[Webkit-unassigned] [Bug 272486] New: REGRESSION (276827 at main): BitmapImageSource may outlive its creator BitmapImage

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=272486

            Bug ID: 272486
           Summary: REGRESSION (276827 at main): BitmapImageSource may
                    outlive its creator BitmapImage
           Product: WebKit
           Version: WebKit Nightly Build
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: Images
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: sabouhallawa at apple.com
                CC: sabouhallawa at apple.com

If the image is decoded asynchronously the BitmapImageSource will be protected by the ImageDecoder thread in ImageFrameWorkQueue::start(). But this does not protect the creator of the BitmapImageSource which is BitmapImage. This means the BitmapImage might be freed on the main thread while the ImageFrameWorkQueue is still decoding an image frame and holding a valid BitmapImageSource.

When an image frame finishes decoding, the decoding thread calls BitmapImageSource::imageFrameDecodeAtIndexHasFinished(). In this function the BitmapImage is used to notify the ImageObserver about the decoded frame.

The problem is BitmapImageSource holds a raw reference to the BitmapImage which may have been freed before it is used. Currently there is no way for BitmapImageSource to know that.

Before 276827 at main, ImageSource used to hold a raw pointer BitmapImage and it had function to clear this pointer which is called from the destructor of BitmapImage. Moreover ImageSource methods used to check the nullability of this pointer before it is used.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20240410/1f4b8256/attachment.htm>