Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: b17b55f6a8fb1f801cf24aceb70a867e7db87af1
https://github.com/WebKit/WebKit/commit/b17b55f6a8fb1f801cf24aceb70a867e7db87af1
Author: Said Abou-Hallawa <[email protected]>
Date: 2026-08-25 (Tue, 25 Aug 2026)
Changed paths:
M Source/WebCore/SourcesCocoa.txt
M Source/WebCore/WebCore.xcodeproj/project.pbxproj
M Source/WebCore/platform/graphics/ImageDecoder.cpp
M Source/WebCore/platform/graphics/ImageDecoder.h
A Source/WebCore/platform/graphics/avfoundation/ImageDecoderFactoryAVF.cpp
A Source/WebCore/platform/graphics/avfoundation/ImageDecoderFactoryAVF.h
M Source/WebKit/WebProcess/GPU/media/RemoteImageDecoderAVFManager.cpp
M Source/WebKit/WebProcess/GPU/media/RemoteImageDecoderAVFManager.h
Log Message:
-----------
Make ImageDecoderFactoryAVF thread safe
https://bugs.webkit.org/show_bug.cgi?id=315295
rdar://177298988
Reviewed by Jean-Yves
Avenard.
ImageDecoderFactoryAVF is a new class which will replace the calls and uses of
installedFactories() in ImageDecoder.cpp.
installedFactories() returns a process-wide Vector<ImageDecoderFactory> with
NO synchronization. A worker thread can reach to installedFactories() to call
createImageDecoder(). The main thread can also reach to installedFactories() but
to clearFactories() which deletes the heap-allocated of
Vector<ImageDecoderFactory>
which can lead to UAF.
The fix is to move the code of installedFactories() to a new class called
ImageDecoderFactoryAVF. This class will contain a single DecoderInterface but
guarded by a Lock. All accesses to the DecoderInterface have to preceded by
acquiring the Lock through a Locker.
* Source/WebCore/SourcesCocoa.txt:
* Source/WebCore/WebCore.xcodeproj/project.pbxproj:
*
Source/WebCore/platform/graphics/ImageDecoder.cpp:
(WebCore::ImageDecoder::create):
(WebCore::ImageDecoder::supportsMediaType):
(WebCore::createInProcessImageDecoderAVFObjC): Deleted.
(WebCore::platformRegisterFactories): Deleted.
(WebCore::installedFactories): Deleted.
(WebCore::ImageDecoder::installFactory): Deleted.
(WebCore::ImageDecoder::resetFactories): Deleted.
(WebCore::ImageDecoder::clearFactories): Deleted.
(WebCore::createInProcessAsyncImageDecoderAVFObjC): Deleted.
* Source/WebCore/platform/graphics/ImageDecoder.h:
* Source/WebCore/platform/graphics/avfoundation/ImageDecoderFactoryAVF.cpp:
Added.
(WebCore::ImageDecoderFactoryAVF::singleton):
(WebCore::ImageDecoderFactoryAVF::ImageDecoderFactoryAVF):
(WebCore::ImageDecoderFactoryAVF::platformDecoderInterface):
(WebCore::ImageDecoderFactoryAVF::set):
(WebCore::ImageDecoderFactoryAVF::reset):
(WebCore::ImageDecoderFactoryAVF::supportsMediaType const):
(WebCore::ImageDecoderFactoryAVF::createImageDecoder
const):
* Source/WebCore/platform/graphics/avfoundation/ImageDecoderFactoryAVF.h: Added.
* Source/WebKit/WebProcess/GPU/media/RemoteImageDecoderAVFManager.cpp:
(WebKit::RemoteImageDecoderAVFManager::setUseGPUProcess):
(WebKit::RemoteImageDecoderAVFManager::createAsyncImageDecoder): Deleted.
Originally-landed-as: [email protected] (187f143ff26f).
rdar://185369465
* Source/WebKit/WebProcess/GPU/media/RemoteImageDecoderAVFManager.h:
Canonical link:
https://flagged.apple.com:443/proxy?t2=Ds4E4k7XO7&o=aHR0cHM6Ly9jb21taXRzLndlYmtpdC5vcmcvMzE5Nzk5QG1haW4=&emid=4eeaa702-b653-42b2-81bc-2fef14ec3521&c=11
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
