Branch: refs/heads/webkitglib/2.52
Home: https://github.com/WebKit/WebKit
Commit: 10b34fbebfbb0aa8a19126c6c0cf71c3f0c6afd3
https://github.com/WebKit/WebKit/commit/10b34fbebfbb0aa8a19126c6c0cf71c3f0c6afd3
Author: Philippe Normand <[email protected]>
Date: 2026-05-25 (Mon, 25 May 2026)
Changed paths:
M Source/WebCore/platform/graphics/gstreamer/GLVideoSinkGStreamer.cpp
Log Message:
-----------
Cherry-pick 313828@main (a3972609ade7).
https://bugs.webkit.org/show_bug.cgi?id=308119
[GStreamer] WebKitGLVideoSink finalized from wrong thread
https://bugs.webkit.org/show_bug.cgi?id=308119
Reviewed by Xabier Rodriguez-Calvar.
Remove the ASSERT(isMainThread()) from ~_WebKitGLVideoSinkPrivate() because
it is invalid, the sink
can be finalized from a non-main thread when the player it belongs to has
been destructed while the
pipeline was in an ASYNC state change.
* Source/WebCore/platform/graphics/gstreamer/GLVideoSinkGStreamer.cpp:
(_WebKitGLVideoSinkPrivate::~_WebKitGLVideoSinkPrivate):
Canonical link: https://commits.webkit.org/313828@main
Canonical link: https://commits.webkit.org/305877.670@webkitglib/2.52
Commit: 03125b1d93594f70ebf7f266af266d8c0d2e7a21
https://github.com/WebKit/WebKit/commit/03125b1d93594f70ebf7f266af266d8c0d2e7a21
Author: Philippe Normand <[email protected]>
Date: 2026-05-25 (Mon, 25 May 2026)
Changed paths:
M Source/WebCore/platform/graphics/gstreamer/GStreamerVideoSinkCommon.cpp
M Source/WebCore/platform/graphics/gstreamer/GStreamerVideoSinkCommon.h
Log Message:
-----------
Cherry-pick 313829@main (36e289cd26dc).
https://bugs.webkit.org/show_bug.cgi?id=315460
[GStreamer] Clean-up the video sink pad pad probe when finalizing the sink
https://bugs.webkit.org/show_bug.cgi?id=315460
Reviewed by Xabier Rodriguez-Calvar.
This isn't strictly needed because probes are removed during pad disposal,
but doesn't hurt either
;)
* Source/WebCore/platform/graphics/gstreamer/GStreamerVideoSinkCommon.cpp:
(webKitVideoSinkSetMediaPlayerPrivate):
(webKitVideoSinkDisconnectSignalHandlers):
* Source/WebCore/platform/graphics/gstreamer/GStreamerVideoSinkCommon.h:
Canonical link: https://commits.webkit.org/313829@main
Canonical link: https://commits.webkit.org/305877.671@webkitglib/2.52
Commit: 4258a0e2e2b51a0bdf84b9fbdb89d5a30f1dedfd
https://github.com/WebKit/WebKit/commit/4258a0e2e2b51a0bdf84b9fbdb89d5a30f1dedfd
Author: Philippe Normand <[email protected]>
Date: 2026-05-25 (Mon, 25 May 2026)
Changed paths:
M Source/WebCore/Modules/mediastream/gstreamer/GStreamerIceAgent.h
Log Message:
-----------
Cherry-pick 313827@main (71f768520877).
https://bugs.webkit.org/show_bug.cgi?id=313410
[GStreamer] Several tests crash with assertions enabled due to deref'ing
WebCore::RiceBackendClient from the wrong thread
https://bugs.webkit.org/show_bug.cgi?id=313410
Reviewed by Xabier Rodriguez-Calvar.
The GStreamer ICE agent can be finalized from a non-main thread, when the
pipeline it belongs to was
in an ASYNC state change while it was destructed. The only non-threadsafe
smart pointer in
_WebKitGstIceAgentPrivate was the RiceBackendClient, so make it so in order
to prevent
false-positive asserts at runtime.
* Source/WebCore/Modules/mediastream/gstreamer/GStreamerIceAgent.h:
Canonical link: https://commits.webkit.org/313827@main
Canonical link: https://commits.webkit.org/305877.672@webkitglib/2.52
Commit: f08217b73040a989a1fdb061a3a57b303a00ed97
https://github.com/WebKit/WebKit/commit/f08217b73040a989a1fdb061a3a57b303a00ed97
Author: Said Abou-Hallawa <[email protected]>
Date: 2026-05-25 (Mon, 25 May 2026)
Changed paths:
A LayoutTests/ipc/fecolormatrix-type-values-mismatch-crash-expected.txt
A LayoutTests/ipc/fecolormatrix-type-values-mismatch-crash.html
M Source/WebCore/platform/graphics/filters/FEColorMatrix.cpp
M Source/WebCore/platform/graphics/filters/FEColorMatrix.h
M Source/WebCore/svg/SVGFEColorMatrixElement.cpp
M Source/WebCore/svg/SVGFEColorMatrixElement.h
M Source/WebKit/Shared/WebCoreArgumentCoders.serialization.in
Log Message:
-----------
Cherry-pick 305413.505@safari-7624-branch (ec665bbbbe8b).
https://bugs.webkit.org/show_bug.cgi?id=309868
[GPU Process]: Before decoding FEColorMatrix validate the length of the
`values` vector
https://bugs.webkit.org/show_bug.cgi?id=309868
rdar://172397794
Reviewed by Kimmo Kinnunen.
SVGFEColorMatrixElement checks the length of `values` attribute before
creating
the FEColorMatrix. Similarly the IPC should check the length of decoded
`values`
before creating the FEColorMatrix. In both cases the `type` attribute
should be
used to decide whether the length of `values` is valid or not.
Test: ipc/fecolormatrix-type-values-mismatch-crash.html
* LayoutTests/ipc/fecolormatrix-type-values-mismatch-crash-expected.txt:
Added.
* LayoutTests/ipc/fecolormatrix-type-values-mismatch-crash.html: Added.
* Source/WebCore/platform/graphics/filters/FEColorMatrix.cpp:
(WebCore::FEColorMatrix::create):
(WebCore::FEColorMatrix::areValuesValidForType):
* Source/WebCore/platform/graphics/filters/FEColorMatrix.h:
* Source/WebCore/svg/SVGFEColorMatrixElement.cpp:
(WebCore::SVGFEColorMatrixElement::svgAttributeChanged):
(WebCore::SVGFEColorMatrixElement::createFilterEffect const):
(WebCore::SVGFEColorMatrixElement::isInvalidValuesLength const): Deleted.
* Source/WebCore/svg/SVGFEColorMatrixElement.h:
* Source/WebKit/Shared/WebCoreArgumentCoders.serialization.in:
Identifier: 305413.505@safari-7624-branch
Canonical link: https://commits.webkit.org/305877.673@webkitglib/2.52
Compare: https://github.com/WebKit/WebKit/compare/ae3eaacd1b2d...f08217b73040
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
