Diff
Modified: trunk/LayoutTests/ChangeLog (275146 => 275147)
--- trunk/LayoutTests/ChangeLog 2021-03-28 03:26:26 UTC (rev 275146)
+++ trunk/LayoutTests/ChangeLog 2021-03-28 13:55:24 UTC (rev 275147)
@@ -1,3 +1,18 @@
+2021-03-28 Youenn Fablet <you...@apple.com>
+
+ Use-after-move in UserMediaPermissionRequestManagerProxy::checkUserMediaPermissionForSpeechRecognition
+ https://bugs.webkit.org/show_bug.cgi?id=223842
+ <rdar://problem/75791668>
+
+ Reviewed by Eric Carlson.
+
+ * fast/speechrecognition/start-recognition-after-denied-gum-expected.txt: Added.
+ * fast/speechrecognition/start-recognition-after-denied-gum.html: Added.
+ * fast/speechrecognition/start-recognition-after-gum-expected.txt: Added.
+ * fast/speechrecognition/start-recognition-after-gum.html: Added.
+ * platform/mac-wk1/TestExpectations:
+ * platform/win/TestExpectations:
+
2021-03-27 Kate Cheney <katherine_che...@apple.com>
PCM: Send report to both click source and attribution destination website
Added: trunk/LayoutTests/fast/speechrecognition/start-recognition-after-denied-gum-expected.txt (0 => 275147)
--- trunk/LayoutTests/fast/speechrecognition/start-recognition-after-denied-gum-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/speechrecognition/start-recognition-after-denied-gum-expected.txt 2021-03-28 13:55:24 UTC (rev 275147)
@@ -0,0 +1,3 @@
+
+PASS Speech recognition after denied audio gum
+
Added: trunk/LayoutTests/fast/speechrecognition/start-recognition-after-denied-gum.html (0 => 275147)
--- trunk/LayoutTests/fast/speechrecognition/start-recognition-after-denied-gum.html (rev 0)
+++ trunk/LayoutTests/fast/speechrecognition/start-recognition-after-denied-gum.html 2021-03-28 13:55:24 UTC (rev 275147)
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html>
+<body>
+<script src=""
+<script src=""
+<script>
+promise_test(async () => {
+ if (window.testRunner)
+ testRunner.setUserMediaPermission(false);
+ await navigator.mediaDevices.getUserMedia({audio:true}).then(() => assert_unreached("succcesful gum"), () => { });
+ if (window.testRunner)
+ testRunner.setUserMediaPermission(true);
+
+ const recognition = new webkitSpeechRecognition();
+ recognition.start();
+ return new Promise(resolve => recognition._onerror_ = resolve);
+}, "Speech recognition after denied audio gum");
+</script>
+</body>
+</html>
Added: trunk/LayoutTests/fast/speechrecognition/start-recognition-after-gum-expected.txt (0 => 275147)
--- trunk/LayoutTests/fast/speechrecognition/start-recognition-after-gum-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/speechrecognition/start-recognition-after-gum-expected.txt 2021-03-28 13:55:24 UTC (rev 275147)
@@ -0,0 +1,3 @@
+
+PASS Speech recognition after successful audio gum
+
Added: trunk/LayoutTests/fast/speechrecognition/start-recognition-after-gum.html (0 => 275147)
--- trunk/LayoutTests/fast/speechrecognition/start-recognition-after-gum.html (rev 0)
+++ trunk/LayoutTests/fast/speechrecognition/start-recognition-after-gum.html 2021-03-28 13:55:24 UTC (rev 275147)
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html>
+<body>
+<script src=""
+<script src=""
+<script>
+promise_test(async () => {
+ if (window.testRunner)
+ testRunner.setUserMediaPermission(true);
+ await navigator.mediaDevices.getUserMedia({audio:true});
+ if (window.testRunner)
