Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: 2917a663b046e5d58a97db8eb33a938a27a49161
      
https://github.com/WebKit/WebKit/commit/2917a663b046e5d58a97db8eb33a938a27a49161
  Author: Said Abou-Hallawa <[email protected]>
  Date:   2026-08-13 (Thu, 13 Aug 2026)

  Changed paths:
    A 
LayoutTests/fast/canvas/offscreen-isPointInStroke-svg-stroke-bounds-race-crash-expected.txt
    A 
LayoutTests/fast/canvas/offscreen-isPointInStroke-svg-stroke-bounds-race-crash.html
    M Source/WebCore/platform/graphics/cg/PathCG.cpp

  Log Message:
  -----------
  PathCG should use thread-safe scratchContext
https://bugs.webkit.org/show_bug.cgi?id=316567
rdar://178176596

Reviewed by Darin Adler.

The fix of bug 313935 was incomplete. The fix was done by adding two static 
Locks
to PathCG::strokeContains() and PathCG::strokeBoundingRect(). This fix makes 
these
two functions be thread-safe independently. But this is not enough. It is 
possible
to call PathCG::strokeContains() and PathCG::strokeBoundingRect() from two
different threads at the same time.

The fix is to make scratchContext() return a thread-specific graphics context.
So two threads can't access the same context at the same time.

Test: fast/canvas/offscreen-isPointInStroke-svg-stroke-bounds-race-crash.html

* 
LayoutTests/fast/canvas/offscreen-isPointInStroke-svg-stroke-bounds-race-crash-expected.txt:
 Added.
* 
LayoutTests/fast/canvas/offscreen-isPointInStroke-svg-stroke-bounds-race-crash.html:
 Added.
* Source/WebCore/platform/graphics/cg/PathCG.cpp:
(WebCore::scratchContext):
(WebCore::PathCG::strokeContains const):
(WebCore::PathCG::strokeBoundingRect const):

Originally-landed-as: [email protected] (6ab6f0e16b4d). 
rdar://184744291
Canonical link: https://commits.webkit.org/319095@main



To unsubscribe from these emails, change your notification settings at 
https://github.com/WebKit/WebKit/settings/notifications

Reply via email to