Skip to content

Commit 1b1813a

Browse files
committed
ASSERTION FAILED: actualVTablePointer == expectedVTablePointer in toJSNewlyCreated(JSC::JSGlobalObject *, WebCore::JSDOMGlobalObject *, Ref<WebCore::AudioNode> &&)
https://bugs.webkit.org/show_bug.cgi?id=225719 <rdar://77828031> Reviewed by Geoffrey Garen. Source/WebCore: AudioNode has (a lot of) subclasses that are exposed to JS (for which we call toJS() for). As a result, AudioNode needs a custom toJS() implementation which returns the correct subclass wrapper, instead of a generic JSAudioNode. Test: webaudio/event-relatedTarget-audionode.html * Modules/webaudio/AudioNode.idl: * Sources.txt: * WebCore.xcodeproj/project.pbxproj: * bindings/js/JSAudioNodeCustom.cpp: Added. (WebCore::toJSNewlyCreated): (WebCore::toJS): LayoutTests: Add layout test coverage. This test was reliably crashing before the fix. * webaudio/event-relatedTarget-audionode-expected.txt: Added. * webaudio/event-relatedTarget-audionode.html: Added. Canonical link: https://commits.webkit.org/237661@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@277411 268f45cc-cd09-0410-ab3c-d52691b4dbfc
1 parent 5d211bc commit 1b1813a

8 files changed

Lines changed: 210 additions & 0 deletions

File tree

LayoutTests/ChangeLog

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,16 @@
1+
2021-05-12 Chris Dumez <cdumez@apple.com>
2+
3+
ASSERTION FAILED: actualVTablePointer == expectedVTablePointer in toJSNewlyCreated(JSC::JSGlobalObject *, WebCore::JSDOMGlobalObject *, Ref<WebCore::AudioNode> &&)
4+
https://bugs.webkit.org/show_bug.cgi?id=225719
5+
<rdar://77828031>
6+
7+
Reviewed by Geoffrey Garen.
8+
9+
Add layout test coverage. This test was reliably crashing before the fix.
10+
11+
* webaudio/event-relatedTarget-audionode-expected.txt: Added.
12+
* webaudio/event-relatedTarget-audionode.html: Added.
13+
114
2021-05-12 Robert Jenner <jenner@apple.com>
215

316
[ BigSur Release wk2 arm64 ] http/tests/appcache/fail-on-update-2.html (layout-test) is a flaky timeout
Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
Tests that we do not crash when trying to access an Event's relatedTarget when the target is an AudioNode and we have GC'd.
2+
3+
On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
4+
5+
6+
PASS focusEvent.relatedTarget.delayTime.value is 0
7+
PASS focusEvent.relatedTarget.__proto__ is DelayNode.prototype
8+
PASS focusEvent.relatedTarget.channelCount is 2
9+
PASS focusEvent.relatedTarget.context.sampleRate is 3000
10+
PASS successfullyParsed is true
11+
12+
TEST COMPLETE
13+
Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
<!DOCTYPE html>
2+
<html>
3+
<body>
4+
<script src="../resources/js-test.js"></script>
5+
<script>
6+
description("Tests that we do not crash when trying to access an Event's relatedTarget when the target is an AudioNode and we have GC'd.");
7+
8+
let focusEvent = new FocusEvent('', {relatedTarget: new DelayNode(new AudioContext({sampleRate: 3000}))});
9+
gc();
10+
shouldBe("focusEvent.relatedTarget.delayTime.value", "0");
11+
shouldBe("focusEvent.relatedTarget.__proto__", "DelayNode.prototype");
12+
shouldBe("focusEvent.relatedTarget.channelCount", "2");
13+
shouldBe("focusEvent.relatedTarget.context.sampleRate", "3000");
14+
</script>
15+
</body>
16+
</html>

Source/WebCore/ChangeLog

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,24 @@
1+
2021-05-12 Chris Dumez <cdumez@apple.com>
2+
3+
ASSERTION FAILED: actualVTablePointer == expectedVTablePointer in toJSNewlyCreated(JSC::JSGlobalObject *, WebCore::JSDOMGlobalObject *, Ref<WebCore::AudioNode> &&)
4+
https://bugs.webkit.org/show_bug.cgi?id=225719
5+
<rdar://77828031>
6+
7+
Reviewed by Geoffrey Garen.
8+
9+
AudioNode has (a lot of) subclasses that are exposed to JS (for which we call toJS() for).
10+
As a result, AudioNode needs a custom toJS() implementation which returns the correct subclass
11+
wrapper, instead of a generic JSAudioNode.
12+
13+
Test: webaudio/event-relatedTarget-audionode.html
14+
15+
* Modules/webaudio/AudioNode.idl:
16+
* Sources.txt:
17+
* WebCore.xcodeproj/project.pbxproj:
18+
* bindings/js/JSAudioNodeCustom.cpp: Added.
19+
(WebCore::toJSNewlyCreated):
20+
(WebCore::toJS):
21+
122
2021-05-12 Ziran Sun <zsun@igalia.com>
223

