Changeset 246437 in webkit

Timestamp:

Jun 14, 2019 10:42:13 AM (5 years ago)

Author:

jer.noble@apple.com

Message:

CRASH(nullptr) in WebCore::jsAudioContextCurrentTime()
​https://bugs.webkit.org/show_bug.cgi?id=198859
<rdar://problem/27986991>

Reviewed by Eric Carlson.

AudioContext's m_destinationNode can become null during iframe teardown,
but can AudioContext methods can still be called by JavaScript. Add null-checks
to all (remaing) unprotected dereferences of m_destinationNode.

• Modules/webaudio/AudioContext.cpp:

(WebCore::AudioContext::uninitialize):
(WebCore::AudioContext::createBufferSource):
(WebCore::AudioContext::createScriptProcessor):
(WebCore::AudioContext::createBiquadFilter):
(WebCore::AudioContext::createPanner):
(WebCore::AudioContext::createConvolver):
(WebCore::AudioContext::createDynamicsCompressor):
(WebCore::AudioContext::createAnalyser):
(WebCore::AudioContext::createGain):
(WebCore::AudioContext::createDelay):
(WebCore::AudioContext::createChannelSplitter):
(WebCore::AudioContext::createChannelMerger):
(WebCore::AudioContext::createOscillator):

• Modules/webaudio/AudioContext.h:

(WebCore::AudioContext::currentSampleFrame const):
(WebCore::AudioContext::currentTime const):
(WebCore::AudioContext::sampleRate const):

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• Modules/webaudio/AudioContext.cpp (modified) (13 diffs)
• Modules/webaudio/AudioContext.h (modified) (1 diff)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2019-06-14  Jer Noble  <jer.noble@apple.com>
+
+        CRASH(nullptr) in WebCore::jsAudioContextCurrentTime()
+        https://bugs.webkit.org/show_bug.cgi?id=198859
+        <rdar://problem/27986991>
+
+        Reviewed by Eric Carlson.
+
+        AudioContext's m_destinationNode can become null during iframe teardown,
+        but can AudioContext methods can still be called by JavaScript. Add null-checks
+        to all (remaing) unprotected dereferences of m_destinationNode.
+
+        * Modules/webaudio/AudioContext.cpp:
+        (WebCore::AudioContext::uninitialize):
+        (WebCore::AudioContext::createBufferSource):
+        (WebCore::AudioContext::createScriptProcessor):
+        (WebCore::AudioContext::createBiquadFilter):
+        (WebCore::AudioContext::createPanner):
+        (WebCore::AudioContext::createConvolver):
+        (WebCore::AudioContext::createDynamicsCompressor):
+        (WebCore::AudioContext::createAnalyser):
+        (WebCore::AudioContext::createGain):
+        (WebCore::AudioContext::createDelay):
+        (WebCore::AudioContext::createChannelSplitter):
+        (WebCore::AudioContext::createChannelMerger):
+        (WebCore::AudioContext::createOscillator):
+        * Modules/webaudio/AudioContext.h:
+        (WebCore::AudioContext::currentSampleFrame const):
+        (WebCore::AudioContext::currentTime const):
+        (WebCore::AudioContext::sampleRate const):
+
 2019-06-14  Youenn Fablet  <youenn@apple.com>
 

trunk/Source/WebCore/Modules/webaudio/AudioContext.cpp

@@ -268 +268 @@
 
     // This stops the audio thread and all audio rendering.
-    m_destinationNode->uninitialize();
+    if (m_destinationNode)
+        m_destinationNode->uninitialize();
 
     // Don't allow the context to initialize a second time after it's already been explicitly uninitialized.
@@ -442 +443 @@
 
     lazyInitialize();
-    Ref<AudioBufferSourceNode> node = AudioBufferSourceNode::create(*this, m_destinationNode->sampleRate());
+    Ref<AudioBufferSourceNode> node = AudioBufferSourceNode::create(*this, sampleRate());
 
