Title: [270768] trunk/Source
Revision
270768
Author
[email protected]
Date
2020-12-14 08:26:26 -0800 (Mon, 14 Dec 2020)

Log Message

[GPUProcess] Crash under AudioDestinationCocoa::setIsPlaying(bool)
https://bugs.webkit.org/show_bug.cgi?id=219809

Reviewed by Eric Carlson.

Source/WebCore:

The issue is that when using the GPU process, AudioDestination::stop() & start()
are asynchronous due to IPC. Those functions take completion handlers and
the AudioDestination object makes sure to ref itself to keep itself alive during
async operations. However, AudioDestination::m_callback is a raw pointer to
the AudioDestinationNode, which may itself become dead if AudioDestination
extends its lifetime by ref'ing itself.

To address the issue, AudioDestination is not fully owned by AudioDestinationNode.
If the AudioDestination needs to keep itself alive, it now ref's its owner
(AudioDestinationNode). This ensure that AudioDestination::m_callback never goes
stale, even if AudioDestination extends its lifetime by ref'ing itself during
async operations.

No new tests, covered by existing WebAudio tests currently crashing on
the GPU bots.

* Modules/webaudio/AudioDestinationNode.cpp:
(WebCore::AudioDestinationNode::~AudioDestinationNode):
* Modules/webaudio/AudioDestinationNode.h:
(WebCore::AudioDestinationNode::isPlaying):
* Modules/webaudio/AudioNode.cpp:
(WebCore::AudioNode::deref):
* Modules/webaudio/BaseAudioContext.cpp:
(WebCore::BaseAudioContext::clear):
* Modules/webaudio/DefaultAudioDestinationNode.cpp:
(WebCore::DefaultAudioDestinationNode::~DefaultAudioDestinationNode):
(WebCore::DefaultAudioDestinationNode::uninitialize):
(WebCore::DefaultAudioDestinationNode::createDestination):
* Modules/webaudio/DefaultAudioDestinationNode.h:
* Modules/webaudio/OfflineAudioDestinationNode.cpp:
(WebCore::OfflineAudioDestinationNode::~OfflineAudioDestinationNode):
* platform/MediaStrategy.h:
* platform/audio/AudioDestination.h:
(WebCore::AudioDestination::ref):
(WebCore::AudioDestination::deref):
(WebCore::AudioDestination::AudioDestination):
* platform/audio/AudioIOCallback.h:
* platform/audio/cocoa/AudioDestinationCocoa.cpp:
(WebCore::AudioDestination::create):
(WebCore::AudioDestinationCocoa::AudioDestinationCocoa):
* platform/audio/cocoa/AudioDestinationCocoa.h:
* platform/audio/gstreamer/AudioDestinationGStreamer.cpp:
(WebCore::AudioDestination::create):
(WebCore::AudioDestinationGStreamer::AudioDestinationGStreamer):
* platform/mock/MockAudioDestinationCocoa.h:

Source/WebKit:

* WebProcess/GPU/media/RemoteAudioDestinationProxy.cpp:
(WebKit::RemoteAudioDestinationProxy::create):
* WebProcess/GPU/media/RemoteAudioDestinationProxy.h:
* WebProcess/GPU/media/WebMediaStrategy.cpp:
(WebKit::WebMediaStrategy::createAudioDestination):
* WebProcess/GPU/media/WebMediaStrategy.h:

Source/WebKitLegacy/mac:

* WebCoreSupport/WebPlatformStrategies.mm:

Source/WebKitLegacy/win:

* WebCoreSupport/WebPlatformStrategies.cpp:

Modified Paths

Diff

Modified: trunk/Source/WebCore/ChangeLog (270767 => 270768)


