Changeset 169074 in webkit

Timestamp:

May 19, 2014, 3:04:29 PM (12 years ago)

Author:

matthew_hanson@apple.com

Message:

Merge r168974.

Location:

branches/safari-538.34-branch/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• Modules/mediasource/SourceBuffer.cpp (modified) (2 diffs)
• Modules/mediasource/SourceBuffer.h (modified) (1 diff)
• platform/graphics/avfoundation/objc/MediaSourcePrivateAVFObjC.mm (modified) (3 diffs)
• platform/graphics/avfoundation/objc/SourceBufferPrivateAVFObjC.h (modified) (2 diffs)
• platform/graphics/avfoundation/objc/SourceBufferPrivateAVFObjC.mm (modified) (13 diffs)

branches/safari-538.34-branch/Source/WebCore/ChangeLog

@@ +1 @@
+2014-05-19  Matthew Hanson  <matthew_hanson@apple.com>
+
+        Merge r168974.
+
+    2014-05-16  Jer Noble  <jer.noble@apple.com>
+
+            [MSE] Crash at  WebCore::SourceBuffer::~SourceBuffer + 110
+            https://bugs.webkit.org/show_bug.cgi?id=132973
+
+            Reviewed by Eric Carlson.
+
+            Change SourceBuffer::m_private into a Ref<>, and add an assertion to
+            SourceBufferPrivateAVFObjC's destructor if its client has not been cleared.
+
+            Eliminate unnecessary churn in MediaSourcePrivateAVFObjC by having the predicate
+            functor take bare pointers, rather than a PassRefPtr.
+
+            The underlying problem seems to be in WebAVStreamDataParserListener. RefPtrs were
+            being created off the main thread to a non-thread safe ref counted class. In some
+            situations, this would result in double decrementing the ref, which would cause an
+            early destruction of the underlying object. Instead replace these RefPtr strong
+            pointers with explicit weak ones. Ensure the parser and its delegate are not freed
+            before the append operation completes by passing strong pointers into the async
+            append operation lambda.
+
+            There were a few places where we weren't null checking m_mediaSource before using it,
+            and at least one place where we weren't clearing m_mediaSource.
+
+            * Modules/mediasource/SourceBuffer.cpp:
+            (WebCore::SourceBuffer::SourceBuffer): Use Ref instead of RefPtr.
+            (WebCore::SourceBuffer::appendBufferTimerFired): Ditto.
+            * Modules/mediasource/SourceBuffer.h:
+            * platform/graphics/avfoundation/objc/MediaSourcePrivateAVFObjC.mm:
+            (WebCore::MediaSourcePrivateAVFObjCHasAudio): Take a bare pointer, instead of a PassRefPtr.
+            (WebCore::MediaSourcePrivateAVFObjCHasVideo): Ditto.
+            * platform/graphics/avfoundation/objc/MediaSourcePrivateAVFObjC.mm:
+            (WebCore::MediaSourcePrivateAVFObjC::removeSourceBuffer): Clear the back pointer when removing a buffer.
+            * platform/graphics/avfoundation/objc/SourceBufferPrivateAVFObjC.h:
+            * platform/graphics/avfoundation/objc/SourceBufferPrivateAVFObjC.mm:
+            (-[WebAVStreamDataParserListener initWithParser:parent:WebCore::]): Use WeakPtr instead of RefPtr.
+            (-[WebAVStreamDataParserListener invalidate]): Ditto.
+            (-[WebAVStreamDataParserListener streamDataParser:didParseStreamDataAsAsset:]): Ditto.
+            (-[WebAVStreamDataParserListener streamDataParser:didParseStreamDataAsAsset:withDiscontinuity:]): Ditto.
+            (-[WebAVStreamDataParserListener streamDataParser:didFailToParseStreamDataWithError:]): Ditto.
+            (-[WebAVStreamDataParserListener streamDataParser:didProvideMediaData:forTrackID:mediaType:flags:]): Ditto.
+            (-[WebAVStreamDataParserListener streamDataParser:didReachEndOfTrackWithTrackID:mediaType:]): Ditto.
+            (-[WebAVStreamDataParserListener streamDataParser:didProvideContentKeyRequestInitializationData:forTrackID:]): Ditto.
+            (WebCore::SourceBufferPrivateAVFObjC::~SourceBufferPrivateAVFObjC):
+            (WebCore::SourceBufferPrivateAVFObjC::append): Ditto.
+
 2014-05-19  Matthew Hanson  <matthew_hanson@apple.com>
 

branches/safari-538.34-branch/Source/WebCore/Modules/mediasource/SourceBuffer.cpp

