Changeset 277379 in webkit

Timestamp:

May 12, 2021, 11:00:23 AM (5 years ago)

Author:

jer.noble@apple.com

Message:

HTMLMediaElement::mediaLoadingFailedFatally() does direct dispatch of events; should enqueue
​https://bugs.webkit.org/show_bug.cgi?id=225700
<rdar://75576322>

Reviewed by Eric Carlson.

In r274559, an update was made to mediaLoadingFailedFatally to adopt recent spec changes, and as
part of that change, an "error" event was changed from being enqueued to being directly dispatched.
However, directly dispatching events exposes the element to JS and has the potential to cause the
element to be garbage collected, deleting the object and potentially other objects in the backtrace.
Events should always be enqueued, rather than directy dispatched, for this reason.

• html/HTMLMediaElement.cpp:

(WebCore::HTMLMediaElement::mediaLoadingFailedFatally):

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• html/HTMLMediaElement.cpp (modified) (1 diff)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2021-05-12  Jer Noble  <jer.noble@apple.com>
+
+        HTMLMediaElement::mediaLoadingFailedFatally() does direct dispatch of events; should enqueue
+        https://bugs.webkit.org/show_bug.cgi?id=225700
+        <rdar://75576322>
+
+        Reviewed by Eric Carlson.
+
+        In r274559, an update was made to mediaLoadingFailedFatally to adopt recent spec changes, and as
+        part of that change, an "error" event was changed from being enqueued to being directly dispatched.
+        However, directly dispatching events exposes the element to JS and has the potential to cause the
+        element to be garbage collected, deleting the object and potentially other objects in the backtrace.
+        Events should always be enqueued, rather than directy dispatched, for this reason.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::mediaLoadingFailedFatally):
+
 2021-05-12  Sergio Villar Senin  <svillar@igalia.com>
 

trunk/Source/WebCore/html/HTMLMediaElement.cpp

@@ -2144 +2144 @@
 
     // 5 - Fire an event named error at the media element.
-    dispatchEvent(Event::create(eventNames().errorEvent, Event::CanBubble::No, Event::IsCancelable::No));
+    scheduleEvent(eventNames().errorEvent);
 
     // 6 - Abort the overall resource selection algorithm.