--- trunk/Source/WebCore/ChangeLog	2020-12-14 12:27:57 UTC (rev 270767)
+++ trunk/Source/WebCore/ChangeLog	2020-12-14 16:26:26 UTC (rev 270768)
@@ -1,3 +1,56 @@
+2020-12-14  Chris Dumez  <[email protected]>
+
+        [GPUProcess] Crash under AudioDestinationCocoa::setIsPlaying(bool)
+        https://bugs.webkit.org/show_bug.cgi?id=219809
+
+        Reviewed by Eric Carlson.
+
+        The issue is that when using the GPU process, AudioDestination::stop() & start()
+        are asynchronous due to IPC. Those functions take completion handlers and
+        the AudioDestination object makes sure to ref itself to keep itself alive during
+        async operations. However, AudioDestination::m_callback is a raw pointer to
+        the AudioDestinationNode, which may itself become dead if AudioDestination
+        extends its lifetime by ref'ing itself.
+
+        To address the issue, AudioDestination is not fully owned by AudioDestinationNode.
+        If the AudioDestination needs to keep itself alive, it now ref's its owner
+        (AudioDestinationNode). This ensure that AudioDestination::m_callback never goes
+        stale, even if AudioDestination extends its lifetime by ref'ing itself during
+        async operations.
+
+        No new tests, covered by existing WebAudio tests currently crashing on
+        the GPU bots.
+
+        * Modules/webaudio/AudioDestinationNode.cpp:
+        (WebCore::AudioDestinationNode::~AudioDestinationNode):
+        * Modules/webaudio/AudioDestinationNode.h:
+        (WebCore::AudioDestinationNode::isPlaying):
+        * Modules/webaudio/AudioNode.cpp:
+        (WebCore::AudioNode::deref):
+        * Modules/webaudio/BaseAudioContext.cpp:
+        (WebCore::BaseAudioContext::clear):
+        * Modules/webaudio/DefaultAudioDestinationNode.cpp:
+        (WebCore::DefaultAudioDestinationNode::~DefaultAudioDestinationNode):
+        (WebCore::DefaultAudioDestinationNode::uninitialize):
+        (WebCore::DefaultAudioDestinationNode::createDestination):
+        * Modules/webaudio/DefaultAudioDestinationNode.h:
+        * Modules/webaudio/OfflineAudioDestinationNode.cpp:
+        (WebCore::OfflineAudioDestinationNode::~OfflineAudioDestinationNode):
+        * platform/MediaStrategy.h:
+        * platform/audio/AudioDestination.h:
+        (WebCore::AudioDestination::ref):
+        (WebCore::AudioDestination::deref):
+        (WebCore::AudioDestination::AudioDestination):
+        * platform/audio/AudioIOCallback.h:
+        * platform/audio/cocoa/AudioDestinationCocoa.cpp:
+        (WebCore::AudioDestination::create):
+        (WebCore::AudioDestinationCocoa::AudioDestinationCocoa):
+        * platform/audio/cocoa/AudioDestinationCocoa.h:
+        * platform/audio/gstreamer/AudioDestinationGStreamer.cpp:
+        (WebCore::AudioDestination::create):
+        (WebCore::AudioDestinationGStreamer::AudioDestinationGStreamer):
+        * platform/mock/MockAudioDestinationCocoa.h:
+
 2020-12-14  Lauro Moura  <[email protected]>
 
         REGRESSSION(270435) [GStreamer] Many media source tests failing and timing out

Modified: trunk/Source/WebCore/Modules/webaudio/AudioDestinationNode.cpp (270767 => 270768)


--- trunk/Source/WebCore/Modules/webaudio/AudioDestinationNode.cpp	2020-12-14 12:27:57 UTC (rev 270767)
+++ trunk/Source/WebCore/Modules/webaudio/AudioDestinationNode.cpp	2020-12-14 16:26:26 UTC (rev 270768)
@@ -52,7 +52,7 @@
 
 AudioDestinationNode::~AudioDestinationNode()
 {
-    uninitialize();
+    ASSERT(!isInitialized());
 }
 
 void AudioDestinationNode::render(AudioBus*, AudioBus* destinationBus, size_t numberOfFrames, const AudioIOPosition& outputPosition)

Modified: trunk/Source/WebCore/Modules/webaudio/AudioDestinationNode.h (270767 => 270768)


--- trunk/Source/WebCore/Modules/webaudio/AudioDestinationNode.h	2020-12-14 12:27:57 UTC (rev 270767)
+++ trunk/Source/WebCore/Modules/webaudio/AudioDestinationNode.h	2020-12-14 16:26:26 UTC (rev 270768)
@@ -62,10 +62,14 @@
     virtual void restartRendering() { }
 
     virtual bool isPlaying() { return false; }
-    void isPlayingDidChange() override;
     bool isPlayingAudio() const { return m_isEffectivelyPlayingAudio; }
     void setMuted(bool muted) { m_muted = muted; }
 
+    // AudioIOCallback.
+    void refAudioCallback() final { ref(); }
+    void derefAudioCallback() final { deref(); }
+    void isPlayingDidChange() override;
+
 protected:
     double tailTime() const override { return 0; }
     double latencyTime() const override { return 0; }

Modified: trunk/Source/WebCore/Modules/webaudio/AudioNode.cpp (270767 => 270768)


--- trunk/Source/WebCore/Modules/webaudio/AudioNode.cpp	2020-12-14 12:27:57 UTC (rev 270767)
+++ trunk/Source/WebCore/Modules/webaudio/AudioNode.cpp	2020-12-14 16:26:26 UTC (rev 270768)
@@ -646,6 +646,11 @@
 
 void AudioNode::deref()
 {
+    if (!isMainThread()) {
+        callOnMainThread(std::bind(&AudioNode::deref, this));
+        return;
+    }
+
     ASSERT(!context().isAudioThread());
 
