Changeset 179892 in webkit

Timestamp:

Feb 10, 2015, 3:45:53 PM (12 years ago)

Author:

bshafiei@apple.com

Message:

Merged r178426. rdar://problem/19564743

Location:

branches/safari-600.1.4.15-branch

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/media/video-ended-seek-crash-expected.txt (copied) (copied from trunk/LayoutTests/media/video-ended-seek-crash-expected.txt )
• LayoutTests/media/video-ended-seek-crash.html (copied) (copied from trunk/LayoutTests/media/video-ended-seek-crash.html )
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/html/HTMLMediaElement.cpp (modified) (1 diff)

branches/safari-600.1.4.15-branch/LayoutTests/ChangeLog

@@ +1 @@
+2015-02-10  Babak Shafiei  <bshafiei@apple.com>
+
+        Merge r178426.
+
+    2015-01-14  Jer Noble  <jer.noble@apple.com>
+
+            Null-deref crash when seeking immediately before looping.
+            https://bugs.webkit.org/show_bug.cgi?id=140394
+
+            Reviewed by Eric Carlson.
+
+            * media/video-ended-seek-crash-expected.txt: Added.
+            * media/video-ended-seek-crash.html: Added.
+
 2015-02-05  Lucas Forschler  <lforschler@apple.com>
 

branches/safari-600.1.4.15-branch/Source/WebCore/ChangeLog

@@ +1 @@
+2015-02-10  Babak Shafiei  <bshafiei@apple.com>
+
+        Merge r178426.
+
+    2015-01-14  Jer Noble  <jer.noble@apple.com>
+
+            Null-deref crash when seeking immediately before looping.
+            https://bugs.webkit.org/show_bug.cgi?id=140394
+
+            Reviewed by Eric Carlson.
+
+            It is possible for finishSeek() to be called when a seek() has caused a pending seek task
+            to be scheduled, but before that pending seek task is run. In this case, if a seek request
+            is issued, the existing pending seek task will not be cancelled, which will cause a crash
+            when the pending seek task is run.
+
+            When checking whether an existing seek task needs to be cancelled, check the actual timer,
+            rather than the m_seeking boolean, so that this case is covered.
+
+            Test: media/video-ended-seek-crash.html
+
+            * html/HTMLMediaElement.cpp:
+            (WebCore::HTMLMediaElement::seekWithTolerance):
+
 2015-02-10  Babak Shafiei  <bshafiei@apple.com>
 

branches/safari-600.1.4.15-branch/Source/WebCore/html/HTMLMediaElement.cpp

@@ -2372 +2372 @@
     // already running. Abort that other instance of the algorithm without waiting for the step that
     // it is running to complete.
-    if (m_seeking) {
+    if (m_seekTimer.isActive()) {
         m_seekTimer.stop();
         m_pendingSeek = nullptr;