Title: [272595] branches/safari-611.1.14.1-branch/Source/WebCore
Revision
272595
Author
[email protected]
Date
2021-02-09 10:50:21 -0800 (Tue, 09 Feb 2021)

Log Message

Cherry-pick r272439. rdar://problem/74146132

    [Cocoa] CRASH in MediaPlayerPrivateMediaSourceAVFObjC::removeAudioRenderer()
    https://bugs.webkit.org/show_bug.cgi?id=221490
    <rdar://73966316>

    Reviewed by Eric Carlson.

    Add null-checks to every use of player() in SourceBufferPrivateAVFObjC.

    * platform/graphics/avfoundation/objc/SourceBufferPrivateAVFObjC.h:
    * platform/graphics/avfoundation/objc/SourceBufferPrivateAVFObjC.mm:
    (WebCore::SourceBufferPrivateAVFObjC::didParseInitializationData):
    (WebCore::SourceBufferPrivateAVFObjC::willProvideContentKeyRequestInitializationDataForTrackID):
    (WebCore::SourceBufferPrivateAVFObjC::didProvideContentKeyRequestInitializationDataForTrackID):
    (WebCore::SourceBufferPrivateAVFObjC::appendCompleted):
    (WebCore::SourceBufferPrivateAVFObjC::destroyParser):
    (WebCore::SourceBufferPrivateAVFObjC::destroyRenderers):
    (WebCore::SourceBufferPrivateAVFObjC::readyState const):
    (WebCore::SourceBufferPrivateAVFObjC::setReadyState):
    (WebCore::SourceBufferPrivateAVFObjC::trackDidChangeEnabled):
    (WebCore::SourceBufferPrivateAVFObjC::flushVideo):
    (WebCore::SourceBufferPrivateAVFObjC::enqueueSample):
    (WebCore::SourceBufferPrivateAVFObjC::bufferWasConsumed):
    (WebCore::SourceBufferPrivateAVFObjC::setDecompressionSession):
    (WebCore::SourceBufferPrivateAVFObjC::player const):

    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@272439 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Modified Paths

Diff

Modified: branches/safari-611.1.14.1-branch/Source/WebCore/ChangeLog (272594 => 272595)


