RESOLVED FIXED309776
Race condition in JSXPathResult::visitAdditionalChildren during GC 
https://bugs.webkit.org/show_bug.cgi?id=309776
Summary Race condition in JSXPathResult::visitAdditionalChildren during GC
Ryosuke Niwa
Reported 2026-03-12 03:34:06 PDT
JSXPathResult::visitAdditionalChildren is not thread safe. Make it safe. <rdar://172263146>
Attachments
Add attachment proposed patch, testcase, etc.
Ryosuke Niwa
Comment 1 2026-03-12 03:41:59 PDT
Pull request: https://github.com/apple/WebKit/pull/4683
Ryosuke Niwa
Comment 2 2026-03-12 12:49:30 PDT
Pull request: https://github.com/apple/WebKit/pull/4690
Ryosuke Niwa
Comment 3 2026-03-12 19:50:20 PDT
Pull request: https://github.com/apple/WebKit/pull/4700
EWS
Comment 4 2026-03-13 23:59:15 PDT
Committed 305413.475@safari-7624-branch (97ed68c66545): <https://commits.webkit.org/305413.475@safari-7624-branch> Reviewed commits have been landed. Closing PR #4700 and removing active labels.
EWS
Comment 5 2026-03-26 22:02:52 PDT
Committed ? (a49421e4185a): <https://commits.webkit.org/a49421e4185a> Reviewed commits have been landed. Closing PR #4816 and removing active labels.
EWS
Comment 6 2026-03-26 22:06:53 PDT
Committed ? (f23e2dda6f07): <https://commits.webkit.org/f23e2dda6f07> Reviewed commits have been landed. Closing PR #4832 and removing active labels.
Note You need to log in before you can comment on or make changes to this bug.