Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 9ba6cb68fcfbb1948bc4b6a1d3f88c4d9073e032
https://github.com/WebKit/WebKit/commit/9ba6cb68fcfbb1948bc4b6a1d3f88c4d9073e032
Author: Youenn Fablet <[email protected]>
Date: 2026-08-26 (Wed, 26 Aug 2026)
Changed paths:
A
LayoutTests/http/wpt/webcodecs/videoDecoder-concurrent-decode-output-no-crash-expected.txt
A
LayoutTests/http/wpt/webcodecs/videoDecoder-concurrent-decode-output-no-crash.html
M Source/WebKit/WebProcess/GPU/media/RemoteVideoCodecFactory.cpp
Log Message:
-----------
Race on RemoteVideoDecoderCallbacks::m_timestampToDuration leads to
use-after-free
rdar://177096608
Reviewed by Jean-Yves Avenard.
RemoteVideoDecoderCallbacks::addDuration is called from the JS thread that
invoked VideoDecoder.decode.
RemoteVideoDecoderCallbacks::notifyDecodingResult is called from the
LibWebRTCCodecs work queue.
Both mutate m_timestampToDuration so we need to add a lock to ensure
synchronization.
We also make m_isClosed atomic on both the decoder and encoder callback objects
as it is written in a thread and read in another.
Patch mostly written by Simon Lewis.
*
LayoutTests/http/wpt/webcodecs/videoDecoder-concurrent-decode-output-no-crash-expected.txt:
Added.
*
LayoutTests/http/wpt/webcodecs/videoDecoder-concurrent-decode-output-no-crash.html:
Added.
* Source/WebKit/WebProcess/GPU/media/RemoteVideoCodecFactory.cpp:
(WebKit::RemoteVideoDecoderCallbacks::addDuration):
(WebKit::RemoteVideoDecoderCallbacks::takeDuration):
(WebKit::RemoteVideoDecoderCallbacks::notifyDecodingResult):
Originally-landed-as: [email protected] (50232798d951).
rdar://185369402
Canonical link: https://commits.webkit.org/319863@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