     {

Modified: trunk/Source/WebCore/Modules/webaudio/BaseAudioContext.cpp (270767 => 270768)


--- trunk/Source/WebCore/Modules/webaudio/BaseAudioContext.cpp	2020-12-14 12:27:57 UTC (rev 270767)
+++ trunk/Source/WebCore/Modules/webaudio/BaseAudioContext.cpp	2020-12-14 16:26:26 UTC (rev 270768)
@@ -203,8 +203,10 @@
     auto protectedThis = makeRef(*this);
 
     // We have to release our reference to the destination node before the context will ever be deleted since the destination node holds a reference to the context.
-    if (m_destinationNode)
+    if (m_destinationNode) {
+        m_destinationNode->uninitialize();
         m_destinationNode = nullptr;
+    }
 
     // Audio thread is dead. Nobody will schedule node deletion action. Let's do it ourselves.
     do {

Modified: trunk/Source/WebCore/Modules/webaudio/DefaultAudioDestinationNode.cpp (270767 => 270768)


--- trunk/Source/WebCore/Modules/webaudio/DefaultAudioDestinationNode.cpp	2020-12-14 12:27:57 UTC (rev 270767)
+++ trunk/Source/WebCore/Modules/webaudio/DefaultAudioDestinationNode.cpp	2020-12-14 16:26:26 UTC (rev 270768)
@@ -54,7 +54,7 @@
 
 DefaultAudioDestinationNode::~DefaultAudioDestinationNode()
 {
-    uninitialize();
+    ASSERT(!isInitialized());
 }
 
 void DefaultAudioDestinationNode::initialize()
@@ -77,7 +77,6 @@
     ALWAYS_LOG(LOGIDENTIFIER);
     m_wasDestinationStarted = false;
     m_destination->stop();
-    m_destination = nullptr;
     m_numberOfInputChannels = 0;
 
     AudioNode::uninitialize();
@@ -86,7 +85,7 @@
 void DefaultAudioDestinationNode::createDestination()
 {
     ALWAYS_LOG(LOGIDENTIFIER, "contextSampleRate = ", m_sampleRate, ", hardwareSampleRate = ", AudioDestination::hardwareSampleRate());
-    m_destination = platformStrategies()->mediaStrategy().createAudioDestination(*this, m_inputDeviceId, m_numberOfInputChannels, channelCount(), m_sampleRate);
+    m_destination = platformStrategies()->mediaStrategy().createAudioDestination(*this, m_inputDeviceId, m_numberOfInputChannels, channelCount(), m_sampleRate).moveToUniquePtr();
 }
 
 void DefaultAudioDestinationNode::enableInput(const String& inputDeviceId)

Modified: trunk/Source/WebCore/Modules/webaudio/DefaultAudioDestinationNode.h (270767 => 270768)


--- trunk/Source/WebCore/Modules/webaudio/DefaultAudioDestinationNode.h	2020-12-14 12:27:57 UTC (rev 270767)
+++ trunk/Source/WebCore/Modules/webaudio/DefaultAudioDestinationNode.h	2020-12-14 16:26:26 UTC (rev 270768)
@@ -64,7 +64,7 @@
     unsigned maxChannelCount() const final;
     bool isPlaying() final;
 
-    RefPtr<AudioDestination> m_destination;
+    std::unique_ptr<AudioDestination> m_destination;
     bool m_wasDestinationStarted { false };
     String m_inputDeviceId;
     unsigned m_numberOfInputChannels { 0 };

Modified: trunk/Source/WebCore/Modules/webaudio/OfflineAudioDestinationNode.cpp (270767 => 270768)


--- trunk/Source/WebCore/Modules/webaudio/OfflineAudioDestinationNode.cpp	2020-12-14 12:27:57 UTC (rev 270767)
+++ trunk/Source/WebCore/Modules/webaudio/OfflineAudioDestinationNode.cpp	2020-12-14 16:26:26 UTC (rev 270768)
@@ -55,7 +55,7 @@
 
 OfflineAudioDestinationNode::~OfflineAudioDestinationNode()
 {
-    uninitialize();
+    ASSERT(!isInitialized());
 }
 
 unsigned OfflineAudioDestinationNode::maxChannelCount() const

Modified: trunk/Source/WebCore/platform/MediaStrategy.h (270767 => 270768)


