Bug 219867 – [GPUProcess] Crash in SharedRingBufferStorage::setStorage() under GuardMalloc

• Component: WebAssembly
• Status: RESOLVED FIXED

[Chris Dumez]

Crash in SharedRingBufferStorage::setStorage() under GuardMalloc when running WebAudio tests:

Thread 0 Crashed:
0   com.apple.WebKit              	0x00000001108a36ee WebKit::SharedRingBufferStorage::setStorage(WTF::RefPtr<WebKit::SharedMemory, WTF::RawPtrTraits<WebKit::SharedMemory>, WTF::DefaultRefDerefTraits<WebKit::SharedMemory> >&&) + 206 (SharedRingBufferStorage.cpp:38)
1   com.apple.WebKit              	0x00000001108a3888 WebKit::SharedRingBufferStorage::deallocate() + 56 (SharedRingBufferStorage.cpp:59)
2   com.apple.WebCore             	0x0000000121d25a15 WebCore::CARingBuffer::deallocate() + 37 (CARingBuffer.cpp:89)
3   com.apple.WebCore             	0x0000000121d259bc WebCore::CARingBuffer::~CARingBuffer() + 28 (CARingBuffer.cpp:53)
4   com.apple.WebCore             	0x0000000121d25aa5 WebCore::CARingBuffer::~CARingBuffer() + 21 (CARingBuffer.cpp:52)
5   com.apple.WebCore             	0x000000011de61e2b std::__1::default_delete<WebCore::CARingBuffer>::operator()(WebCore::CARingBuffer*) const + 43 (memory:2368)
6   com.apple.WebCore             	0x000000011de61daf std::__1::unique_ptr<WebCore::CARingBuffer, std::__1::default_delete<WebCore::CARingBuffer> >::reset(WebCore::CARingBuffer*) + 95 (memory:2623)
7   com.apple.WebCore             	0x000000011de61d49 std::__1::unique_ptr<WebCore::CARingBuffer, std::__1::default_delete<WebCore::CARingBuffer> >::~unique_ptr() + 25 (memory:2577)
8   com.apple.WebCore             	0x000000011de5bf25 std::__1::unique_ptr<WebCore::CARingBuffer, std::__1::default_delete<WebCore::CARingBuffer> >::~unique_ptr() + 21 (memory:2577)
9   com.apple.WebCore             	0x000000011de5c18a WebCore::AudioSourceProviderAVFObjC::~AudioSourceProviderAVFObjC() + 330 (AudioSourceProviderAVFObjC.mm:95)
10  com.apple.WebCore             	0x000000011de5c495 WebCore::AudioSourceProviderAVFObjC::~AudioSourceProviderAVFObjC() + 21 (AudioSourceProviderAVFObjC.mm:87)
11  com.apple.WebCore             	0x000000011de5c4bc WebCore::AudioSourceProviderAVFObjC::~AudioSourceProviderAVFObjC() + 28 (AudioSourceProviderAVFObjC.mm:87)
12  com.apple.WebCore             	0x000000011de61744 WTF::ThreadSafeRefCounted<WebCore::AudioSourceProviderAVFObjC, (WTF::DestructionThread)0>::deref() const::'lambda'()::operator()() const + 52 (ThreadSafeRefCounted.h:117)
13  com.apple.WebCore             	0x000000011de616fd WTF::ThreadSafeRefCounted<WebCore::AudioSourceProviderAVFObjC, (WTF::DestructionThread)0>::deref() const + 61 (ThreadSafeRefCounted.h:135)
14  com.apple.WebCore             	0x000000011e2108a7 WTF::DefaultRefDerefTraits<WebCore::AudioSourceProviderAVFObjC>::derefIfNotNull(WebCore::AudioSourceProviderAVFObjC*) + 55 (RefPtr.h:42)
15  com.apple.WebCore             	0x000000011e210869 WTF::RefPtr<WebCore::AudioSourceProviderAVFObjC, WTF::RawPtrTraits<WebCore::AudioSourceProviderAVFObjC>, WTF::DefaultRefDerefTraits<WebCore::AudioSourceProviderAVFObjC> >::~RefPtr() + 41 (RefPtr.h:73)
16  com.apple.WebCore             	0x000000011e1e9015 WTF::RefPtr<WebCore::AudioSourceProviderAVFObjC, WTF::RawPtrTraits<WebCore::AudioSourceProviderAVFObjC>, WTF::DefaultRefDerefTraits<WebCore::AudioSourceProviderAVFObjC> >::~RefPtr() + 21 (RefPtr.h:73)
17  com.apple.WebCore             	0x000000011e1e95eb WebCore::MediaPlayerPrivateAVFoundationObjC::~MediaPlayerPrivateAVFoundationObjC() + 1307 (MediaPlayerPrivateAVFoundationObjC.mm:457)
18  com.apple.WebCore             	0x000000011e1ea925 WebCore::MediaPlayerPrivateAVFoundationObjC::~MediaPlayerPrivateAVFoundationObjC() + 21 (MediaPlayerPrivateAVFoundationObjC.mm:443)
19  com.apple.WebCore             	0x000000011e1ea98c WebCore::MediaPlayerPrivateAVFoundationObjC::~MediaPlayerPrivateAVFoundationObjC() + 28 (MediaPlayerPrivateAVFoundationObjC.mm:443)
20  com.apple.WebCore             	0x0000000121e5eebf std::__1::default_delete<WebCore::MediaPlayerPrivateInterface>::operator()(WebCore::MediaPlayerPrivateInterface*) const + 47 (memory:2368)
21  com.apple.WebCore             	0x0000000121e5ee3f std::__1::unique_ptr<WebCore::MediaPlayerPrivateInterface, std::__1::default_delete<WebCore::MediaPlayerPrivateInterface> >::reset(WebCore::MediaPlayerPrivateInterface*) + 95 (memory:2623)
22  com.apple.WebCore             	0x0000000121e5edd9 std::__1::unique_ptr<WebCore::MediaPlayerPrivateInterface, std::__1::default_delete<WebCore::MediaPlayerPrivateInterface> >::~unique_ptr() + 25 (memory:2577)
23  com.apple.WebCore             	0x0000000121e432a5 std::__1::unique_ptr<WebCore::MediaPlayerPrivateInterface, std::__1::default_delete<WebCore::MediaPlayerPrivateInterface> >::~unique_ptr() + 21 (memory:2577)
24  com.apple.WebCore             	0x0000000121e43261 WebCore::MediaPlayer::~MediaPlayer() + 241 (MediaPlayer.cpp:424)
25  com.apple.WebCore             	0x0000000121e432e5 WebCore::MediaPlayer::~MediaPlayer() + 21 (MediaPlayer.cpp:422)
26  com.apple.WebCore             	0x0000000121e4330c WebCore::MediaPlayer::~MediaPlayer() + 28 (MediaPlayer.cpp:422)
27  com.apple.WebKit              	0x00000001101db91f std::__1::default_delete<WebCore::MediaPlayer>::operator()(WebCore::MediaPlayer*) const + 47 (memory:2368)
28  com.apple.WebKit              	0x00000001101db8e2 WTF::RefCounted<WebCore::MediaPlayer, std::__1::default_delete<WebCore::MediaPlayer> >::deref() const + 66 (RefCounted.h:190)
29  com.apple.WebKit              	0x00000001101db867 WTF::DefaultRefDerefTraits<WebCore::MediaPlayer>::derefIfNotNull(WebCore::MediaPlayer*) + 55 (RefPtr.h:42)
30  com.apple.WebKit              	0x00000001101db829 WTF::RefPtr<WebCore::MediaPlayer, WTF::RawPtrTraits<WebCore::MediaPlayer>, WTF::DefaultRefDerefTraits<WebCore::MediaPlayer> >::~RefPtr() + 41 (RefPtr.h:73)
31  com.apple.WebKit              	0x00000001101b4d75 WTF::RefPtr<WebCore::MediaPlayer, WTF::RawPtrTraits<WebCore::MediaPlayer>, WTF::DefaultRefDerefTraits<WebCore::MediaPlayer> >::~RefPtr() + 21 (RefPtr.h:73)
32  com.apple.WebKit              	0x0000000110239a53 WebKit::RemoteMediaPlayerProxy::~RemoteMediaPlayerProxy() + 307 (RemoteMediaPlayerProxy.cpp:93)

