⚠ Archived content — this site is no longer maintained.   Current WebKit documentation is at docs.webkit.org.

Changeset 259691 in webkit


Ignore:
Timestamp:
Apr 7, 2020, 5:32:35 PM (6 years ago)
Author:
Alan Coon
Message:

Cherry-pick r259363. rdar://problem/61269736

CRASH in MediaPlayerPrivateMediaSourceAVFObjC::addAudioRenderer(), uncaught ObjC exception
​https://bugs.webkit.org/show_bug.cgi?id=209827
<rdar://problem/61113080>

Reviewed by Eric Carlson.

-[AVSampleBufferAudioRenderer init] can, in exceptional conditions, return nil. Passing a
nil object, or another object that AVSampleBufferRenderSynchronizer considers "invalid", into
-[AVSampleBufferRenderSynchronizer addRenderer:] will throw an exception. Protect against this
scenario in two ways:

  • Check the return value of -[AVSampleBufferAudioRenderer init], and if nil, log an error, log to console, and set the network state to "DecodeError".
  • Wrap calls to -addRenderer: in @try/@catch blocks, which if caught, log an error, assert, and set the network state to "DecodeError".
  • Modules/mediasource/MediaSource.cpp: (WebCore::MediaSource::failedToCreateRenderer):
  • Modules/mediasource/MediaSource.h:
  • platform/graphics/MediaSourcePrivateClient.h:
  • platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaSourceAVFObjC.mm: (WebCore::MediaPlayerPrivateMediaSourceAVFObjC::ensureLayer):
  • platform/graphics/avfoundation/objc/MediaSourcePrivateAVFObjC.h:
  • platform/graphics/avfoundation/objc/MediaSourcePrivateAVFObjC.mm: (WebCore::MediaSourcePrivateAVFObjC::failedToCreateAudioRenderer): (WebCore::MediaSourcePrivateAVFObjC::failedToCreateVideoRenderer):
  • platform/graphics/avfoundation/objc/SourceBufferPrivateAVFObjC.mm: (WebCore::SourceBufferPrivateAVFObjC::trackDidChangeEnabled):

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@259363 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Location:
branches/safari-609-branch/Source/WebCore
Files:
8 edited

Legend:

