Changeset 207294 in webkit

Timestamp:

Oct 13, 2016 11:13:19 AM (8 years ago)

Author:

jer.noble@apple.com

Message:

CRASH at WebCore::SourceBuffer::removeCodedFrames + 37
​https://bugs.webkit.org/show_bug.cgi?id=163336

Reviewed by Alex Christensen.

Source/WebCore:

Test: media/media-source/media-source-remove-crash.html

A null-deref crash can occur if a SourceBuffer is removed from a MediaSource after
SourceBuffer.remove() is called, but before the removeTimer is fired.

• Modules/mediasource/SourceBuffer.cpp:

(WebCore::SourceBuffer::removeTimerFired):

LayoutTests:

• media/media-source/media-source-remove-crash-expected.txt: Added.
• media/media-source/media-source-remove-crash.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/media/media-source/media-source-remove-crash-expected.txt (added)
• LayoutTests/media/media-source/media-source-remove-crash.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/Modules/mediasource/SourceBuffer.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2016-10-13  Jer Noble  <jer.noble@apple.com>
+
+        CRASH at WebCore::SourceBuffer::removeCodedFrames + 37
+        https://bugs.webkit.org/show_bug.cgi?id=163336
+
+        Reviewed by Alex Christensen.
+
+        * media/media-source/media-source-remove-crash-expected.txt: Added.
+        * media/media-source/media-source-remove-crash.html: Added.
+
 2016-10-13  Sergio Villar Senin  <svillar@igalia.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2016-10-13  Jer Noble  <jer.noble@apple.com>
+
+        CRASH at WebCore::SourceBuffer::removeCodedFrames + 37
+        https://bugs.webkit.org/show_bug.cgi?id=163336
+
+        Reviewed by Alex Christensen.
+
+        Test: media/media-source/media-source-remove-crash.html
+
+        A null-deref crash can occur if a SourceBuffer is removed from a MediaSource after
+        SourceBuffer.remove() is called, but before the removeTimer is fired.
+
+        * Modules/mediasource/SourceBuffer.cpp:
+        (WebCore::SourceBuffer::removeTimerFired):
+
 2016-10-13  Michael Catanzaro  <mcatanzaro@igalia.com>
 

trunk/Source/WebCore/Modules/mediasource/SourceBuffer.cpp

@@ -830 +830 @@
 void SourceBuffer::removeTimerFired()
 {
+    if (isRemoved())
+        return;
+
     ASSERT(m_updating);
     ASSERT(m_pendingRemoveStart.isValid());