AudioWorkletProcessor which does not extend base class crashes Safari

https://bugs.webkit.org/show_bug.cgi?id=225449
<rdar://problem/77624792>

Reviewed by Sam Weinig.

Update AudioWorkletGlobalScope::createProcessor() to validate the type of the processor
after constructing it.

* Modules/webaudio/AudioWorkletGlobalScope.cpp:
(WebCore::AudioWorkletGlobalScope::createProcessor):


Canonical link: https://commits.webkit.org/237463@main
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@277177 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Source/WebCore/ChangeLog

@@ -1,3 +1,17 @@
+2021-05-07  Chris Dumez  <cdumez@apple.com>
+
+        AudioWorkletProcessor which does not extend base class crashes Safari
+        https://bugs.webkit.org/show_bug.cgi?id=225449
+        <rdar://problem/77624792>
+
+        Reviewed by Sam Weinig.
+
+        Update AudioWorkletGlobalScope::createProcessor() to validate the type of the processor
+        after constructing it.
+
+        * Modules/webaudio/AudioWorkletGlobalScope.cpp:
+        (WebCore::AudioWorkletGlobalScope::createProcessor):
+
 2021-05-07  Philippe Normand  <pnormand@igalia.com>
 
         [GStreamer][MediaStream] Emit black frames for disabled video tracks

Source/WebCore/Modules/webaudio/AudioWorkletGlobalScope.cpp

@@ -150,10 +150,13 @@ RefPtr<AudioWorkletProcessor> AudioWorkletGlobalScope::createProcessor(const Str
     ASSERT(!!scope.exception() == !object);
     RETURN_IF_EXCEPTION(scope, nullptr);
 
-    auto& jsProcessor = *JSC::jsCast<JSAudioWorkletProcessor*>(object);
-    jsProcessor.wrapped().setProcessCallback(makeUnique<JSCallbackDataStrong>(&jsProcessor, globalObject));
+    auto* jsProcessor = JSC::jsDynamicCast<JSAudioWorkletProcessor*>(vm, object);
+    if (!jsProcessor)
+        return nullptr;
+
+    jsProcessor->wrapped().setProcessCallback(makeUnique<JSCallbackDataStrong>(jsProcessor, globalObject));
 
-    return &jsProcessor.wrapped();
+    return &jsProcessor->wrapped();
 }
 
 void AudioWorkletGlobalScope::prepareForDestruction()