312726 2026-04-19 09:46:29 -0700 ThreadSanitizer reports false-positive data race on ThreadSafeWeakPtrControlBlock members after relaxed load of control block pointer 2026-04-20 17:14:07 -0700 1 1 1 Unclassified WebKit Web Template Framework WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 ddkilzer ddkilzer webkit-bug-importer oldest_to_newest 2202003 0 ddkilzer 2026-04-19 09:46:29 -0700 ThreadSanitizer (TSan) reports a data race between the non-atomic initialization of `ThreadSafeWeakPtrControlBlock` members and subsequent atomic operations on them (e.g., `WordLock::lock()`). The `controlBlock()` method in `ThreadSafeRefCountedAndCanMakeThreadSafeWeakPtr` stores the newly allocated control block pointer into `m_bits` with `memory_order_release` to ensure other threads see the initialized ref count and object pointer. However, callers in `ref()`, `deref()`, and the losing-CAS path of `controlBlock()` itself read `m_bits` with `loadRelaxed()` before dereferencing the pointer to access the control block's members. Under the C++ memory model, a relaxed load does not formally synchronize with a release store, so TSan correctly flags the subsequent member access as a data race. ARM64 dependency ordering and x86 strong ordering make this benign in practice, but the formal C++ memory model requires `memory_order_acquire` on the load to synchronize with the `memory_order_release` store. 2202004 1 webkit-bug-importer 2026-04-19 09:46:36 -0700 <rdar://problem/175117037> 2202006 2 ddkilzer 2026-04-19 10:06:53 -0700 Pull request: https://github.com/WebKit/WebKit/pull/63076 2202492 3 ews-feeder 2026-04-20 17:14:04 -0700 Committed 311633@main (1ae1abc47aac): <https://commits.webkit.org/311633@main> Reviewed commits have been landed. Closing PR #63076 and removing active labels.