Race
40 commits
Concurrency race, TOCTOU, data race on shared state.
2026-W33 2026-08-15 – 21
2026-W32 2026-08-08 – 14
- PathCG should use thread-safe scratchContext
- Data race reading the process-global TrackerDomainLookupInfo map from the network resolver thread in WebPrivacyHelpers
2026-W31 2026-08-01 – 07
2026-W26 2026-06-27 – 07-03
- Data race in JSStyleSheet::visitAdditionalChildren during GC leading to use-after-free
- [WebKit] Cross-thread use-after-free in RemoteSampleBufferDisplayLayer via off-main layerErrorDidChange() from FlushAndRemoveImage @catch
- [CoreIPC] [GPUP] off-main-thread ~CDMSessionAVContentKeySession mutates unlocked LegacyCDMPrivateAVFObjC::m_sessions Vector
- Data race on MIMETypeCache::m_cachedResults / m_supportedTypes in MIMETypeCache::canDecodeType
- Fix Cross-thread use-after-free in RemoteScrollingTree::m_progressBasedTimelineRegistry
- [WebCore] Store WaveShaperProcessor curve as Vector<float> to avoid cross-thread RefCounted race
- [CoreIPC] [GPUP] off-main-thread ~RemoteAudioMediaStreamTrackRendererInternalUnitManagerUnit mutates unlocked AudioSession interruption-observer WeakHashSet
- Data race in JSTextTrackCue::visitAdditionalChildrenInGCThread leading to use-after-free (variant of bug 311800)
- Use-after-free in -[_WKWebExtensionDeclarativeNetRequestRule _resourcesToTargetWhenNoneAreSpecifiedInRule] on concurrent queue.
- [libpas] Fix race in pas_segregated_heap_medium_size_directory_for_index
- [CoreIPC][GPUProcess] UserMediaCaptureManagerProxy::startProducingData races prepareAudioDescription() against audioSamplesAvailable() lead to various UAF/write-after-unmap
- Dynamic content scaling display lists should not be requested while preparing for display
- [WebGL] Missing objectGraphLock on WebGL context restore races with GC
- Cross-Thread Destruction of BlobData Races Non-Thread-Safe RefCounted<BlobDataFileReference> Leads to UAF
- Fix data race on m_outgoingMessageQueueIsGrowingLargeCallback in IPC::Connection
- UAF due to cross-thread destruction of worker DeferredPromise in WebLockManager::query()
- [WebCore] Take graphLock() in BiquadFilterNode::setType() to avoid race
- [JSC] Missing codeBlock->m_lock in repatchGetBySlowPathCall
- [WebCore] Data race on VideoFrameLibWebRTC::m_conversionCallback between clone and pixelBuffer causes use-after-free
- PathCG::strokeContains() is not thread safe
2026-W24 2026-06-13 – 19
- Race condition in JSSubscriber::visitAdditionalChildren during GC
- FEMorphologySoftwareApplier is not thread safe
- Concurrent HashMap access leads to MTE crashes
- [CoreIPC][GPU] Use-after-free on `ControlFactory::singleton()` due to usage of non-thread-safe RefCounted
- [CoreIPC] TOCTOU in `logOnBehalfOfWebContent` leads to logging of OOB memory
2026-W23 2026-06-06 – 12
- [JSC] Make wasm name section parsing threadsafe
- [JSC] `Heap::clearConcurrentRetainedDataIfPossible()` should not run while concurrent marking is active
- Data race in Range::visitNodesConcurrently during GC, leading to a use-after-free of RangeBoundaryPoint container nodes
- Data race in Range::visitNodesConcurrently during GC, leading to a use-after-free of RangeBoundaryPoint container nodes
- Race condition in Node::traverseToOpaqueRoot
2026-W22 2026-05-30 – 06-05
- [JSC] Data race in WaiterListManager::unregister
2026-W21 2026-05-23 – 29
- [JSC] JSLock m_hasOwnerThread has concurrency issue
- [JSC] Use span's length in genericTypedArrayViewProtoFuncSortImpl
- Concurrent HashMap access leads to MTE crashes