Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 55d9d9007f54ee61fa38accb59cd88a8d4075847
https://github.com/WebKit/WebKit/commit/55d9d9007f54ee61fa38accb59cd88a8d4075847
Author: Phinehas Fuachie <[email protected]>
Date: 2026-08-23 (Sun, 23 Aug 2026)
Changed paths:
A LayoutTests/webaudio/mediaelementsource-clear-detached-frame-expected.txt
A LayoutTests/webaudio/mediaelementsource-clear-detached-frame.html
A
LayoutTests/webaudio/resources/mediaelementsource-clear-detached-frame-iframe.html
M Source/WebCore/html/HTMLMediaElement.cpp
Log Message:
-----------
Use-after-free in MediaElementAudioSourceNode::provideInput when iframe is
detached
https://bugs.webkit.org/show_bug.cgi?id=315989
rdar://175673159
Reviewed by Chris Dumez.
HTMLMediaElement::clearMediaPlayer() resets m_player on the main thread without
holding
m_audioSourceNode->processLock(), but the audio render thread reads m_player via
audioSourceProvider() inside MediaElementAudioSourceNode::process() while
holding that lock.
Because audioSourceProvider() returns a raw AudioSourceProvider* and drops its
local
RefPtr<MediaPlayer> on return, and MediaPlayer is DestructionThread::Main, the
main thread can
synchronously run ~MediaPlayer (destroying the RemoteAudioSourceProvider) while
the render thread
is still inside provideInput() with the now-dangling pointer.
This is reachable from HTMLMediaElement::stop() (ActiveDOMObject stop on iframe
detach) and
userCancelledLoad().
Match the contract already enforced by createMediaPlayer() and
mediaPlayerWill/DidInitializeMediaEngine() by holding the audio node's
processLock around
player->invalidate() / m_player = nullptr in clearMediaPlayer(). process()
acquires the same lock
with tryLock(), so this cannot deadlock — the render thread will simply zero
its output for one
quantum while the main thread tears down.
Test: webaudio/mediaelementsource-clear-detached-frame.html
* LayoutTests/webaudio/mediaelementsource-clear-detached-frame-expected.txt:
Added.
* LayoutTests/webaudio/mediaelementsource-clear-detached-frame.html: Added.
*
LayoutTests/webaudio/resources/mediaelementsource-clear-detached-frame-iframe.html:
Added.
* Source/WebCore/html/HTMLMediaElement.cpp:
(WebCore::HTMLMediaElement::clearMediaPlayer): Deleted.
Originally-landed-as: [email protected] (e186258f7967).
rdar://185367736
Canonical link: https://commits.webkit.org/319666@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
