Branch: refs/heads/webkitglib/2.52
Home: https://github.com/WebKit/WebKit
Commit: b5dfc709ba57e67d3efa64f74c581c0db9df5b4a
https://github.com/WebKit/WebKit/commit/b5dfc709ba57e67d3efa64f74c581c0db9df5b4a
Author: Eric Carlson <[email protected]>
Date: 2026-09-02 (Wed, 02 Sep 2026)
Changed paths:
A
LayoutTests/ipc/remote-media-session-manager-audio-hardware-listener-crash-expected.txt
A
LayoutTests/ipc/remote-media-session-manager-audio-hardware-listener-crash.html
A
LayoutTests/ipc/remote-media-session-manager-audio-hardware-listener-uaf-expected.txt
A
LayoutTests/ipc/remote-media-session-manager-audio-hardware-listener-uaf.html
M Source/WebCore/platform/audio/AudioHardwareListener.h
M Source/WebCore/platform/audio/cocoa/MediaSessionManagerCocoa.mm
M Source/WebCore/platform/audio/mac/AudioHardwareListenerMac.cpp
M Source/WebKit/GPUProcess/GPUConnectionToWebProcess.cpp
M Source/WebKit/GPUProcess/GPUConnectionToWebProcess.h
M Source/WebKit/GPUProcess/media/RemoteAudioHardwareListenerProxy.h
M Source/WebKit/UIProcess/Media/RemoteMediaSessionManagerProxy.cpp
M Source/WebKit/UIProcess/Media/RemoteMediaSessionManagerProxy.h
M Source/WebKit/WebProcess/GPU/media/RemoteAudioHardwareListener.cpp
Log Message:
-----------
Cherry-pick [email protected] (ddf732bdf8b3).
https://bugs.webkit.org/show_bug.cgi?id=319112
Hold AudioHardwareListener client weakly and stop caching listener proxies
across clients
rdar://177436036
Reviewed by Jean-Yves Avenard.
AudioHardwareListener stored its Client as a raw reference, while
RemoteMediaSessionManagerProxy::ensureAudioHardwareListenerProxy()
cached the first listener it created and reused it (with the original
client) for every subsequent caller, in addition to holding it
strongly via m_audioHardwareListenerProxy. Because each
RemoteMediaSessionManagerProxy also overwrites the process-global
AudioHardwareListener factory with a lambda capturing Ref{*this}, two
WebPageProxy instances could end up with B's cached listener bound to
A; closing A's page then made B's RemoteAudioOutputDeviceChanged
dispatch a virtual call on a freed proxy (UI-process heap-use-after-
free). Within a single page, removing the last media session cleared
MediaSessionManagerCocoa::m_audioHardwareListener but left the
strongly-held m_audioHardwareListenerProxy, so the same IPC message
null-dereferenced m_audioHardwareListener in audioOutputDeviceChanged.
Make AudioHardwareListener::Client an AbstractRefCountedAndCanMakeWeakPtr
(matching NowPlayingManagerClient), store m_client as a WeakPtr, and
upgrade to a protecting RefPtr before dispatching in every listener
subclass. In RemoteMediaSessionManagerProxy, capture *this weakly in
the creation lambda (also removing a leak of the last-constructed
proxy), always create a fresh listener per call, only stash a
ThreadSafeWeakPtr to it when the client is *this*, and dispatch IPC
through that weak pointer so the listener's lifetime is governed
solely by MediaSessionManagerCocoa::m_audioHardwareListener. Also
guard MediaSessionManagerCocoa::audioOutputDeviceChanged() against a
null m_audioHardwareListener for defense in depth, and make
RemoteAudioHardwareListenerProxy ref-counted to satisfy the new Client
contract.
Tests: ipc/remote-media-session-manager-audio-hardware-listener-crash.html
ipc/remote-media-session-manager-audio-hardware-listener-uaf.html
*
LayoutTests/ipc/remote-media-session-manager-audio-hardware-listener-crash-expected.txt:
Added.
