Bug 272486 – REGRESSION (276827@main): BitmapImageSource may outlive its creator BitmapImage

• Component: Images
• Status: RESOLVED FIXED

[Said Abou-Hallawa]

If the image is decoded asynchronously the BitmapImageSource will be protected by the ImageDecoder thread in ImageFrameWorkQueue::start(). But this does not protect the creator of the BitmapImageSource which is BitmapImage. This means the BitmapImage might be freed on the main thread while the ImageFrameWorkQueue is still decoding an image frame and holding a valid BitmapImageSource.

When an image frame finishes decoding, the decoding thread calls BitmapImageSource::imageFrameDecodeAtIndexHasFinished(). In this function the BitmapImage is used to notify the ImageObserver about the decoded frame.

The problem is BitmapImageSource holds a raw reference to the BitmapImage which may have been freed before it is used. Currently there is no way for BitmapImageSource to know that.

Before 276827@main, ImageSource used to hold a raw pointer BitmapImage and it had function to clear this pointer which is called from the destructor of BitmapImage. Moreover ImageSource methods used to check the nullability of this pointer before it is used.

[Said Abou-Hallawa]

rdar://126113651

[Said Abou-Hallawa]

Pull request: https://github.com/apple/WebKit/pull/1193

[Said Abou-Hallawa]

Pull request: https://github.com/WebKit/WebKit/pull/27121

[EWS]

Committed 277375@main (4a9fc932842d): <https://commits.webkit.org/277375@main>

Reviewed commits have been landed. Closing PR #27121 and removing active labels.