--- trunk/Source/WebCore/platform/MediaStrategy.h	2020-12-14 12:27:57 UTC (rev 270767)
+++ trunk/Source/WebCore/platform/MediaStrategy.h	2020-12-14 16:26:26 UTC (rev 270768)
@@ -37,7 +37,7 @@
 class WEBCORE_EXPORT MediaStrategy {
 public:
 #if ENABLE(WEB_AUDIO)
-    virtual Ref<AudioDestination> createAudioDestination(
+    virtual UniqueRef<AudioDestination> createAudioDestination(
         AudioIOCallback&, const String& inputDeviceId, unsigned numberOfInputChannels, unsigned numberOfOutputChannels, float sampleRate) = 0;
 #endif
 #if PLATFORM(COCOA)

Modified: trunk/Source/WebCore/platform/audio/AudioDestination.h (270767 => 270768)


--- trunk/Source/WebCore/platform/audio/AudioDestination.h	2020-12-14 12:27:57 UTC (rev 270767)
+++ trunk/Source/WebCore/platform/audio/AudioDestination.h	2020-12-14 16:26:26 UTC (rev 270768)
@@ -29,6 +29,7 @@
 #ifndef AudioDestination_h
 #define AudioDestination_h
 
+#include "AudioIOCallback.h"
 #include <memory>
 #include <wtf/CompletionHandler.h>
 #include <wtf/ThreadSafeRefCounted.h>
@@ -36,18 +37,16 @@
 
 namespace WebCore {
 
-class AudioIOCallback;
-
 // AudioDestination is an abstraction for audio hardware I/O.
 // The audio hardware periodically calls the AudioIOCallback render() method asking it to render/output the next render quantum of audio.
 // It optionally will pass in local/live audio input when it calls render().
 
-class AudioDestination : public ThreadSafeRefCounted<AudioDestination> {
+class AudioDestination {
     WTF_MAKE_FAST_ALLOCATED;
 public:
     // Pass in (numberOfInputChannels > 0) if live/local audio input is desired.
     // Port-specific device identification information for live/local input streams can be passed in the inputDeviceId.
-    WEBCORE_EXPORT static Ref<AudioDestination> create(AudioIOCallback&, const String& inputDeviceId, unsigned numberOfInputChannels, unsigned numberOfOutputChannels, float sampleRate);
+    WEBCORE_EXPORT static UniqueRef<AudioDestination> create(AudioIOCallback&, const String& inputDeviceId, unsigned numberOfInputChannels, unsigned numberOfOutputChannels, float sampleRate);
 
     virtual ~AudioDestination() = default;
 
@@ -55,6 +54,9 @@
     virtual void stop(CompletionHandler<void(bool)>&& = [](bool) { }) = 0;
     virtual bool isPlaying() = 0;
 
+    void ref() { m_callback.refAudioCallback(); }
+    void deref() { m_callback.derefAudioCallback(); }
+
     // Sample-rate conversion may happen in AudioDestination to the hardware sample-rate
     virtual float sampleRate() const = 0;
     WEBCORE_EXPORT static float hardwareSampleRate();
@@ -68,6 +70,14 @@
     // be a value: 1 <= numberOfOutputChannels <= maxChannelCount(),
     // or if maxChannelCount() equals 0, then numberOfOutputChannels must be 2.
     static unsigned long maxChannelCount();
+
+protected:
+    explicit AudioDestination(AudioIOCallback& callback)
+        : m_callback(callback)
+    {
+    }
+
+    AudioIOCallback& m_callback;
 };
 
 } // namespace WebCore

Modified: trunk/Source/WebCore/platform/audio/AudioIOCallback.h (270767 => 270768)


--- trunk/Source/WebCore/platform/audio/AudioIOCallback.h	2020-12-14 12:27:57 UTC (rev 270767)
+++ trunk/Source/WebCore/platform/audio/AudioIOCallback.h	2020-12-14 16:26:26 UTC (rev 270768)
@@ -74,6 +74,9 @@
     virtual void isPlayingDidChange() = 0;
 
     virtual ~AudioIOCallback() = default;
+
+    virtual void refAudioCallback() = 0;
+    virtual void derefAudioCallback() = 0;
 };
 
 } // WebCore

Modified: trunk/Source/WebCore/platform/audio/cocoa/AudioDestinationCocoa.cpp (270767 => 270768)


--- trunk/Source/WebCore/platform/audio/cocoa/AudioDestinationCocoa.cpp	2020-12-14 12:27:57 UTC (rev 270767)
+++ trunk/Source/WebCore/platform/audio/cocoa/AudioDestinationCocoa.cpp	2020-12-14 16:26:26 UTC (rev 270768)
@@ -41,7 +41,7 @@
 
 CreateAudioDestinationCocoaOverride AudioDestinationCocoa::createOverride = nullptr;
 
-Ref<AudioDestination> AudioDestination::create(AudioIOCallback& callback, const String&, unsigned numberOfInputChannels, unsigned numberOfOutputChannels, float sampleRate)
+UniqueRef<AudioDestination> AudioDestination::create(AudioIOCallback& callback, const String&, unsigned numberOfInputChannels, unsigned numberOfOutputChannels, float sampleRate)
 {
     // FIXME: make use of inputDeviceId as appropriate.
 
