Bug 315849 – [EME] Crash pruning a back/forward-cached page that owns an open MediaKeySession

• Status: RESOLVED
• Resolution: FIXED
• Component: Media

[Simon Pena]

WebProcess crash (debug/asserts build) when a back/forward-cached page that still owns an open MediaKeySession is pruned instead of restored:

  ASSERTION FAILED: !activeDOMObjectsAreSuspended() || scriptExecutionContext()->eventLoop().isSuspended()
  Source/WebCore/bindings/js/JSDOMPromiseDeferred.cpp(86) : void WebCore::DeferredPromise::callFunction(...)

    WebCore::DeferredPromise::callFunction(...)
    WebCore::DeferredPromise::resolve()
    WebCore::DOMPromiseProxy<WebCore::IDLUndefined>::resolve()
    WebCore::MediaKeySession::sessionClosed()
    WebCore::MediaKeySession::stop()
    WebCore::ScriptExecutionContext::stopActiveDOMObjects()
    WebCore::Document::commonTeardown()
    WebCore::CachedFrame::destroy()
    WebCore::CachedPage::~CachedPage()
    WebCore::BackForwardCache::prune(WebCore::PruningReason)

Steps: open a MediaKeySession and observe session.closed, navigate away so the page enters the back/forward cache, then prune the cache (e.g. under memory pressure) instead of restoring. In release builds the closed-promise resolution is silently dropped instead.

[Simon Pena]

Pull request: https://github.com/WebKit/WebKit/pull/66027

[EWS]

Committed 314352@main (b09929827ab5): <https://commits.webkit.org/314352@main>

Reviewed commits have been landed. Closing PR #66027 and removing active labels.

[Radar WebKit Bug Importer]

<rdar://problem/178505550>