Bug 195502

Summary: The event dispatcher thread reads ScrollingTree's m_rootNode without locking
Product: WebKit Reporter: Simon Fraser (smfr) <simon.fraser>
Component: ScrollingAssignee: Nobody <webkit-unassigned>
Status: NEW ---    
Severity: Normal    
Priority: P2    
Version: WebKit Nightly Build   
Hardware: Unspecified   
OS: Unspecified   

Description Simon Fraser (smfr) 2019-03-08 17:24:53 PST
ScrollingTree::shouldHandleWheelEventSynchronously() which runs on the event dispatcher thread consults m_rootNode, but no locking prevents this being modified by the scrolling thread at the same time.