Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 21ab50e40f062d97c1d1eb47f5d42e51bc201203
https://github.com/WebKit/WebKit/commit/21ab50e40f062d97c1d1eb47f5d42e51bc201203
Author: Kai Tamkun <[email protected]>
Date: 2026-06-02 (Tue, 02 Jun 2026)
Changed paths:
A LayoutTests/js/regress-311234-expected.txt
A LayoutTests/js/regress-311234.html
M Source/JavaScriptCore/runtime/DeferredWorkTimer.h
M Source/JavaScriptCore/runtime/WaiterListManager.cpp
M Source/JavaScriptCore/runtime/WaiterListManager.h
Log Message:
-----------
[JSC] Data race in WaiterListManager::unregister
https://bugs.webkit.org/show_bug.cgi?id=311234
rdar://173161138
Reviewed by Yijia Huang.
Stores a JSGlobalObject pointer in JSC::Waiter so that it doesn't
have to be fetched from the target.
Test: js/regress-311234.html
* LayoutTests/js/regress-311234-expected.txt: Added.
* LayoutTests/js/regress-311234.html: Added.
* Source/JavaScriptCore/runtime/DeferredWorkTimer.h:
* Source/JavaScriptCore/runtime/WaiterListManager.cpp:
(JSC::Waiter::Waiter):
(JSC::WaiterListManager::unregister):
(JSC::Waiter::dump const):
* Source/JavaScriptCore/runtime/WaiterListManager.h:
Originally-landed-as: 305413.625@rapid/safari-7624.2.5.110-branch
(3b7488ef5bc6). rdar://176059262
Canonical link: https://commits.webkit.org/314376@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
