Title: [279324] releases/WebKitGTK/webkit-2.32/Source/WebCore
- Revision
- 279324
- Author
- [email protected]
- Date
- 2021-06-28 00:56:26 -0700 (Mon, 28 Jun 2021)
Log Message
Merge r277177 - AudioWorkletProcessor which does not extend base class crashes Safari
https://bugs.webkit.org/show_bug.cgi?id=225449
<rdar://problem/77624792>
Reviewed by Sam Weinig.
Update AudioWorkletGlobalScope::createProcessor() to validate the type of the processor
after constructing it.
* Modules/webaudio/AudioWorkletGlobalScope.cpp:
(WebCore::AudioWorkletGlobalScope::createProcessor):
Modified Paths
Diff
Modified: releases/WebKitGTK/webkit-2.32/Source/WebCore/ChangeLog (279323 => 279324)
--- releases/WebKitGTK/webkit-2.32/Source/WebCore/ChangeLog 2021-06-28 05:07:04 UTC (rev 279323)
+++ releases/WebKitGTK/webkit-2.32/Source/WebCore/ChangeLog 2021-06-28 07:56:26 UTC (rev 279324)
@@ -1,3 +1,17 @@
+2021-05-07 Chris Dumez <[email protected]>
+
+ AudioWorkletProcessor which does not extend base class crashes Safari
+ https://bugs.webkit.org/show_bug.cgi?id=225449
+ <rdar://problem/77624792>
+
+ Reviewed by Sam Weinig.
+
+ Update AudioWorkletGlobalScope::createProcessor() to validate the type of the processor
+ after constructing it.
+
+ * Modules/webaudio/AudioWorkletGlobalScope.cpp:
+ (WebCore::AudioWorkletGlobalScope::createProcessor):
+
2021-05-06 Philippe Normand <[email protected]>
[WebAudio][GStreamer] socketpair leaks
Modified: releases/WebKitGTK/webkit-2.32/Source/WebCore/Modules/webaudio/AudioWorkletGlobalScope.cpp (279323 => 279324)
--- releases/WebKitGTK/webkit-2.32/Source/WebCore/Modules/webaudio/AudioWorkletGlobalScope.cpp 2021-06-28 05:07:04 UTC (rev 279323)
+++ releases/WebKitGTK/webkit-2.32/Source/WebCore/Modules/webaudio/AudioWorkletGlobalScope.cpp 2021-06-28 07:56:26 UTC (rev 279324)
@@ -146,10 +146,13 @@
ASSERT(!!scope.exception() == !object);
RETURN_IF_EXCEPTION(scope, nullptr);
- auto& jsProcessor = *JSC::jsCast<JSAudioWorkletProcessor*>(object);
- jsProcessor.wrapped().setProcessCallback(makeUnique<JSCallbackDataStrong>(&jsProcessor, globalObject));
+ auto* jsProcessor = JSC::jsDynamicCast<JSAudioWorkletProcessor*>(vm, object);
+ if (!jsProcessor)
+ return nullptr;
- return &jsProcessor.wrapped();
+ jsProcessor->wrapped().setProcessCallback(makeUnique<JSCallbackDataStrong>(jsProcessor, globalObject));
+
+ return &jsProcessor->wrapped();
}
void AudioWorkletGlobalScope::prepareForDestruction()
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
