Changeset 107632 in webkit

Timestamp:

Feb 13, 2012 4:06:25 PM (12 years ago)

Author:

commit-queue@webkit.org

Message:

Chrome crashes when attempting to add cue to track element
​https://bugs.webkit.org/show_bug.cgi?id=77951

Patch by Arun Patole <​bmf834@motorola.com> on 2012-02-13
Reviewed by Eric Carlson.

Source/WebCore:

Allocate text track's text track list of cues before using it.

• html/TextTrack.cpp:

(WebCore::TextTrack::cues):
(WebCore::TextTrack::addCue):
(WebCore::TextTrack::removeCue): return if text track list of cues is not allocated.
(WebCore::TextTrack::ensureTextTrackCueList):Added.

• html/TextTrack.h:

(TextTrack):

LayoutTests:

Updated add-remove-cue.html to handle adding a new cue to the text track created with addTextTrack.

• media/track/track-add-remove-cue-expected.txt:
• media/track/track-add-remove-cue.html:

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/media/track/track-add-remove-cue-expected.txt (modified) (1 diff)
• LayoutTests/media/track/track-add-remove-cue.html (modified) (1 diff)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/html/TextTrack.cpp (modified) (5 diffs)
• Source/WebCore/html/TextTrack.h (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2012-02-13  Arun Patole  <bmf834@motorola.com>
+
+        Chrome crashes when attempting to add cue to track element
+        https://bugs.webkit.org/show_bug.cgi?id=77951
+
+        Reviewed by Eric Carlson.
+
+        Updated add-remove-cue.html to handle adding a new cue to the text track created with addTextTrack.
+        * media/track/track-add-remove-cue-expected.txt:
+        * media/track/track-add-remove-cue.html:
+
 2012-02-13  Kenichi Ishibashi  <bashi@chromium.org>
 

trunk/LayoutTests/media/track/track-add-remove-cue-expected.txt

@@ -31 +31 @@
 EXPECTED (cues[3].startTime == '61') OK
 
+*** create a new cue and add it to a track created with video.addTextTrack, make sure it is inserted correctly.
+RUN(newTrack = video.addTextTrack("subtitles", "French subtitles", "fr"))
+RUN(newTrack.addCue(new TextTrackCue("test", 0.0, 1.0, "Test!")))
+RUN(newCue = newTrack.cues[0])
+EXPECTED (newCue.track == '[object TextTrack]') OK
+EXPECTED (newCue.id == 'test') OK
+EXPECTED (newCue.startTime == '0') OK
+EXPECTED (newCue.endTime == '1') OK
+EXPECTED (newCue.pauseOnExit == 'false') OK
+EXPECTED (newCue.direction == 'horizontal') OK
+EXPECTED (newCue.snapToLines == 'true') OK
+EXPECTED (newCue.linePosition == '-1') OK
+EXPECTED (newCue.textPosition == '50') OK
+EXPECTED (newCue.size == '100') OK
+EXPECTED (newCue.alignment == 'middle') OK
+
 *** Remove a cue created with addCue().
 RUN(testTrack.track.removeCue(textCue))

trunk/LayoutTests/media/track/track-add-remove-cue.html

@@ -44 +44 @@
                 testExpected("cues[3].startTime", 61);
 
+                consoleWrite("<br>*** create a new cue and add it to a track created with video.addTextTrack, make sure it is inserted correctly.");
+                findMediaElement();
+                run('newTrack = video.addTextTrack("subtitles", "French subtitles", "fr")');
+                newTrack.mode = 2;
+                run('newTrack.addCue(new TextTrackCue("test", 0.0, 1.0, "Test!"))');
+                run('newCue = newTrack.cues[0]');
+                testExpected("newCue.track", newTrack);
+                testExpected("newCue.id", "test");
+                testExpected("newCue.startTime", 0.0);
+                testExpected("newCue.endTime", 1.0);
+                testExpected("newCue.pauseOnExit", false);
+                testExpected("newCue.direction", "horizontal");
+                testExpected("newCue.snapToLines", true);
+                testExpected("newCue.linePosition", -1);
+                testExpected("newCue.textPosition", 50);
+                testExpected("newCue.size", 100);
+                testExpected("newCue.alignment", "middle");
+
                 consoleWrite("<br>*** Remove a cue created with addCue().");
                 run("testTrack.track.removeCue(textCue)");

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2012-02-13  Arun Patole  <bmf834@motorola.com>
+
+        Chrome crashes when attempting to add cue to track element
+        https://bugs.webkit.org/show_bug.cgi?id=77951
+
+        Reviewed by Eric Carlson.
+
+        Allocate text track's text track list of cues before using it.
+
+        * html/TextTrack.cpp:
+        (WebCore::TextTrack::cues):
+        (WebCore::TextTrack::addCue):
+        (WebCore::TextTrack::removeCue): return if text track list of cues is not allocated.
+        (WebCore::TextTrack::ensureTextTrackCueList):Added.
+        * html/TextTrack.h:
+        (TextTrack):
+
 2012-02-13  Andy Estes  <aestes@apple.com>
 

trunk/Source/WebCore/html/TextTrack.cpp

@@ -156 +156 @@
 TextTrackCueList* TextTrack::cues()
 {
-    if (!m_cues)
-        m_cues = TextTrackCueList::create();    
-
     // 4.8.10.12.5 If the text track mode ... is not the text track disabled mode,
     // then the cues attribute must return a live TextTrackCueList object ...
@@ -164 +161 @@
     // same object must be returned each time.
     // http://www.whatwg.org/specs/web-apps/current-work/#dom-texttrack-cues
-    if (m_cues && m_mode != TextTrack::DISABLED)
-        return m_cues.get();
+    if (m_mode != TextTrack::DISABLED)
+        return ensureTextTrackCueList();
     return 0;
 }
@@ -209 +206 @@
     // track's text track list of cues, then throw an InvalidStateError exception.
     // 4. Add cue to the method's TextTrack object's text track's text track list of cues.
-    if (!m_cues->add(cue)) {
+    if (!ensureTextTrackCueList()->add(cue)) {
         ec = INVALID_STATE_ERR;
         return;
@@ -237 +234 @@
     // object's text track's text track list of cues, then throw a NotFoundError exception.
     // 3. Remove cue from the method's TextTrack object's text track's text track list of cues.
-    if (!m_cues->remove(cue)) {
+    if (!m_cues || !m_cues->remove(cue)) {
         ec = INVALID_STATE_ERR;
         return;
@@ -272 +269 @@
 }
 
+TextTrackCueList* TextTrack::ensureTextTrackCueList()
+{
+    if (!m_cues)
+        m_cues = TextTrackCueList::create();
+
+    return m_cues.get();
+}
+
 } // namespace WebCore
 

trunk/Source/WebCore/html/TextTrack.h

@@ -115 +115 @@
 
 private:
+    TextTrackCueList* ensureTextTrackCueList();
     HTMLMediaElement* m_mediaElement;
     String m_kind;