Branch: refs/heads/webkitglib/2.54
Home: https://github.com/WebKit/WebKit
Commit: 5d96a4934eed0228239c55f399969dd18859840a
https://github.com/WebKit/WebKit/commit/5d96a4934eed0228239c55f399969dd18859840a
Author: Kai Tamkun <[email protected]>
Date: 2026-08-22 (Sat, 22 Aug 2026)
Changed paths:
A
JSTests/stress/ftl-osr-exit-materialize-phantom-array-with-live-butterfly.js
M Source/JavaScriptCore/ftl/FTLOSRExitCompiler.cpp
Log Message:
-----------
Cherry-pick [email protected] (883cc7576689).
https://bugs.webkit.org/show_bug.cgi?id=314579
[JSC] FTL OSR exit: handle DataFormatStorage in reboxAccordingToFormat
https://bugs.webkit.org/show_bug.cgi?id=314579
rdar://176131036
Reviewed by Marcus Plutowski.
300523@main relaxed validation so that PhantomNewArrayWithButterfly may
reference a non-phantom NewButterflyWithSize, and taught
FTLLowerDFGToB3::exitValueForNode to emit an ExitArgument with
DataFormatStorage for the live butterfly. However, the FTL OSR exit
compiler's reboxAccordingToFormat() was never updated, so when such an
exit is compiled it falls into RELEASE_ASSERT_NOT_REACHED().
The recovered storage value is the raw butterfly pointer that
operationMaterializeObjectInOSR(PhantomNewArrayWithButterfly) consumes
via std::bit_cast<Butterfly*>, so no boxing is required; treat it the
same as DataFormatJS and pass it through unchanged.
Test:
JSTests/stress/ftl-osr-exit-materialize-phantom-array-with-live-butterfly.js
*
JSTests/stress/ftl-osr-exit-materialize-phantom-array-with-live-butterfly.js:
Added.
(check):
(main.v2):
(main):
* Source/JavaScriptCore/ftl/FTLOSRExitCompiler.cpp:
(JSC::FTL::reboxAccordingToFormat):
Identifier: [email protected]
Canonical link: https://commits.webkit.org/317695.136@webkitglib/2.54
Commit: 8b15b7ea86363a8cac72bfee3b661090864b633d
https://github.com/WebKit/WebKit/commit/8b15b7ea86363a8cac72bfee3b661090864b633d
Author: Ryosuke Niwa <[email protected]>
Date: 2026-08-22 (Sat, 22 Aug 2026)
Changed paths:
M Source/WebCore/Modules/mediasource/SourceBuffer.cpp
M Source/WebCore/Modules/mediasource/SourceBuffer.h
M Source/WebCore/Sources.txt
M Source/WebCore/WebCore.xcodeproj/project.pbxproj
A Source/WebCore/bindings/js/JSHTMLMediaElementCustom.cpp
M Source/WebCore/html/HTMLMediaElement.cpp
M Source/WebCore/html/HTMLMediaElement.h
M Source/WebCore/html/HTMLMediaElement.idl
M Source/WebCore/html/track/TextTrackList.cpp
M Source/WebCore/html/track/TextTrackList.h
M Source/WebCore/html/track/TrackBase.cpp
M Source/WebCore/html/track/TrackBase.h
M Source/WebCore/html/track/TrackListBase.cpp
M Source/WebCore/html/track/TrackListBase.h
A Source/WebCore/html/track/TrackOpaqueRoot.h
Log Message:
-----------
Cherry-pick [email protected] (3cbf2f5adfe0).
https://bugs.webkit.org/show_bug.cgi?id=311800
Data race in TrackBase::opaqueRoot during GC leading to use-after-free
https://bugs.webkit.org/show_bug.cgi?id=311800
rdar://176058579
Reviewed by Geoffrey Garen.
To fix the data race, we introduce SourceBuffer and HTMLMediaElement as
opaque roots for Track* classes
and *TrackList classes instead of using the root node of HTMLMediaElement
which can change over time.
We introduce TrackOpaqueRoot, which is a thin ThreadSafeRefCounted wrapper
around WebCoreOpaqueRoot,
and initialize it with WebCoreOpaqueRoot pointing to SourceBuffer or
HTMLMediaElement.
Each Track and TrackList class will have RefPtr<TrackOpaqueRoot> and reads
the opaque root directly
from a GC thread without relying on any pointer indirections.
No new tests since there is no reliable way to test this data race.
* Source/WebCore/Modules/mediasource/SourceBuffer.cpp:
(WebCore::SourceBuffer::SourceBuffer):
(WebCore::SourceBuffer::~SourceBuffer):
(WebCore::SourceBuffer::videoTracks):
(WebCore::SourceBuffer::audioTracks):
(WebCore::SourceBuffer::textTracks):
(WebCore::m_logIdentifier): Deleted.
* Source/WebCore/Modules/mediasource/SourceBuffer.h:
* Source/WebCore/Sources.txt:
* Source/WebCore/WebCore.xcodeproj/project.pbxproj:
* Source/WebCore/bindings/js/JSHTMLMediaElementCustom.cpp: Added.
(WebCore::JSHTMLMediaElement::visitAdditionalChildren):
* Source/WebCore/html/HTMLMediaElement.cpp:
(WebCore::m_trackOpaqueRoot):
(WebCore::HTMLMediaElement::~HTMLMediaElement):
(WebCore::HTMLMediaElement::ensureAudioTracks):
(WebCore::HTMLMediaElement::ensureTextTracks):
(WebCore::HTMLMediaElement::ensureVideoTracks):
(WebCore::m_opaqueRootProvider): Deleted.
* Source/WebCore/html/HTMLMediaElement.h:
(WebCore::HTMLMediaElement::trackOpaqueRoot):
* Source/WebCore/html/HTMLMediaElement.idl:
* Source/WebCore/html/track/TextTrackList.cpp:
(WebCore::TextTrackList::setOpaqueRoot):
* Source/WebCore/html/track/TextTrackList.h:
* Source/WebCore/html/track/TrackBase.cpp:
(WebCore::TrackBase::setOpaqueRoot):
(WebCore::TrackBase::opaqueRoot):
(WebCore::TrackBase::setTrackList):
(WebCore::TrackBase::clearTrackList):
* Source/WebCore/html/track/TrackBase.h:
* Source/WebCore/html/track/TrackListBase.cpp:
(WebCore::TrackListBase::setOpaqueRoot):
(WebCore::TrackListBase::opaqueRoot):
* Source/WebCore/html/track/TrackListBase.h:
(WebCore::TrackListBase::trackOpaqueRoot):
(WebCore::TrackListBase::setOpaqueRootObserver): Deleted.
* Source/WebCore/html/track/TrackOpaqueRoot.h: Added.
(WebCore::TrackOpaqueRoot::create):
(WebCore::TrackOpaqueRoot::opaqueRoot const):
(WebCore::TrackOpaqueRoot::clear):
(WebCore::TrackOpaqueRoot::TrackOpaqueRoot):
Identifier: [email protected]
Canonical link: https://commits.webkit.org/317695.137@webkitglib/2.54
Compare: https://github.com/WebKit/WebKit/compare/6342ed412b09...8b15b7ea8636
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
