Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 9289509917c1ae8a6a37f04dcc1b3bc8ce32c022
https://github.com/WebKit/WebKit/commit/9289509917c1ae8a6a37f04dcc1b3bc8ce32c022
Author: Zak Ridouh <[email protected]>
Date: 2026-09-18 (Fri, 18 Sep 2026)
Changed paths:
A
LayoutTests/fast/forms/search/search-field-gpu-process-teardown-no-crash-expected.txt
A
LayoutTests/fast/forms/search/search-field-gpu-process-teardown-no-crash.html
M Source/WebCore/platform/graphics/controls/ControlFactory.h
M Source/WebCore/platform/graphics/mac/controls/ControlFactoryMac.h
M Source/WebCore/platform/graphics/mac/controls/ControlFactoryMac.mm
Log Message:
-----------
[macOS] GPU process crash in
NSSearchFieldAquaduckVisualProvider.__ivar_destroyer under ~ControlFactoryMac
<https://bugs.webkit.org/show_bug.cgi?id=319529>
<rdar://181691068>
Reviewed by David Kilzer.
In the GPU process, RemoteGraphicsContext lazily creates its own
ControlFactory the first time it draws a native control part, and holds
the only reference to it. That RemoteGraphicsContext is destroyed on the
RemoteRenderingBackend work queue (via RemoteImageBuffer::stopListeningForIPC
or RemoteImageBufferSet::endPrepareForDisplay), dropping the last reference
to the ControlFactory off the main thread. On macOS this is a
ControlFactoryMac holding cached AppKit NSCell instances (NSSearchFieldCell,
etc.); releasing those off the main thread reaches NSSearchFieldCell's
Swift NSSearchFieldAquaduckVisualProvider.__ivar_destroyer, which is not
safe off the main thread and crashes.
Make ControlFactory use DestructionThread::MainRunLoop so its destructor
(and thus its cached AppKit cells' -dealloc) always runs on the main run
loop, regardless of which thread drops the last reference. This covers
every owner (RemoteGraphicsContext, ImageBufferDisplayListBackend,
ControlPart's override factory); the never-destroyed main-thread singleton
is unaffected.
* Source/WebCore/platform/graphics/controls/ControlFactory.h:
* Source/WebCore/platform/graphics/mac/controls/ControlFactoryMac.h:
* Source/WebCore/platform/graphics/mac/controls/ControlFactoryMac.mm:
(WebCore::ControlFactoryMac::~ControlFactoryMac):
*
LayoutTests/fast/forms/search/search-field-gpu-process-teardown-no-crash-expected.txt:
Added.
*
LayoutTests/fast/forms/search/search-field-gpu-process-teardown-no-crash.html:
Added.
Originally-landed-as: 316606.158@safari-7625-branch (d4d8214bc7f6).
rdar://187506855
Canonical link: https://commits.webkit.org/321403@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
