Changeset 233557 in webkit

Timestamp:

Jul 5, 2018, 7:32:52 PM (8 years ago)

Author:

rniwa@webkit.org

Message:

REGRESSION(r233496): Crash in WebCore::VideoTrack::clearClient()
​https://bugs.webkit.org/show_bug.cgi?id=187377

Reviewed by Simon Fraser.

Clear m_client of an audio track or a video track before removing it from the list
since TrackListBase::m_inbandTracks may hold the last ref to the track.

• html/HTMLMediaElement.cpp:

(WebCore::HTMLMediaElement::removeAudioTrack):
(WebCore::HTMLMediaElement::removeVideoTrack):

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• html/HTMLMediaElement.cpp (modified) (2 diffs)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2018-07-05  Ryosuke Niwa  <rniwa@webkit.org>
+
+        REGRESSION(r233496): Crash in WebCore::VideoTrack::clearClient()
+        https://bugs.webkit.org/show_bug.cgi?id=187377
+
+        Reviewed by Simon Fraser.
+
+        Clear m_client of an audio track or a video track before removing it from the list
+        since TrackListBase::m_inbandTracks may hold the last ref to the track.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::removeAudioTrack):
+        (WebCore::HTMLMediaElement::removeVideoTrack):
+
 2018-07-05  Fujii Hironori  <Hironori.Fujii@sony.com>
 

trunk/Source/WebCore/html/HTMLMediaElement.cpp

@@ -4050 +4050 @@
 void HTMLMediaElement::removeAudioTrack(AudioTrack& track)
 {
+    track.clearClient();
     m_audioTracks->remove(track);
-    track.clearClient();
 }
 
@@ -4068 +4068 @@
 void HTMLMediaElement::removeVideoTrack(VideoTrack& track)
 {
+    track.clearClient();
     m_videoTracks->remove(track);
-    track.clearClient();
 }