Changeset 178426 in webkit

Timestamp:

Jan 14, 2015, 10:43:05 AM (12 years ago)

Author:

jer.noble@apple.com

Message:

Null-deref crash when seeking immediately before looping.
​https://bugs.webkit.org/show_bug.cgi?id=140394

Reviewed by Eric Carlson.

Source/WebCore:

It is possible for finishSeek() to be called when a seek() has caused a pending seek task
to be scheduled, but before that pending seek task is run. In this case, if a seek request
is issued, the existing pending seek task will not be cancelled, which will cause a crash
when the pending seek task is run.

When checking whether an existing seek task needs to be cancelled, check the actual timer,
rather than the m_seeking boolean, so that this case is covered.

Test: media/video-ended-seek-crash.html

• html/HTMLMediaElement.cpp:

(WebCore::HTMLMediaElement::seekWithTolerance):

LayoutTests:

• media/video-ended-seek-crash-expected.txt: Added.
• media/video-ended-seek-crash.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/media/video-ended-seek-crash-expected.txt (added)
• LayoutTests/media/video-ended-seek-crash.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/html/HTMLMediaElement.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2015-01-14  Jer Noble  <jer.noble@apple.com>
+
+        Null-deref crash when seeking immediately before looping.
+        https://bugs.webkit.org/show_bug.cgi?id=140394
+
+        Reviewed by Eric Carlson.
+
+        * media/video-ended-seek-crash-expected.txt: Added.
+        * media/video-ended-seek-crash.html: Added.
+
 2015-01-14  Brent Fulgham  <bfulgham@apple.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2015-01-14  Jer Noble  <jer.noble@apple.com>
+
+        Null-deref crash when seeking immediately before looping.
+        https://bugs.webkit.org/show_bug.cgi?id=140394
+
+        Reviewed by Eric Carlson.
+
+        It is possible for finishSeek() to be called when a seek() has caused a pending seek task
+        to be scheduled, but before that pending seek task is run. In this case, if a seek request
+        is issued, the existing pending seek task will not be cancelled, which will cause a crash
+        when the pending seek task is run.
+
+        When checking whether an existing seek task needs to be cancelled, check the actual timer,
+        rather than the m_seeking boolean, so that this case is covered.
+
+        Test: media/video-ended-seek-crash.html
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::seekWithTolerance):
+
 2015-01-14  Brent Fulgham  <bfulgham@apple.com>
 

trunk/Source/WebCore/html/HTMLMediaElement.cpp

@@ -2350 +2350 @@
     // already running. Abort that other instance of the algorithm without waiting for the step that
     // it is running to complete.
-    if (m_seeking) {
+    if (m_seekTimer.isActive()) {
         m_seekTimer.stop();
         m_pendingSeek = nullptr;