Changeset 239889 in webkit

Timestamp:

Jan 11, 2019, 5:22:58 PM (8 years ago)

Author:

jer.noble@apple.com

Message:

REGRESSION(r239419): Crash in AudioSourceProviderAVFObjC::~AudioSourceProviderAVFObjC()
​https://bugs.webkit.org/show_bug.cgi?id=193342
<rdar://problem/47119836>

Reviewed by Eric Carlson.

Make the TapStorage used by AudioSourceProviderAVFObjC thread-safe RefCounted.

• platform/graphics/avfoundation/AudioSourceProviderAVFObjC.h:
• platform/graphics/avfoundation/AudioSourceProviderAVFObjC.mm:

(WebCore::AudioSourceProviderAVFObjC::initCallback):
(WebCore::AudioSourceProviderAVFObjC::finalizeCallback):

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• platform/graphics/avfoundation/AudioSourceProviderAVFObjC.h (modified) (1 diff)
• platform/graphics/avfoundation/AudioSourceProviderAVFObjC.mm (modified) (3 diffs)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2019-01-11  Jer Noble  <jer.noble@apple.com>
+
+        REGRESSION(r239419): Crash in AudioSourceProviderAVFObjC::~AudioSourceProviderAVFObjC()
+        https://bugs.webkit.org/show_bug.cgi?id=193342
+        <rdar://problem/47119836>
+
+        Reviewed by Eric Carlson.
+
+        Make the TapStorage used by AudioSourceProviderAVFObjC thread-safe RefCounted.
+
+        * platform/graphics/avfoundation/AudioSourceProviderAVFObjC.h:
+        * platform/graphics/avfoundation/AudioSourceProviderAVFObjC.mm:
+        (WebCore::AudioSourceProviderAVFObjC::initCallback):
+        (WebCore::AudioSourceProviderAVFObjC::finalizeCallback):
+
 2019-01-11  John Wilander  <wilander@apple.com>
 

trunk/Source/WebCore/platform/graphics/avfoundation/AudioSourceProviderAVFObjC.h

@@ -99 +99 @@
     AudioSourceProviderClient* m_client { nullptr };
 
-    struct TapStorage;
-    TapStorage* m_tapStorage { nullptr };
+    class TapStorage;
+    RefPtr<TapStorage> m_tapStorage;
 };
     

trunk/Source/WebCore/platform/graphics/avfoundation/AudioSourceProviderAVFObjC.mm

@@ -70 +70 @@
 static const double kRingBufferDuration = 1;
 
-struct AudioSourceProviderAVFObjC::TapStorage {
+class AudioSourceProviderAVFObjC::TapStorage : public ThreadSafeRefCounted<AudioSourceProviderAVFObjC::TapStorage> {
+public:
     TapStorage(AudioSourceProviderAVFObjC* _this) : _this(_this) { }
     AudioSourceProviderAVFObjC* _this;
@@ -239 +240 @@
     AudioSourceProviderAVFObjC* _this = static_cast<AudioSourceProviderAVFObjC*>(clientInfo);
     _this->m_tap = adoptCF(tap);
-    _this->m_tapStorage = new TapStorage(_this);
+    _this->m_tapStorage = adoptRef(new TapStorage(_this));
     _this->init(clientInfo, tapStorageOut);
-    *tapStorageOut = _this->m_tapStorage;
+    *tapStorageOut = _this->m_tapStorage.get();
+
+    // ref balanced by deref in finalizeCallback:
+    _this->m_tapStorage->ref();
 }
 
@@ -254 +258 @@
             tapStorage->_this->finalize();
     }
-    delete tapStorage;
+    tapStorage->deref();
 }