REGRESSION(r239419): Crash in AudioSourceProviderAVFObjC::~AudioSourceProviderAVFObjC()
authorjer.noble@apple.com <jer.noble@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Sat, 12 Jan 2019 01:22:58 +0000 (01:22 +0000)
committerjer.noble@apple.com <jer.noble@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Sat, 12 Jan 2019 01:22:58 +0000 (01:22 +0000)
https://bugs.webkit.org/show_bug.cgi?id=193342
<rdar://problem/47119836>

Reviewed by Eric Carlson.

Make the TapStorage used by AudioSourceProviderAVFObjC thread-safe RefCounted.

* platform/graphics/avfoundation/AudioSourceProviderAVFObjC.h:
* platform/graphics/avfoundation/AudioSourceProviderAVFObjC.mm:
(WebCore::AudioSourceProviderAVFObjC::initCallback):
(WebCore::AudioSourceProviderAVFObjC::finalizeCallback):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@239889 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Source/WebCore/ChangeLog
Source/WebCore/platform/graphics/avfoundation/AudioSourceProviderAVFObjC.h
Source/WebCore/platform/graphics/avfoundation/AudioSourceProviderAVFObjC.mm

index b899f4b..9d44ee5 100644 (file)
@@ -1,3 +1,18 @@
+2019-01-11  Jer Noble  <jer.noble@apple.com>
+
+        REGRESSION(r239419): Crash in AudioSourceProviderAVFObjC::~AudioSourceProviderAVFObjC()
+        https://bugs.webkit.org/show_bug.cgi?id=193342
+        <rdar://problem/47119836>
+
+        Reviewed by Eric Carlson.
+
+        Make the TapStorage used by AudioSourceProviderAVFObjC thread-safe RefCounted.
+
+        * platform/graphics/avfoundation/AudioSourceProviderAVFObjC.h:
+        * platform/graphics/avfoundation/AudioSourceProviderAVFObjC.mm:
+        (WebCore::AudioSourceProviderAVFObjC::initCallback):
+        (WebCore::AudioSourceProviderAVFObjC::finalizeCallback):
+
 2019-01-11  John Wilander  <wilander@apple.com>
 
         Compile out Web API Statistics Collection
index 56ce2fe..b1ff2a2 100644 (file)
@@ -98,8 +98,8 @@ private:
     bool m_paused { true };
     AudioSourceProviderClient* m_client { nullptr };
 
-    struct TapStorage;
-    TapStorage* m_tapStorage { nullptr };
+    class TapStorage;
+    RefPtr<TapStorage> m_tapStorage;
 };
     
 }
index 15b6b93..4609056 100644 (file)
@@ -69,7 +69,8 @@ namespace WebCore {
 using namespace PAL;
 static const double kRingBufferDuration = 1;
 
-struct AudioSourceProviderAVFObjC::TapStorage {
+class AudioSourceProviderAVFObjC::TapStorage : public ThreadSafeRefCounted<AudioSourceProviderAVFObjC::TapStorage> {
+public:
     TapStorage(AudioSourceProviderAVFObjC* _this) : _this(_this) { }
     AudioSourceProviderAVFObjC* _this;
     Lock mutex;
@@ -238,9 +239,12 @@ void AudioSourceProviderAVFObjC::initCallback(MTAudioProcessingTapRef tap, void*
     ASSERT(tap);
     AudioSourceProviderAVFObjC* _this = static_cast<AudioSourceProviderAVFObjC*>(clientInfo);
     _this->m_tap = adoptCF(tap);
-    _this->m_tapStorage = new TapStorage(_this);
+    _this->m_tapStorage = adoptRef(new TapStorage(_this));
     _this->init(clientInfo, tapStorageOut);
-    *tapStorageOut = _this->m_tapStorage;
+    *tapStorageOut = _this->m_tapStorage.get();
+
+    // ref balanced by deref in finalizeCallback:
+    _this->m_tapStorage->ref();
 }
 
 void AudioSourceProviderAVFObjC::finalizeCallback(MTAudioProcessingTapRef tap)
@@ -253,7 +257,7 @@ void AudioSourceProviderAVFObjC::finalizeCallback(MTAudioProcessingTapRef tap)
         if (tapStorage->_this)
             tapStorage->_this->finalize();
     }
-    delete tapStorage;
+    tapStorage->deref();
 }
 
 void AudioSourceProviderAVFObjC::prepareCallback(MTAudioProcessingTapRef tap, CMItemCount maxFrames, const AudioStreamBasicDescription *processingFormat)