Changeset 287804 in webkit

Timestamp:

Jan 7, 2022, 6:45:22 PM (5 years ago)

Author:

Russell Epstein

Message:

Revert "Cherry-pick r287604. rdar://problem/85966622"

This reverts commit r287751.

Location:

branches/safari-612.4.9.3-branch

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/http/conf/mime.types (modified) (1 diff)
• LayoutTests/http/tests/media/media-element-frame-destroyed-crash-expected.txt (deleted)
• LayoutTests/http/tests/media/media-element-frame-destroyed-crash.html (deleted)
• LayoutTests/http/tests/media/resources/empty.ts (deleted)
• LayoutTests/http/tests/media/resources/media-element-frame-destroyed-crash-subframe.html (deleted)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/html/HTMLMediaElement.cpp (modified) (1 diff)

branches/safari-612.4.9.3-branch/LayoutTests/ChangeLog

@@ -1 @@
-2022-01-07  Russell Epstein  <repstein@apple.com>
-
-        Cherry-pick r287604. rdar://problem/85966622
-
-    Protect frame from destruction in HTMLMediaElement::setupAndCallJS
-    https://bugs.webkit.org/show_bug.cgi?id=234259
-    
-    Patch by Frédéric Wang <fwang@igalia.com> on 2022-01-04
-    Reviewed by Darin Adler.
-    
-    Source/WebCore:
-    
-    Test: http/tests/media/media-element-frame-destroyed-crash.html
-    
-    * html/HTMLMediaElement.cpp:
-    (WebCore::HTMLMediaElement::setupAndCallJS): Protect the frame before executing the JS code,
-    so that it is not destroyed before its associated ScriptController.
-    
-    LayoutTests:
-    
-    Add non-regression test, embedded in multiple iframes to make regression easily reproducible.
-    
-    * http/conf/mime.types: Ensure that ts files are served with MIME type video/mp2t as that's required
-    to make the non-regression test work properly.
-    * http/tests/media/media-element-frame-destroyed-crash-expected.txt: Added.
-    * http/tests/media/media-element-frame-destroyed-crash.html: Added.
-    * http/tests/media/resources/empty.ts: Added.
-    * http/tests/media/resources/media-element-frame-destroyed-crash-subframe.html: Added.
-    
-    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@287604 268f45cc-cd09-0410-ab3c-d52691b4dbfc
-
-    2022-01-04  Frédéric Wang  <fwang@igalia.com>
-
-            Protect frame from destruction in HTMLMediaElement::setupAndCallJS
-            https://bugs.webkit.org/show_bug.cgi?id=234259
-
-            Reviewed by Darin Adler.
-
-            Add non-regression test, embedded in multiple iframes to make regression easily reproducible.
-
-            * http/conf/mime.types: Ensure that ts files are served with MIME type video/mp2t as that's required
-            to make the non-regression test work properly.
-            * http/tests/media/media-element-frame-destroyed-crash-expected.txt: Added.
-            * http/tests/media/media-element-frame-destroyed-crash.html: Added.
-            * http/tests/media/resources/empty.ts: Added.
-            * http/tests/media/resources/media-element-frame-destroyed-crash-subframe.html: Added.
-
 2022-01-06  Russell Epstein  <repstein@apple.com>
 

branches/safari-612.4.9.3-branch/LayoutTests/http/conf/mime.types

@@ -579 +579 @@
 video/mp1s
 video/mp2p
-video/mp2t                      ts
+video/mp2t
 video/mp4                       mp4
 video/mp4v-es

branches/safari-612.4.9.3-branch/Source/WebCore/ChangeLog

@@ -1 @@
-2022-01-07  Russell Epstein  <repstein@apple.com>
-
-        Cherry-pick r287604. rdar://problem/85966622
-
-    Protect frame from destruction in HTMLMediaElement::setupAndCallJS
-    https://bugs.webkit.org/show_bug.cgi?id=234259
-    
-    Patch by Frédéric Wang <fwang@igalia.com> on 2022-01-04
-    Reviewed by Darin Adler.
-    
-    Source/WebCore:
-    
-    Test: http/tests/media/media-element-frame-destroyed-crash.html
-    
-    * html/HTMLMediaElement.cpp:
-    (WebCore::HTMLMediaElement::setupAndCallJS): Protect the frame before executing the JS code,
-    so that it is not destroyed before its associated ScriptController.
-    
-    LayoutTests:
-    
-    Add non-regression test, embedded in multiple iframes to make regression easily reproducible.
-    
-    * http/conf/mime.types: Ensure that ts files are served with MIME type video/mp2t as that's required
-    to make the non-regression test work properly.
-    * http/tests/media/media-element-frame-destroyed-crash-expected.txt: Added.
-    * http/tests/media/media-element-frame-destroyed-crash.html: Added.
-    * http/tests/media/resources/empty.ts: Added.
-    * http/tests/media/resources/media-element-frame-destroyed-crash-subframe.html: Added.
-    
-    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@287604 268f45cc-cd09-0410-ab3c-d52691b4dbfc
-
-    2022-01-04  Frédéric Wang  <fwang@igalia.com>
-
-            Protect frame from destruction in HTMLMediaElement::setupAndCallJS
-            https://bugs.webkit.org/show_bug.cgi?id=234259
-
-            Reviewed by Darin Adler.
-
-            Test: http/tests/media/media-element-frame-destroyed-crash.html
-
-            * html/HTMLMediaElement.cpp:
-            (WebCore::HTMLMediaElement::setupAndCallJS): Protect the frame before executing the JS code,
-            so that it is not destroyed before its associated ScriptController.
-
 2022-01-06  Russell Epstein  <repstein@apple.com>
 

branches/safari-612.4.9.3-branch/Source/WebCore/html/HTMLMediaElement.cpp

@@ -4398 +4398 @@
     auto pendingActivity = makePendingActivity(*this);
     auto& world = ensureIsolatedWorld();
-    Ref protectedFrame = *document().frame();
-    auto& scriptController = protectedFrame->script();
+    auto& scriptController = document().frame()->script();
     auto* globalObject = JSC::jsCast<JSDOMGlobalObject*>(scriptController.globalObject(world));
     auto& vm = globalObject->vm();