[Chris Dumez]

Created attachment 416183 [details]
Patch

[Chris Dumez]

Created attachment 416185 [details]
Patch

[Darin Adler]

Comment on attachment 416185 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=416185&action=review

> Source/WebKit/GPUProcess/media/RemoteAudioSourceProviderProxy.cpp:64
> +    auto ringBuffer = makeUniqueRef<CARingBuffer>(makeUniqueRef<SharedRingBufferStorage>([this, protectedThis = makeRef(*this)](SharedMemory* memory) mutable {
> +        storageChanged(memory);
> +    }));

I might have written:

    protectedThis->storageChanged(memory);

And then not captured "this".

[Chris Dumez]

Created attachment 416186 [details]
Patch

[Chris Dumez]

(In reply to Darin Adler from comment #3)
> Comment on attachment 416185 [details]
> Patch
> 
> View in context:
> https://bugs.webkit.org/attachment.cgi?id=416185&action=review
> 
> > Source/WebKit/GPUProcess/media/RemoteAudioSourceProviderProxy.cpp:64
> > +    auto ringBuffer = makeUniqueRef<CARingBuffer>(makeUniqueRef<SharedRingBufferStorage>([this, protectedThis = makeRef(*this)](SharedMemory* memory) mutable {
> > +        storageChanged(memory);
> > +    }));
> 
> I might have written:
> 
>     protectedThis->storageChanged(memory);
> 
> And then not captured "this".

Done.

[Peng Liu]

Comment on attachment 416186 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=416186&action=review

> Source/WebKit/ChangeLog:15
> +        of the CARingBuffer is not tried to the lifetime of RemoteAudioSourceProviderProxy.

Nit.
s/tried/tied/

[Chris Dumez]

Created attachment 416190 [details]
Patch

[EWS]

Committed r270804: <https://trac.webkit.org/changeset/270804>

All reviewed patches have been landed. Closing bug and clearing flags on attachment 416190 [details].

[Radar WebKit Bug Importer]

<rdar://problem/72313619>