diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog index 37ad10bfdb1c..ffc91fa7e51e 100644 --- a/Source/WebCore/ChangeLog +++ b/Source/WebCore/ChangeLog @@ -1,3 +1,17 @@ +2021-05-07 Chris Dumez + + AudioWorkletProcessor which does not extend base class crashes Safari + https://bugs.webkit.org/show_bug.cgi?id=225449 + + + Reviewed by Sam Weinig. + + Update AudioWorkletGlobalScope::createProcessor() to validate the type of the processor + after constructing it. + + * Modules/webaudio/AudioWorkletGlobalScope.cpp: + (WebCore::AudioWorkletGlobalScope::createProcessor): + 2021-05-07 Philippe Normand [GStreamer][MediaStream] Emit black frames for disabled video tracks diff --git a/Source/WebCore/Modules/webaudio/AudioWorkletGlobalScope.cpp b/Source/WebCore/Modules/webaudio/AudioWorkletGlobalScope.cpp index ad563da53c04..2070fc7c1098 100644 --- a/Source/WebCore/Modules/webaudio/AudioWorkletGlobalScope.cpp +++ b/Source/WebCore/Modules/webaudio/AudioWorkletGlobalScope.cpp @@ -150,10 +150,13 @@ RefPtr AudioWorkletGlobalScope::createProcessor(const Str ASSERT(!!scope.exception() == !object); RETURN_IF_EXCEPTION(scope, nullptr); - auto& jsProcessor = *JSC::jsCast(object); - jsProcessor.wrapped().setProcessCallback(makeUnique(&jsProcessor, globalObject)); + auto* jsProcessor = JSC::jsDynamicCast(vm, object); + if (!jsProcessor) + return nullptr; + + jsProcessor->wrapped().setProcessCallback(makeUnique(jsProcessor, globalObject)); - return &jsProcessor.wrapped(); + return &jsProcessor->wrapped(); } void AudioWorkletGlobalScope::prepareForDestruction()