commit 43b018be2c2e5a350ac3382edcbf9a734765e9a8
author cdumez@apple.com <cdumez@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc> Sat Jul 13 11:07:41 2019 +0000
committer cdumez@apple.com <cdumez@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc> Sat Jul 13 11:07:41 2019 +0000
tree 3263dbf3f0622a56b0434d428f03775730dca6ee
parent d6ceefd38b1d3100caa6d2a8c6c8c1e1e675148b

Fix non thread-safe usage of makeWeakPtr() in MediaPlayerPrivateAVFoundation
https://bugs.webkit.org/show_bug.cgi?id=199777

Reviewed by Eric Carlson.

The code was calling makeWeakPtr() on a main-thread object, from a background thread.
This is not thread safe. To address the issue, this patches creates the WeakPtr ahead
of time, on the main thread.

* platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.cpp:
(WebCore::MediaPlayerPrivateAVFoundation::MediaPlayerPrivateAVFoundation):
(WebCore::MediaPlayerPrivateAVFoundation::scheduleMainThreadNotification):
(WebCore::MediaPlayerPrivateAVFoundation::dispatchNotification):
* platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.h:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@247415 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Source/WebCore/ChangeLog

diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
index 15d693c..ea154d6 100644
--- a/Source/WebCore/ChangeLog
+++ b/Source/WebCore/ChangeLog
@@ -1,3 +1,20 @@
+2019-07-13  Chris Dumez  <cdumez@apple.com>
+
+        Fix non thread-safe usage of makeWeakPtr() in MediaPlayerPrivateAVFoundation
+        https://bugs.webkit.org/show_bug.cgi?id=199777
+
+        Reviewed by Eric Carlson.
+
+        The code was calling makeWeakPtr() on a main-thread object, from a background thread.
+        This is not thread safe. To address the issue, this patches creates the WeakPtr ahead
+        of time, on the main thread.
+
+        * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.cpp:
+        (WebCore::MediaPlayerPrivateAVFoundation::MediaPlayerPrivateAVFoundation):
+        (WebCore::MediaPlayerPrivateAVFoundation::scheduleMainThreadNotification):
+        (WebCore::MediaPlayerPrivateAVFoundation::dispatchNotification):
+        * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.h:
+
 2019-07-12  Thibault Saunier  <tsaunier@igalia.com>
 
         [GStreamer] Mock GStreamer realtime sources should keep a Ref of their mock realtime media sources

Source/WebCore/platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.cpp

diff --git a/Source/WebCore/platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.cpp b/Source/WebCore/platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.cpp
index 2898df8..857f31f 100644
--- a/Source/WebCore/platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.cpp
+++ b/Source/WebCore/platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.cpp
@@ -55,7 +55,8 @@
 namespace WebCore {
 
 MediaPlayerPrivateAVFoundation::MediaPlayerPrivateAVFoundation(MediaPlayer* player)
-    : m_player(player)
+    : m_weakThis(makeWeakPtr(*this))
+    , m_player(player)
     , m_queuedNotifications()
     , m_queueMutex()
     , m_networkState(MediaPlayer::Empty)
@@ -774,7 +775,7 @@
     if (delayDispatch && !m_mainThreadCallPending) {
         m_mainThreadCallPending = true;
 
-        callOnMainThread([weakThis = makeWeakPtr(*this)] {
+        callOnMainThread([weakThis = m_weakThis] {
             if (!weakThis)
                 return;
 
@@ -807,7 +808,7 @@
         }
         
         if (!m_queuedNotifications.isEmpty() && !m_mainThreadCallPending) {
-            callOnMainThread([weakThis = makeWeakPtr(*this)] {
+            callOnMainThread([weakThis = m_weakThis] {
                 if (!weakThis)
                     return;
 

Source/WebCore/platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.h

diff --git a/Source/WebCore/platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.h b/Source/WebCore/platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.h
index 51a29bd..a61e5b9 100644
--- a/Source/WebCore/platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.h
+++ b/Source/WebCore/platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.h
@@ -327,6 +327,7 @@
     const URL& resolvedURL() const { return m_resolvedURL; }
 
 private:
+    WeakPtr<MediaPlayerPrivateAVFoundation> m_weakThis;
     MediaPlayer* m_player;
 
     WTF::Function<void()> m_pendingSeek;