Changeset 287604 in webkit

Timestamp:

Jan 4, 2022, 11:52:54 PM (5 years ago)

Author:

commit-queue@webkit.org

Message:

Protect frame from destruction in HTMLMediaElement::setupAndCallJS
​https://bugs.webkit.org/show_bug.cgi?id=234259

Patch by Frédéric Wang <​fwang@igalia.com> on 2022-01-04
Reviewed by Darin Adler.

Source/WebCore:

Test: http/tests/media/media-element-frame-destroyed-crash.html

• html/HTMLMediaElement.cpp:

(WebCore::HTMLMediaElement::setupAndCallJS): Protect the frame before executing the JS code,
so that it is not destroyed before its associated ScriptController.

LayoutTests:

Add non-regression test, embedded in multiple iframes to make regression easily reproducible.

• http/conf/mime.types: Ensure that ts files are served with MIME type video/mp2t as that's required

to make the non-regression test work properly.

• http/tests/media/media-element-frame-destroyed-crash-expected.txt: Added.
• http/tests/media/media-element-frame-destroyed-crash.html: Added.
• http/tests/media/resources/empty.ts: Added.
• http/tests/media/resources/media-element-frame-destroyed-crash-subframe.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/http/conf/mime.types (modified) (1 diff)
• LayoutTests/http/tests/media/media-element-frame-destroyed-crash-expected.txt (added)
• LayoutTests/http/tests/media/media-element-frame-destroyed-crash.html (added)
• LayoutTests/http/tests/media/resources/empty.ts (added)
• LayoutTests/http/tests/media/resources/media-element-frame-destroyed-crash-subframe.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/html/HTMLMediaElement.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2022-01-04  Frédéric Wang  <fwang@igalia.com>
+
+        Protect frame from destruction in HTMLMediaElement::setupAndCallJS
+        https://bugs.webkit.org/show_bug.cgi?id=234259
+
+        Reviewed by Darin Adler.
+
+        Add non-regression test, embedded in multiple iframes to make regression easily reproducible.
+
+        * http/conf/mime.types: Ensure that ts files are served with MIME type video/mp2t as that's required
+        to make the non-regression test work properly.
+        * http/tests/media/media-element-frame-destroyed-crash-expected.txt: Added.
+        * http/tests/media/media-element-frame-destroyed-crash.html: Added.
+        * http/tests/media/resources/empty.ts: Added.
+        * http/tests/media/resources/media-element-frame-destroyed-crash-subframe.html: Added.
+
 2022-01-04  Antoine Quint  <graouts@webkit.org>
 

trunk/LayoutTests/http/conf/mime.types

@@ -580 +580 @@
 video/mp1s
 video/mp2p
-video/mp2t
+video/mp2t                      ts
 video/mp4                       mp4
 video/mp4v-es

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2022-01-04  Frédéric Wang  <fwang@igalia.com>
+
+        Protect frame from destruction in HTMLMediaElement::setupAndCallJS
+        https://bugs.webkit.org/show_bug.cgi?id=234259
+
+        Reviewed by Darin Adler.
+
+        Test: http/tests/media/media-element-frame-destroyed-crash.html
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::setupAndCallJS): Protect the frame before executing the JS code,
+        so that it is not destroyed before its associated ScriptController.
+
 2022-01-04  Antoine Quint  <graouts@webkit.org>
 

trunk/Source/WebCore/html/HTMLMediaElement.cpp

@@ -4585 +4585 @@
     auto pendingActivity = makePendingActivity(*this);
     auto& world = ensureIsolatedWorld();
-    auto& scriptController = document().frame()->script();
+    Ref protectedFrame = *document().frame();
+    auto& scriptController = protectedFrame->script();
     auto* globalObject = JSC::jsCast<JSDOMGlobalObject*>(scriptController.globalObject(world));
     auto& vm = globalObject->vm();