Changeset 202928 in webkit

Timestamp:

Jul 7, 2016, 1:13:58 PM (10 years ago)

Author:

bshafiei@apple.com

Message:

Merged r202923. rdar://problem/27221109

Location:

branches/safari-602.1.40-branch/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• html/HTMLMediaElement.cpp (modified) (1 diff)

branches/safari-602.1.40-branch/Source/WebCore/ChangeLog

@@ +1 @@
+2016-07-07  Babak Shafiei  <bshafiei@apple.com>
+
+        Merge r202923.
+
+    2016-07-07  Jer Noble  <jer.noble@apple.com>
+
+            Crash due to HTMLMediaElement at JavaScriptCore: JSC::JSLockHolder::JSLockHolder
+            https://bugs.webkit.org/show_bug.cgi?id=159517
+            <rdar://problem/27221109>
+
+            Reviewed by Eric Carlson.
+
+            When WebKit on iOS gets a notification that the UIProcess has been backgrounded, it sends an
+            interruption event to the WebProcess to pause any playing HTMLMediaElements. When the
+            elements which get this interruption have pending promises created during a previous call to
+            play(), these promises get rejected.
+
+            However, if the HTMLMediaElement's document has already been destroyed, the pending Promises
+            are in an inconsistent state: their script execution context (the document) has been
+            destroyed, leading to the crash in JSLockHolder.
+
+            When HTMLMediaElement is notified that its ScriptExecutionContext has been destroyed, also
+            clear the list of pending Promises.
+
+            * html/HTMLMediaElement.cpp:
+            (WebCore::HTMLMediaElement::contextDestroyed):
+
 2016-07-07  Babak Shafiei  <bshafiei@apple.com>
 

branches/safari-602.1.40-branch/Source/WebCore/html/HTMLMediaElement.cpp

@@ -5095 +5095 @@
     m_pauseAfterDetachedTaskQueue.close();
 
+    m_pendingPlayPromises.clear();
+
     ActiveDOMObject::contextDestroyed();
 }