jsc_fuz/wktr: *flaky* RELEASE_ASSERT_WITH_SECURITY_IMPLICATION(!retai…

…nedPointer || !m_controlBlock->objectHasBeenDeleted()); in MediaRecorderPrivateWriter::compressedVideoOutputBufferCallback MediaRecorderPrivateWriterCocoa.mm:107 https://bugs.webkit.org/show_bug.cgi?id=257780 rdar://109659987 Reviewed by Eric Carlson. After the introduction of ThreadSafeRefCountedAndCanMakeThreadSafeWeakPtr, we are now lazily creating our weak pointer on various threads, and this can happen while destroying the object in main thread. To make sure we do not end up in that situation, we are now closing MediaRecorderPrivateWriter before destroying it. In closing, we destroy the compressors which are the ones calling the callbacks that can create the weak pointers. * LayoutTests/fast/mediastream/mediarecorder-close-expected.txt: Added. * LayoutTests/fast/mediastream/mediarecorder-close.html: Added. * Source/WebCore/platform/mediarecorder/MediaRecorderPrivateAVFImpl.cpp: (WebCore::MediaRecorderPrivateAVFImpl::MediaRecorderPrivateAVFImpl): * Source/WebCore/platform/mediarecorder/cocoa/MediaRecorderPrivateWriterCocoa.h: * Source/WebCore/platform/mediarecorder/cocoa/MediaRecorderPrivateWriterCocoa.mm: (WebCore::MediaRecorderPrivateWriter::~MediaRecorderPrivateWriter): (WebCore::MediaRecorderPrivateWriter::close): * Source/WebKit/GPUProcess/webrtc/RemoteMediaRecorder.cpp: (WebKit::RemoteMediaRecorder::~RemoteMediaRecorder): Originally-landed-as: 259548.822@safari-7615-branch (3282e8c). rdar://113224891 Canonical link: https://commits.webkit.org/266596@main
WebKit · Aug 4, 2023 · b08d868 · b08d868
1 parent 6d13b16
commit b08d868
Show file tree

Hide file tree

Showing 6 changed files with 33 additions and 0 deletions.
diff --git a/LayoutTests/fast/mediastream/mediarecorder-close-expected.txt b/LayoutTests/fast/mediastream/mediarecorder-close-expected.txt
@@ -0,0 +1 @@
+PASS if not crashing
diff --git a/LayoutTests/fast/mediastream/mediarecorder-close.html b/LayoutTests/fast/mediastream/mediarecorder-close.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html>
+<body>
+<div>PASS if not crashing</div>
+<script>
+if (window.testRunner)
+    testRunner.dumpAsText();
+
+onload = async () => {
+  for (let i = 0; i < 25; i++) {
+    await caches.has('a');
+    const stream = await navigator.mediaDevices.getUserMedia({video: true});
+    const mediaRecorder = new MediaRecorder(stream);
+    location.hash = 'x';
+    mediaRecorder.start();
+  }
+};
+</script>
+</body>
+</html>
diff --git a/Source/WebCore/platform/mediarecorder/MediaRecorderPrivateAVFImpl.cpp b/Source/WebCore/platform/mediarecorder/MediaRecorderPrivateAVFImpl.cpp
@@ -75,6 +75,7 @@ MediaRecorderPrivateAVFImpl::MediaRecorderPrivateAVFImpl(Ref<MediaRecorderPrivat
 
 MediaRecorderPrivateAVFImpl::~MediaRecorderPrivateAVFImpl()
 {
+    m_writer->close();
 }
 
 void MediaRecorderPrivateAVFImpl::startRecording(StartRecordingCallback&& callback)

diff --git a/Source/WebCore/platform/mediarecorder/cocoa/MediaRecorderPrivateWriterCocoa.h b/Source/WebCore/platform/mediarecorder/cocoa/MediaRecorderPrivateWriterCocoa.h
@@ -80,6 +80,8 @@ class WEBCORE_EXPORT MediaRecorderPrivateWriter : public ThreadSafeRefCountedAnd
     unsigned audioBitRate() const;
     unsigned videoBitRate() const;
 
+    void close();
+
 private:
     MediaRecorderPrivateWriter(bool hasAudio, bool hasVideo);
 

diff --git a/Source/WebCore/platform/mediarecorder/cocoa/MediaRecorderPrivateWriterCocoa.mm b/Source/WebCore/platform/mediarecorder/cocoa/MediaRecorderPrivateWriterCocoa.mm
@@ -132,6 +132,8 @@ - (void)close
 MediaRecorderPrivateWriter::~MediaRecorderPrivateWriter()
 {
     ASSERT(isMainThread());
+    ASSERT(!m_audioCompressor);
+    ASSERT(!m_videoCompressor);
 
     m_pendingAudioSampleQueue.clear();
     m_pendingVideoFrameQueue.clear();
@@ -147,6 +149,12 @@ - (void)close
         completionHandler(nullptr, 0);
 }
 
+void MediaRecorderPrivateWriter::close()
+{
+    m_audioCompressor = nullptr;
+    m_videoCompressor = nullptr;
+}
+
 bool MediaRecorderPrivateWriter::initialize(const MediaRecorderPrivateOptions& options)
 {
     NSError *error = nil;

diff --git a/Source/WebKit/GPUProcess/webrtc/RemoteMediaRecorder.cpp b/Source/WebKit/GPUProcess/webrtc/RemoteMediaRecorder.cpp
@@ -62,6 +62,7 @@ RemoteMediaRecorder::RemoteMediaRecorder(GPUConnectionToWebProcess& gpuConnectio
 
 RemoteMediaRecorder::~RemoteMediaRecorder()
 {
+    m_writer->close();
 }
 
 void RemoteMediaRecorder::audioSamplesStorageChanged(ConsumerSharedCARingBuffer::Handle&& handle, const WebCore::CAAudioStreamDescription& description)