Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: dc6ce247faeea6c6466018559b5177314ac1d667
      
https://github.com/WebKit/WebKit/commit/dc6ce247faeea6c6466018559b5177314ac1d667
  Author: Eric Carlson <[email protected]>
  Date:   2026-08-24 (Mon, 24 Aug 2026)

  Changed paths:
    M Source/WebCore/platform/audio/cocoa/MediaSessionManagerCocoa.mm
    M Tools/TestWebKitAPI/Tests/WebCore/PlatformMediaSessionManagerTests.cpp

  Log Message:
  -----------
  [Site Isolation] UI-process crash in 
MediaSessionManagerCocoa::audioOutputDeviceChanged() after the last media 
session is removed
https://bugs.webkit.org/show_bug.cgi?id=322355
rdar://183466855

Reviewed by Jer Noble.

MediaSessionManagerCocoa::audioOutputDeviceChanged() dereferenced 
m_audioHardwareListener
unconditionally, guarded only by an ASSERT. That listener is created in 
addSession() and cleared
in removeSession() once the last session is gone.

Under site isolation the UI-process RemoteMediaSessionManagerProxy keeps its 
audio-hardware
listener proxy alive for the lifetime of the process, so an audio-output-device 
change relayed
from the GPU process after the last session was removed still reached 
audioOutputDeviceChanged()
- now with a null m_audioHardwareListener - and crashed the UI process in 
release builds.

A device change arriving while no media session exists is a valid condition, 
not a
programming error, so return early when there is no listener and drop the 
ASSERT.

* Source/WebCore/platform/audio/cocoa/MediaSessionManagerCocoa.mm:
(WebCore::MediaSessionManagerCocoa::audioOutputDeviceChanged):
* Tools/TestWebKitAPI/Tests/WebCore/PlatformMediaSessionManagerTests.cpp:
(TestWebKitAPI::TestFiringAudioHardwareListener::create):
(TestWebKitAPI::TestFiringAudioHardwareListener::fireOutputDeviceChanged):
(TestWebKitAPI::TestMediaSessionManagerCocoa::create):
(TestWebKitAPI::TEST): Added a regression test that fires a device change after 
the last
session is removed.

Canonical link: https://commits.webkit.org/319716@main



To unsubscribe from these emails, change your notification settings at 
https://github.com/WebKit/WebKit/settings/notifications

Reply via email to