[webkit-changes] [WebKit/WebKit] e8ba01: [visionOS] Crash in com.apple.WebKit.GPU at AVFCor...

[Jean-Yves Avenard]

  Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: e8ba0143ef25ddeca6162f0e76fa499f6f84fe09
      https://github.com/WebKit/WebKit/commit/e8ba0143ef25ddeca6162f0e76fa499f6f84fe09
  Author: Jean-Yves Avenard <jya at apple.com>
  Date:   2025-02-25 (Tue, 25 Feb 2025)

  Changed paths:
    M Source/WebCore/SaferCPPExpectations/UncountedCallArgsCheckerExpectations
    M Source/WebCore/platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaSourceAVFObjC.mm
    M Source/WebCore/platform/graphics/cocoa/VideoMediaSampleRenderer.h
    M Source/WebCore/platform/graphics/cocoa/VideoMediaSampleRenderer.mm

  Log Message:
  -----------
  [visionOS] Crash in com.apple.WebKit.GPU at AVFCore:  -[AVSampleBufferVideoRenderer enqueueSampleBuffer:]
https://bugs.webkit.org/show_bug.cgi?id=288234
rdar://145047791

Reviewed by Andy Estes.

It was possible that we would enqueue a frame to the AVSampleBufferRenderer
after all its video targets had been removed, causing it to throw.

We move the removal of the video targets to the `VideoMediaSampleRenderer`
destructor to reduce the potential number of concurrent access to the
AVSampleBufferRenderer.
Additionally, we endure that the TimerDispatchSource has been cancelled
first to further guarantee that no frames can be enqueued on a shutting down
AVSampleBufferRender.

Fly-By: It was possible for the VideoMediaSampleRenderer::m_decompressionSession
member to be cleared without thread synchronisation. We now ensure that the
read operation is guarded by a lock. It practice it doesn't make a difference
as the m_decompressionSession was only ever cleared in the destructor.

* Source/WebCore/SaferCPPExpectations/UncountedCallArgsCheckerExpectations:
* Source/WebCore/platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaSourceAVFObjC.mm:
(WebCore::MediaPlayerPrivateMediaSourceAVFObjC::destroyVideoRenderer):
* Source/WebCore/platform/graphics/cocoa/VideoMediaSampleRenderer.h: Make class final as destructor isn't virtual.
(WebCore::VideoMediaSampleRenderer::create): Deleted.
(WebCore::VideoMediaSampleRenderer::prefersDecompressionSession const): Deleted.
(WebCore::VideoMediaSampleRenderer::as const): Deleted.
(WebCore::VideoMediaSampleRenderer::WTF_GUARDED_BY_CAPABILITY): Deleted.
* Source/WebCore/platform/graphics/cocoa/VideoMediaSampleRenderer.mm:
(WebCore::VideoMediaSampleRenderer::~VideoMediaSampleRenderer):
(WebCore::VideoMediaSampleRenderer::decompressionSession const):
(WebCore::VideoMediaSampleRenderer::stopRequestingMediaData):
(WebCore::VideoMediaSampleRenderer::prefersDecompressionSession const):
(WebCore::VideoMediaSampleRenderer::setPrefersDecompressionSession):
(WebCore::VideoMediaSampleRenderer::enqueueSample):
(WebCore::VideoMediaSampleRenderer::decodeNextSample):
(WebCore::VideoMediaSampleRenderer::initializeDecompressionSession):
(WebCore::VideoMediaSampleRenderer::purgeDecodedSampleQueueAndDisplay):
(WebCore::VideoMediaSampleRenderer::flush):
(WebCore::VideoMediaSampleRenderer::resetReadyForMoreSample):
(WebCore::VideoMediaSampleRenderer::expectMinimumUpcomingSampleBufferPresentationTime):
(WebCore::VideoMediaSampleRenderer::resetUpcomingSampleBufferPresentationTimeExpectations):
(WebCore::VideoMediaSampleRenderer::copyDisplayedPixelBuffer):
(WebCore::VideoMediaSampleRenderer::totalVideoFrames const):
(WebCore::VideoMediaSampleRenderer::droppedVideoFrames const):
(WebCore::VideoMediaSampleRenderer::corruptedVideoFrames const):
(WebCore::VideoMediaSampleRenderer::totalFrameDelay const):
(WebCore::VideoMediaSampleRenderer::isUsingDecompressionSession const): Deleted.

Canonical link: https://commits.webkit.org/291046@main



To unsubscribe from these emails, change your notification settings at https://github.com/WebKit/WebKit/settings/notifications