Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 7815063976b2892c650e6f974e9d5c30e6131839
https://github.com/WebKit/WebKit/commit/7815063976b2892c650e6f974e9d5c30e6131839
Author: Chris Dumez <[email protected]>
Date: 2026-07-27 (Mon, 27 Jul 2026)
Changed paths:
M Source/WebKit/UIProcess/UserMediaPermissionRequestManagerProxy.cpp
Log Message:
-----------
Null-check m_currentUserMediaRequest before denying in
requestSystemValidation callback
https://bugs.webkit.org/show_bug.cgi?id=320167
Reviewed by Jean-Yves Avenard.
The completion handler passed to requestSystemValidation() captures only a
WeakPtr to the manager and, on the denial (!isOK) path, dereferenced the
m_currentUserMediaRequest member directly. On Cocoa, that callback is invoked
asynchronously once the system capture-access (TCC) prompt resolves. While the
prompt is pending, m_currentUserMediaRequest can be cleared by
invalidatePendingRequests()
(reachable from stopCapture() / clearCachedState(),
e.g. on navigation or capture stop). When the prompt then returns a denial, the
handler dereferenced a null RefPtr and crashed.
Add a null check on m_currentUserMediaRequest before use, mirroring the sibling
decidePolicyForUserMediaPermissionRequest() method that the isOK path calls.
Both callback paths now no-op cleanly when there is no current request.
This is difficult to cover with an automated test: the only path that is both
asynchronous and can report denial goes through the real system TCC prompt,
whereas automated media tests use mock capture devices, which resolve
requestSystemValidation() synchronously with success and never reach this
branch.
* Source/WebKit/UIProcess/UserMediaPermissionRequestManagerProxy.cpp:
(WebKit::UserMediaPermissionRequestManagerProxy::processUserMediaPermissionValidRequest):
Canonical link:
https://flagged.apple.com:443/proxy?t2=Du5V6A7RF8&o=aHR0cHM6Ly9jb21taXRzLndlYmtpdC5vcmcvMzE3OTY5QG1haW4=&emid=ae4ba8f0-3daf-408a-9a9b-14270c8cfd26&c=11
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
