Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 28838f616b1d327c59413bcf0d2956d560a68522
https://github.com/WebKit/WebKit/commit/28838f616b1d327c59413bcf0d2956d560a68522
Author: David Kilzer <[email protected]>
Date: 2026-05-04 (Mon, 04 May 2026)
Changed paths:
A
LayoutTests/fast/speechsynthesis/mac/speech-synthesis-voices-changed-background-thread-expected.txt
A
LayoutTests/fast/speechsynthesis/mac/speech-synthesis-voices-changed-background-thread.html
M Source/WebCore/platform/cocoa/PlatformSpeechSynthesizerCocoa.mm
M Tools/TestRunnerShared/UIScriptContext/Bindings/UIScriptController.idl
M Tools/TestRunnerShared/UIScriptContext/UIScriptController.h
M Tools/WebKitTestRunner/cocoa/UIScriptControllerCocoa.h
M Tools/WebKitTestRunner/cocoa/UIScriptControllerCocoa.mm
Log Message:
-----------
[Cocoa] Crash in WeakPtr<PlatformSpeechSynthesizer>::get() under
-[WebSpeechSynthesisWrapper availableVoicesDidChange]
<https://bugs.webkit.org/show_bug.cgi?id=313950>
<rdar://173555693>
Reviewed by Tyler Wilcock.
AVFoundation's `VoiceDatabaseClient` now posts
`AVSpeechSynthesisAvailableVoicesDidChangeNotification` from a
Swift concurrency cooperative thread rather than the main thread.
The `WebSpeechSynthesisWrapper` observer dereferenced its
`WeakPtr<PlatformSpeechSynthesizer>` directly in the notification
handler, tripping the `WeakPtr` threading assertion
(`ASSERT_WITH_SECURITY_IMPLICATION(canSafelyBeUsed())`) and
crashing the UI process.
Fix by ensuring the code runs on the main thread before accessing the
`WeakPtr` and null-checking it there since the owning
`PlatformSpeechSynthesizer` may have been destroyed by the time
the dispatched task runs.
Add a `UIScriptController` hook that posts the notification from a
background dispatch queue so the regression is covered by a layout test.
Test:
fast/speechsynthesis/mac/speech-synthesis-voices-changed-background-thread.html
*
LayoutTests/fast/speechsynthesis/mac/speech-synthesis-voices-changed-background-thread-expected.txt:
Add.
*
LayoutTests/fast/speechsynthesis/mac/speech-synthesis-voices-changed-background-thread.html:
Add.
* Source/WebCore/platform/cocoa/PlatformSpeechSynthesizerCocoa.mm:
(-[WebSpeechSynthesisWrapper availableVoicesDidChange]):
* Tools/TestRunnerShared/UIScriptContext/Bindings/UIScriptController.idl:
* Tools/TestRunnerShared/UIScriptContext/UIScriptController.h:
(WTR::UIScriptController::simulateAvailableSpeechVoicesDidChangeOnBackgroundThread):
* Tools/WebKitTestRunner/cocoa/UIScriptControllerCocoa.h:
* Tools/WebKitTestRunner/cocoa/UIScriptControllerCocoa.mm:
(WTR::UIScriptControllerCocoa::simulateAvailableSpeechVoicesDidChangeOnBackgroundThread):
Canonical link: https://commits.webkit.org/312522@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
