Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 14878d1cdcb1713e69fb3d037ea878cbc0fb2218
https://github.com/WebKit/WebKit/commit/14878d1cdcb1713e69fb3d037ea878cbc0fb2218
Author: Jean-Yves Avenard <[email protected]>
Date: 2026-07-14 (Tue, 14 Jul 2026)
Changed paths:
M Source/WebKit/GPUProcess/media/RemoteMediaPlayerManagerProxy.cpp
Log Message:
-----------
(315905@main) Unable to access apple.com in Safari in recoveryOS
RemoteMediaPlayerManagerProxy_CreateMediaPlayer
https://bugs.webkit.org/show_bug.cgi?id=319383
rdar://181834735
Reviewed by Jer Noble and Eric Carlson.
In an environment where AVFoundation/CoreMedia are not available (such as
recoveryOS), loading any page with a media element repeatedly killed the
WebContent process with:
Received an invalid message RemoteMediaPlayerManagerProxy_CreateMediaPlayer
from WebContent process N, requesting for it to be terminated.
WebContent registers a remote AVFoundation factory whenever GPU-media is
enabled, without regard to whether the framework is actually present, and ends
up sending CreateMediaPlayer(AVFoundation) to the GPU process. This path is
long-standing and, on its own, harmless.
315905@main replaced the identifier allowlist in
RemoteMediaPlayerManagerProxy::createMediaPlayer() with
MESSAGE_CHECK(playbackEngineForConnection(engineIdentifier)), turning the guard
into a registration-existence test. That conflates two distinct cases where the
lookup returns null:
- a contained engine (WebM/MSE) registered in the GPU process for capability
queries only (Supports scope) — a genuine containment bypass that must
terminate WebContent, and
- an engine that is entirely unregistered because its platform framework is
unavailable (AVFoundation in recoveryOS) — which previously fell through and
degraded to a null player.
The latter now fails the MESSAGE_CHECK and terminates WebContent, which respawns
and is killed again, surfacing as "a problem repeatedly occurred".
Only terminate for the containment-bypass case: when
playbackEngineForConnection()
returns null, terminate only if the engine is registered at Supports scope.
An entirely-absent engine falls through to RemoteMediaPlayerProxy::create(),
whose MediaPlayer resolves the identifier to a NullMediaPlayerPrivate and
reports
"not supported" back to WebContent, as it did before 315905@main.
As a follow-up, WebContent should not register a remote player factory for an
engine whose underlying framework is unavailable, so that no doomed
CreateMediaPlayer message is sent to the GPU process in the first place (e.g. by
checking isAvailable() before
RemoteMediaPlayerSupport::registerRemoteEngineIfAvailable()
in the Cocoa engines' registerMediaEngine()).
* Source/WebKit/GPUProcess/media/RemoteMediaPlayerManagerProxy.cpp:
(WebKit::RemoteMediaPlayerManagerProxy::createMediaPlayer):
Canonical link: https://commits.webkit.org/317195@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
