 
BorrowChecker)
as the underlying object can be mutated or freed leaving a dangling reference. 
Make two
changes to MIMETypeCache as a result:
- Require a lock be held to access the inner data member variable
- Return a copy of the inner member rather than a reference

* Source/WebCore/platform/graphics/MIMETypeCache.cpp:
(WebCore::MIMETypeCache::ensureSupportedTypes):
(WebCore::MIMETypeCache::supportedTypes):
(WebCore::MIMETypeCache::supportsContainerType):
(WebCore::MIMETypeCache::canDecodeType):
(WebCore::MIMETypeCache::addSupportedTypes):
(WebCore::MIMETypeCache::getCachedResult const):
(WebCore::MIMETypeCache::addCachedResult):
(WebCore::MIMETypeCache::isEmpty const):
* Source/WebCore/platform/graphics/MIMETypeCache.h:
* 
Source/WebCore/platform/graphics/avfoundation/objc/AVStreamDataParserMIMETypeCache.h:
* 
Source/WebCore/platform/graphics/avfoundation/objc/AVStreamDataParserMIMETypeCache.mm:
(WebCore::AVStreamDataParserMIMETypeCache::supportedTypes):
(WebCore::AVStreamDataParserMIMETypeCache::canDecodeExtendedType):

Originally-landed-as: 305413.822@safari-7624-branch (720a8f0b10ab). 
rdar://180428110
Canonical link: https://commits.webkit.org/316458@main



To unsubscribe from these emails, change your notification settings at 
https://github.com/WebKit/WebKit/settings/notifications

Reply via email to