--- branches/safari-611.1.14.1-branch/Source/WebCore/ChangeLog	2021-02-09 18:50:16 UTC (rev 272594)
+++ branches/safari-611.1.14.1-branch/Source/WebCore/ChangeLog	2021-02-09 18:50:21 UTC (rev 272595)
@@ -1,3 +1,62 @@
+2021-02-09  Russell Epstein  <[email protected]>
+
+        Cherry-pick r272439. rdar://problem/74146132
+
+    [Cocoa] CRASH in MediaPlayerPrivateMediaSourceAVFObjC::removeAudioRenderer()
+    https://bugs.webkit.org/show_bug.cgi?id=221490
+    <rdar://73966316>
+    
+    Reviewed by Eric Carlson.
+    
+    Add null-checks to every use of player() in SourceBufferPrivateAVFObjC.
+    
+    * platform/graphics/avfoundation/objc/SourceBufferPrivateAVFObjC.h:
+    * platform/graphics/avfoundation/objc/SourceBufferPrivateAVFObjC.mm:
+    (WebCore::SourceBufferPrivateAVFObjC::didParseInitializationData):
+    (WebCore::SourceBufferPrivateAVFObjC::willProvideContentKeyRequestInitializationDataForTrackID):
+    (WebCore::SourceBufferPrivateAVFObjC::didProvideContentKeyRequestInitializationDataForTrackID):
+    (WebCore::SourceBufferPrivateAVFObjC::appendCompleted):
+    (WebCore::SourceBufferPrivateAVFObjC::destroyParser):
+    (WebCore::SourceBufferPrivateAVFObjC::destroyRenderers):
+    (WebCore::SourceBufferPrivateAVFObjC::readyState const):
+    (WebCore::SourceBufferPrivateAVFObjC::setReadyState):
+    (WebCore::SourceBufferPrivateAVFObjC::trackDidChangeEnabled):
+    (WebCore::SourceBufferPrivateAVFObjC::flushVideo):
+    (WebCore::SourceBufferPrivateAVFObjC::enqueueSample):
+    (WebCore::SourceBufferPrivateAVFObjC::bufferWasConsumed):
+    (WebCore::SourceBufferPrivateAVFObjC::setDecompressionSession):
+    (WebCore::SourceBufferPrivateAVFObjC::player const):
+    
+    
+    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@272439 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+    2021-02-05  Jer Noble  <[email protected]>
+
+            [Cocoa] CRASH in MediaPlayerPrivateMediaSourceAVFObjC::removeAudioRenderer()
+            https://bugs.webkit.org/show_bug.cgi?id=221490
+            <rdar://73966316>
+
+            Reviewed by Eric Carlson.
+
+            Add null-checks to every use of player() in SourceBufferPrivateAVFObjC.
+
+            * platform/graphics/avfoundation/objc/SourceBufferPrivateAVFObjC.h:
+            * platform/graphics/avfoundation/objc/SourceBufferPrivateAVFObjC.mm:
+            (WebCore::SourceBufferPrivateAVFObjC::didParseInitializationData):
+            (WebCore::SourceBufferPrivateAVFObjC::willProvideContentKeyRequestInitializationDataForTrackID):
+            (WebCore::SourceBufferPrivateAVFObjC::didProvideContentKeyRequestInitializationDataForTrackID):
+            (WebCore::SourceBufferPrivateAVFObjC::appendCompleted):
+            (WebCore::SourceBufferPrivateAVFObjC::destroyParser):
+            (WebCore::SourceBufferPrivateAVFObjC::destroyRenderers):
+            (WebCore::SourceBufferPrivateAVFObjC::readyState const):
+            (WebCore::SourceBufferPrivateAVFObjC::setReadyState):
+            (WebCore::SourceBufferPrivateAVFObjC::trackDidChangeEnabled):
+            (WebCore::SourceBufferPrivateAVFObjC::flushVideo):
+            (WebCore::SourceBufferPrivateAVFObjC::enqueueSample):
+            (WebCore::SourceBufferPrivateAVFObjC::bufferWasConsumed):
+            (WebCore::SourceBufferPrivateAVFObjC::setDecompressionSession):
+            (WebCore::SourceBufferPrivateAVFObjC::player const):
+
 2021-02-03  Russell Epstein  <[email protected]>
 
         Apply patch. rdar://problem/73890906

Modified: branches/safari-611.1.14.1-branch/Source/WebCore/platform/graphics/avfoundation/objc/SourceBufferPrivateAVFObjC.h (272594 => 272595)


--- branches/safari-611.1.14.1-branch/Source/WebCore/platform/graphics/avfoundation/objc/SourceBufferPrivateAVFObjC.h	2021-02-09 18:50:16 UTC (rev 272594)
+++ branches/safari-611.1.14.1-branch/Source/WebCore/platform/graphics/avfoundation/objc/SourceBufferPrivateAVFObjC.h	2021-02-09 18:50:21 UTC (rev 272595)
@@ -60,6 +60,7 @@
 class CDMInstance;
 class CDMInstanceFairPlayStreamingAVFObjC;
 class CDMSessionMediaSourceAVFObjC;
+class MediaPlayerPrivateMediaSourceAVFObjC;
 class MediaSourcePrivateAVFObjC;
 class TimeRanges;
 class AudioTrackPrivate;
@@ -175,6 +176,8 @@
     void flushAudio(AVSampleBufferAudioRenderer *);
     ALLOW_NEW_API_WITHOUT_GUARDS_END
 
+    MediaPlayerPrivateMediaSourceAVFObjC* player() const;
+
     Vector<RefPtr<VideoTrackPrivate>> m_videoTracks;
     Vector<RefPtr<AudioTrackPrivate>> m_audioTracks;
     Vector<SourceBufferPrivateAVFObjCErrorClient*> m_errorClients;

Modified: branches/safari-611.1.14.1-branch/Source/WebCore/platform/graphics/avfoundation/objc/SourceBufferPrivateAVFObjC.mm (272594 => 272595)


--- branches/safari-611.1.14.1-branch/Source/WebCore/platform/graphics/avfoundation/objc/SourceBufferPrivateAVFObjC.mm	2021-02-09 18:50:16 UTC (rev 272594)
+++ branches/safari-611.1.14.1-branch/Source/WebCore/platform/graphics/avfoundation/objc/SourceBufferPrivateAVFObjC.mm	2021-02-09 18:50:21 UTC (rev 272595)
@@ -357,12 +357,12 @@
         return;
     }
 
