Changeset 147370 in webkit

Timestamp:

Apr 1, 2013 5:00:16 PM (11 years ago)

Author:

Nate Chapin

Message:

Crash in WebCore::HTMLMediaElement::~HTMLMediaElement.
​https://bugs.webkit.org/show_bug.cgi?id=113531

Reviewed by Adam Barth.

No new tests, though this is intermittently reproducible with
http/tests/misc/delete-frame-during-readystatechange.html under ASAN.

• html/HTMLMediaElement.cpp:

(WebCore::HTMLMediaElement::~HTMLMediaElement): Clear the media player manually

before the destructor exits. Clearing the media player may cancel a resource load,
which can trigger a readystatechange event. It's possible for the HTMLMediaElement
to attempt to fire an abort event within the readystatechange event, even though it is
now in an inconsistent state. Clearling the media player before finishing the destructor
ensures that the HTMLMediaElement will at least still be alive if this case is triggered.
Set m_completelyLoaded to true to ensure that if userCancelledLoad() is called, it doesn't
attempt to fire events while destructing.

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• html/HTMLMediaElement.cpp (modified) (1 diff)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2013-04-01  Nate Chapin  <japhet@chromium.org>
+
+        Crash in WebCore::HTMLMediaElement::~HTMLMediaElement.
+        https://bugs.webkit.org/show_bug.cgi?id=113531
+
+        Reviewed by Adam Barth.
+
+        No new tests, though this is intermittently reproducible with
+        http/tests/misc/delete-frame-during-readystatechange.html under ASAN.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::~HTMLMediaElement): Clear the media player manually
+            before the destructor exits. Clearing the media player may cancel a resource load,
+            which can trigger a readystatechange event. It's possible for the HTMLMediaElement
+            to attempt to fire an abort event within the readystatechange event, even though it is
+            now in an inconsistent state. Clearling the media player before finishing the destructor
+            ensures that the HTMLMediaElement will at least still be alive if this case is triggered.
+            Set m_completelyLoaded to true to ensure that if userCancelledLoad() is called, it doesn't
+            attempt to fire events while destructing.
+
 2013-04-01  Sheriff Bot  <webkit.review.bot@gmail.com>
 

trunk/Source/WebCore/html/HTMLMediaElement.cpp

@@ -350 +350 @@
 
     removeElementFromDocumentMap(this, document());
+
+    m_completelyLoaded = true;
+    clearMediaPlayer(-1);
 }