Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 9e74021a2f6df53821e4bc9b6405f8a2a3f67913
https://github.com/WebKit/WebKit/commit/9e74021a2f6df53821e4bc9b6405f8a2a3f67913
Author: Adrian Taylor <[email protected]>
Date: 2026-09-23 (Wed, 23 Sep 2026)
Changed paths:
M Source/WTF/wtf/Borrow.h
M Tools/TestWebKitAPI/Tests/WTF/Borrow.cpp
Log Message:
-----------
Guard against out of order borrows
https://bugs.webkit.org/show_bug.cgi?id=324545
rdar://187781375
Reviewed by Geoffrey Garen.
Borrow is a form of runtime protection against mutation of an object while
another object has a view of it. The object itself stores a Boolean representing
whether it's borrowed (in the case of Vector, one of its precious bits is used
for it).
If Borrow lifespans were like this:
<--- Borrow A --->
<--- Borrow B --->
then the borrow bit would be cleared at the end of A, and memory safety errors
could exist during the remainder of the B borrow span.
This was difficult to achieve because Borrows are always stack-scoped, but
that doesn't mean they always strictly nest, as the included test shows.
setIsBorrowed() already returns the state it replaced, so Borrow's destructor
can assert that the object is still borrowed at the point it releases, with no
change to the CanBorrow protocol. The out-of-order case is caught when the
later borrow is released.
This is not currently intended to be actual protection against this scenario -
just a debug assertion to help us find cases where this pattern might occur. In
any case, the assertion happens at the end of Borrow B, which is too late for
actual protection.
Test: Tools/TestWebKitAPI/Tests/WTF/Borrow.cpp
Canonical link: https://commits.webkit.org/321683@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
