Title: [272439] trunk/Source/WebCore
Revision
272439
Author
[email protected]
Date
2021-02-05 14:40:21 -0800 (Fri, 05 Feb 2021)

Log Message

[Cocoa] CRASH in MediaPlayerPrivateMediaSourceAVFObjC::removeAudioRenderer()
https://bugs.webkit.org/show_bug.cgi?id=221490
<rdar://73966316>

Reviewed by Eric Carlson.

Add null-checks to every use of player() in SourceBufferPrivateAVFObjC.

* platform/graphics/avfoundation/objc/SourceBufferPrivateAVFObjC.h:
* platform/graphics/avfoundation/objc/SourceBufferPrivateAVFObjC.mm:
(WebCore::SourceBufferPrivateAVFObjC::didParseInitializationData):
(WebCore::SourceBufferPrivateAVFObjC::willProvideContentKeyRequestInitializationDataForTrackID):
(WebCore::SourceBufferPrivateAVFObjC::didProvideContentKeyRequestInitializationDataForTrackID):
(WebCore::SourceBufferPrivateAVFObjC::appendCompleted):
(WebCore::SourceBufferPrivateAVFObjC::destroyParser):
(WebCore::SourceBufferPrivateAVFObjC::destroyRenderers):
(WebCore::SourceBufferPrivateAVFObjC::readyState const):
(WebCore::SourceBufferPrivateAVFObjC::setReadyState):
(WebCore::SourceBufferPrivateAVFObjC::trackDidChangeEnabled):
(WebCore::SourceBufferPrivateAVFObjC::flushVideo):
(WebCore::SourceBufferPrivateAVFObjC::enqueueSample):
(WebCore::SourceBufferPrivateAVFObjC::bufferWasConsumed):
(WebCore::SourceBufferPrivateAVFObjC::setDecompressionSession):
(WebCore::SourceBufferPrivateAVFObjC::player const):

Modified Paths

Diff

Modified: trunk/Source/WebCore/ChangeLog (272438 => 272439)


--- trunk/Source/WebCore/ChangeLog	2021-02-05 22:31:52 UTC (rev 272438)
+++ trunk/Source/WebCore/ChangeLog	2021-02-05 22:40:21 UTC (rev 272439)
@@ -1,3 +1,30 @@
+2021-02-05  Jer Noble  <[email protected]>
+
+        [Cocoa] CRASH in MediaPlayerPrivateMediaSourceAVFObjC::removeAudioRenderer()
+        https://bugs.webkit.org/show_bug.cgi?id=221490
+        <rdar://73966316>
+
+        Reviewed by Eric Carlson.
+
+        Add null-checks to every use of player() in SourceBufferPrivateAVFObjC.
+
+        * platform/graphics/avfoundation/objc/SourceBufferPrivateAVFObjC.h:
+        * platform/graphics/avfoundation/objc/SourceBufferPrivateAVFObjC.mm:
+        (WebCore::SourceBufferPrivateAVFObjC::didParseInitializationData):
+        (WebCore::SourceBufferPrivateAVFObjC::willProvideContentKeyRequestInitializationDataForTrackID):
+        (WebCore::SourceBufferPrivateAVFObjC::didProvideContentKeyRequestInitializationDataForTrackID):
+        (WebCore::SourceBufferPrivateAVFObjC::appendCompleted):
+        (WebCore::SourceBufferPrivateAVFObjC::destroyParser):
+        (WebCore::SourceBufferPrivateAVFObjC::destroyRenderers):
+        (WebCore::SourceBufferPrivateAVFObjC::readyState const):
+        (WebCore::SourceBufferPrivateAVFObjC::setReadyState):
+        (WebCore::SourceBufferPrivateAVFObjC::trackDidChangeEnabled):
+        (WebCore::SourceBufferPrivateAVFObjC::flushVideo):
+        (WebCore::SourceBufferPrivateAVFObjC::enqueueSample):
+        (WebCore::SourceBufferPrivateAVFObjC::bufferWasConsumed):
+        (WebCore::SourceBufferPrivateAVFObjC::setDecompressionSession):
+        (WebCore::SourceBufferPrivateAVFObjC::player const):
+
 2021-02-05  Devin Rousso  <[email protected]>
 
         [macOS] REGRESSION(r272352): missing track for videos that haven't fully loaded

Modified: trunk/Source/WebCore/platform/graphics/avfoundation/objc/SourceBufferPrivateAVFObjC.h (272438 => 272439)


