136492 2014-09-03 12:08:17 -0700 [Win] Potential overrelease of AVCFURLAssetRef 2014-09-03 12:22:31 -0700 1 1 1 Unclassified WebKit Media 528+ (Nightly build) PC All RESOLVED FIXED InRadar P2 Major --- 1 bfulgham bfulgham bfulgham commit-queue eric.carlson glenn jer.noble philipj sergio webkit-bug-importer oldest_to_newest 1032965 0 bfulgham 2014-09-03 12:08:17 -0700 Very rarely, the AVCFURLAssetRef associated with a media element can change from its original state. When this happens, we adopt the new AVCFURLAssetRef without incrementing its retain count. Later, when the AVFWrapper is destroyed it calls Release on this item causing a double-release. 1032966 1 bfulgham 2014-09-03 12:08:47 -0700 <rdar://problem/18206746> 1032968 2 237568 bfulgham 2014-09-03 12:16:46 -0700 Created attachment 237568 Patch 1032971 3 bfulgham 2014-09-03 12:22:31 -0700 Committed r173216: <http://trac.webkit.org/changeset/173216> 237568 2014-09-03 12:16:46 -0700 2014-09-03 12:19:12 -0700 Patch bug-136492-20140903121748.patch text/plain 1600 bfulgham SW5kZXg6IFNvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2Vi Q29yZS9DaGFuZ2VMb2cJKHJldmlzaW9uIDE3MzIxNCkKKysrIFNvdXJjZS9XZWJDb3JlL0NoYW5n ZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE5IEBACisyMDE0LTA5LTAzICBCcmVudCBG dWxnaGFtICA8YmZ1bGdoYW1AYXBwbGUuY29tPgorCisgICAgICAgIFtXaW5dIFByZXZlbnQgZG91 YmxlLXJlbGVhc2Ugb24gQVZDRlVSTEFzc2V0UmVmCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJr aXQub3JnL3Nob3dfYnVnLmNnaT9pZD0xMzY0OTIKKyAgICAgICAgPHJkYXI6Ly9wcm9ibGVtLzE4 MjA2NzQ2PgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAg IFRoZSBBVkZXcmFwcGVyOjpzZXRBc3NldCBtZXRob2QgbmVlZHMgdG8gcmV0YWluIHRoZSBwYXNz ZWQgYXJndW1lbnQsIHNpbmNlIGl0CisgICAgICAgIG9yaWdpbmF0ZXMgZnJvbSBBVkNGUGxheWVy SXRlbUdldEFzc2V0LCB3aGljaCBkb2VzIG5vdCBpbmNyZW1lbnQgdGhlCisgICAgICAgIHJlZmVy ZW5jZSBjb3VudCBvZiBpdHMgcmV0dXJuIHZhbHVlIGFzIGV4cGVjdGVkIGJ5IENvY29hIEdldC9D cmVhdGUvQ29weQorICAgICAgICBzZW1hbnRpY3MuCisKKyAgICAgICAgKiBwbGF0Zm9ybS9ncmFw aGljcy9hdmZvdW5kYXRpb24vY2YvTWVkaWFQbGF5ZXJQcml2YXRlQVZGb3VuZGF0aW9uQ0YuY3Bw OgorICAgICAgICAoV2ViQ29yZTo6QVZGV3JhcHBlcjo6c2V0QXNzZXQpOiBSZXRhaW4gdGhlIHBh c3NlZCBhcmd1bWVudC4KKwogMjAxNC0wOS0wMyAgSm9zZXBoIFBlY29yYXJvICA8cGVjb3Jhcm9A YXBwbGUuY29tPgogCiAgICAgICAgIFVzZSBTdHJpbmdCdWlsZGVyIGFwcGVuZChjaGFyKSBhbmQg YXBwZW5kTGl0ZXJhbCBpbiBtb3JlIHBsYWNlcwpJbmRleDogU291cmNlL1dlYkNvcmUvcGxhdGZv cm0vZ3JhcGhpY3MvYXZmb3VuZGF0aW9uL2NmL01lZGlhUGxheWVyUHJpdmF0ZUFWRm91bmRhdGlv bkNGLmNwcAo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2ViQ29yZS9wbGF0Zm9ybS9ncmFwaGljcy9h dmZvdW5kYXRpb24vY2YvTWVkaWFQbGF5ZXJQcml2YXRlQVZGb3VuZGF0aW9uQ0YuY3BwCShyZXZp c2lvbiAxNzMyMDYpCisrKyBTb3VyY2UvV2ViQ29yZS9wbGF0Zm9ybS9ncmFwaGljcy9hdmZvdW5k YXRpb24vY2YvTWVkaWFQbGF5ZXJQcml2YXRlQVZGb3VuZGF0aW9uQ0YuY3BwCSh3b3JraW5nIGNv cHkpCkBAIC0xODU0LDcgKzE4NTQsNyBAQCB2b2lkIEFWRldyYXBwZXI6OnNldEFzc2V0KEFWQ0ZV UkxBc3NldFJlCiAgICAgICAgIHJldHVybjsKIAogICAgIEFWQ0ZBc3NldENhbmNlbExvYWRpbmco YXZBc3NldCgpKTsKLSAgICBtX2F2QXNzZXQgPSBhZG9wdENGKGFzc2V0KTsKKyAgICBtX2F2QXNz ZXQgPSBhc3NldDsKIH0KIAogUGxhdGZvcm1MYXllciogQVZGV3JhcHBlcjo6cGxhdGZvcm1MYXll cigpCg==