@@ -108 +108 @@
     , m_removeTimer(this, &SourceBuffer::removeTimerFired)
 {
-    ASSERT(m_private);
     ASSERT(m_source);
 
@@ -475 +474 @@
     // 1. Loop Top: If the input buffer is empty, then jump to the need more data step below.
     if (!m_pendingAppendData.size()) {
-        sourceBufferPrivateAppendComplete(m_private.get(), AppendSucceeded);
+        sourceBufferPrivateAppendComplete(&m_private.get(), AppendSucceeded);
         return;
     }

branches/safari-538.34-branch/Source/WebCore/Modules/mediasource/SourceBuffer.h

@@ -157 +157 @@
     void removeCodedFrames(const MediaTime& start, const MediaTime& end);
 
-    RefPtr<SourceBufferPrivate> m_private;
+    Ref<SourceBufferPrivate> m_private;
     MediaSource* m_source;
     GenericEventQueue m_asyncEventQueue;

branches/safari-538.34-branch/Source/WebCore/platform/graphics/avfoundation/objc/MediaSourcePrivateAVFObjC.mm

@@ -86 +86 @@
 
     pos = m_sourceBuffers.find(buffer);
+    m_sourceBuffers[pos]->clearMediaSource();
     m_sourceBuffers.remove(pos);
 }
@@ -158 +159 @@
 #endif
 
-static bool MediaSourcePrivateAVFObjCHasAudio(PassRefPtr<SourceBufferPrivateAVFObjC> prpSourceBuffer)
-{
-    RefPtr<SourceBufferPrivateAVFObjC> sourceBuffer = prpSourceBuffer;
+static bool MediaSourcePrivateAVFObjCHasAudio(SourceBufferPrivateAVFObjC* sourceBuffer)
+{
     return sourceBuffer->hasAudio();
 }
@@ -169 +169 @@
 }
 
-static bool MediaSourcePrivateAVFObjCHasVideo(PassRefPtr<SourceBufferPrivateAVFObjC> prpSourceBuffer)
-{
-    RefPtr<SourceBufferPrivateAVFObjC> sourceBuffer = prpSourceBuffer;
+static bool MediaSourcePrivateAVFObjCHasVideo(SourceBufferPrivateAVFObjC* sourceBuffer)
+{
     return sourceBuffer->hasVideo();
 }

branches/safari-538.34-branch/Source/WebCore/platform/graphics/avfoundation/objc/SourceBufferPrivateAVFObjC.h

@@ -37 +37 @@
 #include <wtf/RetainPtr.h>
 #include <wtf/Vector.h>
+#include <wtf/WeakPtr.h>
 #include <wtf/text/AtomicString.h>
 
@@ -114 +115 @@
     void destroyRenderers();
 
+    WeakPtr<SourceBufferPrivateAVFObjC> createWeakPtr() { return m_weakFactory.createWeakPtr(); }
+
     Vector<RefPtr<VideoTrackPrivateMediaSourceAVFObjC>> m_videoTracks;
     Vector<RefPtr<AudioTrackPrivateMediaSourceAVFObjC>> m_audioTracks;
+
+    WeakPtrFactory<SourceBufferPrivateAVFObjC> m_weakFactory;
 
     RetainPtr<AVStreamDataParser> m_parser;

branches/safari-538.34-branch/Source/WebCore/platform/graphics/avfoundation/objc/SourceBufferPrivateAVFObjC.mm

