Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore: cherry-pick 85f708fa7ab8 from chromium #23048

merged 3 commits into from Apr 13, 2020


Copy link

@nornagon nornagon commented Apr 9, 2020

Use KeepSelfAlive on AudioContext to keep it alive until rendering stops

When an ExecutionContext is abruptly/unexpectedly destroyed (e.g.
shutting down of document or iframe), an AudioContext can also
go away. This type of shutdown can be problematic because the render
thread still might be touching resources in the AudioContext allocated
by the main thread.

This CL introduces a self-referencing pointer to the AudioContext,
and it is cleared after the underlying render thread is stopped. In
that way, the destruction of AudioContext can be done safely.

Test: Locally confirmed the repro case doesn't crash (UAP) after 1hr.
Bug: 1043446
Change-Id: I2e40b7d58ca9d647eed8a5971fc69dc87ee3d1fe
Reviewed-by: Raymond Toy
Reviewed-by: Michael Lippautz
Commit-Queue: Hongchan Choi
Cr-Commit-Position: refs/heads/master@{#742338}

Notes: Security: backported fix for CVE-2020-6423: Use after free in audio.

@nornagon nornagon merged commit 372c5b9 into 7-2-x Apr 13, 2020
15 of 16 checks passed
Copy link

@release-clerk release-clerk bot commented Apr 13, 2020

Release Notes Persisted

Security: backported fix for CVE-2020-6423: Use after free in audio.

@nornagon nornagon deleted the cherry-pick/7-2-x/chromium/85f708fa7ab8 branch Apr 13, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
None yet
Linked issues

Successfully merging this pull request may close these issues.

None yet

2 participants