Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 6d581f5af3ee9952c4d2a53c03c9b950fcb29ed3
https://github.com/WebKit/WebKit/commit/6d581f5af3ee9952c4d2a53c03c9b950fcb29ed3
Author: Ahmad Saleem <[email protected]>
Date: 2026-10-06 (Tue, 06 Oct 2026)
Changed paths:
M Source/WebCore/dom/Document.cpp
M Source/WebCore/dom/Document.h
M Source/WebCore/dom/RequestAnimationFrameCallback.h
M Source/WebCore/dom/ScriptedAnimationController.h
M Source/WebCore/page/DOMWindow.cpp
M Source/WebCore/page/DOMWindow.h
M Source/WebCore/page/LocalDOMWindow.cpp
M Source/WebCore/page/LocalDOMWindow.h
M Source/WebCore/workers/DedicatedWorkerGlobalScope.h
M Source/WebCore/workers/WorkerAnimationController.h
Log Message:
-----------
requestAnimationFrame handles use int in C++ but unsigned long in IDL
https://bugs.webkit.org/show_bug.cgi?id=326480
rdar://189270148
Reviewed by Ryosuke Niwa.
AnimationFrameProvider declares the requestAnimationFrame() handle as
`unsigned long`, but the C++ implementation on both Window
(DOMWindow, LocalDOMWindow, Document, ScriptedAnimationController) and
DedicatedWorkerGlobalScope (WorkerAnimationController) used `int`. The
generated bindings narrow the uint32_t argument to int, and the
`++m_nextCallbackId` counters are signed, so they overflow (undefined
behavior) after 2^31 requests. Handles still round-trip today only
because both directions narrow identically.
Use `unsigned` for the handle throughout so it matches the IDL and the
counters wrap with defined behavior. The Inspector instrumentation
hooks keep taking `int`, since they share JSC's async-call identifier
type with timers and postMessage.
No new test: there is no web-observable behavior change, and reaching
the overflow needs 2^31 requestAnimationFrame() calls.
* Source/WebCore/dom/Document.cpp:
(WebCore::Document::requestAnimationFrame):
(WebCore::Document::cancelAnimationFrame):
* Source/WebCore/dom/Document.h:
* Source/WebCore/dom/RequestAnimationFrameCallback.h:
* Source/WebCore/dom/ScriptedAnimationController.h:
* Source/WebCore/page/DOMWindow.cpp:
(WebCore::DOMWindow::requestAnimationFrame):
(WebCore::DOMWindow::webkitRequestAnimationFrame):
(WebCore::DOMWindow::cancelAnimationFrame):
* Source/WebCore/page/DOMWindow.h:
* Source/WebCore/page/LocalDOMWindow.cpp:
(WebCore::LocalDOMWindow::requestAnimationFrame):
(WebCore::LocalDOMWindow::webkitRequestAnimationFrame):
(WebCore::LocalDOMWindow::cancelAnimationFrame):
* Source/WebCore/page/LocalDOMWindow.h:
* Source/WebCore/workers/DedicatedWorkerGlobalScope.h:
* Source/WebCore/workers/WorkerAnimationController.h:
Canonical link: https://commits.webkit.org/322922@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
