)]}'
{
  "commit": "23cf554e645f61acabcd10aac24bfe6d6b0eeeec",
  "tree": "e47721032ea12e4d302fed91a7ecfe9407138823",
  "parents": [
    "c801e774e7ecdf68f03f326ca4570732de3ca5c1"
  ],
  "author": {
    "name": "Lokbondo Kung",
    "email": "lokokung@google.com",
    "time": "Fri Jun 05 23:02:56 2026 -0700"
  },
  "committer": {
    "name": "dawn-scoped@luci-project-accounts.iam.gserviceaccount.com",
    "email": "dawn-scoped@luci-project-accounts.iam.gserviceaccount.com",
    "time": "Fri Jun 05 23:02:56 2026 -0700"
  },
  "message": "Reland \"[native] Guarantee thread safety during the map async callback.\"\n\n- This is a reland of commit fd625322444f0c207ac196e258d218a9237ce72e\n- Moves locking in map callback in tests. The lock should be held for\n  the entire duration of the expectation handling, not only during the\n  callback because the callback captures a reference to the `slot`\n  which could be invalidated if the expectation states were modified.\n  On top of that, it was causing a lock inversion issue under TSAN\n  noted in the bug. The original lock was also incorrect because we\n  would take that lock when we access all the buffers to Unmap or\n  Destroy the expectation buffers, but also try to take the lock again\n  in the callback. That means it could have been possible to deadlock\n  if we were using AllowSpontaneous instead of AllowProcessEvents,\n  i.e. imagine taking the lock, calling Unmap which spontaneously\n  calls the callback which tries to take the lock again in the same\n  thread.\n\nBug: 517692772\nOriginal change\u0027s description:\n\u003e [native] Guarantee thread safety during the map async callback.\n\u003e\n\u003e - This change makes the pending map mutex into a recursive one so\n\u003e   that it can be held throughout the duration of the map async\n\u003e   callback. This ensures that during the callback, there cannot be\n\u003e   a race with Unmap or Destroy.\n\u003e - This addresses the security bug below by because on the server,\n\u003e   the call to GetMappedRange always happens in the scope of the map\n\u003e   async callback. This means that even if an Unmap or Destroy\n\u003e   races, either the Unmap/Destroy will happen first, thereby\n\u003e   resulting in a failed map async callback, or the callback will\n\u003e   happen first before the Unmap goes through.\n\u003e - Note that we needed to use a recursive mutex instead of a normal\n\u003e   one because otherwise, a map async callback that calls Unmap\n\u003e   would deadlock.\n\u003e\n\u003e Bug: 517692772\n\u003e Change-Id: I25068c3722a138ec3014a5b942457e5d484462ec\n\u003e Reviewed-on: https://dawn-review.googlesource.com/c/dawn/+/313216\n\u003e Reviewed-by: Kai Ninomiya \u003ckainino@chromium.org\u003e\n\u003e Reviewed-by: Kyle Charbonneau \u003ckylechar@google.com\u003e\n\u003e Commit-Queue: Loko Kung \u003clokokung@google.com\u003e\n\nBug: 517692772\nChange-Id: Ic07bacc8e99cf8305038c1489458218a3f138e6c\nReviewed-on: https://dawn-review.googlesource.com/c/dawn/+/313915\nAuto-Submit: Loko Kung \u003clokokung@google.com\u003e\nReviewed-by: Kai Ninomiya \u003ckainino@chromium.org\u003e\nCommit-Queue: Kai Ninomiya \u003ckainino@chromium.org\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "866fe8627279a97d319c79435df580a334516701",
      "old_mode": 33188,
      "old_path": "src/dawn/native/Buffer.cpp",
      "new_id": "93d475ae83d31884086aba36152c8dfa823767c8",
      "new_mode": 33188,
      "new_path": "src/dawn/native/Buffer.cpp"
    },
    {
      "type": "modify",
      "old_id": "217818364e643c8552948d2e8c557061faeaf05e",
      "old_mode": 33188,
      "old_path": "src/dawn/native/Buffer.h",
      "new_id": "2aa81aeb33453dd816fb4a19801ef193722e24e0",
      "new_mode": 33188,
      "new_path": "src/dawn/native/Buffer.h"
    },
    {
      "type": "modify",
      "old_id": "990f126d9a27cff94cf860ce2c34c1416ed2c9db",
      "old_mode": 33188,
      "old_path": "src/dawn/tests/DawnTest.cpp",
      "new_id": "f142b024910cfdd428074542a66162dbd1f27e18",
      "new_mode": 33188,
      "new_path": "src/dawn/tests/DawnTest.cpp"
    }
  ]
}