--- trunk/Source/WebCore/platform/graphics/avfoundation/objc/SourceBufferPrivateAVFObjC.h	2021-02-05 22:31:52 UTC (rev 272438)
+++ trunk/Source/WebCore/platform/graphics/avfoundation/objc/SourceBufferPrivateAVFObjC.h	2021-02-05 22:40:21 UTC (rev 272439)
@@ -61,6 +61,7 @@
 class CDMInstance;
 class CDMInstanceFairPlayStreamingAVFObjC;
 class CDMSessionMediaSourceAVFObjC;
+class MediaPlayerPrivateMediaSourceAVFObjC;
 class MediaSourcePrivateAVFObjC;
 class TimeRanges;
 class AudioTrackPrivate;
@@ -176,6 +177,8 @@
     void flushAudio(AVSampleBufferAudioRenderer *);
     ALLOW_NEW_API_WITHOUT_GUARDS_END
 
+    MediaPlayerPrivateMediaSourceAVFObjC* player() const;
+
     Vector<RefPtr<VideoTrackPrivate>> m_videoTracks;
     Vector<RefPtr<AudioTrackPrivate>> m_audioTracks;
     Vector<SourceBufferPrivateAVFObjCErrorClient*> m_errorClients;

Modified: trunk/Source/WebCore/platform/graphics/avfoundation/objc/SourceBufferPrivateAVFObjC.mm (272438 => 272439)


--- trunk/Source/WebCore/platform/graphics/avfoundation/objc/SourceBufferPrivateAVFObjC.mm	2021-02-05 22:31:52 UTC (rev 272438)
+++ trunk/Source/WebCore/platform/graphics/avfoundation/objc/SourceBufferPrivateAVFObjC.mm	2021-02-05 22:40:21 UTC (rev 272439)
@@ -354,12 +354,12 @@
         return;
     }
 
-    if (m_mediaSource->player()->shouldCheckHardwareSupport()) {
+    if (auto player = this->player(); player && player->shouldCheckHardwareSupport()) {
         for (auto& info : segment.videoTracks) {
             auto codec = FourCC::fromString(info.description->codec());
             if (!codec)
                 continue;
-            if (!codecsMeetHardwareDecodeRequirements({{ *codec }}, m_mediaSource->player()->mediaContentTypesRequiringHardwareSupport())) {
+            if (!codecsMeetHardwareDecodeRequirements({{ *codec }}, player->mediaContentTypesRequiringHardwareSupport())) {
                 m_parsingSucceeded = false;
                 return;
             }
@@ -384,8 +384,8 @@
         m_audioTracks.append(audioTrackInfo.track);
     }
 
-    if (m_mediaSource)
-        m_mediaSource->player()->characteristicsChanged();
+    if (auto player = this->player())
+        player->characteristicsChanged();
 
     m_initializationSegmentIsHandled = false;
     didReceiveInitializationSegment(WTFMove(segment), [this, weakThis = makeWeakPtr(*this)]() mutable {
@@ -467,11 +467,15 @@
     if (!parser)
         return;
 
-    if (CDMSessionMediaSourceAVFObjC* session = m_mediaSource->player()->cdmSession())
+    auto player = this->player();
+    if (!player)
+        return;
+
+    if (CDMSessionMediaSourceAVFObjC* session = player->cdmSession())
         session->addParser(parser);
     else if (!CDMSessionAVContentKeySession::isAvailable()) {
         BEGIN_BLOCK_OBJC_EXCEPTIONS
-        [m_mediaSource->player()->streamSession() addStreamDataParser:parser];
+        [player->streamSession() addStreamDataParser:parser];
         END_BLOCK_OBJC_EXCEPTIONS
     }
 #else
@@ -481,7 +485,8 @@
 
 void SourceBufferPrivateAVFObjC::didProvideContentKeyRequestInitializationDataForTrackID(Ref<Uint8Array>&& initData, uint64_t trackID, Box<BinarySemaphore> hasSessionSemaphore)
 {
-    if (!m_mediaSource)
+    auto player = this->player();
+    if (!player)
         return;
 
 #if HAVE(AVCONTENTKEYSESSION) && ENABLE(LEGACY_ENCRYPTED_MEDIA)
@@ -490,7 +495,7 @@
     m_protectedTrackID = trackID;
     m_initData = WTFMove(initData);
     m_mediaSource->sourceBufferKeyNeeded(this, m_initData.get());
-    if (auto session = m_mediaSource->player()->cdmSession()) {
+    if (auto session = player->cdmSession()) {
         if (auto parser = this->parser())
             session->addParser(parser);
         hasSessionSemaphore->signal();
@@ -522,10 +527,10 @@
     }
 
     m_keyIDs = WTFMove(keyIDs.value());
-    m_mediaSource->player()->initializationDataEncountered("sinf", initDataBuffer->tryCreateArrayBuffer());
+    player->initializationDataEncountered("sinf", initDataBuffer->tryCreateArrayBuffer());
 
     m_waitingForKey = true;
-    m_mediaSource->player()->waitingForKeyChanged();
+    player->waitingForKeyChanged();
 #endif
 
