fast/dom/Window/property-access-on-cached-window-after-frame-removed.html may crash if the MediaSession is constructed when we have no page. This is an intermittent failure. Reason being: we only construct the MediaSessionCoordinator when a Page exists, and MediaSession::coordinator() returns a reference which would attempt to dereference a null pointer.
<rdar://problem/78846264>
Created attachment 430531 [details] Patch
Created attachment 430534 [details] Patch
Committed r278448 (238468@main): <https://commits.webkit.org/238468@main> All reviewed patches have been landed. Closing bug and clearing flags on attachment 430534 [details].
Comment on attachment 430534 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=430534&action=review > Source/WebCore/Modules/mediasession/MediaSessionCoordinator.h:52 > + WEBCORE_EXPORT static Ref<MediaSessionCoordinator> create(ScriptExecutionContext*); Since we were changing this, it might have been good to make this take a reference instead of a pointer too. Next time, I guess. > Source/WebCore/Modules/mediasession/MediaSessionCoordinator.h:76 > + MediaSessionCoordinator(ScriptExecutionContext*); In a situation like this I suggest we add "explicit" now that the constructor has only a single argument. In practice it’s not critical since this is private anyway, and doing a conversion by accident is unlikely.
Comment on attachment 430534 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=430534&action=review >> Source/WebCore/Modules/mediasession/MediaSessionCoordinator.h:76 >> + MediaSessionCoordinator(ScriptExecutionContext*); > > In a situation like this I suggest we add "explicit" now that the constructor has only a single argument. In practice it’s not critical since this is private anyway, and doing a conversion by accident is unlikely. This is an oversight, I should have done so. We should have a static analyser enforcing the rule that single argument constructor must be made explicit.