Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 99d64d9ab12bf3e0977fc299da19c126f69a076a
https://github.com/WebKit/WebKit/commit/99d64d9ab12bf3e0977fc299da19c126f69a076a
Author: Youenn Fablet <[email protected]>
Date: 2026-08-31 (Mon, 31 Aug 2026)
Changed paths:
M Source/WebCore/workers/service/context/ServiceWorkerThread.cpp
M Source/WebCore/workers/service/context/ServiceWorkerThread.h
Log Message:
-----------
ServiceWorkerThread can fire events while its related scope is stopped
rdar://185766290
https://bugs.webkit.org/show_bug.cgi?id=322586
Reviewed by Chris Dumez.
ServiceWorkerThread is queuing a task on its scope vent loop to fire events.
This can race with stopping the service worker.
For normal non main thread service workers, this is not an issue as we post a
task to terminate.
For main thread service workers, stopping the service worker means destroying
the script, which can happen between the time we queue a task to fire the event
and the time we fire the event.
We fix this by adding a shared ServiceWorkerThread::queueTaskToFireEvent
helper, used by all the queueTaskToFire*/queueTaskToPostMessage methods.
It checks whether activeDOMObjectsAreStopped before invoking the event
callback, which is true once WorkerOrWorkletGlobalScope::prepareForDestruction
is called.
* Source/WebCore/workers/service/context/ServiceWorkerThread.cpp:
(WebCore::ServiceWorkerThread::queueTaskToFireEvent):
(WebCore::ServiceWorkerThread::queueTaskToFireFetchEvent):
(WebCore::ServiceWorkerThread::queueTaskToPostMessage):
(WebCore::ServiceWorkerThread::queueTaskToFireInstallEvent):
(WebCore::ServiceWorkerThread::queueTaskToFireActivateEvent):
(WebCore::ServiceWorkerThread::queueTaskToFirePushEvent):
(WebCore::ServiceWorkerThread::queueTaskToFireDeclarativePushEvent):
(WebCore::ServiceWorkerThread::queueTaskToFirePushSubscriptionChangeEvent):
(WebCore::ServiceWorkerThread::queueTaskToFireNotificationEvent):
(WebCore::ServiceWorkerThread::queueTaskToFireBackgroundFetchEvent):
(WebCore::ServiceWorkerThread::queueTaskToFireBackgroundFetchClickEvent):
* Source/WebCore/workers/service/context/ServiceWorkerThread.h:
Canonical link: https://commits.webkit.org/320145@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
