Changeset 248492 in webkit


Ignore:
Timestamp:
Aug 9, 2019 5:56:31 PM (5 years ago)
Author:
Chris Dumez
Message:

Possible non-thread safe usage of RefCounted in ~VideoFullscreenControllerContext()
https://bugs.webkit.org/show_bug.cgi?id=200599

Reviewed by Geoffrey Garen.

WebVideoFullscreenControllerAVKit's m_playbackModel & m_fullscreenModel data members are
WebThread objects so we need to make sure we grab the WebThread lock before dereferencing
them in the WebVideoFullscreenControllerAVKit destructor, when destroyed on the UIThread.

  • platform/ios/WebVideoFullscreenControllerAVKit.mm:

(VideoFullscreenControllerContext::~VideoFullscreenControllerContext):

Location:
trunk/Source/WebCore
Files:
2 edited

Legend:

Unmodified
Added
Removed
  • trunk/Source/WebCore/ChangeLog

    r248491 r248492  
     12019-08-09  Chris Dumez  <cdumez@apple.com>
     2
     3        Possible non-thread safe usage of RefCounted in ~VideoFullscreenControllerContext()
     4        https://bugs.webkit.org/show_bug.cgi?id=200599
     5
     6        Reviewed by Geoffrey Garen.
     7
     8        WebVideoFullscreenControllerAVKit's m_playbackModel & m_fullscreenModel data members are
     9        WebThread objects so we need to make sure we grab the WebThread lock before dereferencing
     10        them in the WebVideoFullscreenControllerAVKit destructor, when destroyed on the UIThread.
     11
     12        * platform/ios/WebVideoFullscreenControllerAVKit.mm:
     13        (VideoFullscreenControllerContext::~VideoFullscreenControllerContext):
     14
    1152019-08-09  Ali Juma  <ajuma@chromium.org>
    216
  • trunk/Source/WebCore/platform/ios/WebVideoFullscreenControllerAVKit.mm

    r248101 r248492  
    227227            (*m_fullscreenClients.begin())->modelDestroyed();
    228228    };
    229     if (isUIThread())
     229    if (isUIThread()) {
     230        WebThreadLock();
    230231        notifyClientsModelWasDestroyed();
    231     else
     232        m_playbackModel = nullptr;
     233        m_fullscreenModel = nullptr;
     234    } else
    232235        dispatch_sync(dispatch_get_main_queue(), WTFMove(notifyClientsModelWasDestroyed));
    233236}
Note: See TracChangeset for help on using the changeset viewer.