Bug 226612 - fast/dom/Window/property-access-on-cached-window-after-frame-removed.html (layout-test) may crash
Summary: fast/dom/Window/property-access-on-cached-window-after-frame-removed.html (la...
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: Media (show other bugs)
Version: WebKit Nightly Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Jean-Yves Avenard [:jya]
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2021-06-03 17:40 PDT by Jean-Yves Avenard [:jya]
Modified: 2021-06-04 16:13 PDT (History)
8 users (show)

See Also:


Attachments
Patch (8.41 KB, patch)
2021-06-03 18:58 PDT, Jean-Yves Avenard [:jya]
no flags Details | Formatted Diff | Diff
Patch (8.45 KB, patch)
2021-06-03 20:06 PDT, Jean-Yves Avenard [:jya]
no flags Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Jean-Yves Avenard [:jya] 2021-06-03 17:40:23 PDT
fast/dom/Window/property-access-on-cached-window-after-frame-removed.html may crash if the MediaSession is constructed when we have no page.

This is an intermittent failure.

Reason being: we only construct the MediaSessionCoordinator when a Page exists, and MediaSession::coordinator() returns a reference which would attempt to dereference a null pointer.
Comment 1 Radar WebKit Bug Importer 2021-06-03 17:41:16 PDT
<rdar://problem/78846264>
Comment 2 Jean-Yves Avenard [:jya] 2021-06-03 18:58:53 PDT
Created attachment 430531 [details]
Patch
Comment 3 Jean-Yves Avenard [:jya] 2021-06-03 20:06:25 PDT
Created attachment 430534 [details]
Patch
Comment 4 EWS 2021-06-03 21:16:48 PDT
Committed r278448 (238468@main): <https://commits.webkit.org/238468@main>

All reviewed patches have been landed. Closing bug and clearing flags on attachment 430534 [details].
Comment 5 Darin Adler 2021-06-04 13:16:38 PDT
Comment on attachment 430534 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=430534&action=review

> Source/WebCore/Modules/mediasession/MediaSessionCoordinator.h:52
> +    WEBCORE_EXPORT static Ref<MediaSessionCoordinator> create(ScriptExecutionContext*);

Since we were changing this, it might have been good to make this take a reference instead of a pointer too. Next time, I guess.

> Source/WebCore/Modules/mediasession/MediaSessionCoordinator.h:76
> +    MediaSessionCoordinator(ScriptExecutionContext*);

In a situation like this I suggest we add "explicit" now that the constructor has only a single argument. In practice it’s not critical since this is private anyway, and doing a conversion by accident is unlikely.
Comment 6 Jean-Yves Avenard [:jya] 2021-06-04 16:13:30 PDT
Comment on attachment 430534 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=430534&action=review

>> Source/WebCore/Modules/mediasession/MediaSessionCoordinator.h:76
>> +    MediaSessionCoordinator(ScriptExecutionContext*);
> 
> In a situation like this I suggest we add "explicit" now that the constructor has only a single argument. In practice it’s not critical since this is private anyway, and doing a conversion by accident is unlikely.

This is an oversight, I should have done so.
We should have a static analyser enforcing the rule that single argument constructor must be made explicit.