*
LayoutTests/ipc/remote-media-session-manager-audio-hardware-listener-crash.html:
Added.
*
LayoutTests/ipc/remote-media-session-manager-audio-hardware-listener-uaf-expected.txt:
Added.
*
LayoutTests/ipc/remote-media-session-manager-audio-hardware-listener-uaf.html:
Added.
* Source/WebCore/platform/audio/AudioHardwareListener.h:
(WebCore::AudioHardwareListener::client const):
* Source/WebCore/platform/audio/cocoa/MediaSessionManagerCocoa.mm:
(WebCore::MediaSessionManagerCocoa::audioOutputDeviceChanged):
* Source/WebCore/platform/audio/mac/AudioHardwareListenerMac.cpp:
(WebCore::AudioHardwareListenerMac::processIsRunningChanged):
(WebCore::AudioHardwareListenerMac::outputDeviceChanged):
* Source/WebKit/GPUProcess/GPUConnectionToWebProcess.cpp:
(WebKit::GPUConnectionToWebProcess::createAudioHardwareListener):
* Source/WebKit/GPUProcess/GPUConnectionToWebProcess.h:
* Source/WebKit/GPUProcess/media/RemoteAudioHardwareListenerProxy.h:
* Source/WebKit/UIProcess/Media/RemoteMediaSessionManagerProxy.cpp:
(WebKit::RemoteMediaSessionManagerProxy::RemoteMediaSessionManagerProxy):
(WebKit::RemoteMediaSessionManagerProxy::remoteAudioHardwareDidBecomeActive):
(WebKit::RemoteMediaSessionManagerProxy::remoteAudioHardwareDidBecomeInactive):
(WebKit::RemoteMediaSessionManagerProxy::remoteAudioOutputDeviceChanged):
(WebKit::RemoteMediaSessionManagerProxy::ensureAudioHardwareListenerProxy):
* Source/WebKit/UIProcess/Media/RemoteMediaSessionManagerProxy.h:
* Source/WebKit/WebProcess/GPU/media/RemoteAudioHardwareListener.cpp:
(WebKit::RemoteAudioHardwareListener::audioHardwareDidBecomeActive):
(WebKit::RemoteAudioHardwareListener::audioHardwareDidBecomeInactive):
(WebKit::RemoteAudioHardwareListener::audioOutputDeviceChanged):
Identifier: [email protected]
Canonical link: https://commits.webkit.org/305877.1133@webkitglib/2.52
Commit: a80092a6bded04704466c14a9136eb065a2dcd91
https://github.com/WebKit/WebKit/commit/a80092a6bded04704466c14a9136eb065a2dcd91
Author: Jer Noble <[email protected]>
Date: 2026-09-02 (Wed, 02 Sep 2026)
Changed paths:
A
LayoutTests/fast/webcodecs/audio-data-copy-to-zero-frames-crash-expected.txt
A LayoutTests/fast/webcodecs/audio-data-copy-to-zero-frames-crash.html
M
LayoutTests/imported/w3c/web-platform-tests/webcodecs/audio-data-copyTo.any-expected.txt
M
LayoutTests/imported/w3c/web-platform-tests/webcodecs/audio-data-copyTo.any.js
M
LayoutTests/imported/w3c/web-platform-tests/webcodecs/audio-data-copyTo.any.worker-expected.txt
M Source/WebCore/Modules/webcodecs/WebCodecsAudioDataAlgorithms.cpp
M Source/WebCore/platform/audio/cocoa/PlatformRawAudioDataCocoa.cpp
Log Message:
-----------
Cherry-pick [email protected] (6b8717a224a0).
https://bugs.webkit.org/show_bug.cgi?id=318500
[WebCore] Memory underflow in PlatformRawAudioData::copyTo()
rdar://176473804
https://bugs.webkit.org/show_bug.cgi?id=318500
Reviewed by Jean-Yves Avenard
When PlatformRawAudioData::copyTo() is told to copy zero samples, just bail
out early. This
avoids a calculation where the number of samples has 1 subtracted from it,
causing a math
underflow.
