Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: e7f7480061c3edc6ddbadaad7fe202f28fcd6154
https://github.com/WebKit/WebKit/commit/e7f7480061c3edc6ddbadaad7fe202f28fcd6154
Author: Youenn Fablet <[email protected]>
Date: 2026-06-29 (Mon, 29 Jun 2026)
Changed paths:
A LayoutTests/http/wpt/webcodecs/frame-clone-and-convert-expected.txt
A LayoutTests/http/wpt/webcodecs/frame-clone-and-convert.html
M Source/WebCore/platform/mediastream/libwebrtc/VideoFrameLibWebRTC.cpp
M Source/WebCore/platform/mediastream/libwebrtc/VideoFrameLibWebRTC.h
Log Message:
-----------
[WebCore] Data race on VideoFrameLibWebRTC::m_conversionCallback between
clone and pixelBuffer causes use-after-free
rdar://175482151
Reviewed by Jean-Yves Avenard.
We add a thread annotation to make sure the conversion callback cannot be
modified without the pixel buffer lock.
We update VideoFrameLibWebRTC::clone so that it holds the pixel buffer lock to
ensure it gets a correct conversion callback.
We also copy the pixel buffer with a lock, as it could be null on the cloned
video frame if the conversion callback has already been called.
Covered by LayoutTests/http/wpt/webcodecs/frame-clone-and-convert.html, which
does the following:
1. Create a LibWebRTC VideoFrame.
2. Encode it using VP8 so that the VideoFrame pixelBuffer method is executed in
a background queue.
3. In parallel, clone the VideoFrame to exercice the racy code path and encode
the cloned frame.
* LayoutTests/http/wpt/webcodecs/frame-clone-and-convert-expected.txt: Added.
* LayoutTests/http/wpt/webcodecs/frame-clone-and-convert.html: Added.
* Source/WebCore/platform/mediastream/libwebrtc/VideoFrameLibWebRTC.cpp:
(WebCore::VideoFrameLibWebRTC::clone):
* Source/WebCore/platform/mediastream/libwebrtc/VideoFrameLibWebRTC.h:
Originally-landed-as: 305413.760@safari-7624-branch (f4c62c374952).
rdar://180436627
Canonical link: https://commits.webkit.org/316112@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
