Changeset 182918 in webkit

Timestamp:

Apr 16, 2015, 4:04:00 PM (11 years ago)

Author:

ap@apple.com

Message:

Media element can manipulate DOM during Document destruction.
rdar://problem/20553898 and ​https://bugs.webkit.org/show_bug.cgi?id=143780

Patch by Brady Eidson <​beidson@apple.com> on 2015-04-16
Reviewed by Jer Noble.

• html/HTMLMediaElement.cpp:

(WebCore::HTMLMediaElement::configureMediaControls): Bail if the element has no active document.

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• html/HTMLMediaElement.cpp (modified) (1 diff)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2015-04-16  Brady Eidson  <beidson@apple.com>
+
+        Media element can manipulate DOM during Document destruction.
+        rdar://problem/20553898 and https://bugs.webkit.org/show_bug.cgi?id=143780
+
+        Reviewed by Jer Noble.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::configureMediaControls): Bail if the element has no active document.
+
 2015-04-13  Jer Noble  <jer.noble@apple.com>
 

trunk/Source/WebCore/html/HTMLMediaElement.cpp

@@ -5324 +5324 @@
 
 #if ENABLE(MEDIA_CONTROLS_SCRIPT)
-    if (!requireControls || !inDocument())
+    if (!requireControls || !inDocument() || !inActiveDocument())
         return;
 
     ensureUserAgentShadowRoot();
 #else
-    if (!requireControls || !inDocument()) {
+    if (!requireControls || !inDocument() || !inActiveDocument()) {
         if (hasMediaControls())
             mediaControls()->hide();