Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: d6fb60c4fa7912ac11adc9b79f6de7aac952d967
https://github.com/WebKit/WebKit/commit/d6fb60c4fa7912ac11adc9b79f6de7aac952d967
Author: Anthony Tarbinian <[email protected]>
Date: 2026-06-30 (Tue, 30 Jun 2026)
Changed paths:
A
LayoutTests/fast/mediasession/metadata/artwork-image-loader-callback-crash-expected.txt
A
LayoutTests/fast/mediasession/metadata/artwork-image-loader-callback-crash.html
M Source/WebCore/Modules/mediasession/MediaMetadata.cpp
M Source/WebCore/Modules/mediasession/MediaMetadata.h
Log Message:
-----------
[WebCore] Capture WeakPtr to this (MediaMetadata) in ArtworkImageLoader
callback
https://bugs.webkit.org/show_bug.cgi?id=312480
rdar://174651594
Reviewed by Geoffrey Garen.
In media artwork image loading, it is possible for a
callback lambda to outlive the lifetime of the
MediaMetadata which it captures with a raw "this".
This callback is stored in ArtworkImageLoader::m_callback
and ArtworkImageLoader is owned by MediaMetadata.
The lambda captures a raw this to MediaMetadata during
MediaMetadata::tryNextArtworkImage.
However, it's possible for the lambda to outlive ArtworkImageLoader
and, in turn, MediaMetadata after beeing std::exchanged outside
of the artwork loader in ArtworkImageLoader::notifyFinished.
Then, it's possible for MediaMetadata to be destroyed while
the lambda has a dangling "this" pointer to the destroyed object.
This patch changes the lambda to capture a WeakPtr
to "this" (MediaMetadata) and returns early if it has
been destroyed. If weakThis is still alive, we keep it alive for the
duration of the lambda body with a RefPtr.
*
LayoutTests/fast/mediasession/metadata/artwork-image-loader-callback-crash-expected.txt:
Added.
*
LayoutTests/fast/mediasession/metadata/artwork-image-loader-callback-crash.html:
Added.
* Source/WebCore/Modules/mediasession/MediaMetadata.cpp:
(WebCore::MediaMetadata::tryNextArtworkImage):
Changed the artwork loader lambda to capture a WeakPtr
to "this" and early return if weakThis is null.
The rest of the lambda explicitly uses weakThis where needed.
* Source/WebCore/Modules/mediasession/MediaMetadata.h:
Changed MediaMetadata to inherit from CanMakeWeakPtr.
Originally-landed-as: 305413.695@safari-7624-branch (9da5185f2406).
rdar://180437956
Canonical link: https://commits.webkit.org/316179@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
