Changeset 247192 in webkit

Timestamp:

Jul 6, 2019 1:14:16 AM (5 years ago)

Author:

Chris Fleizach

Message:

AX: CrashTracer: com.apple.WebKit.WebContent at WebKit: WebKit::WebSpeechSynthesisClient::speak
​https://bugs.webkit.org/show_bug.cgi?id=199435

Reviewed by Ryosuke Niwa.

Ensure we don't access null observers in speech callbacks.

• WebProcess/WebCoreSupport/WebSpeechSynthesisClient.cpp:

(WebKit::WebSpeechSynthesisClient::voiceList):
(WebKit::WebSpeechSynthesisClient::speak):
(WebKit::WebSpeechSynthesisClient::pause):
(WebKit::WebSpeechSynthesisClient::resume):

• WebProcess/WebPage/WebPage.cpp:

(WebKit::WebPage::speakingErrorOccurred):
(WebKit::WebPage::boundaryEventOccurred):
(WebKit::WebPage::voicesDidChange):

Location:

trunk/Source/WebKit

Files:

• ChangeLog (modified) (1 diff)
• WebProcess/WebCoreSupport/WebSpeechSynthesisClient.cpp (modified) (5 diffs)
• WebProcess/WebCoreSupport/WebSpeechSynthesisClient.h (modified) (1 diff)
• WebProcess/WebPage/WebPage.cpp (modified) (1 diff)

trunk/Source/WebKit/ChangeLog

@@ +1 @@
+2019-07-06  Chris Fleizach  <cfleizach@apple.com>
+
+        AX: CrashTracer: com.apple.WebKit.WebContent at WebKit: WebKit::WebSpeechSynthesisClient::speak
+        https://bugs.webkit.org/show_bug.cgi?id=199435
+
+        Reviewed by Ryosuke Niwa.
+
+        Ensure we don't access null observers in speech callbacks.
+
+        * WebProcess/WebCoreSupport/WebSpeechSynthesisClient.cpp:
+        (WebKit::WebSpeechSynthesisClient::voiceList):
+        (WebKit::WebSpeechSynthesisClient::speak):
+        (WebKit::WebSpeechSynthesisClient::pause):
+        (WebKit::WebSpeechSynthesisClient::resume):
+        * WebProcess/WebPage/WebPage.cpp:
+        (WebKit::WebPage::speakingErrorOccurred):
+        (WebKit::WebPage::boundaryEventOccurred):
+        (WebKit::WebPage::voicesDidChange):
+
 2019-07-05  Chris Dumez  <cdumez@apple.com>
 

trunk/Source/WebKit/WebProcess/WebCoreSupport/WebSpeechSynthesisClient.cpp

@@ -44 +44 @@
 
     m_voices.clear();
-    for (auto& voice : voiceList) {
+    for (auto& voice : voiceList)
         m_voices.append(WebCore::PlatformSpeechSynthesisVoice::create(voice.voiceURI, voice.name, voice.lang, voice.localService, voice.defaultLang));
-        
-    }
     return m_voices;
+}
+
+WebCore::SpeechSynthesisClientObserver* WebSpeechSynthesisClient::corePageObserver() const
+{
+    if (m_page.corePage() && m_page.corePage()->speechSynthesisClient() && m_page.corePage()->speechSynthesisClient()->observer())
+        return m_page.corePage()->speechSynthesisClient()->observer().get();
+    return nullptr;
 }
 
@@ -54 +59 @@
 {
     WTF::CompletionHandler<void()> completionHandler = [this, weakThis = makeWeakPtr(*this)]() mutable {
-        if (weakThis)
-            m_page.corePage()->speechSynthesisClient()->observer()->didFinishSpeaking();
+        if (!weakThis)
+            return;
+        if (auto observer = corePageObserver())
+            observer->didFinishSpeaking();
     };
 
@@ -66 +73 @@
 
     m_page.sendWithAsyncReply(Messages::WebPageProxy::SpeechSynthesisSpeak(utterance->text(), utterance->lang(), utterance->volume(), utterance->rate(), utterance->pitch(), utterance->startTime(), voiceURI, name, lang, localService, isDefault), WTFMove(completionHandler));
-
-    m_page.corePage()->speechSynthesisClient()->observer()->didStartSpeaking();
+    if (auto observer = corePageObserver())
+        observer->didStartSpeaking();
 }
 
@@ -78 +85 @@
 {
     WTF::CompletionHandler<void()> completionHandler = [this, weakThis = makeWeakPtr(*this)]() mutable {
-        if (weakThis)
-            m_page.corePage()->speechSynthesisClient()->observer()->didPauseSpeaking();
+        if (!weakThis)
+            return;
+        if (auto observer = corePageObserver())
+            observer->didPauseSpeaking();
     };
     
@@ -88 +97 @@
 {
     WTF::CompletionHandler<void()> completionHandler = [this, weakThis = makeWeakPtr(*this)]() mutable {
-        if (weakThis)
-            m_page.corePage()->speechSynthesisClient()->observer()->didResumeSpeaking();
+        if (!weakThis)
+            return;
+        if (auto observer = corePageObserver())
+            observer->didResumeSpeaking();
     };
     

trunk/Source/WebKit/WebProcess/WebCoreSupport/WebSpeechSynthesisClient.h

@@ -50 +50 @@
     void pause() override;
     void resume() override;
-    
+private:
     void setObserver(WeakPtr<WebCore::SpeechSynthesisClientObserver> observer) override { m_observer = observer; }
     WeakPtr<WebCore::SpeechSynthesisClientObserver> observer() const override { return m_observer; }
+
+    WebCore::SpeechSynthesisClientObserver* corePageObserver() const;
     
-
-private:
     WebPage& m_page;
     WeakPtr<WebCore::SpeechSynthesisClientObserver> m_observer;

trunk/Source/WebKit/WebProcess/WebPage/WebPage.cpp

@@ -6585 +6585 @@
 void WebPage::speakingErrorOccurred()
 {
-    corePage()->speechSynthesisClient()->observer()->speakingErrorOccurred();
+    if (auto observer = corePage()->speechSynthesisClient()->observer())
+        observer->speakingErrorOccurred();
 }
 
 void WebPage::boundaryEventOccurred(bool wordBoundary, unsigned charIndex)
 {
-    corePage()->speechSynthesisClient()->observer()->boundaryEventOccurred(wordBoundary, charIndex);
+    if (auto observer = corePage()->speechSynthesisClient()->observer())
+        observer->boundaryEventOccurred(wordBoundary, charIndex);
 }
 
 void WebPage::voicesDidChange()
 {
-    corePage()->speechSynthesisClient()->observer()->voicesChanged();
+    if (auto observer = corePage()->speechSynthesisClient()->observer())
+        observer->voicesChanged();
 }
 #endif