← WebKit — 2026-W36
6cce7c11dbb0d62b1a27d241219f47792b2b6885 QueuedVideoOutput::invalidate() can race -[AVPlayerItemVideoOutput dealloc] on the delegate queue
severity medium
class Race
confidence 0.6
signal score 7.67
Source/WebCore/platform
patch-now
Primitive: AVPlayerItemVideoOutput released on delegate queue mutates KVO graph off main thread
Triage note: RC_REMOVE_SEC_ACCEL_3-gated MainRunLoopVideoOutput wrapper forces the periodic-time-observer block's AVPlayerItemVideoOutput reference to be released on the main run loop, because its dealloc mutates the AVPlayer KVO observation graph that invalidate() touches on the main thread. Fixes wrong-thread destruction / concurrent graph mutation.
Triage note: RC_REMOVE_SEC_ACCEL_3-gated MainRunLoopVideoOutput wrapper forces the periodic-time-observer block's AVPlayerItemVideoOutput reference to be released on the main run loop, because its dealloc mutates the AVPlayer KVO observation graph that invalidate() touches on the main thread. Fixes wrong-thread destruction / concurrent graph mutation.
Structural signals: smartptr_member_added (+6.47), null_guard (+1.2)
Commit message
QueuedVideoOutput::invalidate() can race -[AVPlayerItemVideoOutput dealloc] on the delegate queue
https://bugs.webkit.org/show_bug.cgi?id=322980
rdar://180467727
Reviewed by Gerald Squelart.
The block installed by -addPeriodicTimeObserverForInterval: strongly captured the
AVPlayerItemVideoOutput. The dispatch source backing
addPeriodicTimeObserverForInterval: could be cancelled by removeTimeObserver; its
cancel handler was drained on globalOutputDelegateQueue(), which destroyed the block,
which destroyed the captured lambda, which released the last reference while in the
block.
We wrap the QueuedVideoOutput in a MainRunLoopVideoOutput which will always
delete the videoOutput on the main thread.
The boundary observer's captured of the output and the delegate were unused and are removed.
* Source/WebCore/platform/graphics/avfoundation/objc/QueuedVideoOutput.mm:
(WebCore::QueuedVideoOutput::QueuedVideoOutput):
(WebCore::QueuedVideoOutput::invalidate):
(WebCore::QueuedVideoOutput::configureNextImageTimeObserver):
Identifier: 316606.571@safari-7625-branch
Before / after
Loading diff…
On This Page