Changeset 202923 in webkit

Timestamp:

Jul 7, 2016, 11:53:19 AM (10 years ago)

Author:

jer.noble@apple.com

Message:

Crash due to HTMLMediaElement at JavaScriptCore: JSC::JSLockHolder::JSLockHolder
​https://bugs.webkit.org/show_bug.cgi?id=159517
<rdar://problem/27221109>

Reviewed by Eric Carlson.

When WebKit on iOS gets a notification that the UIProcess has been backgrounded, it sends an
interruption event to the WebProcess to pause any playing HTMLMediaElements. When the
elements which get this interruption have pending promises created during a previous call to
play(), these promises get rejected.

However, if the HTMLMediaElement's document has already been destroyed, the pending Promises
are in an inconsistent state: their script execution context (the document) has been
destroyed, leading to the crash in JSLockHolder.

When HTMLMediaElement is notified that its ScriptExecutionContext has been destroyed, also
clear the list of pending Promises.

• html/HTMLMediaElement.cpp:

(WebCore::HTMLMediaElement::contextDestroyed):

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• html/HTMLMediaElement.cpp (modified) (1 diff)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2016-07-07  Jer Noble  <jer.noble@apple.com>
+
+        Crash due to HTMLMediaElement at JavaScriptCore: JSC::JSLockHolder::JSLockHolder
+        https://bugs.webkit.org/show_bug.cgi?id=159517
+        <rdar://problem/27221109>
+
+        Reviewed by Eric Carlson.
+
+        When WebKit on iOS gets a notification that the UIProcess has been backgrounded, it sends an
+        interruption event to the WebProcess to pause any playing HTMLMediaElements. When the
+        elements which get this interruption have pending promises created during a previous call to
+        play(), these promises get rejected.
+
+        However, if the HTMLMediaElement's document has already been destroyed, the pending Promises
+        are in an inconsistent state: their script execution context (the document) has been
+        destroyed, leading to the crash in JSLockHolder.
+
+        When HTMLMediaElement is notified that its ScriptExecutionContext has been destroyed, also
+        clear the list of pending Promises.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::contextDestroyed):
+
 2016-07-05  Jer Noble  <jer.noble@apple.com>
 

trunk/Source/WebCore/html/HTMLMediaElement.cpp

@@ -5097 +5097 @@
     m_updatePlaybackControlsManagerQueue.close();
 
+    m_pendingPlayPromises.clear();
+
     ActiveDOMObject::contextDestroyed();
 }