Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: b4925b759d58d7263d828afc861163305f079e18
https://github.com/WebKit/WebKit/commit/b4925b759d58d7263d828afc861163305f079e18
Author: Ahmad Saleem <[email protected]>
Date: 2026-10-06 (Tue, 06 Oct 2026)
Changed paths:
M Source/WebCore/dom/Document.cpp
M Source/WebCore/dom/Document.h
M Source/WebCore/dom/IdleCallbackController.cpp
M Source/WebCore/dom/IdleCallbackController.h
M Source/WebCore/page/DOMWindow.cpp
M Source/WebCore/page/DOMWindow.h
M Source/WebCore/page/LocalDOMWindow.cpp
M Source/WebCore/page/LocalDOMWindow.h
Log Message:
-----------
requestIdleCallback handles above 2^31 cannot be cancelled because C++ uses
int for the IDL unsigned long handle
https://bugs.webkit.org/show_bug.cgi?id=326471
rdar://189266546
Reviewed by Ryosuke Niwa.
The requestIdleCallback spec declares the handle as `unsigned long`, and
IdleCallbackController stores it as `unsigned`, but the C++ plumbing in
between (DOMWindow, LocalDOMWindow, Document, IdleCallbackController)
passed it as `int`. The generated binding converts the JS argument with
convert<IDLUnsignedLong>() and then silently narrows the uint32_t to int.
Once a document has issued 2^31 handles, requestIdleCallback() returns
2147483648 to script, but cancelIdleCallback(2147483648) arrives as
INT_MIN and removeIdleCallback() bails out on its `<= 0` check, so the
callback still runs.
Use `unsigned` throughout so the handle round-trips unchanged, and drop
the now-unneeded signed check in removeIdleCallback().
No new test: this needs 2^31 requestIdleCallback() calls in a single
document, which is far beyond any test timeout.
* Source/WebCore/dom/Document.cpp:
(WebCore::Document::requestIdleCallback):
(WebCore::Document::cancelIdleCallback):
* Source/WebCore/dom/Document.h:
* Source/WebCore/dom/IdleCallbackController.cpp:
(WebCore::IdleCallbackController::queueIdleCallback):
(WebCore::IdleCallbackController::removeIdleCallback):
* Source/WebCore/dom/IdleCallbackController.h:
* Source/WebCore/page/DOMWindow.cpp:
(WebCore::DOMWindow::requestIdleCallback):
(WebCore::DOMWindow::cancelIdleCallback):
* Source/WebCore/page/DOMWindow.h:
* Source/WebCore/page/LocalDOMWindow.cpp:
(WebCore::LocalDOMWindow::requestIdleCallback):
(WebCore::LocalDOMWindow::cancelIdleCallback):
* Source/WebCore/page/LocalDOMWindow.h:
Canonical link: https://commits.webkit.org/322942@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