324
Wrong position for orthogonal positioned element with writing-mode: vertical-rl

Source/WebCore/Modules/webaudio/AudioNode.idl

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,7 @@
2424

2525
[
2626
Conditional=WEB_AUDIO,
27+
CustomToJSObject,
2728
Exposed=Window
2829
] interface AudioNode : EventTarget {
2930
[ImplementedAs=contextForBindings] readonly attribute (BaseAudioContext or WebKitAudioContext) context;

Source/WebCore/Sources.txt

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -511,6 +511,7 @@ bindings/js/JSAnimationEffectCustom.cpp
511511
bindings/js/JSAnimationTimelineCustom.cpp
512512
bindings/js/JSAttrCustom.cpp
513513
bindings/js/JSAudioBufferCustom.cpp
514+
bindings/js/JSAudioNodeCustom.cpp
514515
bindings/js/JSAudioTrackCustom.cpp
515516
bindings/js/JSAudioTrackListCustom.cpp
516517
bindings/js/JSAudioWorkletProcessorCustom.cpp

Source/WebCore/WebCore.xcodeproj/project.pbxproj

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8305,6 +8305,7 @@
83058305
465EDDA0222F4EC400B46E16 /* DeviceOrientationOrMotionPermissionState.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = DeviceOrientationOrMotionPermissionState.idl; sourceTree = "<group>"; };
83068306
466172E923A2ABFA003AB309 /* PostMessageOptions.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = PostMessageOptions.idl; sourceTree = "<group>"; };
83078307
466172EB23A2ABFA003AB309 /* PostMessageOptions.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PostMessageOptions.h; sourceTree = "<group>"; };
8308+
466536FA264C8DD100AAD1D7 /* JSAudioNodeCustom.cpp */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.cpp; path = JSAudioNodeCustom.cpp; sourceTree = "<group>"; };
83088309
466DC6AB1EDE021D00746224 /* JSDOMRectList.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSDOMRectList.cpp; sourceTree = "<group>"; };
83098310
466ED8D21EDE0135005E43F6 /* JSDOMRectList.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSDOMRectList.h; sourceTree = "<group>"; };
83108311
4671E0631D67A57B00C6B497 /* CanvasPath.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CanvasPath.cpp; sourceTree = "<group>"; };
@@ -23003,6 +23004,7 @@
2300323004
71025ED51F99F147004A250C /* JSAnimationTimelineCustom.cpp */,
2300423005
BC2ED6BB0C6BD2F000920BFF /* JSAttrCustom.cpp */,
2300523006
46C3A8D32548D4B700C8C53A /* JSAudioBufferCustom.cpp */,
23007+
466536FA264C8DD100AAD1D7 /* JSAudioNodeCustom.cpp */,
2300623008
BE6DF70E171CA2DA00DD52B8 /* JSAudioTrackCustom.cpp */,
2300723009
BE6DF710171CA2DA00DD52B8 /* JSAudioTrackListCustom.cpp */,
2300823010
83F37A672536B21B00FF5F3B /* JSAudioWorkletProcessorCustom.cpp */,
Lines changed: 143 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,143 @@
1+
/*
2+
* Copyright (C) 2021 Apple Inc. All rights reserved.
3+
*
4+
* Redistribution and use in source and binary forms, with or without
5+
* modification, are permitted provided that the following conditions
6+
* are met:
7+
* 1. Redistributions of source code must retain the above copyright
8+
* notice, this list of conditions and the following disclaimer.
9+
* 2. Redistributions in binary form must reproduce the above copyright
10+
* notice, this list of conditions and the following disclaimer in the
11+
* documentation and/or other materials provided with the distribution.
12+
*
13+
* THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
14+
* EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
15+
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
16+
* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
17+
* CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
18+
* EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
19+
* PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
20+
* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
21+
* OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
22+
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
23+
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
24+
*/
25+
26+
#include "config.h"
27+
28+
#if ENABLE(WEB_AUDIO)
29+
#include "JSAudioNode.h"
30+
31+
#include "AnalyserNode.h"
32+
#include "AudioBufferSourceNode.h"
33+
#include "AudioDestinationNode.h"
34+
#include "AudioNode.h"
35+
#include "AudioWorkletNode.h"
36+
#include "BiquadFilterNode.h"
37+
#include "ChannelMergerNode.h"
38+
#include "ChannelSplitterNode.h"
39+
#include "ConstantSourceNode.h"
40+
#include "ConvolverNode.h"
41+
#include "DelayNode.h"
42+
#include "DynamicsCompressorNode.h"
