← WebKit — 2026-W35
5173c0afd8a3 [macOS] YouTube.com audio continues to play after tab is closed
severity medium
class UAF
confidence 0.38
signal score 6.17
Source/WebKit/GPUProcess
Primitive: AudioVideoRenderer left running past manager shutdown/destruction could call back into freed state
Triage note: RemoteAudioVideoRendererProxyManager destructor and shutdown() now pause()+flush() each renderer before removal, plus ALWAYS_LOG instrumentation. Defensive teardown ordering in GPUProcess; plausible lifecycle fix but no concrete identified UAF and partly instrumentation.
Triage note: RemoteAudioVideoRendererProxyManager destructor and shutdown() now pause()+flush() each renderer before removal, plus ALWAYS_LOG instrumentation. Defensive teardown ordering in GPUProcess; plausible lifecycle fix but no concrete identified UAF and partly instrumentation.
Structural signals: smartptr_member_added (+4.87), surgical (+1.3)
Commit message
[macOS] YouTube.com audio continues to play after tab is closed
rdar://185505597
https://bugs.webkit.org/show_bug.cgi?id=322448
Reviewed by Jean-Yves Avenard and Abrar Rahman Protyasha.
User reports indicate YouTube.com audio playback is continuing under some circumstances, even after
the tab containing the YouTube.com page is closed. Subsequent analysis of users' logs reveals that
the AudioVideoRenderAVFObjC object continues playback until it runs out of enqueued buffers and
stalls. The teardown path inside RemoteAudioVideoRendererProxyManager::shutdown() is being called,
and in fact the RemoteAudioVideoRendererProxyManager itself is being destroyed. But if
RemoteAudioVideoRendererProxyManager is not the lone holder of the AudioVideoRenderer RefPtr, its
refcount will not drop to zero and audio will continue until either buffers run dry or the last
remaining RefPtr is destroyed.
Rather than rely on the refcount dropping to zero to end playback, explicitly pause() and flush
() the renderer when shutting down a player, and do the same to all outstanding renderers when the
Manager itself is destroyed.
* Source/WebKit/GPUProcess/media/RemoteAudioVideoRendererProxyManager.cpp:
(WebKit::RemoteAudioVideoRendererProxyManager::~RemoteAudioVideoRendererProxyManager):
(WebKit::RemoteAudioVideoRendererProxyManager::shutdown):
Canonical link: https://commits.webkit.org/319759@main
Before / after
Loading diff…
On This Page