|
| 1 | +From 53edfff6e5a4e96ac617aee1530559be4c26958d Mon Sep 17 00:00:00 2001 |
| 2 | +From: Andrzej Surdej <Andrzej_Surdej@comcast.com> |
| 3 | +Date: Thu, 21 May 2026 13:20:47 +0200 |
| 4 | +Subject: [PATCH] [MediaCapabilities] Protect MediaCapabilities JS wrapper from |
| 5 | + GC |
| 6 | + |
| 7 | +Add GenerateIsReachable=ReachableFromNavigator to prevent wrapper GC. |
| 8 | +The MediaCapabilities interface is annotated [SameObject] in the spec, |
| 9 | +meaning navigator.mediaCapabilities must return the same object on every |
| 10 | +access. Without GC protection, the JS wrapper can be collected when no |
| 11 | +JS reference holds it, causing a new wrapper to be created on next access. |
| 12 | +This breaks object identity and loses any user-set properties. |
| 13 | +--- |
| 14 | + .../Modules/mediacapabilities/MediaCapabilities.cpp | 11 +++++++++++ |
| 15 | + .../Modules/mediacapabilities/MediaCapabilities.h | 8 ++++++-- |
| 16 | + .../Modules/mediacapabilities/MediaCapabilities.idl | 3 ++- |
| 17 | + .../mediacapabilities/NavigatorMediaCapabilities.cpp | 6 +++--- |
| 18 | + .../mediacapabilities/NavigatorMediaCapabilities.h | 2 +- |
| 19 | + .../WorkerNavigatorMediaCapabilities.cpp | 6 +++--- |
| 20 | + .../WorkerNavigatorMediaCapabilities.h | 2 +- |
| 21 | + 7 files changed, 27 insertions(+), 11 deletions(-) |
| 22 | + |
| 23 | +diff --git a/Source/WebCore/Modules/mediacapabilities/MediaCapabilities.cpp b/Source/WebCore/Modules/mediacapabilities/MediaCapabilities.cpp |
| 24 | +index 6eca6dd6b30f..a3cfa014b792 100644 |
| 25 | +--- a/Source/WebCore/Modules/mediacapabilities/MediaCapabilities.cpp |
| 26 | ++++ b/Source/WebCore/Modules/mediacapabilities/MediaCapabilities.cpp |
| 27 | +@@ -42,11 +42,22 @@ |
| 28 | + #include "Page.h" |
| 29 | + #include "Settings.h" |
| 30 | + #include "WebRTCProvider.h" |
| 31 | ++#include "NavigatorBase.h" |
| 32 | + #include <wtf/Logger.h> |
| 33 | + #include <wtf/SortedArrayMap.h> |
| 34 | + |
| 35 | + namespace WebCore { |
| 36 | + |
| 37 | ++MediaCapabilities::MediaCapabilities(NavigatorBase& navigator) |
| 38 | ++ : m_navigator(navigator) |
| 39 | ++{ |
| 40 | ++} |
| 41 | ++ |
| 42 | ++NavigatorBase* MediaCapabilities::navigator() |
| 43 | ++{ |
| 44 | ++ return m_navigator.get(); |
| 45 | ++} |
| 46 | ++ |
| 47 | + static bool isValidMediaMIMEType(const ContentType& contentType) |
| 48 | + { |
| 49 | + // A "bucket" MIME types is one whose container type does not uniquely specify a codec. |
| 50 | +diff --git a/Source/WebCore/Modules/mediacapabilities/MediaCapabilities.h b/Source/WebCore/Modules/mediacapabilities/MediaCapabilities.h |
| 51 | +index b9579019c1a7..0ab7a7ad3c44 100644 |
| 52 | +--- a/Source/WebCore/Modules/mediacapabilities/MediaCapabilities.h |
| 53 | ++++ b/Source/WebCore/Modules/mediacapabilities/MediaCapabilities.h |
| 54 | +@@ -33,18 +33,22 @@ |
| 55 | + namespace WebCore { |
| 56 | + |
| 57 | + class DeferredPromise; |
| 58 | ++class NavigatorBase; |
| 59 | + class ScriptExecutionContext; |
| 60 | + |
| 61 | + class MediaCapabilities : public RefCounted<MediaCapabilities>, public CanMakeWeakPtr<MediaCapabilities> { |
| 62 | + public: |
| 63 | +- static Ref<MediaCapabilities> create() { return adoptRef(*new MediaCapabilities); } |