43+
#include "GainNode.h"
44+
#include "IIRFilterNode.h"
45+
#include "JSAnalyserNode.h"
46+
#include "JSAudioBufferSourceNode.h"
47+
#include "JSAudioDestinationNode.h"
48+
#include "JSAudioWorkletNode.h"
49+
#include "JSBiquadFilterNode.h"
50+
#include "JSChannelMergerNode.h"
51+
#include "JSChannelSplitterNode.h"
52+
#include "JSConstantSourceNode.h"
53+
#include "JSConvolverNode.h"
54+
#include "JSDelayNode.h"
55+
#include "JSDynamicsCompressorNode.h"
56+
#include "JSGainNode.h"
57+
#include "JSIIRFilterNode.h"
58+
#include "JSMediaElementAudioSourceNode.h"
59+
#include "JSMediaStreamAudioDestinationNode.h"
60+
#include "JSMediaStreamAudioSourceNode.h"
61+
#include "JSOscillatorNode.h"
62+
#include "JSPannerNode.h"
63+
#include "JSScriptProcessorNode.h"
64+
#include "JSStereoPannerNode.h"
65+
#include "JSWaveShaperNode.h"
66+
#include "MediaElementAudioSourceNode.h"
67+
#include "MediaStreamAudioDestinationNode.h"
68+
#include "MediaStreamAudioSourceNode.h"
69+
#include "OscillatorNode.h"
70+
#include "PannerNode.h"
71+
#include "ScriptProcessorNode.h"
72+
#include "StereoPannerNode.h"
73+
#include "WaveShaperNode.h"
74+
75+
namespace WebCore {
76+
using namespace JSC;
77+
78+
JSValue toJSNewlyCreated(JSGlobalObject*, JSDOMGlobalObject* globalObject, Ref<AudioNode>&& node)
79+
{
80+
switch (node->nodeType()) {
81+
case AudioNode::NodeTypeDestination:
82+
return createWrapper<AudioDestinationNode>(globalObject, WTFMove(node));
83+
case AudioNode::NodeTypeOscillator:
84+
return createWrapper<OscillatorNode>(globalObject, WTFMove(node));
85+
case AudioNode::NodeTypeAudioBufferSource:
86+
return createWrapper<AudioBufferSourceNode>(globalObject, WTFMove(node));
87+
case AudioNode::NodeTypeMediaElementAudioSource:
88+
#if ENABLE(VIDEO)
89+
return createWrapper<MediaElementAudioSourceNode>(globalObject, WTFMove(node));
90+
#else
91+
return createWrapper<AudioNode>(globalObject, WTFMove(node));
92+
#endif
93+
#if ENABLE(MEDIA_STREAM)
94+
case AudioNode::NodeTypeMediaStreamAudioDestination:
95+
return createWrapper<MediaStreamAudioDestinationNode>(globalObject, WTFMove(node));
96+
case AudioNode::NodeTypeMediaStreamAudioSource:
97+
return createWrapper<MediaStreamAudioSourceNode>(globalObject, WTFMove(node));
98+
#else
99+
case AudioNode::NodeTypeMediaStreamAudioDestination:
100+
case AudioNode::NodeTypeMediaStreamAudioSource:
101+
return createWrapper<AudioNode>(globalObject, WTFMove(node));
102+
#endif
103+
case AudioNode::NodeTypeJavaScript:
104+
return createWrapper<ScriptProcessorNode>(globalObject, WTFMove(node));
105+
case AudioNode::NodeTypeBiquadFilter:
106+
return createWrapper<BiquadFilterNode>(globalObject, WTFMove(node));
107+
case AudioNode::NodeTypePanner:
108+
return createWrapper<PannerNode>(globalObject, WTFMove(node));
109+
case AudioNode::NodeTypeConvolver:
110+
return createWrapper<ConvolverNode>(globalObject, WTFMove(node));
111+
case AudioNode::NodeTypeDelay:
112+
return createWrapper<DelayNode>(globalObject, WTFMove(node));
113+
case AudioNode::NodeTypeGain:
114+
return createWrapper<GainNode>(globalObject, WTFMove(node));
115+
case AudioNode::NodeTypeChannelSplitter:
116+
return createWrapper<ChannelSplitterNode>(globalObject, WTFMove(node));
117+
case AudioNode::NodeTypeChannelMerger:
118+
return createWrapper<ChannelMergerNode>(globalObject, WTFMove(node));
119+
case AudioNode::NodeTypeAnalyser:
120+
return createWrapper<AnalyserNode>(globalObject, WTFMove(node));
121+
case AudioNode::NodeTypeDynamicsCompressor:
122+
return createWrapper<DynamicsCompressorNode>(globalObject, WTFMove(node));
123+
case AudioNode::NodeTypeWaveShaper:
124+
return createWrapper<WaveShaperNode>(globalObject, WTFMove(node));
125+
case AudioNode::NodeTypeConstant:
126+
return createWrapper<ConstantSourceNode>(globalObject, WTFMove(node));
127+
case AudioNode::NodeTypeStereoPanner:
128+
return createWrapper<StereoPannerNode>(globalObject, WTFMove(node));
129+
case AudioNode::NodeTypeIIRFilter:
130+
return createWrapper<IIRFilterNode>(globalObject, WTFMove(node));
131+
case AudioNode::NodeTypeWorklet:
132+
return createWrapper<AudioWorkletNode>(globalObject, WTFMove(node));
133+
}
134+
}
135+
136+
JSValue toJS(JSGlobalObject* lexicalGlobalObject, JSDOMGlobalObject* globalObject, AudioNode& node)
137+
{
138+
return wrap(lexicalGlobalObject, globalObject, node);
139+
}
140+
141+
} // namespace WebCore
142+
143+
#endif // ENABLE(WEB_AUDIO)

0 commit comments

Comments
 (0)