Attachment 438482 Details for Bug 230410 – Patch

[patch] Patch

bug-230410-20210917091813.patch (text/plain), 4.45 KB, created by Chris Dumez on 2021-09-17 09:18:14 PDT

(hide)

Description:

Filename:

MIME Type:

Creator: Chris Dumez

Created: 2021-09-17 09:18:14 PDT

Size: 4.45 KB

patch

obsolete

>Subversion Revision: 282616
>diff --git a/Source/WebKit/ChangeLog b/Source/WebKit/ChangeLog
>index 1ddffc58ed696526b6165dbb42c261b9f2611380..d3e24599ce1cc22a5242c0f2319de81f5d46c227 100644
>--- a/Source/WebKit/ChangeLog
>+++ b/Source/WebKit/ChangeLog
>@@ -1,3 +1,19 @@
>+2021-09-17  Chris Dumez  <cdumez@apple.com>
>+
>+        Crash under RemoteMediaPlayerManager::getSupportedTypes()
>+        https://bugs.webkit.org/show_bug.cgi?id=230410
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        The code would do a null dereference of m_supportedTypesCache if the IPC to the GPUProcess
>+        failed, which could happen in the event of the GPUProcess crash or jetsam.
>+
>+        * WebProcess/GPU/media/RemoteMediaPlayerMIMETypeCache.cpp:
>+        (WebKit::RemoteMediaPlayerMIMETypeCache::addSupportedTypes):
>+        (WebKit::RemoteMediaPlayerMIMETypeCache::isEmpty const):
>+        (WebKit::RemoteMediaPlayerMIMETypeCache::supportedTypes):
>+        * WebProcess/GPU/media/RemoteMediaPlayerMIMETypeCache.h:
>+
> 2021-09-16  Chris Dumez  <cdumez@apple.com>
> 
>         Stringify process termination reason in dispatchProcessDidTerminate logging
>diff --git a/Source/WebKit/WebProcess/GPU/media/RemoteMediaPlayerMIMETypeCache.cpp b/Source/WebKit/WebProcess/GPU/media/RemoteMediaPlayerMIMETypeCache.cpp
>index 438d1dbfb9f5f1f2ccbea7cd5d3b232749222b2b..ed236f8bea38d5c8b628514d54f22e7c545152a9 100644
>--- a/Source/WebKit/WebProcess/GPU/media/RemoteMediaPlayerMIMETypeCache.cpp
>+++ b/Source/WebKit/WebProcess/GPU/media/RemoteMediaPlayerMIMETypeCache.cpp
>@@ -28,6 +28,7 @@
> 
> #if ENABLE(GPU_PROCESS)
> 
>+#include "Logging.h"
> #include "RemoteMediaPlayerManager.h"
> #include "RemoteMediaPlayerManagerProxyMessages.h"
> #include <wtf/Vector.h>
>@@ -43,28 +44,26 @@ RemoteMediaPlayerMIMETypeCache::RemoteMediaPlayerMIMETypeCache(RemoteMediaPlayer
> 
> void RemoteMediaPlayerMIMETypeCache::addSupportedTypes(const Vector<String>& newTypes)
> {
>-    if (!m_supportedTypesCache)
>-        m_supportedTypesCache = HashSet<String, ASCIICaseInsensitiveHash> { };
>-
>-    for (auto& type : newTypes)
>-        m_supportedTypesCache->add(type);
>+    m_supportedTypesCache.add(newTypes.begin(), newTypes.end());
> }
> 
> bool RemoteMediaPlayerMIMETypeCache::isEmpty() const
> {
>-    return m_supportedTypesCache && m_supportedTypesCache->isEmpty();
>+    return m_hasPopulatedSupportedTypesCacheFromGPUProcess && m_supportedTypesCache.isEmpty();
> }
> 
> HashSet<String, ASCIICaseInsensitiveHash>& RemoteMediaPlayerMIMETypeCache::supportedTypes()
> {
>-    if (m_supportedTypesCache)
>-        return *m_supportedTypesCache;
>-
>-    Vector<String> types;
>-    if (m_manager.gpuProcessConnection().connection().sendSync(Messages::RemoteMediaPlayerManagerProxy::GetSupportedTypes(m_engineIdentifier), Messages::RemoteMediaPlayerManagerProxy::GetSupportedTypes::Reply(types), 0))
>-        addSupportedTypes(types);
>-
>-    return *m_supportedTypesCache;
>+    ASSERT(isMainRunLoop());
>+    if (!m_hasPopulatedSupportedTypesCacheFromGPUProcess) {
>+        Vector<String> types;
>+        if (m_manager.gpuProcessConnection().connection().sendSync(Messages::RemoteMediaPlayerManagerProxy::GetSupportedTypes(m_engineIdentifier), Messages::RemoteMediaPlayerManagerProxy::GetSupportedTypes::Reply(types), 0)) {
>+            addSupportedTypes(types);
>+            m_hasPopulatedSupportedTypesCacheFromGPUProcess = true;
>+        } else
>+            RELEASE_LOG_ERROR(Media, "RemoteMediaPlayerMIMETypeCache::supportedTypes: Sync IPC to the GPUProcess failed.");
>+    }
>+    return m_supportedTypesCache;
> }
> 
> MediaPlayerEnums::SupportsType RemoteMediaPlayerMIMETypeCache::supportsTypeAndCodecs(const MediaEngineSupportParameters& parameters)
>diff --git a/Source/WebKit/WebProcess/GPU/media/RemoteMediaPlayerMIMETypeCache.h b/Source/WebKit/WebProcess/GPU/media/RemoteMediaPlayerMIMETypeCache.h
>index bbcf9b40355df7fdc0e46fbe7cf785985fd79fa0..ab8fc0e933e634bf47a455fa98ff8ef185a36f95 100644
>--- a/Source/WebKit/WebProcess/GPU/media/RemoteMediaPlayerMIMETypeCache.h
>+++ b/Source/WebKit/WebProcess/GPU/media/RemoteMediaPlayerMIMETypeCache.h
>@@ -57,7 +57,8 @@ private:
> 
>     using SupportedTypesAndCodecsKey = std::tuple<String, bool, bool>;
>     std::optional<HashMap<SupportedTypesAndCodecsKey, WebCore::MediaPlayerEnums::SupportsType>> m_supportsTypeAndCodecsCache;
>-    std::optional<HashSet<String, ASCIICaseInsensitiveHash>> m_supportedTypesCache;
>+    HashSet<String, ASCIICaseInsensitiveHash> m_supportedTypesCache;
>+    bool m_hasPopulatedSupportedTypesCacheFromGPUProcess { false };
> };
> 
> } // namespace WebKit

Actions: View | Formatted Diff | Diff

Attachments on bug 230410: 438482 | 438483