| 64 | ++ static Ref<MediaCapabilities> create(NavigatorBase& navigator) { return adoptRef(*new MediaCapabilities(navigator)); } |
| 65 | ++ |
| 66 | ++ NavigatorBase* navigator(); |
| 67 | + |
| 68 | + void decodingInfo(ScriptExecutionContext&, MediaDecodingConfiguration&&, Ref<DeferredPromise>&&); |
| 69 | + void encodingInfo(ScriptExecutionContext&, MediaEncodingConfiguration&&, Ref<DeferredPromise>&&); |
| 70 | + |
| 71 | + private: |
| 72 | +- MediaCapabilities() = default; |
| 73 | ++ explicit MediaCapabilities(NavigatorBase&); |
| 74 | + |
| 75 | ++ WeakPtr<NavigatorBase> m_navigator; |
| 76 | + uint64_t m_nextTaskIdentifier { 0 }; |
| 77 | + HashMap<uint64_t, MediaEngineConfigurationFactory::DecodingConfigurationCallback> m_decodingTasks; |
| 78 | + HashMap<uint64_t, MediaEngineConfigurationFactory::EncodingConfigurationCallback> m_encodingTasks; |
| 79 | +diff --git a/Source/WebCore/Modules/mediacapabilities/MediaCapabilities.idl b/Source/WebCore/Modules/mediacapabilities/MediaCapabilities.idl |
| 80 | +index 05fc7ea634a8..02c367959f19 100644 |
| 81 | +--- a/Source/WebCore/Modules/mediacapabilities/MediaCapabilities.idl |
| 82 | ++++ b/Source/WebCore/Modules/mediacapabilities/MediaCapabilities.idl |
| 83 | +@@ -25,7 +25,8 @@ |
| 84 | + |
| 85 | + [ |
| 86 | + EnabledBySetting=MediaCapabilitiesEnabled, |
| 87 | +- Exposed=(Window,DedicatedWorker) |
| 88 | ++ Exposed=(Window,DedicatedWorker), |
| 89 | ++ GenerateIsReachable=ReachableFromNavigator |
| 90 | + ] interface MediaCapabilities { |
| 91 | + [CallWith=CurrentScriptExecutionContext] Promise<MediaCapabilitiesDecodingInfo> decodingInfo(MediaDecodingConfiguration configuration); |
| 92 | + [CallWith=CurrentScriptExecutionContext] Promise<MediaCapabilitiesEncodingInfo> encodingInfo(MediaEncodingConfiguration configuration); |
| 93 | +diff --git a/Source/WebCore/Modules/mediacapabilities/NavigatorMediaCapabilities.cpp b/Source/WebCore/Modules/mediacapabilities/NavigatorMediaCapabilities.cpp |
| 94 | +index fce51add8aa6..6608175e1094 100644 |
| 95 | +--- a/Source/WebCore/Modules/mediacapabilities/NavigatorMediaCapabilities.cpp |
| 96 | ++++ b/Source/WebCore/Modules/mediacapabilities/NavigatorMediaCapabilities.cpp |
| 97 | +@@ -31,8 +31,8 @@ |
| 98 | + |
| 99 | + namespace WebCore { |
| 100 | + |
| 101 | +-NavigatorMediaCapabilities::NavigatorMediaCapabilities() |
| 102 | +- : m_mediaCapabilities(MediaCapabilities::create()) |
| 103 | ++NavigatorMediaCapabilities::NavigatorMediaCapabilities(Navigator& navigator) |
| 104 | ++ : m_mediaCapabilities(MediaCapabilities::create(navigator)) |
| 105 | + { |
| 106 | + } |
| 107 | + |
| 108 | +@@ -47,7 +47,7 @@ NavigatorMediaCapabilities& NavigatorMediaCapabilities::from(Navigator& navigato |
| 109 | + { |
| 110 | + NavigatorMediaCapabilities* supplement = static_cast<NavigatorMediaCapabilities*>(Supplement<Navigator>::from(&navigator, supplementName())); |
| 111 | + if (!supplement) { |
| 112 | +- auto newSupplement = makeUnique<NavigatorMediaCapabilities>(); |
| 113 | ++ auto newSupplement = makeUnique<NavigatorMediaCapabilities>(navigator); |
| 114 | + supplement = newSupplement.get(); |
| 115 | + provideTo(&navigator, supplementName(), WTFMove(newSupplement)); |
