Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 559622a9eb506a6562041f96eb2c09f3d6b577ee
https://github.com/WebKit/WebKit/commit/559622a9eb506a6562041f96eb2c09f3d6b577ee
Author: Ian Grunert <[email protected]>
Date: 2026-08-02 (Sun, 02 Aug 2026)
Changed paths:
M LayoutTests/platform/win/TestExpectations
M Source/WTF/wtf/RunLoop.h
M Source/WTF/wtf/win/RunLoopWin.cpp
Log Message:
-----------
[Win] RunLoopWin Timer can be destroyed before its FireTimerMessage is
dispatched
https://bugs.webkit.org/show_bug.cgi?id=318867
Reviewed by Justin Michaud.
fireTimers() posted a FireTimerMessage carrying a raw TimerBase*, but
stop()/~TimerBase()
never cancelled an already-posted message, so wndProc() could use a timer that
was
destroyed before the message was dispatched (e.g. across a nested modal run
loop).
Post a pointer-free FireTimerMessage instead: fireTimers() enqueues the timer
on a new
m_timersToFire deque guarded by m_loopLock, wndProc() fires the next live one,
and stop()
removes itself from the deque.
The no-javascript-* Windows crash expectations are removed so the testers can
confirm.
* Source/WTF/wtf/RunLoop.h:
* Source/WTF/wtf/win/RunLoopWin.cpp:
(WTF::RunLoop::wndProc):
(WTF::RunLoop::fireTimers):
(WTF::RunLoop::TimerBase::stop):
* LayoutTests/platform/win/TestExpectations:
Canonical link: https://commits.webkit.org/318419@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