@@ -55,8 +55,7 @@
     if (AudioDestinationCocoa::createOverride)
         return AudioDestinationCocoa::createOverride(callback, sampleRate);
 
-    auto destination = adoptRef(*new AudioDestinationCocoa(callback, numberOfOutputChannels, sampleRate));
-    return destination;
+    return makeUniqueRef<AudioDestinationCocoa>(callback, numberOfOutputChannels, sampleRate);
 }
 
 float AudioDestination::hardwareSampleRate()
@@ -70,8 +69,8 @@
 }
 
 AudioDestinationCocoa::AudioDestinationCocoa(AudioIOCallback& callback, unsigned numberOfOutputChannels, float sampleRate, bool configureAudioOutputUnit)
-    : m_audioOutputUnitAdaptor(*this)
-    , m_callback(callback)
+    : AudioDestination(callback)
+    , m_audioOutputUnitAdaptor(*this)
     , m_outputBus(AudioBus::create(numberOfOutputChannels, AudioUtilities::renderQuantumSize, false).releaseNonNull())
     , m_renderBus(AudioBus::create(numberOfOutputChannels, AudioUtilities::renderQuantumSize).releaseNonNull())
     , m_fifo(makeUniqueRef<PushPullFIFO>(numberOfOutputChannels, fifoSize))

Modified: trunk/Source/WebCore/platform/audio/cocoa/AudioDestinationCocoa.h (270767 => 270768)


--- trunk/Source/WebCore/platform/audio/cocoa/AudioDestinationCocoa.h	2020-12-14 12:27:57 UTC (rev 270767)
+++ trunk/Source/WebCore/platform/audio/cocoa/AudioDestinationCocoa.h	2020-12-14 16:26:26 UTC (rev 270768)
@@ -40,7 +40,7 @@
 class MultiChannelResampler;
 class PushPullFIFO;
 
-using CreateAudioDestinationCocoaOverride = Ref<AudioDestination>(*)(AudioIOCallback&, float sampleRate);
+using CreateAudioDestinationCocoaOverride = UniqueRef<AudioDestination>(*)(AudioIOCallback&, float sampleRate);
 
 // An AudioDestination using CoreAudio's default output AudioUnit
 class AudioDestinationCocoa : public AudioDestination, public AudioUnitRenderer {
@@ -64,7 +64,7 @@
     WEBCORE_EXPORT void getAudioStreamBasicDescription(AudioStreamBasicDescription&);
 
 private:
-    friend Ref<AudioDestination> AudioDestination::create(AudioIOCallback&, const String&, unsigned, unsigned, float);
+    friend UniqueRef<AudioDestination> AudioDestination::create(AudioIOCallback&, const String&, unsigned, unsigned, float);
 
     void start(Function<void(Function<void()>&&)>&&, CompletionHandler<void(bool)>&&) override;
     void stop(CompletionHandler<void(bool)>&&) override;
@@ -72,7 +72,6 @@
     void renderOnRenderingThead(size_t framesToRender);
 
     AudioOutputUnitAdaptor m_audioOutputUnitAdaptor;
-    AudioIOCallback& m_callback;
 
     // To pass the data from FIFO to the audio device callback.
     Ref<AudioBus> m_outputBus;

Modified: trunk/Source/WebCore/platform/audio/gstreamer/AudioDestinationGStreamer.cpp (270767 => 270768)


--- trunk/Source/WebCore/platform/audio/gstreamer/AudioDestinationGStreamer.cpp	2020-12-14 12:27:57 UTC (rev 270767)
+++ trunk/Source/WebCore/platform/audio/gstreamer/AudioDestinationGStreamer.cpp	2020-12-14 16:26:26 UTC (rev 270768)
@@ -32,6 +32,7 @@
 #include "WebKitWebAudioSourceGStreamer.h"
 #include <gst/audio/gstaudiobasesink.h>
 #include <gst/gst.h>
+#include <wtf/UniqueRef.h>
 #include <wtf/glib/GUniquePtr.h>
 #include <wtf/glib/RunLoopSourcePriority.h>
 
@@ -93,7 +94,7 @@
         g_object_set(GST_AUDIO_BASE_SINK(object), "buffer-time", static_cast<gint64>(100000), nullptr);
 }
 