+ testRunner.setUserMediaPermission(false);
+
+ const recognition = new webkitSpeechRecognition();
+ recognition.start();
+ return new Promise(resolve => recognition._onstart_ = resolve);
+}, "Speech recognition after successful audio gum");
+</script>
+</body>
+</html>
Modified: trunk/LayoutTests/platform/mac-wk1/TestExpectations (275146 => 275147)
--- trunk/LayoutTests/platform/mac-wk1/TestExpectations 2021-03-28 03:26:26 UTC (rev 275146)
+++ trunk/LayoutTests/platform/mac-wk1/TestExpectations 2021-03-28 13:55:24 UTC (rev 275147)
@@ -72,6 +72,9 @@
http/wpt/audio-output [ Skip ]
imported/w3c/web-platform-tests/audio-output [ Skip ]
+fast/speechrecognition/start-recognition-after-gum.html [ Skip ]
+fast/speechrecognition/start-recognition-after-denied-gum.html [ Skip ]
+
# Datalist is unsupported in WK1
accessibility/datalist.html [ WontFix ]
fast/forms/datalist [ WontFix ]
Modified: trunk/LayoutTests/platform/win/TestExpectations (275146 => 275147)
--- trunk/LayoutTests/platform/win/TestExpectations 2021-03-28 03:26:26 UTC (rev 275146)
+++ trunk/LayoutTests/platform/win/TestExpectations 2021-03-28 13:55:24 UTC (rev 275147)
@@ -886,6 +886,9 @@
http/wpt/audio-output [ Skip ]
imported/w3c/web-platform-tests/audio-output [ Skip ]
+fast/speechrecognition/start-recognition-after-gum.html [ Skip ]
+fast/speechrecognition/start-recognition-after-denied-gum.html [ Skip ]
+
# needs enhanced eventSender.contextMenu() return value
#webkit.org/b/45021 media/context-menu-actions.html
Modified: trunk/Source/WebKit/ChangeLog (275146 => 275147)
--- trunk/Source/WebKit/ChangeLog 2021-03-28 03:26:26 UTC (rev 275146)
+++ trunk/Source/WebKit/ChangeLog 2021-03-28 13:55:24 UTC (rev 275147)
@@ -1,3 +1,19 @@
+2021-03-28 Youenn Fablet <you...@apple.com>
+
+ Use-after-move in UserMediaPermissionRequestManagerProxy::checkUserMediaPermissionForSpeechRecognition
+ https://bugs.webkit.org/show_bug.cgi?id=223842
+ <rdar://problem/75791668>
+
+ Reviewed by Eric Carlson.
+
+ Use request decision handler instead of already moved completion handler.
+
+ Tests: fast/speechrecognition/start-recognition-after-denied-gum.html
+ fast/speechrecognition/start-recognition-after-gum.html
+
+ * UIProcess/UserMediaPermissionRequestManagerProxy.cpp:
+ (WebKit::UserMediaPermissionRequestManagerProxy::checkUserMediaPermissionForSpeechRecognition):
+
2021-03-27 Simon Fraser <simon.fra...@apple.com>
Have DisplayLink compute its displayNominalFramesPerSecond just once
Modified: trunk/Source/WebKit/UIProcess/UserMediaPermissionRequestManagerProxy.cpp (275146 => 275147)
--- trunk/Source/WebKit/UIProcess/UserMediaPermissionRequestManagerProxy.cpp 2021-03-28 03:26:26 UTC (rev 275146)
+++ trunk/Source/WebKit/UIProcess/UserMediaPermissionRequestManagerProxy.cpp 2021-03-28 13:55:24 UTC (rev 275147)
@@ -650,14 +650,15 @@
auto request = UserMediaPermissionRequestProxy::create(*this, 0, frameIdentifier, frameIdentifier, requestingOrigin.isolatedCopy(), topOrigin.isolatedCopy(), Vector<WebCore::CaptureDevice> { device }, { }, { }, WTFMove(completionHandler));
+ // FIXME: Use switch on action.
auto action = ""
if (action == RequestAction::Deny) {
- completionHandler(false);
+ request->decisionCompletionHandler()(false);
return;
}
if (action == RequestAction::Grant) {
- completionHandler(true);
+ request->decisionCompletionHandler()(true);
return;
}