Unmodified
Added
Removed

  • branches/safari-609-branch/Source/WebCore/ChangeLog

    r259690 r259691  
     12020-04-07  Russell Epstein  <repstein@apple.com>
     2
     3        Cherry-pick r259363. rdar://problem/61269736
     4
     5    CRASH in MediaPlayerPrivateMediaSourceAVFObjC::addAudioRenderer(), uncaught ObjC exception
     6    https://bugs.webkit.org/show_bug.cgi?id=209827
     7    <rdar://problem/61113080>
     8   
     9    Reviewed by Eric Carlson.
     10   
     11    -[AVSampleBufferAudioRenderer init] can, in exceptional conditions, return nil. Passing a
     12    nil object, or another object that AVSampleBufferRenderSynchronizer considers "invalid", into
     13    -[AVSampleBufferRenderSynchronizer addRenderer:] will throw an exception. Protect against this
     14    scenario in two ways:
     15   
     16    - Check the return value of -[AVSampleBufferAudioRenderer init], and if nil, log an error,
     17      log to console, and set the network state to "DecodeError".
     18    - Wrap calls to -addRenderer: in @try/@catch blocks, which if caught, log an error, assert,
     19      and set the network state to "DecodeError".
     20   
     21    * Modules/mediasource/MediaSource.cpp:
     22    (WebCore::MediaSource::failedToCreateRenderer):
     23    * Modules/mediasource/MediaSource.h:
     24    * platform/graphics/MediaSourcePrivateClient.h:
     25    * platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaSourceAVFObjC.mm:
     26    (WebCore::MediaPlayerPrivateMediaSourceAVFObjC::ensureLayer):
     27    * platform/graphics/avfoundation/objc/MediaSourcePrivateAVFObjC.h:
     28    * platform/graphics/avfoundation/objc/MediaSourcePrivateAVFObjC.mm:
     29    (WebCore::MediaSourcePrivateAVFObjC::failedToCreateAudioRenderer):
     30    (WebCore::MediaSourcePrivateAVFObjC::failedToCreateVideoRenderer):
     31    * platform/graphics/avfoundation/objc/SourceBufferPrivateAVFObjC.mm:
     32    (WebCore::SourceBufferPrivateAVFObjC::trackDidChangeEnabled):
     33   
     34    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@259363 268f45cc-cd09-0410-ab3c-d52691b4dbfc
     35
     36    2020-04-01  Jer Noble  <jer.noble@apple.com>
     37
     38            CRASH in MediaPlayerPrivateMediaSourceAVFObjC::addAudioRenderer(), uncaught ObjC exception
     39            https://bugs.webkit.org/show_bug.cgi?id=209827
     40            <rdar://problem/61113080>
     41
     42            Reviewed by Eric Carlson.
     43
     44            -[AVSampleBufferAudioRenderer init] can, in exceptional conditions, return nil. Passing a
     45            nil object, or another object that AVSampleBufferRenderSynchronizer considers "invalid", into
     46            -[AVSampleBufferRenderSynchronizer addRenderer:] will throw an exception. Protect against this
     47            scenario in two ways:
     48
     49            - Check the return value of -[AVSampleBufferAudioRenderer init], and if nil, log an error,
     50              log to console, and set the network state to "DecodeError".
     51            - Wrap calls to -addRenderer: in @try/@catch blocks, which if caught, log an error, assert,
     52              and set the network state to "DecodeError".
     53
     54            * Modules/mediasource/MediaSource.cpp:
     55            (WebCore::MediaSource::failedToCreateRenderer):
     56            * Modules/mediasource/MediaSource.h:
     57            * platform/graphics/MediaSourcePrivateClient.h:
     58            * platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaSourceAVFObjC.mm:
     59            (WebCore::MediaPlayerPrivateMediaSourceAVFObjC::ensureLayer):
     60            * platform/graphics/avfoundation/objc/MediaSourcePrivateAVFObjC.h:
     61            * platform/graphics/avfoundation/objc/MediaSourcePrivateAVFObjC.mm:
     62            (WebCore::MediaSourcePrivateAVFObjC::failedToCreateAudioRenderer):
     63            (WebCore::MediaSourcePrivateAVFObjC::failedToCreateVideoRenderer):
     64            * platform/graphics/avfoundation/objc/SourceBufferPrivateAVFObjC.mm:
     65            (WebCore::SourceBufferPrivateAVFObjC::trackDidChangeEnabled):
     66
    1672020-04-07  Russell Epstein  <repstein@apple.com>
    268

  • branches/safari-609-branch/Source/WebCore/Modules/mediasource/MediaSource.cpp

    r255726 r259691  
    10951095#endif
    10961096
     1097void MediaSource::failedToCreateRenderer(RendererType type)
     1098{
     1099    if (auto context = scriptExecutionContext())
     1100        context->addConsoleMessage(MessageSource::JS, MessageLevel::Error, makeString("MediaSource ", type == RendererType::Video ? "video" : "audio", " renderer creation failed."));
     1101}
     1102
    10971103}
    10981104

  • branches/safari-609-branch/Source/WebCore/Modules/mediasource/MediaSource.h

    r255726 r259691  
    125125#endif
    126126
     127    void failedToCreateRenderer(RendererType) final;
     128
    127129private:
    128130    explicit MediaSource(ScriptExecutionContext&);

  • branches/safari-609-branch/Source/WebCore/platform/graphics/MediaSourcePrivateClient.h

    r241148 r259691  
    5151    virtual void setLogIdentifier(const void*) = 0;
    5252#endif
     53
     54    enum class RendererType { Audio, Video };
     55    virtual void failedToCreateRenderer(RendererType) = 0;
    5356};
    5457

  • branches/safari-609-branch/Source/WebCore/platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaSourceAVFObjC.mm