@@ -154 +154 @@
 
 @interface WebAVStreamDataParserListener : NSObject {
-    WebCore::SourceBufferPrivateAVFObjC* _parent;
+    WeakPtr<WebCore::SourceBufferPrivateAVFObjC> _parent;
     AVStreamDataParser* _parser;
 }
-- (id)initWithParser:(AVStreamDataParser*)parser parent:(WebCore::SourceBufferPrivateAVFObjC*)parent;
+- (id)initWithParser:(AVStreamDataParser*)parser parent:(WeakPtr<WebCore::SourceBufferPrivateAVFObjC>)parent;
 @end
 
 @implementation WebAVStreamDataParserListener
-- (id)initWithParser:(AVStreamDataParser*)parser parent:(WebCore::SourceBufferPrivateAVFObjC*)parent
+- (id)initWithParser:(AVStreamDataParser*)parser parent:(WeakPtr<WebCore::SourceBufferPrivateAVFObjC>)parent
 {
     self = [super init];
@@ -183 +183 @@
 {
     [_parser setDelegate:nil];
-    _parent = nullptr;
     _parser = nullptr;
 }
@@ -193 +192 @@
 #endif
     ASSERT(streamDataParser == _parser);
-    RefPtr<WebCore::SourceBufferPrivateAVFObjC> strongParent = _parent;
-    if (!strongParent)
-        return;
+    RetainPtr<WebAVStreamDataParserListener> strongSelf = self;
 
     RetainPtr<AVAsset*> strongAsset = asset;
-    callOnMainThread([strongParent, strongAsset] {
-        strongParent->didParseStreamDataAsAsset(strongAsset.get());
+    callOnMainThread([strongSelf, strongAsset] {
+        if (strongSelf->_parent)
+            strongSelf->_parent->didParseStreamDataAsAsset(strongAsset.get());
     });
 }
@@ -210 +208 @@
 #endif
     ASSERT(streamDataParser == _parser);
-    RefPtr<WebCore::SourceBufferPrivateAVFObjC> strongParent = _parent;
-    if (!strongParent)
-        return;
+    RetainPtr<WebAVStreamDataParserListener> strongSelf = self;
 
     RetainPtr<AVAsset*> strongAsset = asset;
-    callOnMainThread([strongParent, strongAsset] {
-        strongParent->didParseStreamDataAsAsset(strongAsset.get());
+    callOnMainThread([strongSelf, strongAsset] {
+        if (strongSelf->_parent)
+            strongSelf->_parent->didParseStreamDataAsAsset(strongAsset.get());
     });
 }
@@ -226 +223 @@
 #endif
     ASSERT(streamDataParser == _parser);
-    RefPtr<WebCore::SourceBufferPrivateAVFObjC> strongParent = _parent;
-    if (!strongParent)
-        return;
+    RetainPtr<WebAVStreamDataParserListener> strongSelf = self;
 
     RetainPtr<NSError> strongError = error;
-    callOnMainThread([strongParent, strongError] {
-        strongParent->didFailToParseStreamDataWithError(strongError.get());
+    callOnMainThread([strongSelf, strongError] {
+        if (strongSelf->_parent)
+            strongSelf->_parent->didFailToParseStreamDataWithError(strongError.get());
     });
 }
@@ -242 +238 @@
 #endif
     ASSERT(streamDataParser == _parser);
-    RefPtr<WebCore::SourceBufferPrivateAVFObjC> strongParent = _parent;
-    if (!strongParent)
-        return;
+    RetainPtr<WebAVStreamDataParserListener> strongSelf = self;
 
     RetainPtr<CMSampleBufferRef> strongSample = sample;
     String mediaType = nsMediaType;
-    callOnMainThread([strongParent, strongSample, trackID, mediaType, flags] {
-        strongParent->didProvideMediaDataForTrackID(trackID, strongSample.get(), mediaType, flags);
+    callOnMainThread([strongSelf, strongSample, trackID, mediaType, flags] {
+        if (strongSelf->_parent)
+            strongSelf->_parent->didProvideMediaDataForTrackID(trackID, strongSample.get(), mediaType, flags);
     });
 }
@@ -259 +254 @@
 #endif
     ASSERT(streamDataParser == _parser);
-    RefPtr<WebCore::SourceBufferPrivateAVFObjC> strongParent = _parent;
-    if (!strongParent)
-        return;
+    RetainPtr<WebAVStreamDataParserListener> strongSelf = self;
 