-Ref<AudioDestination> AudioDestination::create(AudioIOCallback& callback, const String&, unsigned numberOfInputChannels, unsigned numberOfOutputChannels, float sampleRate)
+UniqueRef<AudioDestination> AudioDestination::create(AudioIOCallback& callback, const String&, unsigned numberOfInputChannels, unsigned numberOfOutputChannels, float sampleRate)
 {
     initializeDebugCategory();
     // FIXME: make use of inputDeviceId as appropriate.
@@ -102,7 +103,7 @@
     if (numberOfInputChannels)
         WTFLogAlways("AudioDestination::create(%u, %u, %f) - unhandled input channels", numberOfInputChannels, numberOfOutputChannels, sampleRate);
 
-    return adoptRef(*new AudioDestinationGStreamer(callback, numberOfOutputChannels, sampleRate));
+    return makeUniqueRef<AudioDestinationGStreamer>(callback, numberOfOutputChannels, sampleRate);
 }
 
 float AudioDestination::hardwareSampleRate()
@@ -116,7 +117,7 @@
 }
 
 AudioDestinationGStreamer::AudioDestinationGStreamer(AudioIOCallback& callback, unsigned long numberOfOutputChannels, float sampleRate)
-    : m_callback(callback)
+    : AudioDestination(callback)
     , m_renderBus(AudioBus::create(numberOfOutputChannels, AudioUtilities::renderQuantumSize, false))
     , m_sampleRate(sampleRate)
 {

Modified: trunk/Source/WebCore/platform/audio/gstreamer/AudioDestinationGStreamer.h (270767 => 270768)


--- trunk/Source/WebCore/platform/audio/gstreamer/AudioDestinationGStreamer.h	2020-12-14 12:27:57 UTC (rev 270767)
+++ trunk/Source/WebCore/platform/audio/gstreamer/AudioDestinationGStreamer.h	2020-12-14 16:26:26 UTC (rev 270768)
@@ -45,7 +45,6 @@
     gboolean handleMessage(GstMessage*);
 
 private:
-    AudioIOCallback& m_callback;
     RefPtr<AudioBus> m_renderBus;
 
     float m_sampleRate;

Modified: trunk/Source/WebCore/platform/mock/MockAudioDestinationCocoa.h (270767 => 270768)


--- trunk/Source/WebCore/platform/mock/MockAudioDestinationCocoa.h	2020-12-14 12:27:57 UTC (rev 270767)
+++ trunk/Source/WebCore/platform/mock/MockAudioDestinationCocoa.h	2020-12-14 16:26:26 UTC (rev 270768)
@@ -38,9 +38,9 @@
 class MockAudioDestinationCocoa final : public AudioDestinationCocoa {
     WTF_MAKE_FAST_ALLOCATED;
 public:
-    static Ref<AudioDestination> create(AudioIOCallback& callback, float sampleRate)
+    static UniqueRef<AudioDestination> create(AudioIOCallback& callback, float sampleRate)
     {
-        return adoptRef(*new MockAudioDestinationCocoa(callback, sampleRate));
+        return makeUniqueRef<MockAudioDestinationCocoa>(callback, sampleRate);
     }
 
     WEBCORE_EXPORT MockAudioDestinationCocoa(AudioIOCallback&, float sampleRate);

Modified: trunk/Source/WebKit/ChangeLog (270767 => 270768)


--- trunk/Source/WebKit/ChangeLog	2020-12-14 12:27:57 UTC (rev 270767)
+++ trunk/Source/WebKit/ChangeLog	2020-12-14 16:26:26 UTC (rev 270768)
@@ -1,3 +1,17 @@
+2020-12-14  Chris Dumez  <[email protected]>
+
+        [GPUProcess] Crash under AudioDestinationCocoa::setIsPlaying(bool)
+        https://bugs.webkit.org/show_bug.cgi?id=219809
+
+        Reviewed by Eric Carlson.
+
+        * WebProcess/GPU/media/RemoteAudioDestinationProxy.cpp:
+        (WebKit::RemoteAudioDestinationProxy::create):
+        * WebProcess/GPU/media/RemoteAudioDestinationProxy.h:
+        * WebProcess/GPU/media/WebMediaStrategy.cpp:
+        (WebKit::WebMediaStrategy::createAudioDestination):
+        * WebProcess/GPU/media/WebMediaStrategy.h:
+
 2020-12-14  Carlos Garcia Campos  <[email protected]>
 
         [WPE][GTK] Should enable WebProcessCache

Modified: trunk/Source/WebKit/WebProcess/GPU/media/RemoteAudioDestinationProxy.cpp (270767 => 270768)


