Crash under JSAudioWorkletProcessorConstructor::~JSAudioWorkletProcessorConstructor()

https://bugs.webkit.org/show_bug.cgi?id=217448
<rdar://problem/70059902>

Reviewed by Geoffrey Garen.

Make sure we clear out m_processorConstructorMap in AudioWorkletGlobalScope::prepareForTermination()
since this map keeps JS wrappers alive.

No new tests, already covered by existing tests that are crashing on ASAN bots.

* Modules/webaudio/AudioWorkletGlobalScope.cpp:
(WebCore::AudioWorkletGlobalScope::prepareForTermination):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@268159 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Author: [email protected]

Source/WebCore/ChangeLog

@@ -1,3 +1,19 @@
+2020-10-07  Chris Dumez  <[email protected]>
+
+        Crash under JSAudioWorkletProcessorConstructor::~JSAudioWorkletProcessorConstructor()
+        https://bugs.webkit.org/show_bug.cgi?id=217448
+        <rdar://problem/70059902>
+
+        Reviewed by Geoffrey Garen.
+
+        Make sure we clear out m_processorConstructorMap in AudioWorkletGlobalScope::prepareForTermination()
+        since this map keeps JS wrappers alive.
+
+        No new tests, already covered by existing tests that are crashing on ASAN bots.
+
+        * Modules/webaudio/AudioWorkletGlobalScope.cpp:
+        (WebCore::AudioWorkletGlobalScope::prepareForTermination):
+
 2020-10-07  Tyler Wilcock  <[email protected]>
 
         background-clip:var(--a) invalidates -webkit-background-clip:text when --a:text

Source/WebCore/Modules/webaudio/AudioWorkletGlobalScope.cpp

@@ -115,6 +115,8 @@ void AudioWorkletGlobalScope::prepareForTermination()
         defaultTaskGroup->stopAndDiscardAllTasks();
     stopActiveDOMObjects();
 
+    m_processorConstructorMap.clear();
+
     // Event listeners would keep DOMWrapperWorld objects alive for too long. Also, they have references to JS objects,
     // which become dangling once Heap is destroyed.
     removeAllEventListeners();