    r257165 r259691  
    760760#endif
    761761
    762     ASSERT(m_sampleBufferDisplayLayer);
    763762    if (!m_sampleBufferDisplayLayer) {
    764763        ERROR_LOG(LOGIDENTIFIER, "Failed to create AVSampleBufferDisplayLayer");
     764        if (m_mediaSourcePrivate)
     765            m_mediaSourcePrivate->failedToCreateRenderer(MediaSourcePrivateAVFObjC::RendererType::Video);
    765766        setNetworkState(MediaPlayer::NetworkState::DecodeError);
    766767        return;
    … …  
    770771        m_sampleBufferDisplayLayer.get().preventsDisplaySleepDuringVideoPlayback = NO;
    771772
    772     [m_synchronizer addRenderer:m_sampleBufferDisplayLayer.get()];
     773    @try {
     774        [m_synchronizer addRenderer:m_sampleBufferDisplayLayer.get()];
     775    } @catch(NSException *exception) {
     776        ERROR_LOG(LOGIDENTIFIER, "-[AVSampleBufferRenderSynchronizer addRenderer:] threw an exception: ", [[exception name] UTF8String], ", reason : ", [[exception reason] UTF8String]);
     777        ASSERT_NOT_REACHED();
     778
     779        setNetworkState(MediaPlayer::NetworkState::DecodeError);
     780        return;
     781    }
     782
    773783    if (m_mediaSourcePrivate)
    774784        m_mediaSourcePrivate->setVideoLayer(m_sampleBufferDisplayLayer.get());
    … …  
    11291139ALLOW_NEW_API_WITHOUT_GUARDS_END
    11301140{
     1141    if (!audioRenderer) {
     1142        ASSERT_NOT_REACHED();
     1143        return;
     1144    }
     1145
    11311146    if (!m_sampleBufferAudioRendererMap.add((__bridge CFTypeRef)audioRenderer, AudioRendererProperties()).isNewEntry)
    11321147        return;
    … …  
    11361151    [audioRenderer setAudioTimePitchAlgorithm:(m_player->preservesPitch() ? AVAudioTimePitchAlgorithmSpectral : AVAudioTimePitchAlgorithmVarispeed)];
    11371152
    1138     [m_synchronizer addRenderer:audioRenderer];
     1153    @try {
     1154        [m_synchronizer addRenderer:audioRenderer];
     1155    } @catch(NSException *exception) {
     1156        ERROR_LOG(LOGIDENTIFIER, "-[AVSampleBufferRenderSynchronizer addRenderer:] threw an exception: ", [[exception name] UTF8String], ", reason : ", [[exception reason] UTF8String]);
     1157        ASSERT_NOT_REACHED();
     1158
     1159        setNetworkState(MediaPlayer::NetworkState::DecodeError);
     1160        return;
     1161    }
    11391162    m_player->renderingModeChanged();
    11401163}

  • branches/safari-609-branch/Source/WebCore/platform/graphics/avfoundation/objc/MediaSourcePrivateAVFObjC.h

    r241148 r259691  
    3030
    3131#include "MediaSourcePrivate.h"
     32#include "MediaSourcePrivateClient.h"
    3233#include <wtf/Deque.h>
    3334#include <wtf/LoggerHelper.h>
    … …  
    111112#endif
    112113
     114    using RendererType = MediaSourcePrivateClient::RendererType;
     115    void failedToCreateRenderer(RendererType);
     116
    113117private:
    114118    MediaSourcePrivateAVFObjC(MediaPlayerPrivateMediaSourceAVFObjC*, MediaSourcePrivateClient*);

  • branches/safari-609-branch/Source/WebCore/platform/graphics/avfoundation/objc/MediaSourcePrivateAVFObjC.mm

    r253397 r259691  
    326326#endif
    327327
     328void MediaSourcePrivateAVFObjC::failedToCreateRenderer(RendererType type)
     329{
     330    m_client->failedToCreateRenderer(type);
     331}
     332
    328333}
    329334

  • branches/safari-609-branch/Source/WebCore/platform/graphics/avfoundation/objc/SourceBufferPrivateAVFObjC.mm

    r253397 r259691  
    887887        if (!m_audioRenderers.contains(trackID)) {
    888888            renderer = adoptNS([PAL::allocAVSampleBufferAudioRendererInstance() init]);
     889
     890            if (!renderer) {
     891                ERROR_LOG(LOGIDENTIFIER, "-[AVSampleBufferAudioRenderer init] returned nil! bailing!");
     892                if (m_mediaSource)
     893                    m_mediaSource->failedToCreateRenderer(MediaSourcePrivateAVFObjC::RendererType::Audio);
     894                m_mediaSource->player()->setNetworkState(MediaPlayer::NetworkState::DecodeError);
     895                return;
     896            }
     897
    889898            auto weakThis = makeWeakPtr(*this);
    890899            [renderer requestMediaDataWhenReadyOnQueue:dispatch_get_main_queue() usingBlock:^{
Note: See TracChangeset for help on using the changeset viewer.