Changeset 281011 in webkit

Timestamp:

Aug 13, 2021, 2:38:55 AM (5 years ago)

Author:

svillar@igalia.com

Message:

Crash in MockMediaSourcePrivate
​https://bugs.webkit.org/show_bug.cgi?id=226795

Reviewed by Darin Adler.

The MockMediaPlayerMediaSource uses callOnMainThread() to execute advanceCurrentTime(). It might
happen that the object is destructed before the callback is executed as it isn't a ref counted
object. That leads to a crash on ASAN builds.

Made the object capable of creating weak ptrs so that we could check whether the _this_ object
has been freed in the meantime or not. For the former case we just bail out.

• platform/mock/mediasource/MockMediaPlayerMediaSource.cpp:

(WebCore::MockMediaPlayerMediaSource::play): Create a WeakPtr.
(WebCore::MockMediaPlayerMediaSource::seekWithTolerance): Ditto.
(WebCore::MockMediaPlayerMediaSource::seekCompleted): Ditto.

• platform/mock/mediasource/MockMediaPlayerMediaSource.h: inherit from CanMakeWeakPtr.

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• platform/mock/mediasource/MockMediaPlayerMediaSource.cpp (modified) (3 diffs)
• platform/mock/mediasource/MockMediaPlayerMediaSource.h (modified) (2 diffs)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2021-08-13  Sergio Villar Senin  <svillar@igalia.com>
+
+        Crash in MockMediaSourcePrivate
+        https://bugs.webkit.org/show_bug.cgi?id=226795
+
+        Reviewed by Darin Adler.
+
+        The MockMediaPlayerMediaSource uses callOnMainThread() to execute advanceCurrentTime(). It might
+        happen that the object is destructed before the callback is executed as it isn't a ref counted
+        object. That leads to a crash on ASAN builds.
+
+        Made the object capable of creating weak ptrs so that we could check whether the _this_ object
+        has been freed in the meantime or not. For the former case we just bail out.
+
+        * platform/mock/mediasource/MockMediaPlayerMediaSource.cpp:
+        (WebCore::MockMediaPlayerMediaSource::play): Create a WeakPtr.
+        (WebCore::MockMediaPlayerMediaSource::seekWithTolerance): Ditto.
+        (WebCore::MockMediaPlayerMediaSource::seekCompleted): Ditto.
+        * platform/mock/mediasource/MockMediaPlayerMediaSource.h: inherit from CanMakeWeakPtr.
+
 2021-08-12  Alex Christensen  <achristensen@webkit.org>
 

trunk/Source/WebCore/platform/mock/mediasource/MockMediaPlayerMediaSource.cpp

@@ -124 +124 @@
 {
     m_playing = 1;
-    callOnMainThread([this] {
+    callOnMainThread([this, weakThis = makeWeakPtr(this)] {
+        if (!weakThis)
+            return;
         advanceCurrentTime();
     });
@@ -221 +223 @@
 
         if (m_playing)
-            callOnMainThread([this] {
+            callOnMainThread([this, weakThis = makeWeakPtr(this)] {
+                if (!weakThis)
+                    return;
                 advanceCurrentTime();
             });
@@ -283 +287 @@
 
     if (m_playing)
-        callOnMainThread([this] {
+        callOnMainThread([this, weakThis = makeWeakPtr(this)] {
+            if (!weakThis)
+                return;
             advanceCurrentTime();
         });

trunk/Source/WebCore/platform/mock/mediasource/MockMediaPlayerMediaSource.h

@@ -32 +32 @@
 #include <wtf/Logger.h>
 #include <wtf/MediaTime.h>
+#include <wtf/WeakPtr.h>
 
 namespace WebCore {
@@ -38 +39 @@
 class MockMediaSourcePrivate;
 
-class MockMediaPlayerMediaSource : public MediaPlayerPrivateInterface {
+class MockMediaPlayerMediaSource : public MediaPlayerPrivateInterface, public CanMakeWeakPtr<MockMediaPlayerMediaSource> {
 public:
     explicit MockMediaPlayerMediaSource(MediaPlayer*);