Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 4193d2c83f3aec995d9b8d77ee81297727bc5b1a
https://github.com/WebKit/WebKit/commit/4193d2c83f3aec995d9b8d77ee81297727bc5b1a
Author: David Kilzer <[email protected]>
Date: 2026-05-20 (Wed, 20 May 2026)
Changed paths:
M
Source/WebCore/platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaSourceAVFObjC.mm
Log Message:
-----------
REGRESSION (301011@main): Crash in
MediaPlayerPrivateMediaSourceAVFObjC::setNetworkState during destruction
<https://bugs.webkit.org/show_bug.cgi?id=309455>
<rdar://172006984>
Reviewed by Jean-Yves Avenard.
Revoke all weak pointers at the start of the
`~MediaPlayerPrivateMediaSourceAVFObjC()` destructor to prevent
re-entrant callbacks during member destruction. C++ destroys
`m_logger` before `m_mediaSourcePrivate` (reverse declaration
order), and the `m_mediaSourcePrivate` destructor can trigger
synchronous KVO notifications that invoke `WeakPtr`-guarded
callbacks on the partially-destroyed object. Since the
`CanMakeWeakPtr` base class destructor runs after all member
destructors, `WeakPtr::get()` still succeeds, allowing
callbacks to access already-destroyed members.
*
Source/WebCore/platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaSourceAVFObjC.mm:
(WebCore::MediaPlayerPrivateMediaSourceAVFObjC::~MediaPlayerPrivateMediaSourceAVFObjC):
Originally-landed-as: 305413.419@rapid/safari-7624.2.5.110-branch
(4424466acb2b). rdar://176067520
Canonical link: https://commits.webkit.org/313640@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