-    if (m_mediaSource->player()->shouldCheckHardwareSupport()) {
+    if (auto player = this->player(); player && player->shouldCheckHardwareSupport()) {
         for (auto& info : segment.videoTracks) {
             auto codec = FourCC::fromString(info.description->codec());
             if (!codec)
                 continue;
-            if (!codecsMeetHardwareDecodeRequirements({{ *codec }}, m_mediaSource->player()->mediaContentTypesRequiringHardwareSupport())) {
+            if (!codecsMeetHardwareDecodeRequirements({{ *codec }}, player->mediaContentTypesRequiringHardwareSupport())) {
                 m_parsingSucceeded = false;
                 completionHandler();
                 return;
@@ -388,8 +388,8 @@
         m_audioTracks.append(audioTrackInfo.track);
     }
 
-    if (m_mediaSource)
-        m_mediaSource->player()->characteristicsChanged();
+    if (auto player = this->player())
+        player->characteristicsChanged();
 
     didReceiveInitializationSegment(WTFMove(segment), WTFMove(completionHandler));
 }
@@ -432,11 +432,15 @@
     if (!parser)
         return;
 
-    if (CDMSessionMediaSourceAVFObjC* session = m_mediaSource->player()->cdmSession())
+    auto player = this->player();
+    if (!player)
+        return;
+
+    if (CDMSessionMediaSourceAVFObjC* session = player->cdmSession())
         session->addParser(parser);
     else if (!CDMSessionAVContentKeySession::isAvailable()) {
         BEGIN_BLOCK_OBJC_EXCEPTIONS
-        [m_mediaSource->player()->streamSession() addStreamDataParser:parser];
+        [player->streamSession() addStreamDataParser:parser];
         END_BLOCK_OBJC_EXCEPTIONS
     }
 #else
@@ -446,7 +450,8 @@
 
 void SourceBufferPrivateAVFObjC::didProvideContentKeyRequestInitializationDataForTrackID(Ref<Uint8Array>&& initData, uint64_t trackID, Box<BinarySemaphore> hasSessionSemaphore)
 {
-    if (!m_mediaSource)
+    auto player = this->player();
+    if (!player)
         return;
 
 #if HAVE(AVCONTENTKEYSESSION) && ENABLE(LEGACY_ENCRYPTED_MEDIA)
@@ -455,7 +460,7 @@
     m_protectedTrackID = trackID;
     m_initData = WTFMove(initData);
     m_mediaSource->sourceBufferKeyNeeded(this, m_initData.get());
-    if (auto session = m_mediaSource->player()->cdmSession()) {
+    if (auto session = player->cdmSession()) {
         if (auto parser = this->parser())
             session->addParser(parser);
         hasSessionSemaphore->signal();
@@ -487,10 +492,10 @@
     }
 
     m_keyIDs = WTFMove(keyIDs.value());
-    m_mediaSource->player()->initializationDataEncountered("sinf", initDataBuffer->tryCreateArrayBuffer());
+    player->initializationDataEncountered("sinf", initDataBuffer->tryCreateArrayBuffer());
 
     m_waitingForKey = true;
-    m_mediaSource->player()->waitingForKeyChanged();
+    player->waitingForKeyChanged();
 #endif
 
     UNUSED_PARAM(initData);
@@ -584,8 +589,8 @@
         m_hasSessionSemaphore = nil;
     }
 
-    if (m_parsingSucceeded && m_mediaSource)
-        m_mediaSource->player()->setLoadingProgresssed(true);
+    if (auto player = this->player(); player && m_parsingSucceeded)
+        player->setLoadingProgresssed(true);
 
