Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: e3b8f2b9b9b2f02d71510c5bf9045e51b687e0a9
https://github.com/WebKit/WebKit/commit/e3b8f2b9b9b2f02d71510c5bf9045e51b687e0a9
Author: Chris Dumez <[email protected]>
Date: 2026-07-15 (Wed, 15 Jul 2026)
Changed paths:
A
LayoutTests/webaudio/scriptprocessornode-connected-to-audioparam-crash-expected.txt
A
LayoutTests/webaudio/scriptprocessornode-connected-to-audioparam-crash.html
M Source/WebCore/Modules/webaudio/AudioParam.cpp
M Source/WebCore/Modules/webaudio/AudioParam.h
Log Message:
-----------
REGRESSION(312187@main) AudioParam ref-counting is not thread-safe, causing a
crash when a node connected to it is destroyed on the audio thread
https://bugs.webkit.org/show_bug.cgi?id=319369
rdar://182132498
Reviewed by Jean-Yves Avenard.
Since 312187@main made AudioNode's ref-counting thread-safe, an AudioNode can be
deref'd and marked for deletion on the audio rendering thread. When a node
(e.g. a
ScriptProcessorNode) that is connected to an AudioParam gets deleted this way,
the
teardown path AudioNode::deref() -> markNodeForDeletionIfNecessary() ->
AudioNodeOutput::disconnectAll() -> disconnectAllParams() ref's and deref's the
connected AudioParam on the audio thread. AudioParam was still a plain
RefCounted<AudioParam>, so this tripped the ref/deref threading assertion
(applyRefDerefThreadingCheck) and crashed.
Make AudioParam's ref-counting thread-safe, matching AudioNodeInput which is
processed on the same audio-thread teardown path. AudioParam owns
non-thread-safe
members (e.g. its String name), so it must never be destroyed off the main
thread;
use ThreadSafeRefCounted<AudioParam, DestructionThread::Main> so that a final
deref
on the audio thread defers destruction to the main thread.
Also avoid the INFO_LOG() call in AudioParam::disconnect() when running on the
audio
thread, since building the log string allocates and heap allocations are
forbidden
on the audio thread.
Test: webaudio/scriptprocessornode-connected-to-audioparam-crash.html
*
LayoutTests/webaudio/scriptprocessornode-connected-to-audioparam-crash-expected.txt:
Added.
* LayoutTests/webaudio/scriptprocessornode-connected-to-audioparam-crash.html:
Added.
* Source/WebCore/Modules/webaudio/AudioParam.cpp:
(WebCore::AudioParam::disconnect):
* Source/WebCore/Modules/webaudio/AudioParam.h:
Canonical link: https://commits.webkit.org/317232@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
