Changeset 233570 in webkit

Timestamp:

Jul 5, 2018, 11:43:28 PM (8 years ago)

Author:

bshafiei@apple.com

Message:

Cherry-pick r233557. rdar://problem/41870910

REGRESSION(r233496): Crash in WebCore::VideoTrack::clearClient()
​https://bugs.webkit.org/show_bug.cgi?id=187377

Reviewed by Simon Fraser.

Clear m_client of an audio track or a video track before removing it from the list
since TrackListBase::m_inbandTracks may hold the last ref to the track.

• html/HTMLMediaElement.cpp: (WebCore::HTMLMediaElement::removeAudioTrack): (WebCore::HTMLMediaElement::removeVideoTrack):

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@233557 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Location:

branches/safari-606.1.24-branch/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• html/HTMLMediaElement.cpp (modified) (2 diffs)

branches/safari-606.1.24-branch/Source/WebCore/ChangeLog

@@ +1 @@
+2018-07-05  Babak Shafiei  <bshafiei@apple.com>
+
+        Cherry-pick r233557. rdar://problem/41870910
+
+    REGRESSION(r233496): Crash in WebCore::VideoTrack::clearClient()
+    https://bugs.webkit.org/show_bug.cgi?id=187377
+    
+    Reviewed by Simon Fraser.
+    
+    Clear m_client of an audio track or a video track before removing it from the list
+    since TrackListBase::m_inbandTracks may hold the last ref to the track.
+    
+    * html/HTMLMediaElement.cpp:
+    (WebCore::HTMLMediaElement::removeAudioTrack):
+    (WebCore::HTMLMediaElement::removeVideoTrack):
+    
+    
+    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@233557 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+    2018-07-05  Ryosuke Niwa  <rniwa@webkit.org>
+
+            REGRESSION(r233496): Crash in WebCore::VideoTrack::clearClient()
+            https://bugs.webkit.org/show_bug.cgi?id=187377
+
+            Reviewed by Simon Fraser.
+
+            Clear m_client of an audio track or a video track before removing it from the list
+            since TrackListBase::m_inbandTracks may hold the last ref to the track.
+
+            * html/HTMLMediaElement.cpp:
+            (WebCore::HTMLMediaElement::removeAudioTrack):
+            (WebCore::HTMLMediaElement::removeVideoTrack):
+
 2018-07-04  Carlos Garcia Campos  <cgarcia@igalia.com>
 

branches/safari-606.1.24-branch/Source/WebCore/html/HTMLMediaElement.cpp

@@ -4050 +4050 @@
 void HTMLMediaElement::removeAudioTrack(AudioTrack& track)
 {
+    track.clearClient();
     m_audioTracks->remove(track);
-    track.clearClient();
 }
 
@@ -4068 +4068 @@
 void HTMLMediaElement::removeVideoTrack(VideoTrack& track)
 {
+    track.clearClient();
     m_videoTracks->remove(track);
-    track.clearClient();
 }