Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: de6ac853eb8beed6c1a3f482e4a31d16894bfe93
https://github.com/WebKit/WebKit/commit/de6ac853eb8beed6c1a3f482e4a31d16894bfe93
Author: Ahmad Saleem <[email protected]>
Date: 2026-08-06 (Thu, 06 Aug 2026)
Changed paths:
M Source/WebCore/platform/mediastream/libwebrtc/LibWebRTCAudioModule.cpp
M Source/WebCore/platform/mediastream/libwebrtc/LibWebRTCAudioModule.h
Log Message:
-----------
LibWebRTCAudioModule can use the audio transport after it is unregistered and
destroyed
https://bugs.webkit.org/show_bug.cgi?id=320641
rdar://183619537
Reviewed by Youenn Fablet.
Completes 318047@main. Making m_audioTransport a
std::atomic<webrtc::AudioTransport*> made the pointer value race-free but
gave no ordering against the pointee's destruction. The transport is
AudioState::audio_transport_, a member of AudioState, so when
WebRtcVoiceEngine::Terminate() calls StopPlayout() then
RegisterAudioCallback(nullptr) and drops AudioState, a poll still inside
PullRenderData() is using freed memory. StopPlayout() only stores false
into m_isPlaying and returns; it does not wait for the polling chain.
Guard m_audioTransport with a lock that pollFromSource() holds across its
PullRenderData() calls. RegisterAudioCallback() takes that same lock, so it
cannot return while a poll is still using the transport it is replacing, and
its caller is then free to destroy that transport, as
WebRtcVoiceEngine::Terminate() does. That subsumes the atomic, which is no
longer needed, and WTF_GUARDED_BY_LOCK now machine-checks every access. The
barrier belongs here rather than in StopPlayout(), which libwebrtc reaches
from BaseChannel::UpdateMediaSendRecvState_w() under
RTC_DCHECK_DISALLOW_THREAD_BLOCKING_CALLS() on every renegotiation to
sendonly or inactive; RegisterAudioCallback() runs only at engine init and
terminate, where waiting for at most one in-flight poll is acceptable.
Keep m_isPlaying atomic: it is written on libwebrtc's worker thread, read
on the work queue, and read via Playing() from AudioState.
* Source/WebCore/platform/mediastream/libwebrtc/LibWebRTCAudioModule.cpp:
(WebCore::LibWebRTCAudioModule::RegisterAudioCallback):
(WebCore::LibWebRTCAudioModule::pollFromSource):
* Source/WebCore/platform/mediastream/libwebrtc/LibWebRTCAudioModule.h:
Canonical link: https://commits.webkit.org/318712@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
