Bug 209950 - WebCore::HTMLMediaElement::mediaCanStart crashes
Summary: WebCore::HTMLMediaElement::mediaCanStart crashes
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: Media (show other bugs)
Version: WebKit Nightly Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Peng Liu
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2020-04-02 20:14 PDT by Peng Liu
Modified: 2020-04-03 00:21 PDT (History)
12 users (show)

See Also:


Attachments
Patch (4.99 KB, patch)
2020-04-02 21:10 PDT, Peng Liu
jer.noble: review+
Details | Formatted Diff | Diff
Patch for landing (replace computeSize() with computesEmpty()) (4.98 KB, patch)
2020-04-02 22:29 PDT, Peng Liu
no flags Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Peng Liu 2020-04-02 20:14:24 PDT
WebCore::HTMLMediaElement::mediaCanStart crashes
Comment 1 Peng Liu 2020-04-02 20:22:34 PDT
<rdar://problem/49677331>
Comment 2 Peng Liu 2020-04-02 21:10:29 PDT
Created attachment 395343 [details]
Patch
Comment 3 Jer Noble 2020-04-02 21:25:21 PDT
Comment on attachment 395343 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=395343&action=review

r=me, with nits.

> Source/WebCore/dom/Document.cpp:6426
>  void Document::addMediaCanStartListener(MediaCanStartListener& listener)
>  {
> -    ASSERT(!m_mediaCanStartListeners.contains(&listener));
> -    m_mediaCanStartListeners.add(&listener);
> +    ASSERT(!m_mediaCanStartListeners.contains(listener));
> +    m_mediaCanStartListeners.add(listener);

The way I'd do this would be:

void Document::addMediaCanStartListener(WeakPtr<MediaCanStartListener>&& listener)
{
    ASSERT(!m_mediaCanStartListeners.contains(listener));
    m_mediaCanStartListeners.add(WTFMove(listener));
}

This way, MediaCanStartListener doesn't need to directly inherit from CanMakeWeakPtr.

> Source/WebCore/dom/Document.cpp:6437
> +    if (!m_mediaCanStartListeners.computeSize())

I think this could be: `if (m_mediaCanStartListeners.computeEmpty())`.

> Source/WebKit/WebProcess/MediaStream/UserMediaPermissionRequestManager.h:37
> -class UserMediaPermissionRequestManager : public CanMakeWeakPtr<UserMediaPermissionRequestManager>, private WebCore::MediaCanStartListener {
> +class UserMediaPermissionRequestManager : private WebCore::MediaCanStartListener {

Then this could get reverted. 

It would mean all the call sites to addMediaCanStartListener() would have to change, though.
Comment 4 Peng Liu 2020-04-02 21:54:25 PDT
Comment on attachment 395343 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=395343&action=review

>> Source/WebCore/dom/Document.cpp:6426
>> +    m_mediaCanStartListeners.add(listener);
> 
> The way I'd do this would be:
> 
> void Document::addMediaCanStartListener(WeakPtr<MediaCanStartListener>&& listener)
> {
>     ASSERT(!m_mediaCanStartListeners.contains(listener));
>     m_mediaCanStartListeners.add(WTFMove(listener));
> }
> 
> This way, MediaCanStartListener doesn't need to directly inherit from CanMakeWeakPtr.

That's a good idea! Unfortunately it requires us to add WeakHashSet::add(WeakPtr<U>&& value) to the current implementation.

>> Source/WebCore/dom/Document.cpp:6437
>> +    if (!m_mediaCanStartListeners.computeSize())
> 
> I think this could be: `if (m_mediaCanStartListeners.computeEmpty())`.

Yes, that will work. I chose to use computeSize() because it will clean up nullptrs.

>> Source/WebKit/WebProcess/MediaStream/UserMediaPermissionRequestManager.h:37
>> +class UserMediaPermissionRequestManager : private WebCore::MediaCanStartListener {
> 
> Then this could get reverted. 
> 
> It would mean all the call sites to addMediaCanStartListener() would have to change, though.

Maybe we can do it later after extending WeakHashSet.
Comment 5 Peng Liu 2020-04-02 22:29:36 PDT
Created attachment 395349 [details]
Patch for landing (replace computeSize() with computesEmpty())
Comment 6 EWS 2020-04-03 00:21:09 PDT
Committed r259447: <https://trac.webkit.org/changeset/259447>

All reviewed patches have been landed. Closing bug and clearing flags on attachment 395349 [details].