     // Because this is an AudioScheduledSourceNode, the context keeps a reference until it has finished playing.
@@ -578 +579 @@
         return Exception { NotSupportedError };
 
-    auto node = ScriptProcessorNode::create(*this, m_destinationNode->sampleRate(), bufferSize, numberOfInputChannels, numberOfOutputChannels);
+    auto node = ScriptProcessorNode::create(*this, sampleRate(), bufferSize, numberOfInputChannels, numberOfOutputChannels);
 
     refNode(node); // context keeps reference until we stop making javascript rendering callbacks
@@ -594 +595 @@
     lazyInitialize();
 
-    return BiquadFilterNode::create(*this, m_destinationNode->sampleRate());
+    return BiquadFilterNode::create(*this, sampleRate());
 }
 
@@ -618 +619 @@
 
     lazyInitialize();
-    return PannerNode::create(*this, m_destinationNode->sampleRate());
+    return PannerNode::create(*this, sampleRate());
 }
 
@@ -630 +631 @@
 
     lazyInitialize();
-    return ConvolverNode::create(*this, m_destinationNode->sampleRate());
+    return ConvolverNode::create(*this, sampleRate());
 }
 
@@ -642 +643 @@
 
     lazyInitialize();
-    return DynamicsCompressorNode::create(*this, m_destinationNode->sampleRate());
+    return DynamicsCompressorNode::create(*this, sampleRate());
 }
 
@@ -654 +655 @@
 
     lazyInitialize();
-    return AnalyserNode::create(*this, m_destinationNode->sampleRate());
+    return AnalyserNode::create(*this, sampleRate());
 }
 
@@ -666 +667 @@
 
     lazyInitialize();
-    return GainNode::create(*this, m_destinationNode->sampleRate());
+    return GainNode::create(*this, sampleRate());
 }
 
@@ -678 +679 @@
 
     lazyInitialize();
-    return DelayNode::create(*this, m_destinationNode->sampleRate(), maxDelayTime);
+    return DelayNode::create(*this, sampleRate(), maxDelayTime);
 }
 
@@ -690 +691 @@
 
     lazyInitialize();
-    auto node = ChannelSplitterNode::create(*this, m_destinationNode->sampleRate(), numberOfOutputs);
+    auto node = ChannelSplitterNode::create(*this, sampleRate(), numberOfOutputs);
     if (!node)
         return Exception { IndexSizeError };
@@ -705 +706 @@
 
     lazyInitialize();
-    auto node = ChannelMergerNode::create(*this, m_destinationNode->sampleRate(), numberOfInputs);
+    auto node = ChannelMergerNode::create(*this, sampleRate(), numberOfInputs);
     if (!node)
         return Exception { IndexSizeError };
@@ -721 +722 @@
     lazyInitialize();
 
-    Ref<OscillatorNode> node = OscillatorNode::create(*this, m_destinationNode->sampleRate());
+    Ref<OscillatorNode> node = OscillatorNode::create(*this, sampleRate());
 
     // Because this is an AudioScheduledSourceNode, the context keeps a reference until it has finished playing.

trunk/Source/WebCore/Modules/webaudio/AudioContext.h

@@ -109 +109 @@
 
     AudioDestinationNode* destination() { return m_destinationNode.get(); }
-    size_t currentSampleFrame() const { return m_destinationNode->currentSampleFrame(); }
-    double currentTime() const { return m_destinationNode->currentTime(); }
-    float sampleRate() const { return m_destinationNode->sampleRate(); }
+    size_t currentSampleFrame() const { return m_destinationNode ? m_destinationNode->currentSampleFrame() : 0; }
+    double currentTime() const { return m_destinationNode ? m_destinationNode->currentTime() : 0.; }
+    float sampleRate() const { return m_destinationNode ? m_destinationNode->sampleRate() : 0.f; }
     unsigned long activeSourceCount() const { return static_cast<unsigned long>(m_activeSourceCount); }