Changeset 277177 in webkit

Timestamp:

May 7, 2021, 9:42:35 AM (5 years ago)

Author:

Chris Dumez

Message:

AudioWorkletProcessor which does not extend base class crashes Safari
​https://bugs.webkit.org/show_bug.cgi?id=225449
<rdar://problem/77624792>

Reviewed by Sam Weinig.

Update AudioWorkletGlobalScope::createProcessor() to validate the type of the processor
after constructing it.

• Modules/webaudio/AudioWorkletGlobalScope.cpp:

(WebCore::AudioWorkletGlobalScope::createProcessor):

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• Modules/webaudio/AudioWorkletGlobalScope.cpp (modified) (1 diff)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2021-05-07  Chris Dumez  <cdumez@apple.com>
+
+        AudioWorkletProcessor which does not extend base class crashes Safari
+        https://bugs.webkit.org/show_bug.cgi?id=225449
+        <rdar://problem/77624792>
+
+        Reviewed by Sam Weinig.
+
+        Update AudioWorkletGlobalScope::createProcessor() to validate the type of the processor
+        after constructing it.
+
+        * Modules/webaudio/AudioWorkletGlobalScope.cpp:
+        (WebCore::AudioWorkletGlobalScope::createProcessor):
+
 2021-05-07  Philippe Normand  <pnormand@igalia.com>
 

trunk/Source/WebCore/Modules/webaudio/AudioWorkletGlobalScope.cpp

@@ -151 +151 @@
     RETURN_IF_EXCEPTION(scope, nullptr);
 
-    auto& jsProcessor = *JSC::jsCast<JSAudioWorkletProcessor*>(object);
-    jsProcessor.wrapped().setProcessCallback(makeUnique<JSCallbackDataStrong>(&jsProcessor, globalObject));
-
-    return &jsProcessor.wrapped();
+    auto* jsProcessor = JSC::jsDynamicCast<JSAudioWorkletProcessor*>(vm, object);
+    if (!jsProcessor)
+        return nullptr;
+
+    jsProcessor->wrapped().setProcessCallback(makeUnique<JSCallbackDataStrong>(jsProcessor, globalObject));
+
+    return &jsProcessor->wrapped();
 }