     SourceBufferPrivate::appendCompleted(m_parsingSucceeded, m_mediaSource ? m_mediaSource->isEnded() : true);
 }
@@ -624,8 +629,8 @@
     if (!parser)
         return;
 #if HAVE(AVSTREAMSESSION) && ENABLE(LEGACY_ENCRYPTED_MEDIA)
-    if (m_mediaSource && m_mediaSource->player() && m_mediaSource->player()->hasStreamSession())
-        [m_mediaSource->player()->streamSession() removeStreamDataParser:parser];
+    if (auto player = this->player(); player && player->hasStreamSession())
+        [player->streamSession() removeStreamDataParser:parser];
 #endif
 #if ENABLE(ENCRYPTED_MEDIA) && HAVE(AVCONTENTKEYSESSION)
     if (m_cdmInstance) {
@@ -644,8 +649,8 @@
         setDecompressionSession(nullptr);
 
     for (auto& renderer : m_audioRenderers.values()) {
-        if (m_mediaSource)
-            m_mediaSource->player()->removeAudioRenderer(renderer.get());
+        if (auto player = this->player())
+            player->removeAudioRenderer(renderer.get());
         [renderer flush];
         [renderer stopRequestingMediaData];
         [m_errorListener stopObservingRenderer:renderer.get()];
@@ -682,7 +687,9 @@
 
 MediaPlayer::ReadyState SourceBufferPrivateAVFObjC::readyState() const
 {
-    return m_mediaSource ? m_mediaSource->player()->readyState() : MediaPlayer::ReadyState::HaveNothing;
+    if (auto player = this->player())
+        return player->readyState();
+    return MediaPlayer::ReadyState::HaveNothing;
 }
 
 void SourceBufferPrivateAVFObjC::setReadyState(MediaPlayer::ReadyState readyState)
@@ -689,8 +696,8 @@
 {
     ALWAYS_LOG(LOGIDENTIFIER, readyState);
 
-    if (m_mediaSource)
-        m_mediaSource->player()->setReadyState(readyState);
+    if (auto player = this->player())
+        player->setReadyState(readyState);
 }
 
 bool SourceBufferPrivateAVFObjC::hasSelectedVideo() const
@@ -735,8 +742,8 @@
         RetainPtr<AVSampleBufferAudioRenderer> renderer = m_audioRenderers.get(trackID);
         ALLOW_NEW_API_WITHOUT_GUARDS_END
         m_parser->setShouldProvideMediaDataForTrackID(false, trackID);
-        if (m_mediaSource)
-            m_mediaSource->player()->removeAudioRenderer(renderer.get());
+        if (auto player = this->player())
+            player->removeAudioRenderer(renderer.get());
     } else {
         m_parser->setShouldProvideMediaDataForTrackID(true, trackID);
         ALLOW_NEW_API_WITHOUT_GUARDS_BEGIN
@@ -749,7 +756,8 @@
                 ERROR_LOG(LOGIDENTIFIER, "-[AVSampleBufferAudioRenderer init] returned nil! bailing!");
                 if (m_mediaSource)
                     m_mediaSource->failedToCreateRenderer(MediaSourcePrivateAVFObjC::RendererType::Audio);
-                m_mediaSource->player()->setNetworkState(MediaPlayer::NetworkState::DecodeError);
+                if (auto player = this->player())
+                    player->setNetworkState(MediaPlayer::NetworkState::DecodeError);
                 return;
             }
 
@@ -763,8 +771,8 @@
         } else
             renderer = m_audioRenderers.get(trackID);
 
-        if (m_mediaSource)
-            m_mediaSource->player()->addAudioRenderer(renderer.get());
+        if (auto player = this->player())
+            player->addAudioRenderer(renderer.get());
     }
 }
 
@@ -946,16 +954,16 @@
     if (m_decompressionSession) {
         m_decompressionSession->flush();
         m_decompressionSession->notifyWhenHasAvailableVideoFrame([weakThis = makeWeakPtr(*this)] {
-            if (weakThis && weakThis->m_mediaSource)
-                weakThis->m_mediaSource->player()->setHasAvailableVideoFrame(true);
+            if (weakThis && weakThis->player())
+                weakThis->player()->setHasAvailableVideoFrame(true);
         });
     }
 
     m_cachedSize = WTF::nullopt;
 
-    if (m_mediaSource) {
-        m_mediaSource->player()->setHasAvailableVideoFrame(false);
-        m_mediaSource->player()->flushPendingSizeChanges();
+    if (auto player = this->player()) {
+        player->setHasAvailableVideoFrame(false);
+        player->flushPendingSizeChanges();
     }
 }
 
@@ -965,8 +973,8 @@
 {
     [renderer flush];
 
-    if (m_mediaSource)
-        m_mediaSource->player()->setHasAvailableAudioSample(renderer, false);
+    if (auto player = this->player())
+        player->setHasAvailableAudioSample(renderer, false);
 }
 
 void SourceBufferPrivateAVFObjC::enqueueSample(Ref<MediaSample>&& sample, const AtomString& trackIDString)
@@ -1000,16 +1008,17 @@
             return;
         }
 