| 116 | + } |
| 117 | +diff --git a/Source/WebCore/Modules/mediacapabilities/NavigatorMediaCapabilities.h b/Source/WebCore/Modules/mediacapabilities/NavigatorMediaCapabilities.h |
| 118 | +index 76d598e18af9..3b8baad4b592 100644 |
| 119 | +--- a/Source/WebCore/Modules/mediacapabilities/NavigatorMediaCapabilities.h |
| 120 | ++++ b/Source/WebCore/Modules/mediacapabilities/NavigatorMediaCapabilities.h |
| 121 | +@@ -35,7 +35,7 @@ class Navigator; |
| 122 | + class NavigatorMediaCapabilities final : public Supplement<Navigator> { |
| 123 | + WTF_MAKE_FAST_ALLOCATED; |
| 124 | + public: |
| 125 | +- NavigatorMediaCapabilities(); |
| 126 | ++ explicit NavigatorMediaCapabilities(Navigator&); |
| 127 | + ~NavigatorMediaCapabilities(); |
| 128 | + |
| 129 | + static MediaCapabilities& mediaCapabilities(Navigator&); |
| 130 | +diff --git a/Source/WebCore/Modules/mediacapabilities/WorkerNavigatorMediaCapabilities.cpp b/Source/WebCore/Modules/mediacapabilities/WorkerNavigatorMediaCapabilities.cpp |
| 131 | +index 7a617b33a87b..1c4606d27ba1 100644 |
| 132 | +--- a/Source/WebCore/Modules/mediacapabilities/WorkerNavigatorMediaCapabilities.cpp |
| 133 | ++++ b/Source/WebCore/Modules/mediacapabilities/WorkerNavigatorMediaCapabilities.cpp |
| 134 | +@@ -31,8 +31,8 @@ |
| 135 | + |
| 136 | + namespace WebCore { |
| 137 | + |
| 138 | +-WorkerNavigatorMediaCapabilities::WorkerNavigatorMediaCapabilities() |
| 139 | +- : m_mediaCapabilities(MediaCapabilities::create()) |
| 140 | ++WorkerNavigatorMediaCapabilities::WorkerNavigatorMediaCapabilities(WorkerNavigator& navigator) |
| 141 | ++ : m_mediaCapabilities(MediaCapabilities::create(navigator)) |
| 142 | + { |
| 143 | + } |
| 144 | + |
| 145 | +@@ -47,7 +47,7 @@ WorkerNavigatorMediaCapabilities& WorkerNavigatorMediaCapabilities::from(WorkerN |
| 146 | + { |
| 147 | + auto* supplement = static_cast<WorkerNavigatorMediaCapabilities*>(Supplement<WorkerNavigator>::from(&navigator, supplementName())); |
| 148 | + if (!supplement) { |
| 149 | +- auto newSupplement = makeUnique<WorkerNavigatorMediaCapabilities>(); |
| 150 | ++ auto newSupplement = makeUnique<WorkerNavigatorMediaCapabilities>(navigator); |
| 151 | + supplement = newSupplement.get(); |
| 152 | + provideTo(&navigator, supplementName(), WTFMove(newSupplement)); |
| 153 | + } |
| 154 | +diff --git a/Source/WebCore/Modules/mediacapabilities/WorkerNavigatorMediaCapabilities.h b/Source/WebCore/Modules/mediacapabilities/WorkerNavigatorMediaCapabilities.h |
| 155 | +index 98fffdb05096..f1d698e73cf9 100644 |
| 156 | +--- a/Source/WebCore/Modules/mediacapabilities/WorkerNavigatorMediaCapabilities.h |
| 157 | ++++ b/Source/WebCore/Modules/mediacapabilities/WorkerNavigatorMediaCapabilities.h |
| 158 | +@@ -35,7 +35,7 @@ class WorkerNavigator; |
| 159 | + class WorkerNavigatorMediaCapabilities final : public Supplement<WorkerNavigator> { |
| 160 | + WTF_MAKE_FAST_ALLOCATED; |
| 161 | + public: |
| 162 | +- WorkerNavigatorMediaCapabilities(); |
| 163 | ++ explicit WorkerNavigatorMediaCapabilities(WorkerNavigator&); |
| 164 | + ~WorkerNavigatorMediaCapabilities(); |
| 165 | + |
| 166 | + static MediaCapabilities& mediaCapabilities(WorkerNavigator&); |
| 167 | +-- |
| 168 | +2.51.0 |
| 169 | + |
0 commit comments