Changeset 138966 in webkit

Timestamp:

Jan 7, 2013 11:21:07 AM (11 years ago)

Author:

victor@rosedu.org

Message:

[Track] Rendering crash
​https://bugs.webkit.org/show_bug.cgi?id=106199

Reviewed by Eric Carlson.

Source/WebCore:

The browser is crashing if a text track is added through JavaScript,
due to the fact that the containing block is not marked as inline at
the time RenderTextTrackCue::layout() is called. The fix consists
of ensuring that the pseudo id is set, even if the track isn't
yet visible.

Test: media/track/track-cue-inline-assertion-crash.html

• html/track/TextTrackCue.cpp:

(WebCore::TextTrackCue::updateDisplayTree): The pseudo-id should
be set when the display tree is generated.
(WebCore::TextTrackCue::getDisplayTree): Added extra check to not
do unneccessary logic if the track will never be displayed.

LayoutTests:

• media/track/track-cue-inline-assertion-crash-expected.txt: Added.
• media/track/track-cue-inline-assertion-crash.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/media/track/track-cue-inline-assertion-crash-expected.txt (added)
• LayoutTests/media/track/track-cue-inline-assertion-crash.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/html/track/TextTrackCue.cpp (modified) (3 diffs)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2013-01-07  Victor Carbune  <victor@rosedu.org>
+
+        [Track] Rendering crash
+        https://bugs.webkit.org/show_bug.cgi?id=106199
+
+        Reviewed by Eric Carlson.
+
+        * media/track/track-cue-inline-assertion-crash-expected.txt: Added.
+        * media/track/track-cue-inline-assertion-crash.html: Added.
+
 2013-01-07  Michael Pruett  <michael@68k.org>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2013-01-07  Victor Carbune  <victor@rosedu.org>
+
+        [Track] Rendering crash
+        https://bugs.webkit.org/show_bug.cgi?id=106199
+
+        Reviewed by Eric Carlson.
+
+        The browser is crashing if a text track is added through JavaScript,
+        due to the fact that the containing block is not marked as inline at
+        the time RenderTextTrackCue::layout() is called. The fix consists
+        of ensuring that the pseudo id is set, even if the track isn't
+        yet visible.
+
+        Test: media/track/track-cue-inline-assertion-crash.html
+
+        * html/track/TextTrackCue.cpp:
+        (WebCore::TextTrackCue::updateDisplayTree): The pseudo-id should
+        be set when the display tree is generated.
+        (WebCore::TextTrackCue::getDisplayTree): Added extra check to not
+        do unneccessary logic if the track will never be displayed.
+
 2013-01-07  Michael Pruett  <michael@68k.org>
 

trunk/Source/WebCore/html/track/TextTrackCue.cpp

@@ -696 +696 @@
       return;
 
-
     // Clear the contents of the set.
     m_allDocumentNodes->removeChildren();
-    m_allDocumentNodes->setPseudo(allNodesShadowPseudoId());
 
     // Update the two sets containing past and future WebVTT objects.
@@ -710 +708 @@
 PassRefPtr<TextTrackCueBox> TextTrackCue::getDisplayTree()
 {
-    if (!m_displayTreeShouldChange)
+    if (!m_displayTreeShouldChange || !track()->isRendered())
         return m_displayTree;
 
@@ -728 +726 @@
 
     // Note: This is contained by default in m_allDocumentNodes.
+    m_allDocumentNodes->setPseudo(allNodesShadowPseudoId());
     m_displayTree->appendChild(m_allDocumentNodes, ASSERT_NO_EXCEPTION, true);