Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 9f39c1d4c9b0cb360841d3d81fa72e8f30743d23
https://github.com/WebKit/WebKit/commit/9f39c1d4c9b0cb360841d3d81fa72e8f30743d23
Author: Ahmad Saleem <[email protected]>
Date: 2026-08-09 (Sun, 09 Aug 2026)
Changed paths:
M Source/WebCore/Modules/webaudio/BaseAudioContext.cpp
Log Message:
-----------
BaseAudioContext::clear() leaks AudioNodes marked for deletion during
uninitialize()
https://bugs.webkit.org/show_bug.cgi?id=321367
rdar://184421456
Reviewed by Chris Dumez.
clear() assigned m_nodesMarkedForDeletion over m_nodesToDelete instead of
appending
to it. m_nodesToDelete is not necessarily empty on entry: uninitialize() sets
m_isAudioThreadFinished before calling
handleDeferredDecrementConnectionCounts() and
handleDeferredDerefs(), and those reach markForDeletion(), which appends
straight to
m_nodesToDelete once the audio thread is finished, without the
deleteMarkedNodes()
call that the public deref() / decrementConnectionCount() wrappers make. Those
nodes
were dropped by the assignment. They are deleted by hand, and each holds a Ref
to its
context, so a single dropped node leaks the whole BaseAudioContext and its
graph.
The loop was dead too: deleteMarkedNodes() drains m_nodesToDelete, so the
condition
was always false and nodes marked while deleting other nodes were never
collected.
Append instead of assign and loop on m_nodesMarkedForDeletion, restoring the
behavior
from before 6eceb6d922f3, which drained before moving.
No test: the deferred lists are only populated when the audio thread failed a
tryLock() on the graph lock, so this cannot be triggered deterministically.
* Source/WebCore/Modules/webaudio/BaseAudioContext.cpp:
(WebCore::BaseAudioContext::clear):
Canonical link: https://commits.webkit.org/318867@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