     UNUSED_PARAM(initData);
@@ -627,8 +632,8 @@
         m_hasSessionSemaphore = nil;
     }
 
-    if (m_parsingSucceeded && m_mediaSource)
-        m_mediaSource->player()->setLoadingProgresssed(true);
+    if (auto player = this->player(); player && m_parsingSucceeded)
+        player->setLoadingProgresssed(true);
 
     SourceBufferPrivate::appendCompleted(m_parsingSucceeded, m_mediaSource ? m_mediaSource->isEnded() : true);
 }
@@ -670,8 +675,8 @@
     if (!parser)
         return;
 #if HAVE(AVSTREAMSESSION) && ENABLE(LEGACY_ENCRYPTED_MEDIA)
-    if (m_mediaSource && m_mediaSource->player() && m_mediaSource->player()->hasStreamSession())
-        [m_mediaSource->player()->streamSession() removeStreamDataParser:parser];
+    if (auto player = this->player(); player && player->hasStreamSession())
+        [player->streamSession() removeStreamDataParser:parser];
 #endif
 #if ENABLE(ENCRYPTED_MEDIA) && HAVE(AVCONTENTKEYSESSION)
     if (m_cdmInstance) {
@@ -690,8 +695,8 @@
         setDecompressionSession(nullptr);
 
     for (auto& renderer : m_audioRenderers.values()) {
-        if (m_mediaSource)
-            m_mediaSource->player()->removeAudioRenderer(renderer.get());
+        if (auto player = this->player())
+            player->removeAudioRenderer(renderer.get());
         [renderer flush];
         [renderer stopRequestingMediaData];
         [m_errorListener stopObservingRenderer:renderer.get()];
@@ -728,7 +733,9 @@
 
 MediaPlayer::ReadyState SourceBufferPrivateAVFObjC::readyState() const
 {
-    return m_mediaSource ? m_mediaSource->player()->readyState() : MediaPlayer::ReadyState::HaveNothing;
+    if (auto player = this->player())
+        return player->readyState();
+    return MediaPlayer::ReadyState::HaveNothing;
 }
 
 void SourceBufferPrivateAVFObjC::setReadyState(MediaPlayer::ReadyState readyState)
@@ -735,8 +742,8 @@
 {
     ALWAYS_LOG(LOGIDENTIFIER, readyState);
 
-    if (m_mediaSource)
-        m_mediaSource->player()->setReadyState(readyState);
+    if (auto player = this->player())
+        player->setReadyState(readyState);
 }
 
 bool SourceBufferPrivateAVFObjC::hasSelectedVideo() const
@@ -781,8 +788,8 @@
         RetainPtr<AVSampleBufferAudioRenderer> renderer = m_audioRenderers.get(trackID);
         ALLOW_NEW_API_WITHOUT_GUARDS_END
         m_parser->setShouldProvideMediaDataForTrackID(false, trackID);
-        if (m_mediaSource)
-            m_mediaSource->player()->removeAudioRenderer(renderer.get());
+        if (auto player = this->player())
+            player->removeAudioRenderer(renderer.get());
     } else {
         m_parser->setShouldProvideMediaDataForTrackID(true, trackID);
         ALLOW_NEW_API_WITHOUT_GUARDS_BEGIN
@@ -795,7 +802,8 @@
                 ERROR_LOG(LOGIDENTIFIER, "-[AVSampleBufferAudioRenderer init] returned nil! bailing!");
                 if (m_mediaSource)
                     m_mediaSource->failedToCreateRenderer(MediaSourcePrivateAVFObjC::RendererType::Audio);
-                m_mediaSource->player()->setNetworkState(MediaPlayer::NetworkState::DecodeError);
+                if (auto player = this->player())
+                    player->setNetworkState(MediaPlayer::NetworkState::DecodeError);
                 return;
             }
 
@@ -809,8 +817,8 @@
         } else
             renderer = m_audioRenderers.get(trackID);
 
-        if (m_mediaSource)
-            m_mediaSource->player()->addAudioRenderer(renderer.get());
+        if (auto player = this->player())
+            player->addAudioRenderer(renderer.get());
     }
 }
 
@@ -992,16 +1000,16 @@
     if (m_decompressionSession) {
         m_decompressionSession->flush();
         m_decompressionSession->notifyWhenHasAvailableVideoFrame([weakThis = makeWeakPtr(*this)] {
-            if (weakThis && weakThis->m_mediaSource)
-                weakThis->m_mediaSource->player()->setHasAvailableVideoFrame(true);
+            if (weakThis && weakThis->player())
+                weakThis->player()->setHasAvailableVideoFrame(true);
         });
     }
 
     m_cachedSize = WTF::nullopt;
 