--- trunk/Source/WebKit/WebProcess/GPU/media/RemoteAudioDestinationProxy.cpp	2020-12-14 12:27:57 UTC (rev 270767)
+++ trunk/Source/WebKit/WebProcess/GPU/media/RemoteAudioDestinationProxy.cpp	2020-12-14 16:26:26 UTC (rev 270768)
@@ -48,10 +48,10 @@
 using AudioDestination = WebCore::AudioDestination;
 using AudioIOCallback = WebCore::AudioIOCallback;
 
-Ref<AudioDestination> RemoteAudioDestinationProxy::create(AudioIOCallback& callback,
+UniqueRef<AudioDestination> RemoteAudioDestinationProxy::create(AudioIOCallback& callback,
     const String& inputDeviceId, unsigned numberOfInputChannels, unsigned numberOfOutputChannels, float sampleRate)
 {
-    return adoptRef(*new RemoteAudioDestinationProxy(callback, inputDeviceId, numberOfInputChannels, numberOfOutputChannels, sampleRate));
+    return makeUniqueRef<RemoteAudioDestinationProxy>(callback, inputDeviceId, numberOfInputChannels, numberOfOutputChannels, sampleRate);
 }
 
 RemoteAudioDestinationProxy::RemoteAudioDestinationProxy(AudioIOCallback& callback, const String& inputDeviceId, unsigned numberOfInputChannels, unsigned numberOfOutputChannels, float sampleRate)
@@ -60,7 +60,8 @@
     , m_numberOfFrames(hardwareSampleRate() * ringBufferSizeInSecond)
     , m_ringBuffer(makeUnique<WebCore::CARingBuffer>(makeUniqueRef<SharedRingBufferStorage>(this)))
 #else
-    : m_numberOfOutputChannels(numberOfOutputChannels)
+    : AudioDestination(callback)
+    , m_numberOfOutputChannels(numberOfOutputChannels)
 #endif
     , m_inputDeviceId(inputDeviceId)
     , m_numberOfInputChannels(numberOfInputChannels)

Modified: trunk/Source/WebKit/WebProcess/GPU/media/RemoteAudioDestinationProxy.h (270767 => 270768)


--- trunk/Source/WebKit/WebProcess/GPU/media/RemoteAudioDestinationProxy.h	2020-12-14 12:27:57 UTC (rev 270767)
+++ trunk/Source/WebKit/WebProcess/GPU/media/RemoteAudioDestinationProxy.h	2020-12-14 16:26:26 UTC (rev 270768)
@@ -66,7 +66,7 @@
     using WebCore::AudioDestination::ref;
     using WebCore::AudioDestination::deref;
 
-    static Ref<AudioDestination> create(AudioIOCallback&, const String& inputDeviceId, unsigned numberOfInputChannels, unsigned numberOfOutputChannels, float sampleRate);
+    static UniqueRef<AudioDestination> create(AudioIOCallback&, const String& inputDeviceId, unsigned numberOfInputChannels, unsigned numberOfOutputChannels, float sampleRate);
 
     RemoteAudioDestinationProxy(AudioIOCallback&, const String& inputDeviceId, unsigned numberOfInputChannels, unsigned numberOfOutputChannels, float sampleRate);
     ~RemoteAudioDestinationProxy();

Modified: trunk/Source/WebKit/WebProcess/GPU/media/WebMediaStrategy.cpp (270767 => 270768)


--- trunk/Source/WebKit/WebProcess/GPU/media/WebMediaStrategy.cpp	2020-12-14 12:27:57 UTC (rev 270767)
+++ trunk/Source/WebKit/WebProcess/GPU/media/WebMediaStrategy.cpp	2020-12-14 16:26:26 UTC (rev 270768)
@@ -45,7 +45,7 @@
 WebMediaStrategy::~WebMediaStrategy() = default;
 
 #if ENABLE(WEB_AUDIO)
-Ref<WebCore::AudioDestination> WebMediaStrategy::createAudioDestination(WebCore::AudioIOCallback& callback, const String& inputDeviceId,
+UniqueRef<WebCore::AudioDestination> WebMediaStrategy::createAudioDestination(WebCore::AudioIOCallback& callback, const String& inputDeviceId,
     unsigned numberOfInputChannels, unsigned numberOfOutputChannels, float sampleRate)
 {
 #if ENABLE(GPU_PROCESS)

Modified: trunk/Source/WebKit/WebProcess/GPU/media/WebMediaStrategy.h (270767 => 270768)


