Prevent crash when track is deleted during video element deletion.

https://bugs.webkit.org/show_bug.cgi?id=106183

Reviewed by Dean Jackson.

Source/WebCore:

Test: media/track/track-remove-crash.html

* html/HTMLMediaElement.cpp:
(WebCore::HTMLMediaElement::removedFrom): Set m_inActiveDocument to false so we
    do not process text track cues or dispatch related events.

LayoutTests:

* media/track/track-remove-crash-expected.txt: Added.
* media/track/track-remove-crash.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@149749 268f45cc-cd09-0410-ab3c-d52691b4dbfc
parent b177e982
2013-05-08 Eric Carlson <eric.carlson@apple.com>
Prevent crash when track is deleted during video element deletion.
https://bugs.webkit.org/show_bug.cgi?id=106183
Reviewed by Dean Jackson.
* media/track/track-remove-crash-expected.txt: Added.
* media/track/track-remove-crash.html: Added.
2013-05-08 David Kilzer <ddkilzer@apple.com>
Remove chromium test results added in r149743
......
Tests that removing a track while its parent is being deleted does not crash.
No crash. PASS.
END OF TEST
<!DOCTYPE html>
<html>
<head>
<script src=../video-test.js></script>
<script>
function logEvent(evt)
{
consoleWrite("EVENT(" + evt.type + ")");
}
function startTest()
{
track1 = document.getElementsByTagName('track')[0]
track1.track.mode = 'showing';
track1.addEventListener('removetrack', logEvent);
track2 = document.getElementsByTagName('track')[1]
track2.track.mode = 'showing';
track2.addEventListener('removetrack', logEvent);
video = document.getElementsByTagName('video')[0];
setTimeout("attemptCrash()", 0);
}
document.addEventListener("DOMContentLoaded", startTest, false);
function ForceGC()
{
try { gc(); } catch(e) {}
consoleWrite("");
consoleWrite("No crash. PASS.");
consoleWrite("");
endTest();
}
function attemptCrash()
{
newDocument = document.implementation.createDocument("", null);
newDocument.appendChild(video);
delete newDocument;
setTimeout(ForceGC, 0);
}
</script>
</head>
<body>
<p>Tests that removing a track while its parent is being deleted does not crash.</p>
<video autoplay controls >
<source src="../content/test.ogv" type="video/ogg" >
<source src="../content/test.mp4" type="video/mp4" >
<track src="captions-webvtt/captions-fast.vtt">
<track src="captions-webvtt/captions-fast.vtt">
</video>
</label>
</body>
</html>
2013-05-08 Eric Carlson <eric.carlson@apple.com>
Prevent crash when track is deleted during video element deletion.
https://bugs.webkit.org/show_bug.cgi?id=106183
Reviewed by Dean Jackson.
Test: media/track/track-remove-crash.html
* html/HTMLMediaElement.cpp:
(WebCore::HTMLMediaElement::removedFrom): Set m_inActiveDocument to false so we
do not process text track cues or dispatch related events.
2013-05-08 Eric Carlson <eric.carlson@apple.com>
[Mac] Unreviewed buildfix after r149741.
......
......@@ -587,8 +587,10 @@ Node::InsertionNotificationRequest HTMLMediaElement::insertedInto(ContainerNode*
void HTMLMediaElement::removedFrom(ContainerNode* insertionPoint)
{
m_inActiveDocument = false;
if (insertionPoint->inDocument()) {
LOG(Media, "HTMLMediaElement::removedFromDocument");
LOG(Media, "HTMLMediaElement::removedFrom");
configureMediaControls();
if (m_networkState > NETWORK_EMPTY)
pause();
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment