Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 4b909e882ddebcdf5b5e01ee6499a4ddb7f25940
https://github.com/WebKit/WebKit/commit/4b909e882ddebcdf5b5e01ee6499a4ddb7f25940
Author: Abrar Rahman Protyasha <[email protected]>
Date: 2026-05-11 (Mon, 11 May 2026)
Changed paths:
M Source/WebKit/UIProcess/API/ios/WKWebViewIOS.mm
M Source/WebKit/UIProcess/RemoteLayerTree/RemoteLayerTreeDrawingAreaProxy.h
M Source/WebKit/UIProcess/RemoteLayerTree/RemoteLayerTreeDrawingAreaProxy.mm
M Source/WebKit/UIProcess/RemoteLayerTree/RemoteLayerTreeHost.h
M Source/WebKit/UIProcess/RemoteLayerTree/RemoteLayerTreeHost.mm
M Source/WebKit/UIProcess/RemoteLayerTree/RemoteLayerTreeNode.h
M
Source/WebKit/UIProcess/RemoteLayerTree/RemoteScrollingCoordinatorProxy.cpp
M Source/WebKit/UIProcess/RemoteLayerTree/RemoteScrollingCoordinatorProxy.h
M
Source/WebKit/UIProcess/RemoteLayerTree/ios/RemoteScrollingCoordinatorProxyIOS.mm
M
Source/WebKit/UIProcess/RemoteLayerTree/mac/RemoteScrollingCoordinatorProxyMac.mm
M Source/WebKit/UIProcess/ios/WKBaseScrollView.mm
M Source/WebKit/UIProcess/ios/WKContentViewInteraction.mm
Log Message:
-----------
REGRESSION(310247@main): UI process may hit assertIsCurrent() threading check
under eventRegionForLayer()
https://bugs.webkit.org/show_bug.cgi?id=314533
rdar://176158495
Reviewed by Chris Dumez.
Here is an abridged backtrace of the assertion:
```
WTF::assertIsCurrent(WTF::ThreadLikeAssertion const&)
WTF::RefCountDebuggerImpl<0>::applyRefDerefThreadingCheck(unsigned int)
WTF::RefCountedAndCanMakeWeakPtr<WebKit::RemoteLayerTreeNode>::deref()
WTF::RefPtr<WebKit::RemoteLayerTreeNode, ...>::~RefPtr()
WebKit::eventRegionForLayer(CALayer*)
WebKit::layerEventRegionContainsPoint(CALayer*, CGPoint)
```
310247@main widened the timing window to hit a latent issue where both
the scrolling and the main thread can take RefPtr<RemoteLayerTreeNode>
instances via forCALayer(), through scrollingThreadHandleWheelEvent()
and eventRegionForLayer() paths respectively.
Since RemoteLayerTreeNode does not have thread-safe ref counting, we can
assert when we consume a Ref in the main thread when m_ownerThread was
previously claimed by the scrolling thread (imagine any interleaving of
the offending codepaths from above).
Fix: we make RemoteLayerTreeNode a ThreadSafeRefCountedAndCanMakeWeakPtr
type. It fits well with our general "RefPtr-and-call-it-a-day" strategy
and relieves callsites from the burden of having to reason about node
lifecycles.
Additionally, add LIFETIME_BOUND to RemoteLayerTreeNode::layer() and
update rootLayer()/layerForID() to return RetainPtr<CALayer>, ensuring
callers cannot accidentally hold a dangling CALayer* after the node is
destroyed. Remove incorrect NODELETE annotations from a couple of
getters in RemoteScrollingCoordinatorProxy.
* Source/WebKit/UIProcess/API/ios/WKWebViewIOS.mm:
(-[WKWebView _layerForFindOverlay]):
* Source/WebKit/UIProcess/RemoteLayerTree/RemoteLayerTreeDrawingAreaProxy.h:
* Source/WebKit/UIProcess/RemoteLayerTree/RemoteLayerTreeDrawingAreaProxy.mm:
(WebKit::RemoteLayerTreeDrawingAreaProxy::commitLayerTreeTransaction):
(WebKit::RemoteLayerTreeDrawingAreaProxy::updateDebugIndicator):
(WebKit::RemoteLayerTreeDrawingAreaProxy::layerWithIDForTesting const):
* Source/WebKit/UIProcess/RemoteLayerTree/RemoteLayerTreeHost.h:
(WebKit::RemoteLayerTreeHost::rootNode const):
* Source/WebKit/UIProcess/RemoteLayerTree/RemoteLayerTreeHost.mm:
(WebKit::RemoteLayerTreeHost::updateLayerTree):
(WebKit::RemoteLayerTreeHost::layerWithIDForTesting const):
(WebKit::RemoteLayerTreeHost::layerForID const):
(WebKit::RemoteLayerTreeHost::rootLayer const):
* Source/WebKit/UIProcess/RemoteLayerTree/RemoteLayerTreeNode.h:
* Source/WebKit/UIProcess/RemoteLayerTree/RemoteScrollingCoordinatorProxy.cpp:
(WebKit::RemoteScrollingCoordinatorProxy::hasScrollableMainFrame const):
(WebKit::RemoteScrollingCoordinatorProxy::hasScrollableOrZoomedMainFrame const):
* Source/WebKit/UIProcess/RemoteLayerTree/RemoteScrollingCoordinatorProxy.h:
*
Source/WebKit/UIProcess/RemoteLayerTree/ios/RemoteScrollingCoordinatorProxyIOS.mm:
(WebKit::RemoteScrollingCoordinatorProxyIOS::connectStateNodeLayers):
* Source/WebKit/UIProcess/ios/WKContentViewInteraction.mm:
(-[WKContentView _viewForLayerID:]):
Canonical link: https://commits.webkit.org/313049@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
