Bug 212693 - Read MediaPlayerPrivateMediaStreamAVFObjC::m_canEnqueueDisplayLayer after the lock
Summary: Read MediaPlayerPrivateMediaStreamAVFObjC::m_canEnqueueDisplayLayer after the...
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: WebRTC (show other bugs)
Version: WebKit Nightly Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: youenn fablet
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2020-06-03 06:46 PDT by youenn fablet
Modified: 2020-06-04 06:02 PDT (History)
8 users (show)

See Also:


Attachments
Patch (2.72 KB, patch)
2020-06-03 06:49 PDT, youenn fablet
no flags Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description youenn fablet 2020-06-03 06:46:21 PDT
Read MediaPlayerPrivateMediaStreamAVFObjC::m_canEnqueueDisplayLayer after the lock.
As spotted by Eric, there might be an edge case where m_canEnqueueDisplayLayer check would be bypassed:
- enqueueVideoSample is called in a background thread, checks m_canEnqueueDisplayLayer which is true and pauses just after the check.
- destroyLayers is called, which sets m_canEnqueueDisplayLayer to false.
- ensureLayers recreates the display layer which is then not yet initialized
- enqueueVideoSample continues and will try to enqueue the sample while m_canEnqueueDisplayLayer is false.
Comment 1 youenn fablet 2020-06-03 06:49:40 PDT
Created attachment 400915 [details]
Patch
Comment 2 EWS 2020-06-04 06:01:40 PDT
Committed r262532: <https://trac.webkit.org/changeset/262532>

All reviewed patches have been landed. Closing bug and clearing flags on attachment 400915 [details].
Comment 3 Radar WebKit Bug Importer 2020-06-04 06:02:17 PDT
<rdar://problem/63975063>