Cherry-pick https://commits.webkit.org/314451@main for test to pass.
Test: fast/webcodecs/audio-data-copy-to-zero-frames-crash.html
*
LayoutTests/fast/webcodecs/audio-data-copy-to-zero-frames-crash-expected.txt:
Added.
* LayoutTests/fast/webcodecs/audio-data-copy-to-zero-frames-crash.html:
Added.
*
LayoutTests/imported/w3c/web-platform-tests/webcodecs/audio-data-copyTo.any-expected.txt:
*
LayoutTests/imported/w3c/web-platform-tests/webcodecs/audio-data-copyTo.any.js:
(test):
*
LayoutTests/imported/w3c/web-platform-tests/webcodecs/audio-data-copyTo.any.worker-expected.txt:
* Source/WebCore/Modules/webcodecs/WebCodecsAudioDataAlgorithms.cpp:
(WebCore::computeCopyElementCount):
* Source/WebCore/platform/audio/cocoa/PlatformRawAudioDataCocoa.cpp:
(WebCore::PlatformRawAudioData::copyTo):
Identifier: [email protected]
Canonical link: https://commits.webkit.org/305877.1134@webkitglib/2.52
Commit: 9e2b19d8e67b855ca789e9b2b3f6797ad5e2b73d
https://github.com/WebKit/WebKit/commit/9e2b19d8e67b855ca789e9b2b3f6797ad5e2b73d
Author: Zak Ridouh <[email protected]>
Date: 2026-09-02 (Wed, 02 Sep 2026)
Changed paths:
A
LayoutTests/fast/block/inside-inlines/block-in-inline-partial-relayout-crash-expected.txt
A
LayoutTests/fast/block/inside-inlines/block-in-inline-partial-relayout-crash.html
M
Source/WebCore/layout/integration/inline/LayoutIntegrationInlineContentBuilder.cpp
Log Message:
-----------
Cherry-pick [email protected] (039ba968916b).
https://bugs.webkit.org/show_bug.cgi?id=319704
[IFC] Do not leave stale display content when partial merge fails in
InlineContentBuilder
<https://bugs.webkit.org/show_bug.cgi?id=319704>
<rdar://177161065>
Reviewed by Alan Baradlay.
Field MTE reports show a use-after-free destroying InlineDisplay::Content
during
LineLayout::layout()'s clearInlineContent(): a display box's
CheckedPtr<Layout::Box>
still references a Layout::Box that was already freed.
Partial inline layout keeps the previous display content alive so the
newly-built
lines can be spliced into it, relying on
InlineDamage::m_detachedLayoutBoxes to keep
removed layout boxes alive across the merge. When
handlePartialDisplayContentUpdate
cannot compute a valid damaged range, it returned early through
ASSERT_NOT_REACHED()
and left the previous display content untouched. The caller then destroys
the
InlineDamage (m_lineDamage = { }), freeing the detached layout boxes while
the display
boxes still reference them; the next clearInlineContent() touches freed
memory.
Drop the previous display content on that fallback path (after collecting
its ink
overflow for repaint) so we never carry stale CheckedPtr<Layout::Box>
references past
the point their target is released. This hardens an ASSERT_NOT_REACHED()
branch and
does not change behavior on the fast path.
*
Source/WebCore/layout/integration/inline/LayoutIntegrationInlineContentBuilder.cpp:
(WebCore::LayoutIntegration::InlineContentBuilder::handlePartialDisplayContentUpdate
const):
*
LayoutTests/fast/block/inside-inlines/block-in-inline-partial-relayout-crash.html:
Added.
*
LayoutTests/fast/block/inside-inlines/block-in-inline-partial-relayout-crash-expected.txt:
Added.
Identifier: [email protected]
Canonical link: https://commits.webkit.org/305877.1135@webkitglib/2.52
Compare: https://github.com/WebKit/WebKit/compare/d3570975ba84...9e2b19d8e67b
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
