Cherry-pick 274202@main (ca5c43b). https://bugs.webkit.org/show_bug.c…

…gi?id=268541

    [GStreamer] imported/w3c/web-platform-tests/webaudio/the-audio-api/the-audioworklet-interface/audioworkletprocessor-promises.https.html is flaky crash
    https://bugs.webkit.org/show_bug.cgi?id=268541
    <rdar://problem/122117396>

    Reviewed by Xabier Rodriguez-Calvar.

    The crash backtrace suggested the WebAudioSource element was attempting to use a dangling pointer.
    Ideally we should make the AudioDestination a weak pointer in the WebAudioSource but that breaks
    assumptions elsewhere where AudioDestination is used as a RefCounted.

    * Source/WebCore/platform/audio/gstreamer/AudioDestinationGStreamer.cpp:
    (WebCore::AudioDestinationGStreamer::~AudioDestinationGStreamer):
    * Source/WebCore/platform/audio/gstreamer/WebKitWebAudioSourceGStreamer.cpp:
    (webkit_web_audio_src_class_init):
    (webKitWebAudioSrcConstructed):
    (webKitWebAudioSrcRenderAndPushFrames):

    Canonical link: https://commits.webkit.org/274202@main

Canonical link: https://commits.webkit.org/266719.367@webkitglib/2.42

Source/WebCore/platform/audio/gstreamer/AudioDestinationGStreamer.cpp

@@ -180,6 +180,8 @@ AudioDestinationGStreamer::AudioDestinationGStreamer(AudioIOCallback& callback,
 AudioDestinationGStreamer::~AudioDestinationGStreamer()
 {
     GST_DEBUG_OBJECT(m_pipeline.get(), "Disposing");
+    if (LIKELY(m_src))
+        g_object_set(m_src.get(), "destination", nullptr, nullptr);
     disconnectSimpleBusMessageCallback(m_pipeline.get());
     gst_element_set_state(m_pipeline.get(), GST_STATE_NULL);
     notifyStopResult(true);

Source/WebCore/platform/audio/gstreamer/WebKitWebAudioSourceGStreamer.cpp

@@ -191,8 +191,7 @@ static void webkit_web_audio_src_class_init(WebKitWebAudioSrcClass* webKitWebAud
                                                        G_MINDOUBLE, G_MAXDOUBLE,
                                                        44100.0, flags));
 
-    g_object_class_install_property(objectClass, PROP_DESTINATION, g_param_spec_pointer("destination", "destination",
-        "Destination", flags));
+    g_object_class_install_property(objectClass, PROP_DESTINATION, g_param_spec_pointer("destination", "destination", "Destination", G_PARAM_READWRITE));
 
     g_object_class_install_property(objectClass,
                                     PROP_FRAMES,
@@ -208,7 +207,6 @@ static void webKitWebAudioSrcConstructed(GObject* object)
     WebKitWebAudioSrc* src = WEBKIT_WEB_AUDIO_SRC(object);
     WebKitWebAudioSrcPrivate* priv = src->priv;
 
-    ASSERT(priv->destination);
     ASSERT(priv->sampleRate);
 
     GST_OBJECT_FLAG_SET(GST_OBJECT_CAST(src), GST_ELEMENT_FLAG_SOURCE);
@@ -321,6 +319,9 @@ static void webKitWebAudioSrcRenderAndPushFrames(const GRefPtr<GstElement>& elem
         priv->dispatchCondition.notifyOne();
     });
 
+    if (!priv->destination)
+        return;
+
     GST_TRACE_OBJECT(element.get(), "Playing: %d", priv->destination->isPlaying());
     if (priv->hasRenderedAudibleFrame && !priv->destination->isPlaying())
         return;