Commit ccd1e0c0 authored by tsepez@chromium.org's avatar tsepez@chromium.org
Browse files

ImageLoader can't be cleared when video element poster attribute removed.

https://bugs.webkit.org/show_bug.cgi?id=96301

Reviewed by Abhishek Arya.

Source/WebCore:

Same problem as in https://bugs.webkit.org/show_bug.cgi?id=90801. We can't
clear the image loader when the src attribute is cleared, because we might be
inside a handler called on top of an image loader event dispatch. Instead we
will rely on the OwnPtr relationship between the Element and the Image Loader
to limit the lifetime of the loader to that of the element.

Test: fast/dom/beforeload/clear-video-poster-in-beforeload-listener.html

* html/HTMLVideoElement.cpp:
(WebCore::HTMLVideoElement::parseAttribute):
Remove permature clearing of m_imageLoader.
* html/HTMLEmbedElement.cpp:
(WebCore::HTMLEmbedElement::parseAttribute):
Remove permature clearing of m_imageLoader.
* html/HTMLObjectElement.cpp:
(WebCore::HTMLObjectElement::parseAttribute):
Remove permature clearing of m_imageLoader.

LayoutTests:

Added test case.

* fast/dom/beforeload/clear-video-poster-in-beforeload-listener-expected.txt: Added.
* fast/dom/beforeload/clear-video-poster-in-beforeload-listener.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@128654 268f45cc-cd09-0410-ab3c-d52691b4dbfc
parent aaef7311
2012-09-14 Tom Sepez <tsepez@chromium.org>
ImageLoader can't be cleared when video element poster attribute removed.
https://bugs.webkit.org/show_bug.cgi?id=96301
Reviewed by Abhishek Arya.
Added test case.
* fast/dom/beforeload/clear-video-poster-in-beforeload-listener-expected.txt: Added.
* fast/dom/beforeload/clear-video-poster-in-beforeload-listener.html: Added.
2012-09-14 Jeffrey Pfau <jpfau@apple.com>
 
Allow third-party storage blocking setting to change while a page is loaded
This page tests that you can correctly clear a video object's poster attribute in a beforeload listener without causing a crash.
PASS: test completed.
<!DOCTYPE html>
<html>
<body>
<p>This page tests that you can correctly clear a video object's poster attribute in a beforeload listener without causing a crash.</p>
<div id="console">FAIL: test didn't run to completion.</div>
<script>
if (window.testRunner) {
testRunner.dumpAsText();
testRunner.waitUntilDone();
}
x = document.createElement('video');
x.addEventListener('beforeload', function () {
x.removeAttribute('poster');
document.getElementById('console').textContent = 'PASS: test completed.';
if (window.testRunner)
testRunner.notifyDone();
}, false);
x.poster = 'foobar';
</script>
</body>
</html>
2012-09-14 Tom Sepez <tsepez@chromium.org>
ImageLoader can't be cleared when video element poster attribute removed.
https://bugs.webkit.org/show_bug.cgi?id=96301
Reviewed by Abhishek Arya.
Same problem as in https://bugs.webkit.org/show_bug.cgi?id=90801. We can't
clear the image loader when the src attribute is cleared, because we might be
inside a handler called on top of an image loader event dispatch. Instead we
will rely on the OwnPtr relationship between the Element and the Image Loader
to limit the lifetime of the loader to that of the element.
Test: fast/dom/beforeload/clear-video-poster-in-beforeload-listener.html
* html/HTMLVideoElement.cpp:
(WebCore::HTMLVideoElement::parseAttribute):
Remove permature clearing of m_imageLoader.
* html/HTMLEmbedElement.cpp:
(WebCore::HTMLEmbedElement::parseAttribute):
Remove permature clearing of m_imageLoader.
* html/HTMLObjectElement.cpp:
(WebCore::HTMLObjectElement::parseAttribute):
Remove permature clearing of m_imageLoader.
2012-09-14 Jeffrey Pfau <jpfau@apple.com>
 
Allow third-party storage blocking setting to change while a page is loaded
......@@ -99,8 +99,6 @@ void HTMLEmbedElement::parseAttribute(const Attribute& attribute)
size_t pos = m_serviceType.find(";");
if (pos != notFound)
m_serviceType = m_serviceType.left(pos);
if (!isImageType() && m_imageLoader)
m_imageLoader.clear();
} else if (attribute.name() == codeAttr)
m_url = stripLeadingAndTrailingHTMLSpaces(attribute.value());
else if (attribute.name() == srcAttr) {
......
......@@ -105,8 +105,6 @@ void HTMLObjectElement::parseAttribute(const Attribute& attribute)
m_serviceType = m_serviceType.left(pos);
if (renderer())
setNeedsWidgetUpdate(true);
if (!isImageType() && m_imageLoader)
m_imageLoader.clear();
} else if (attribute.name() == dataAttr) {
m_url = stripLeadingAndTrailingHTMLSpaces(attribute.value());
if (renderer()) {
......
......@@ -116,8 +116,6 @@ void HTMLVideoElement::parseAttribute(const Attribute& attribute)
m_imageLoader = adoptPtr(new HTMLImageLoader(this));
m_imageLoader->updateFromElementIgnoringPreviousError();
} else {
if (m_imageLoader)
m_imageLoader.clear();
if (renderer())
toRenderImage(renderer())->imageResource()->setCachedImage(0);
}
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment