Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: a9c37a133ad499b796b891cdfed52783586bc28c
      
https://github.com/WebKit/WebKit/commit/a9c37a133ad499b796b891cdfed52783586bc28c
  Author: Youenn Fablet <[email protected]>
  Date:   2026-07-01 (Wed, 01 Jul 2026)

  Changed paths:
    A LayoutTests/fast/mediastream/delete-audio-unit-expected.txt
    A LayoutTests/fast/mediastream/delete-audio-unit.html
    M 
Source/WebCore/platform/mediastream/cocoa/AudioMediaStreamTrackRendererInternalUnit.h
    M 
Source/WebCore/platform/mediastream/cocoa/AudioMediaStreamTrackRendererUnit.cpp
    M 
Source/WebCore/platform/mediastream/cocoa/AudioMediaStreamTrackRendererUnit.h
    M Source/WebCore/testing/Internals.cpp
    M Source/WebCore/testing/Internals.h
    M Source/WebCore/testing/Internals.idl
    M 
Source/WebKit/GPUProcess/webrtc/RemoteAudioMediaStreamTrackRendererInternalUnitManager.cpp
    M 
Source/WebKit/WebProcess/GPU/webrtc/AudioMediaStreamTrackRendererInternalUnitManager.cpp

  Log Message:
  -----------
  [CoreIPC] [GPUP] off-main-thread 
~RemoteAudioMediaStreamTrackRendererInternalUnitManagerUnit mutates unlocked 
AudioSession interruption-observer WeakHashSet
rdar://175520451

Reviewed by Jean-Yves Avenard.

If WebProcess sends an IPC message to delete unit while it is running, the unit 
may be destroyed in the rendering thread.
This will cause it to unregister itself from the AudioSession observer map, 
which is not thread safe and supposed to only happen in main thread.
To prevent this, we make sure that deleting the unit will stop the unit. This 
will prevent the rendering thread to have the last ref of the unit.

We add an internals API to trigger deleting a unit that is playing.

* LayoutTests/fast/mediastream/delete-audio-unit-expected.txt: Added.
* LayoutTests/fast/mediastream/delete-audio-unit.html: Added.
* 
Source/WebCore/platform/mediastream/cocoa/AudioMediaStreamTrackRendererInternalUnit.h:
(WebCore::AudioMediaStreamTrackRendererInternalUnit::deleteUnitForTesting):
* 
Source/WebCore/platform/mediastream/cocoa/AudioMediaStreamTrackRendererUnit.cpp:
(WebCore::AudioMediaStreamTrackRendererUnit::deleteUnitForTesting):
(WebCore::AudioMediaStreamTrackRendererUnit::Unit::deleteUnitForTesting):
* Source/WebCore/platform/mediastream/cocoa/AudioMediaStreamTrackRendererUnit.h:
* Source/WebCore/testing/Internals.cpp:
(WebCore::Internals::deleteAudioUnit):
* Source/WebCore/testing/Internals.h:
* Source/WebCore/testing/Internals.idl:
* 
Source/WebKit/GPUProcess/webrtc/RemoteAudioMediaStreamTrackRendererInternalUnitManager.cpp:
(WebKit::RemoteAudioMediaStreamTrackRendererInternalUnitManager::deleteUnit):
(WebKit::RemoteAudioMediaStreamTrackRendererInternalUnitManagerUnit::RemoteAudioMediaStreamTrackRendererInternalUnitManagerUnit):
(WebKit::RemoteAudioMediaStreamTrackRendererInternalUnitManagerUnit::~RemoteAudioMediaStreamTrackRendererInternalUnitManagerUnit):
* 
Source/WebKit/WebProcess/GPU/webrtc/AudioMediaStreamTrackRendererInternalUnitManager.cpp:
(WebKit::AudioMediaStreamTrackRendererInternalUnitManagerProxy::deleteUnitForTesting):

Originally-landed-as: 305413.814@safari-7624-branch (5503234cd8cd). 
rdar://180436518
Canonical link: https://commits.webkit.org/316360@main



To unsubscribe from these emails, change your notification settings at 
https://github.com/WebKit/WebKit/settings/notifications

Reply via email to