⚠ Archived content — this site is no longer maintained.   Current WebKit documentation is at docs.webkit.org.

Changeset 287751 in webkit


Ignore:
Timestamp:
Jan 7, 2022, 9:19:18 AM (5 years ago)
Author:
Russell Epstein
Message:

Cherry-pick r287604. rdar://problem/85966622

Protect frame from destruction in HTMLMediaElement::setupAndCallJS
​https://bugs.webkit.org/show_bug.cgi?id=234259

Patch by Frédéric Wang <​fwang@igalia.com> on 2022-01-04
Reviewed by Darin Adler.

Source/WebCore:

Test: http/tests/media/media-element-frame-destroyed-crash.html

  • html/HTMLMediaElement.cpp: (WebCore::HTMLMediaElement::setupAndCallJS): Protect the frame before executing the JS code, so that it is not destroyed before its associated ScriptController.

LayoutTests:

Add non-regression test, embedded in multiple iframes to make regression easily reproducible.

  • http/conf/mime.types: Ensure that ts files are served with MIME type video/mp2t as that's required to make the non-regression test work properly.
  • http/tests/media/media-element-frame-destroyed-crash-expected.txt: Added.
  • http/tests/media/media-element-frame-destroyed-crash.html: Added.
  • http/tests/media/resources/empty.ts: Added.
  • http/tests/media/resources/media-element-frame-destroyed-crash-subframe.html: Added.

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@287604 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Location:
branches/safari-612.4.9.3-branch
Files:
4 added
4 edited

Legend:

Unmodified
Added
Removed

  • branches/safari-612.4.9.3-branch/LayoutTests/ChangeLog

    r287680 r287751  
     12022-01-07  Russell Epstein  <repstein@apple.com>
     2
     3        Cherry-pick r287604. rdar://problem/85966622
     4
     5    Protect frame from destruction in HTMLMediaElement::setupAndCallJS
     6    https://bugs.webkit.org/show_bug.cgi?id=234259
     7   
     8    Patch by Frédéric Wang <fwang@igalia.com> on 2022-01-04
     9    Reviewed by Darin Adler.
     10   
     11    Source/WebCore:
     12   
     13    Test: http/tests/media/media-element-frame-destroyed-crash.html
     14   
     15    * html/HTMLMediaElement.cpp:
     16    (WebCore::HTMLMediaElement::setupAndCallJS): Protect the frame before executing the JS code,
     17    so that it is not destroyed before its associated ScriptController.
     18   
     19    LayoutTests:
     20   
     21    Add non-regression test, embedded in multiple iframes to make regression easily reproducible.
     22   
     23    * http/conf/mime.types: Ensure that ts files are served with MIME type video/mp2t as that's required
     24    to make the non-regression test work properly.
     25    * http/tests/media/media-element-frame-destroyed-crash-expected.txt: Added.
     26    * http/tests/media/media-element-frame-destroyed-crash.html: Added.
     27    * http/tests/media/resources/empty.ts: Added.
     28    * http/tests/media/resources/media-element-frame-destroyed-crash-subframe.html: Added.
     29   
     30    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@287604 268f45cc-cd09-0410-ab3c-d52691b4dbfc
     31
     32    2022-01-04  Frédéric Wang  <fwang@igalia.com>
     33
     34            Protect frame from destruction in HTMLMediaElement::setupAndCallJS
     35            https://bugs.webkit.org/show_bug.cgi?id=234259
     36
     37            Reviewed by Darin Adler.
     38
     39            Add non-regression test, embedded in multiple iframes to make regression easily reproducible.
     40
     41            * http/conf/mime.types: Ensure that ts files are served with MIME type video/mp2t as that's required
     42            to make the non-regression test work properly.
     43            * http/tests/media/media-element-frame-destroyed-crash-expected.txt: Added.
     44            * http/tests/media/media-element-frame-destroyed-crash.html: Added.
     45            * http/tests/media/resources/empty.ts: Added.
     46            * http/tests/media/resources/media-element-frame-destroyed-crash-subframe.html: Added.
     47
    1482022-01-06  Russell Epstein  <repstein@apple.com>
    249

  • branches/safari-612.4.9.3-branch/LayoutTests/http/conf/mime.types

    r271939 r287751  
    579579video/mp1s
    580580video/mp2p
    581 video/mp2t
     581video/mp2t                      ts
    582582video/mp4                       mp4
    583583video/mp4v-es

  • branches/safari-612.4.9.3-branch/Source/WebCore/ChangeLog

    r287680 r287751  
     12022-01-07  Russell Epstein  <repstein@apple.com>
     2
     3        Cherry-pick r287604. rdar://problem/85966622
     4
     5    Protect frame from destruction in HTMLMediaElement::setupAndCallJS
     6    https://bugs.webkit.org/show_bug.cgi?id=234259
     7   
     8    Patch by Frédéric Wang <fwang@igalia.com> on 2022-01-04
     9    Reviewed by Darin Adler.
     10   
     11    Source/WebCore:
     12   
     13    Test: http/tests/media/media-element-frame-destroyed-crash.html
     14   
     15    * html/HTMLMediaElement.cpp:
     16    (WebCore::HTMLMediaElement::setupAndCallJS): Protect the frame before executing the JS code,
     17    so that it is not destroyed before its associated ScriptController.
     18   
     19    LayoutTests:
     20   
     21    Add non-regression test, embedded in multiple iframes to make regression easily reproducible.
     22   
     23    * http/conf/mime.types: Ensure that ts files are served with MIME type video/mp2t as that's required
     24    to make the non-regression test work properly.
     25    * http/tests/media/media-element-frame-destroyed-crash-expected.txt: Added.
     26    * http/tests/media/media-element-frame-destroyed-crash.html: Added.
     27    * http/tests/media/resources/empty.ts: Added.
     28    * http/tests/media/resources/media-element-frame-destroyed-crash-subframe.html: Added.
     29   
     30    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@287604 268f45cc-cd09-0410-ab3c-d52691b4dbfc
     31
     32    2022-01-04  Frédéric Wang  <fwang@igalia.com>
     33
     34            Protect frame from destruction in HTMLMediaElement::setupAndCallJS
     35            https://bugs.webkit.org/show_bug.cgi?id=234259
     36
     37            Reviewed by Darin Adler.
     38
     39            Test: http/tests/media/media-element-frame-destroyed-crash.html
     40
     41            * html/HTMLMediaElement.cpp:
     42            (WebCore::HTMLMediaElement::setupAndCallJS): Protect the frame before executing the JS code,
     43            so that it is not destroyed before its associated ScriptController.
     44
    1452022-01-06  Russell Epstein  <repstein@apple.com>
    246

  • branches/safari-612.4.9.3-branch/Source/WebCore/html/HTMLMediaElement.cpp

    r285446 r287751  
    43984398    auto pendingActivity = makePendingActivity(*this);
    43994399    auto& world = ensureIsolatedWorld();
    4400     auto& scriptController = document().frame()->script();
     4400    Ref protectedFrame = *document().frame();
     4401    auto& scriptController = protectedFrame->script();
    44014402    auto* globalObject = JSC::jsCast<JSDOMGlobalObject*>(scriptController.globalObject(world));
    44024403    auto& vm = globalObject->vm();
Note: See TracChangeset for help on using the changeset viewer.