Bug 123343 - UserMediaRequest use-after-free
Summary: UserMediaRequest use-after-free
Status: RESOLVED INVALID
Alias: None
Product: WebKit
Classification: Unclassified
Component: WebCore Misc. (show other bugs)
Version: 528+ (Nightly build)
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Nobody
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2013-10-25 08:08 PDT by Philippe Normand
Modified: 2013-10-28 10:13 PDT (History)
2 users (show)

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Philippe Normand 2013-10-25 08:08:14 PDT
The request created in NavigatorMediaStream::webkitGetUserMedia() is freed too early. I wonder if we should make it a unique_ptr.
Comment 1 Philippe Normand 2013-10-28 08:25:04 PDT
Eric and Thiago, have you seen this issue as well?

The life cycle of the request is not very clear to me.
Comment 2 Philippe Normand 2013-10-28 10:13:17 PDT
Turns out this can be fixed by storing the requests correctly as RefPtrs (not raw pointers) in the UserMediaRequestManager (implemented in bug 123158).

Thanks Eric for the help and advice :)