+        auto player = this->player();
         FloatSize formatSize = FloatSize(CMVideoFormatDescriptionGetPresentationDimensions(formatDescription, true, true));
         if (!m_cachedSize || formatSize != m_cachedSize.value()) {
             DEBUG_LOG(logSiteIdentifier, "size changed to ", formatSize);
             bool sizeWasNull = !m_cachedSize;
             m_cachedSize = formatSize;
-            if (m_mediaSource) {
+            if (player) {
                 if (sizeWasNull)
-                    m_mediaSource->player()->setNaturalSize(formatSize);
+                    player->setNaturalSize(formatSize);
                 else
-                    m_mediaSource->player()->sizeWillChangeAtTime(sample->presentationTime(), formatSize);
+                    player->sizeWillChangeAtTime(sample->presentationTime(), formatSize);
             }
         }
 
@@ -1019,7 +1028,7 @@
         if (!m_displayLayer)
             return;
 
-        if (m_mediaSource && !m_mediaSource->player()->hasAvailableVideoFrame() && !sample->isNonDisplaying()) {
+        if (player && !player->hasAvailableVideoFrame() && !sample->isNonDisplaying()) {
             DEBUG_LOG(logSiteIdentifier, "adding buffer attachment");
 
             bool havePrerollDecodeWithCompletionHandler = [PAL::getAVSampleBufferDisplayLayerClass() instancesRespondToSelector:@selector(prerollDecodeWithCompletionHandler:)];
@@ -1031,7 +1040,7 @@
                 CMSetAttachment(sampleCopy.get(), kCMSampleBufferAttachmentKey_PostNotificationWhenConsumed, (__bridge CFDictionaryRef)@{ (__bridge NSString *)kCMSampleBufferAttachmentKey_PostNotificationWhenConsumed : @YES }, kCMAttachmentMode_ShouldNotPropagate);
                 [m_displayLayer enqueueSampleBuffer:sampleCopy.get()];
 #if PLATFORM(IOS_FAMILY)
-                m_mediaSource->player()->setHasAvailableVideoFrame(true);
+                player->setHasAvailableVideoFrame(true);
 #endif
             } else {
 
@@ -1068,8 +1077,8 @@
 
         auto renderer = m_audioRenderers.get(trackID);
         [renderer enqueueSampleBuffer:platformSample.sample.cmSampleBuffer];
-        if (m_mediaSource && !sample->isNonDisplaying() && m_mediaSource->player())
-            m_mediaSource->player()->setHasAvailableAudioSample(renderer.get(), true);
+        if (auto player = this->player(); player && !sample->isNonDisplaying())
+            player->setHasAvailableAudioSample(renderer.get(), true);
     }
 }
 
@@ -1077,8 +1086,8 @@
 {
     DEBUG_LOG(LOGIDENTIFIER);
 
-    if (m_mediaSource)
-        m_mediaSource->player()->setHasAvailableVideoFrame(true);
+    if (auto player = this->player())
+        player->setHasAvailableVideoFrame(true);
 }
 
 bool SourceBufferPrivateAVFObjC::isReadyForMoreSamples(const AtomString& trackIDString)
@@ -1271,12 +1280,18 @@
             weakThis->didBecomeReadyForMoreSamples(weakThis->m_enabledVideoTrackID);
     });
     m_decompressionSession->notifyWhenHasAvailableVideoFrame([weakThis = makeWeakPtr(*this)] {
-        if (weakThis && weakThis->m_mediaSource)
-            weakThis->m_mediaSource->player()->setHasAvailableVideoFrame(true);
+        if (weakThis && weakThis->player())
+            weakThis->player()->setHasAvailableVideoFrame(true);
     });
     reenqueSamples(AtomString::number(m_enabledVideoTrackID));
 }
 
+MediaPlayerPrivateMediaSourceAVFObjC* SourceBufferPrivateAVFObjC::player() const
+{
+    return m_mediaSource ? m_mediaSource->player() : nullptr;
+}
+
+
 #if !RELEASE_LOG_DISABLED
 WTFLogChannel& SourceBufferPrivateAVFObjC::logChannel() const
 {
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes

Reply via email to