Race
56 commits
Concurrency race, TOCTOU, data race on shared state.
2026-W37 2026-09-12 – 18
- finalizeWasmCalleeCleanup should run a cross-modifying code fence
- [macOS] GPU process crash in NSSearchFieldAquaduckVisualProvider.__ivar_destroyer under ~ControlFactoryMac
- Crash under configureForAdvancedPrivacyProtections() due to thread safety issue
2026-W36 2026-09-05 – 11
2026-W35 2026-08-29 – 09-04
- Unreviewed, reverting 681@main (95c3cfc25878)
- Race Condition in RemoteImageDecoderAVFProxy
- [WebGPU] ~CommandBuffer can run on Metal completion thread, racing non-atomic CommandEncoder refcount and Device::m_commandEncoderMap
- [threaded-animations] cross-thread UAF in UIProcess via unguarded static TinyLRUCache in AcceleratedEffect polygon path cache
- Race window lead to reads from deallocated memory
- RemoteLayerTreeEventDispatcher: add lock to guard access to m_momentumEventDispatcher
2026-W34 2026-08-22 – 28
- Unsynchronized cross-thread access to m_opaqueResponseToSizeWithPaddingMap in CacheStorageConnection::computeRecordBodySize
- Race on RemoteVideoDecoderCallbacks::m_timestampToDuration leads to use-after-free
- Make ImageDecoderFactoryAVF thread safe
- [WebCore] Unsynchronized access to process-global serializedPrimitiveValues() HashMap in CSSPrimitiveValue::customCSSText from Worker thread
- Heap-use-after-free of RemoteLayerTreeEventDispatcher's RunLoop::Timer on the scrolling thread
2026-W33 2026-08-15 – 21
2026-W32 2026-08-08 – 14
- PathCG should use thread-safe scratchContext
- Data race reading the process-global TrackerDomainLookupInfo map from the network resolver thread in WebPrivacyHelpers
2026-W31 2026-08-01 – 07
2026-W26 2026-06-27 – 07-03
- Data race in JSStyleSheet::visitAdditionalChildren during GC leading to use-after-free
- [WebKit] Cross-thread use-after-free in RemoteSampleBufferDisplayLayer via off-main layerErrorDidChange() from FlushAndRemoveImage @catch
- [CoreIPC] [GPUP] off-main-thread ~CDMSessionAVContentKeySession mutates unlocked LegacyCDMPrivateAVFObjC::m_sessions Vector
- Data race on MIMETypeCache::m_cachedResults / m_supportedTypes in MIMETypeCache::canDecodeType
- Fix Cross-thread use-after-free in RemoteScrollingTree::m_progressBasedTimelineRegistry
- [WebCore] Store WaveShaperProcessor curve as Vector<float> to avoid cross-thread RefCounted race
- [CoreIPC] [GPUP] off-main-thread ~RemoteAudioMediaStreamTrackRendererInternalUnitManagerUnit mutates unlocked AudioSession interruption-observer WeakHashSet
- Data race in JSTextTrackCue::visitAdditionalChildrenInGCThread leading to use-after-free (variant of bug 311800)
- Use-after-free in -[_WKWebExtensionDeclarativeNetRequestRule _resourcesToTargetWhenNoneAreSpecifiedInRule] on concurrent queue.
- [libpas] Fix race in pas_segregated_heap_medium_size_directory_for_index
- [CoreIPC][GPUProcess] UserMediaCaptureManagerProxy::startProducingData races prepareAudioDescription() against audioSamplesAvailable() lead to various UAF/write-after-unmap
- Dynamic content scaling display lists should not be requested while preparing for display
- [WebGL] Missing objectGraphLock on WebGL context restore races with GC
- Cross-Thread Destruction of BlobData Races Non-Thread-Safe RefCounted<BlobDataFileReference> Leads to UAF
- Fix data race on m_outgoingMessageQueueIsGrowingLargeCallback in IPC::Connection
- UAF due to cross-thread destruction of worker DeferredPromise in WebLockManager::query()
- [WebCore] Take graphLock() in BiquadFilterNode::setType() to avoid race
- [JSC] Missing codeBlock->m_lock in repatchGetBySlowPathCall
- [WebCore] Data race on VideoFrameLibWebRTC::m_conversionCallback between clone and pixelBuffer causes use-after-free
- PathCG::strokeContains() is not thread safe
2026-W24 2026-06-13 – 19
- Race condition in JSSubscriber::visitAdditionalChildren during GC
- FEMorphologySoftwareApplier is not thread safe
- Concurrent HashMap access leads to MTE crashes
- [CoreIPC][GPU] Use-after-free on `ControlFactory::singleton()` due to usage of non-thread-safe RefCounted
- [CoreIPC] TOCTOU in `logOnBehalfOfWebContent` leads to logging of OOB memory
2026-W23 2026-06-06 – 12
- [JSC] Make wasm name section parsing threadsafe
- [JSC] `Heap::clearConcurrentRetainedDataIfPossible()` should not run while concurrent marking is active
- Data race in Range::visitNodesConcurrently during GC, leading to a use-after-free of RangeBoundaryPoint container nodes
- Data race in Range::visitNodesConcurrently during GC, leading to a use-after-free of RangeBoundaryPoint container nodes
- Race condition in Node::traverseToOpaqueRoot
2026-W22 2026-05-30 – 06-05
- [JSC] Data race in WaiterListManager::unregister
2026-W21 2026-05-23 – 29
- [JSC] JSLock m_hasOwnerThread has concurrency issue
- [JSC] Use span's length in genericTypedArrayViewProtoFuncSortImpl
- Concurrent HashMap access leads to MTE crashes