Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: d147fe73cf325652651f542a234f60897daf0480
https://github.com/WebKit/WebKit/commit/d147fe73cf325652651f542a234f60897daf0480
Author: Eric Carlson <[email protected]>
Date: 2026-09-11 (Fri, 11 Sep 2026)
Changed paths:
A
LayoutTests/ipc/remote-media-session-manager-audio-hardware-listener-crash-expected.txt
A
LayoutTests/ipc/remote-media-session-manager-audio-hardware-listener-crash.html
A
LayoutTests/ipc/remote-media-session-manager-audio-hardware-listener-uaf-expected.txt
A
LayoutTests/ipc/remote-media-session-manager-audio-hardware-listener-uaf.html
M Source/WebCore/platform/audio/AudioHardwareListener.h
M Source/WebCore/platform/audio/cocoa/MediaSessionManagerCocoa.mm
M Source/WebCore/platform/audio/mac/AudioHardwareListenerMac.cpp
M Source/WebKit/GPUProcess/GPUConnectionToWebProcess.cpp
M Source/WebKit/GPUProcess/GPUConnectionToWebProcess.h
M Source/WebKit/GPUProcess/media/RemoteAudioHardwareListenerProxy.h
M Source/WebKit/UIProcess/Media/RemoteMediaSessionManagerProxy.cpp
M Source/WebKit/UIProcess/Media/RemoteMediaSessionManagerProxy.h
M Source/WebKit/WebProcess/GPU/media/RemoteAudioHardwareListener.cpp
M Tools/TestWebKitAPI/Tests/WebCore/PlatformMediaSessionManagerTests.cpp
Log Message:
-----------
Hold AudioHardwareListener client weakly and stop caching listener proxies
across clients
rdar://177436036
Reviewed by Jean-Yves Avenard.
AudioHardwareListener stored its Client as a raw reference, while
RemoteMediaSessionManagerProxy::ensureAudioHardwareListenerProxy()
cached the first listener it created and reused it (with the original
client) for every subsequent caller, in addition to holding it
strongly via m_audioHardwareListenerProxy. Because each
RemoteMediaSessionManagerProxy also overwrites the process-global
AudioHardwareListener factory with a lambda capturing Ref{*this}, two
WebPageProxy instances could end up with B's cached listener bound to
A; closing A's page then made B's RemoteAudioOutputDeviceChanged
dispatch a virtual call on a freed proxy (UI-process heap-use-after-
free). Within a single page, removing the last media session cleared
MediaSessionManagerCocoa::m_audioHardwareListener but left the
strongly-held m_audioHardwareListenerProxy, so the same IPC message
null-dereferenced m_audioHardwareListener in audioOutputDeviceChanged.
Make AudioHardwareListener::Client an AbstractRefCountedAndCanMakeWeakPtr
(matching NowPlayingManagerClient), store m_client as a WeakPtr, and
upgrade to a protecting RefPtr before dispatching in every listener
subclass. In RemoteMediaSessionManagerProxy, capture *this weakly in
the creation lambda (also removing a leak of the last-constructed
proxy), always create a fresh listener per call, only stash a
ThreadSafeWeakPtr to it when the client is *this*, and dispatch IPC
through that weak pointer so the listener's lifetime is governed
solely by MediaSessionManagerCocoa::m_audioHardwareListener. Also
guard MediaSessionManagerCocoa::audioOutputDeviceChanged() against a
null m_audioHardwareListener for defense in depth, and make
RemoteAudioHardwareListenerProxy ref-counted to satisfy the new Client
contract.
Tests: ipc/remote-media-session-manager-audio-hardware-listener-crash.html
ipc/remote-media-session-manager-audio-hardware-listener-uaf.html
*
LayoutTests/ipc/remote-media-session-manager-audio-hardware-listener-crash-expected.txt:
Added.
*
LayoutTests/ipc/remote-media-session-manager-audio-hardware-listener-crash.html:
Added.
*
LayoutTests/ipc/remote-media-session-manager-audio-hardware-listener-uaf-expected.txt:
Added.
*
LayoutTests/ipc/remote-media-session-manager-audio-hardware-listener-uaf.html:
Added.
* Source/WebCore/platform/audio/AudioHardwareListener.h:
(WebCore::AudioHardwareListener::client const):
* Source/WebCore/platform/audio/cocoa/MediaSessionManagerCocoa.mm:
(WebCore::MediaSessionManagerCocoa::audioOutputDeviceChanged):
* Source/WebCore/platform/audio/mac/AudioHardwareListenerMac.cpp:
(WebCore::AudioHardwareListenerMac::processIsRunningChanged):
(WebCore::AudioHardwareListenerMac::outputDeviceChanged):
* Source/WebKit/GPUProcess/GPUConnectionToWebProcess.cpp:
(WebKit::GPUConnectionToWebProcess::createAudioHardwareListener):
* Source/WebKit/GPUProcess/GPUConnectionToWebProcess.h:
* Source/WebKit/GPUProcess/media/RemoteAudioHardwareListenerProxy.h:
* Source/WebKit/UIProcess/Media/RemoteMediaSessionManagerProxy.cpp:
(WebKit::RemoteMediaSessionManagerProxy::RemoteMediaSessionManagerProxy):
(WebKit::RemoteMediaSessionManagerProxy::remoteAudioHardwareDidBecomeActive):
(WebKit::RemoteMediaSessionManagerProxy::remoteAudioHardwareDidBecomeInactive):
(WebKit::RemoteMediaSessionManagerProxy::remoteAudioOutputDeviceChanged):
(WebKit::RemoteMediaSessionManagerProxy::ensureAudioHardwareListenerProxy):
* Source/WebKit/UIProcess/Media/RemoteMediaSessionManagerProxy.h:
* Source/WebKit/WebProcess/GPU/media/RemoteAudioHardwareListener.cpp:
(WebKit::RemoteAudioHardwareListener::audioHardwareDidBecomeActive):
(WebKit::RemoteAudioHardwareListener::audioHardwareDidBecomeInactive):
(WebKit::RemoteAudioHardwareListener::audioOutputDeviceChanged):
Originally-landed-as: [email protected] (ddf732bdf8b3).
rdar://185368109
Canonical link: https://commits.webkit.org/320953@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