-    if (m_mediaSource) {
-        m_mediaSource->player()->setHasAvailableVideoFrame(false);
-        m_mediaSource->player()->flushPendingSizeChanges();
+    if (auto player = this->player()) {
+        player->setHasAvailableVideoFrame(false);
+        player->flushPendingSizeChanges();
     }
 }
 
@@ -1011,8 +1019,8 @@
 {
     [renderer flush];
 
-    if (m_mediaSource)
-        m_mediaSource->player()->setHasAvailableAudioSample(renderer, false);
+    if (auto player = this->player())
+        player->setHasAvailableAudioSample(renderer, false);
 }
 
 void SourceBufferPrivateAVFObjC::enqueueSample(Ref<MediaSample>&& sample, const AtomString& trackIDString)
@@ -1046,16 +1054,17 @@
             return;
         }
 
+        auto player = this->player();
         FloatSize formatSize = FloatSize(CMVideoFormatDescriptionGetPresentationDimensions(formatDescription, true, true));
         if (!m_cachedSize || formatSize != m_cachedSize.value()) {
             DEBUG_LOG(logSiteIdentifier, "size changed to ", formatSize);
             bool sizeWasNull = !m_cachedSize;
             m_cachedSize = formatSize;
-            if (m_mediaSource) {
+            if (player) {
                 if (sizeWasNull)
-                    m_mediaSource->player()->setNaturalSize(formatSize);
+                    player->setNaturalSize(formatSize);
                 else
-                    m_mediaSource->player()->sizeWillChangeAtTime(sample->presentationTime(), formatSize);
+                    player->sizeWillChangeAtTime(sample->presentationTime(), formatSize);
             }
         }
 
@@ -1065,7 +1074,7 @@
         if (!m_displayLayer)
             return;
 
-        if (m_mediaSource && !m_mediaSource->player()->hasAvailableVideoFrame() && !sample->isNonDisplaying()) {
+        if (player && !player->hasAvailableVideoFrame() && !sample->isNonDisplaying()) {
             DEBUG_LOG(logSiteIdentifier, "adding buffer attachment");
 
             bool havePrerollDecodeWithCompletionHandler = [PAL::getAVSampleBufferDisplayLayerClass() instancesRespondToSelector:@selector(prerollDecodeWithCompletionHandler:)];
@@ -1077,7 +1086,7 @@
                 CMSetAttachment(sampleCopy.get(), kCMSampleBufferAttachmentKey_PostNotificationWhenConsumed, (__bridge CFDictionaryRef)@{ (__bridge NSString *)kCMSampleBufferAttachmentKey_PostNotificationWhenConsumed : @YES }, kCMAttachmentMode_ShouldNotPropagate);
                 [m_displayLayer enqueueSampleBuffer:sampleCopy.get()];
 #if PLATFORM(IOS_FAMILY)
-                m_mediaSource->player()->setHasAvailableVideoFrame(true);
+                player->setHasAvailableVideoFrame(true);
 #endif
             } else {
 
@@ -1114,8 +1123,8 @@
 
         auto renderer = m_audioRenderers.get(trackID);
         [renderer enqueueSampleBuffer:platformSample.sample.cmSampleBuffer];
-        if (m_mediaSource && !sample->isNonDisplaying() && m_mediaSource->player())
-            m_mediaSource->player()->setHasAvailableAudioSample(renderer.get(), true);
+        if (auto player = this->player(); player && !sample->isNonDisplaying())
+            player->setHasAvailableAudioSample(renderer.get(), true);
     }
 }
 
@@ -1123,8 +1132,8 @@
 {
     DEBUG_LOG(LOGIDENTIFIER);
 
-    if (m_mediaSource)
-        m_mediaSource->player()->setHasAvailableVideoFrame(true);
+    if (auto player = this->player())
+        player->setHasAvailableVideoFrame(true);
 }
 
 bool SourceBufferPrivateAVFObjC::isReadyForMoreSamples(const AtomString& trackIDString)
@@ -1318,12 +1327,18 @@
             weakThis->didBecomeReadyForMoreSamples(weakThis->m_enabledVideoTrackID);
     });
     m_decompressionSession->notifyWhenHasAvailableVideoFrame([weakThis = makeWeakPtr(*this)] {
-        if (weakThis && weakThis->m_mediaSource)
-            weakThis->m_mediaSource->player()->setHasAvailableVideoFrame(true);
+        if (weakThis && weakThis->player())
+            weakThis->player()->setHasAvailableVideoFrame(true);
     });
     reenqueSamples(AtomString::number(m_enabledVideoTrackID));
 }
 
+MediaPlayerPrivateMediaSourceAVFObjC* SourceBufferPrivateAVFObjC::player() const
+{
+    return m_mediaSource ? m_mediaSource->player() : nullptr;
+}
+
+
 #if !RELEASE_LOG_DISABLED
 WTFLogChannel& SourceBufferPrivateAVFObjC::logChannel() const
 {
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes

Reply via email to