Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 90cbe5e8552858d3b1fb959864db034b5b91c9f4
https://github.com/WebKit/WebKit/commit/90cbe5e8552858d3b1fb959864db034b5b91c9f4
Author: Dan Hecht <[email protected]>
Date: 2026-07-30 (Thu, 30 Jul 2026)
Changed paths:
M Source/bmalloc/libpas/src/libpas/pas_thread_local_cache.c
Log Message:
-----------
[libpas] Fix a benign read from a deallocated TLC
https://bugs.webkit.org/show_bug.cgi?id=320595
rdar://183569873
Reviewed by Yusuke Suzuki.
The preceding lines may have called deallocate(thread_local_cache)
so thread_local_cache shouldn't be dereferenced to get the lock.
This is benign, however, because:
1. TLC allocations are in the large utility free heap which doesn't write
metadata into freed blocks.
2. The heap lock is held so the memory won't be recycled or decommitted
in the meantime.
3. No other allocations in this window come from the large utility free heap.
* Source/bmalloc/libpas/src/libpas/pas_thread_local_cache.c:
(pas_thread_local_cache_get_local_allocator_slow):
Canonical link: https://commits.webkit.org/318255@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