--- trunk/Source/WebKit/WebProcess/GPU/media/WebMediaStrategy.h	2020-12-14 12:27:57 UTC (rev 270767)
+++ trunk/Source/WebKit/WebProcess/GPU/media/WebMediaStrategy.h	2020-12-14 16:26:26 UTC (rev 270768)
@@ -39,7 +39,7 @@
 
 private:
 #if ENABLE(WEB_AUDIO)
-    Ref<WebCore::AudioDestination> createAudioDestination(WebCore::AudioIOCallback&,
+    UniqueRef<WebCore::AudioDestination> createAudioDestination(WebCore::AudioIOCallback&,
         const String& inputDeviceId, unsigned numberOfInputChannels, unsigned numberOfOutputChannels, float sampleRate) override;
 #endif
 #if PLATFORM(COCOA)

Modified: trunk/Source/WebKitLegacy/mac/ChangeLog (270767 => 270768)


--- trunk/Source/WebKitLegacy/mac/ChangeLog	2020-12-14 12:27:57 UTC (rev 270767)
+++ trunk/Source/WebKitLegacy/mac/ChangeLog	2020-12-14 16:26:26 UTC (rev 270768)
@@ -1,3 +1,12 @@
+2020-12-14  Chris Dumez  <[email protected]>
+
+        [GPUProcess] Crash under AudioDestinationCocoa::setIsPlaying(bool)
+        https://bugs.webkit.org/show_bug.cgi?id=219809
+
+        Reviewed by Eric Carlson.
+
+        * WebCoreSupport/WebPlatformStrategies.mm:
+
 2020-12-11  Darin Adler  <[email protected]>
 
         [Cocoa] REGRESSION (r270315): WebKitLegacy builds fail with "unifdef" error message

Modified: trunk/Source/WebKitLegacy/mac/WebCoreSupport/WebPlatformStrategies.mm (270767 => 270768)


--- trunk/Source/WebKitLegacy/mac/WebCoreSupport/WebPlatformStrategies.mm	2020-12-14 12:27:57 UTC (rev 270767)
+++ trunk/Source/WebKitLegacy/mac/WebCoreSupport/WebPlatformStrategies.mm	2020-12-14 16:26:26 UTC (rev 270768)
@@ -69,7 +69,7 @@
 class WebMediaStrategy final : public MediaStrategy {
 private:
 #if ENABLE(WEB_AUDIO)
-    Ref<AudioDestination> createAudioDestination(AudioIOCallback& callback, const String& inputDeviceId,
+    UniqueRef<AudioDestination> createAudioDestination(AudioIOCallback& callback, const String& inputDeviceId,
         unsigned numberOfInputChannels, unsigned numberOfOutputChannels, float sampleRate) override
     {
         return AudioDestination::create(callback, inputDeviceId, numberOfInputChannels, numberOfOutputChannels, sampleRate);

Modified: trunk/Source/WebKitLegacy/win/ChangeLog (270767 => 270768)


--- trunk/Source/WebKitLegacy/win/ChangeLog	2020-12-14 12:27:57 UTC (rev 270767)
+++ trunk/Source/WebKitLegacy/win/ChangeLog	2020-12-14 16:26:26 UTC (rev 270768)
@@ -1,3 +1,12 @@
+2020-12-14  Chris Dumez  <[email protected]>
+
+        [GPUProcess] Crash under AudioDestinationCocoa::setIsPlaying(bool)
+        https://bugs.webkit.org/show_bug.cgi?id=219809
+
+        Reviewed by Eric Carlson.
+
+        * WebCoreSupport/WebPlatformStrategies.cpp:
+
 2020-12-09  Cathie Chen  <[email protected]>
 
         Support overscroll-behavior parsing

Modified: trunk/Source/WebKitLegacy/win/WebCoreSupport/WebPlatformStrategies.cpp (270767 => 270768)


--- trunk/Source/WebKitLegacy/win/WebCoreSupport/WebPlatformStrategies.cpp	2020-12-14 12:27:57 UTC (rev 270767)
+++ trunk/Source/WebKitLegacy/win/WebCoreSupport/WebPlatformStrategies.cpp	2020-12-14 16:26:26 UTC (rev 270768)
@@ -65,7 +65,7 @@
 class WebMediaStrategy final : public MediaStrategy {
 private:
 #if ENABLE(WEB_AUDIO)
-    Ref<AudioDestination> createAudioDestination(AudioIOCallback& callback, const String& inputDeviceId,
+    UniqueRef<AudioDestination> createAudioDestination(AudioIOCallback& callback, const String& inputDeviceId,
         unsigned numberOfInputChannels, unsigned numberOfOutputChannels, float sampleRate) override
     {
         return AudioDestination::create(callback, inputDeviceId, numberOfInputChannels, numberOfOutputChannels, sampleRate);
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes

Reply via email to