     String mediaType = nsMediaType;
-    callOnMainThread([strongParent, trackID, mediaType] {
-        strongParent->didReachEndOfTrackWithTrackID(trackID, mediaType);
+    callOnMainThread([strongSelf, trackID, mediaType] {
+        if (strongSelf->_parent)
+            strongSelf->_parent->didReachEndOfTrackWithTrackID(trackID, mediaType);
     });
 }
@@ -275 +269 @@
 #endif
     ASSERT(streamDataParser == _parser);
-    RefPtr<WebCore::SourceBufferPrivateAVFObjC> strongParent = _parent;
-    if (!strongParent)
-        return;
+    RetainPtr<WebAVStreamDataParserListener> strongSelf = self;
 
     RetainPtr<NSData> strongData = initData;
-    callOnMainThread([strongParent, strongData, trackID] {
-        strongParent->didProvideContentKeyRequestInitializationDataForTrackID(strongData.get(), trackID);
+    callOnMainThread([strongSelf, strongData, trackID] {
+        if (strongSelf->_parent)
+            strongSelf->_parent->didProvideContentKeyRequestInitializationDataForTrackID(strongData.get(), trackID);
     });
 }
@@ -387 +380 @@
 
 SourceBufferPrivateAVFObjC::SourceBufferPrivateAVFObjC(MediaSourcePrivateAVFObjC* parent)
-    : m_parser(adoptNS([[getAVStreamDataParserClass() alloc] init]))
-    , m_delegate(adoptNS([[WebAVStreamDataParserListener alloc] initWithParser:m_parser.get() parent:this]))
+    : m_weakFactory(this)
+    , m_parser(adoptNS([[getAVStreamDataParserClass() alloc] init]))
+    , m_delegate(adoptNS([[WebAVStreamDataParserListener alloc] initWithParser:m_parser.get() parent:createWeakPtr()]))
     , m_mediaSource(parent)
     , m_client(0)
@@ -399 +393 @@
 SourceBufferPrivateAVFObjC::~SourceBufferPrivateAVFObjC()
 {
+    ASSERT(!m_client);
     destroyParser();
     destroyRenderers();
@@ -470 +465 @@
             LOG(Media, "SourceBufferPrivateAVFObjC::processCodedFrame(%p) - size change detected: {width=%lf, height=%lf", formatSize.width(), formatSize.height());
             m_cachedSize = formatSize;
-            m_mediaSource->player()->sizeChanged();
+            if (m_mediaSource)
+                m_mediaSource->player()->sizeChanged();
         }
     }
@@ -488 +484 @@
 void SourceBufferPrivateAVFObjC::didProvideContentKeyRequestInitializationDataForTrackID(NSData* initData, int trackID)
 {
+    if (!m_mediaSource)
+        return;
+
     UNUSED_PARAM(trackID);
 #if ENABLE(ENCRYPTED_MEDIA_V2)
@@ -520 +519 @@
 
     RetainPtr<NSData> nsData = adoptNS([[NSData alloc] initWithBytes:data length:length]);
-    RefPtr<SourceBufferPrivateAVFObjC> strongThis = this;
+    WeakPtr<SourceBufferPrivateAVFObjC> weakThis = createWeakPtr();
+    RetainPtr<AVStreamDataParser> parser = m_parser;
+    RetainPtr<WebAVStreamDataParserListener> delegate = m_delegate;
 
     m_parsingSucceeded = true;
 
-    dispatch_async(globalDataParserQueue(), [nsData, strongThis] {
-        [strongThis->m_parser appendStreamData:nsData.get()];
-
-        callOnMainThread([strongThis] {
-            strongThis->appendCompleted();
+    dispatch_async(globalDataParserQueue(), [nsData, weakThis, parser, delegate] {
+
+        [parser appendStreamData:nsData.get()];
+
+        callOnMainThread([weakThis] {
+            if (weakThis)
+                weakThis->appendCompleted();
         });
     });