[webkit-changes] [WebKit/WebKit] 078f63: [Cocoa] Crash in VideoFullscreenModelContext::remo...

[aestes]

  Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: 078f6383edca4bfd40395d3dd2c49504908fb4ff
      https://github.com/WebKit/WebKit/commit/078f6383edca4bfd40395d3dd2c49504908fb4ff
  Author: Andy Estes <aestes at apple.com>
  Date:   2023-06-14 (Wed, 14 Jun 2023)

  Changed paths:
    M Source/WebCore/platform/cocoa/WebAVPlayerLayer.mm
    M Source/WebKit/UIProcess/Cocoa/VideoFullscreenManagerProxy.mm

  Log Message:
  -----------
  [Cocoa] Crash in VideoFullscreenModelContext::removeClient
https://bugs.webkit.org/show_bug.cgi?id=258098
rdar://110390000

Reviewed by Jer Noble.

When VideoFullscreenModelContext's destructor is called it releases its reference to a
WebAVPlayerLayer. If that was the last reference then -[WebAVPlayerLayer dealloc] is called, which
calls back to VideoFullscreenModelContext::removeClient via a WeakPtr that is still valid because
VideoFullscreenModelContext's superclass destructors have not yet been called. However,
VideoFullscreenModelContext::m_client *has* already been destroyed, leading to a crash.

Fixed by explicitly setting WebAVPlayerLayer's fullscreenModel to nullptr in
VideoFullscreenManagerProxy::invalidate.

* Source/WebCore/platform/cocoa/WebAVPlayerLayer.mm:
(-[WebAVPlayerLayer setFullscreenModel:]):
* Source/WebKit/UIProcess/Cocoa/VideoFullscreenManagerProxy.mm:
(WebKit::VideoFullscreenManagerProxy::invalidate):

Canonical link: https://commits.webkit.org/265182@main