Branch: refs/heads/webkitglib/2.52
Home: https://github.com/WebKit/WebKit
Commit: 9665cbc165609c3bda1bf4cd232fa096c0fcfbb4
https://github.com/WebKit/WebKit/commit/9665cbc165609c3bda1bf4cd232fa096c0fcfbb4
Author: Ryosuke Niwa <[email protected]>
Date: 2026-05-29 (Fri, 29 May 2026)
Changed paths:
M Source/WebCore/html/track/TrackBase.cpp
M Source/WebCore/html/track/TrackBase.h
Log Message:
-----------
Cherry-pick 305413.636@safari-7624-branch (33be61fed07c).
https://bugs.webkit.org/show_bug.cgi?id=311800
Data race in TrackBase::opaqueRoot during GC leading to use-after-free
https://bugs.webkit.org/show_bug.cgi?id=311800
rdar://173766033
Reviewed by Jer Noble.
Store the opaque root value separately from m_trackList to avoid data race
during GC.
No new tests since there is no reliable way to test this data race.
* Source/WebCore/html/track/TrackBase.cpp:
(WebCore::TrackBase::setTrackList):
(WebCore::TrackBase::clearTrackList):
(WebCore::TrackBase::opaqueRoot): Deleted.
* Source/WebCore/html/track/TrackBase.h:
(WebCore::TrackBase::opaqueRoot const):
Identifier: 305413.636@safari-7624-branch
Canonical link: https://commits.webkit.org/305877.689@webkitglib/2.52
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
