Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 80abed96e2a668d16fe89c67c91a2cd5be5d9a91
https://github.com/WebKit/WebKit/commit/80abed96e2a668d16fe89c67c91a2cd5be5d9a91
Author: Chris Dumez <[email protected]>
Date: 2026-07-20 (Mon, 20 Jul 2026)
Changed paths:
M Source/WebKit/GPUProcess/graphics/RemoteRenderingBackend.cpp
M Source/WebKit/GPUProcess/graphics/RemoteRenderingBackend.h
Log Message:
-----------
Fix data race on SharedPreferencesForWebProcess read from the
RemoteRenderingBackend work queue
https://bugs.webkit.org/show_bug.cgi?id=319801
Reviewed by Dan Glastonbury.
RemoteRenderingBackend, which runs its message handlers on a stream work
queue, read GPUConnectionToWebProcess::m_sharedPreferencesForWebProcess
directly (via sharedPreferencesForWebProcess(),
isDynamicContentScalingEnabled(),
and the lockdown font-parser check). That member is reassigned on the main
run loop by GPUConnectionToWebProcess::updateSharedPreferencesForWebProcess(),
so the work-queue reads raced with the main-thread write with no
synchronization, producing a torn read of the preferences bitfields — one of
which gates selection of the lockdown-safe font parser.
Fix this by having RemoteRenderingBackend hold its own copy of
SharedPreferencesForWebProcess, following the pre-existing pattern already
used by the sibling graphics work-queue receivers RemoteGraphicsContextGL and
RemoteGPU: the copy is snapshotted on the main thread at construction (the
same thread as the writer, so the read is race-free) and is const thereafter,
so the work queue only ever reads immutable state. As with those siblings,
the backend snapshots preferences at creation and does not observe a later
SharedPreferencesForWebProcessDidChange; this keeps the three graphics
receivers consistent.
* Source/WebKit/GPUProcess/graphics/RemoteRenderingBackend.cpp:
(WebKit::RemoteRenderingBackend::RemoteRenderingBackend):
(WebKit::RemoteRenderingBackend::sharedPreferencesForWebProcess const):
(WebKit::RemoteRenderingBackend::allocateImageBuffer):
(WebKit::RemoteRenderingBackend::shouldUseLockdownFontParser const):
* Source/WebKit/GPUProcess/graphics/RemoteRenderingBackend.h:
Canonical link: https://commits.webkit.org/317588@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
