Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: e147963ac4e9a6cf2bb7c40c23d26b85637db828
https://github.com/WebKit/WebKit/commit/e147963ac4e9a6cf2bb7c40c23d26b85637db828
Author: Simon Lewis <[email protected]>
Date: 2026-06-30 (Tue, 30 Jun 2026)
Changed paths:
A LayoutTests/fast/webcodecs/audio-data-close-during-gc-crash-expected.txt
A LayoutTests/fast/webcodecs/audio-data-close-during-gc-crash.html
M Source/WebCore/Modules/webcodecs/WebCodecsAudioData.cpp
M Source/WebCore/Modules/webcodecs/WebCodecsAudioData.h
Log Message:
-----------
use-after-free in WebCodecsAudioData::memoryCost() via concurrent GC marker /
close()
rdar://175520011
Reviewed by Jean-Yves Avenard
WebCodecsAudioData is annotated with ReportExtraMemoryCost, so the generated
JS wrapper's visitChildren calls WebCodecsAudioData::memoryCost() from a
concurrent GC marker thread. memoryCost() dereferenced m_data.audioData (a
RefPtr<PlatformRawAudioData>) without synchronization while close() on the
main thread assigns m_data.audioData = nullptr and frees the
PlatformRawAudioData, leading to a heap-use-after-free in
PlatformRawAudioDataCocoa::memoryCost().
Cache the memory cost in a std::atomic<size_t> on WebCodecsAudioData,
computed once at construction time on the main thread and zeroed in close(),
so the GC-thread memoryCost() never touches the RefPtr. This matches the
existing pattern in ImageBitmap.
* LayoutTests/fast/webcodecs/audio-data-close-during-gc-crash-expected.txt:
Added.
* LayoutTests/fast/webcodecs/audio-data-close-during-gc-crash.html: Added.
* Source/WebCore/Modules/webcodecs/WebCodecsAudioData.cpp:
(WebCore::WebCodecsAudioData::WebCodecsAudioData):
(WebCore::WebCodecsAudioData::close):
* Source/WebCore/Modules/webcodecs/WebCodecsAudioData.h:
(WebCore::WebCodecsAudioData::memoryCost const):
Originally-landed-as: 305413.845@safari-7624-branch (2102c1dad1d3).
rdar://180438342
Canonical link: https://commits.webkit.org/316135@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
