Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: b48b4d4d4034d4a207ba2e0d61570ecc051f30a4
https://github.com/WebKit/WebKit/commit/b48b4d4d4034d4a207ba2e0d61570ecc051f30a4
Author: Eric Carlson <[email protected]>
Date: 2026-06-30 (Tue, 30 Jun 2026)
Changed paths:
A
LayoutTests/http/wpt/webcodecs/audio-encoder-pcm-format-change-expected.txt
A LayoutTests/http/wpt/webcodecs/audio-encoder-pcm-format-change.html
M Source/WebCore/platform/audio/cocoa/AudioEncoderCocoa.cpp
Log Message:
-----------
[WebCore] Use-after-free in InternalAudioEncoderCocoa on ASBD change because
converter->finish() promise is discarded
https://bugs.webkit.org/show_bug.cgi?id=314107
rdar://175402146
Reviewed by Youenn Fablet and David Kilzer.
When WebCodecs AudioEncoder receives consecutive AudioData frames whose PCM
format differs (e.g. f32-planar then s16) but whose sampleRate and
numberOfChannels are unchanged, encode() replaces the AudioSampleBufferConverter
and calls finish() on the old one. The returned Ref<GenericPromise> was
dropped, so nothing kept the encoder alive while the old converter's async
drain ran on its own serial queue. If the client then called close(), which
keeps the encoder alive for the new converter only, the old converter could
fire its CMBufferQueueTrigger into a freed InternalAudioEncoderCocoa,
producing a heap use-after-free in compressedAudioOutputBufferCallback.
Apply the same whenSettled keep-alive that close() already uses, so the
encoder stays alive on queueSingleton() until the old converter has finished
draining.
Test: http/wpt/webcodecs/audio-encoder-pcm-format-change.html
* LayoutTests/http/wpt/webcodecs/audio-encoder-pcm-format-change-expected.txt:
Added.
* LayoutTests/http/wpt/webcodecs/audio-encoder-pcm-format-change.html: Added.
* Source/WebCore/platform/audio/cocoa/AudioEncoderCocoa.cpp:
(WebCore::InternalAudioEncoderCocoa::encode):
Originally-landed-as: 305413.864@safari-7624-branch (8230e88bd918).
rdar://180436545
Canonical link: https://commits.webkit.org/316188@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
