Changeset 225567 in webkit

Timestamp:

Dec 5, 2017 9:25:15 PM (6 years ago)

Author:

commit-queue@webkit.org

Message:

[GTK] Layout test media/track/track-in-band-duplicate-tracks-when-source-changes.html crashes and times out
​https://bugs.webkit.org/show_bug.cgi?id=160131

Patch by Fujii Hironori <Fujii Hironori> on 2017-12-05
Reviewed by Eric Carlson.

Source/WebCore:

Null dereference can be happen if VideoTrack and AudioTrack are
disconnected from its media element.

No new tests, no behavior change.

• html/track/AudioTrack.cpp:

(WebCore::AudioTrack::willRemove): Null-check mediaElement.

• html/track/VideoTrack.cpp:

(WebCore::VideoTrack::setLanguage): Ditto.

LayoutTests:

• platform/gtk/TestExpectations:

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/platform/gtk/TestExpectations (modified) (2 diffs)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/html/track/AudioTrack.cpp (modified) (1 diff)
• Source/WebCore/html/track/VideoTrack.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2017-12-05  Fujii Hironori  <Hironori.Fujii@sony.com>
+
+        [GTK] Layout test media/track/track-in-band-duplicate-tracks-when-source-changes.html crashes and times out
+        https://bugs.webkit.org/show_bug.cgi?id=160131
+
+        Reviewed by Eric Carlson.
+
+        * platform/gtk/TestExpectations:
+
 2017-12-05  Chris Dumez  <cdumez@apple.com>
 

trunk/LayoutTests/platform/gtk/TestExpectations

@@ -3053 +3053 @@
 webkit.org/b/163512 media/media-controls-accessibility.html [ Failure ]
 webkit.org/b/163521 media/tab-focus-inside-media-elements.html [ Failure ]
-webkit.org/b/163523 media/track/track-manual-mode.html [ Failure Crash ]
+webkit.org/b/163523 media/track/track-manual-mode.html [ Failure ]
 webkit.org/b/163524 media/track/video-track-alternate-groups.html [ Failure ]
 webkit.org/b/163525 media/video-background-tab-playback.html [ Failure Pass Crash Timeout ]
@@ -3501 +3501 @@
 webkit.org/b/160119 media/click-volume-bar-not-pausing.html [ Timeout Failure Pass ]
 
-# This one has its own bug because the crashes were preexisting; only the
-# timeout is caused by the switch to threaded compositor.
-webkit.org/b/160131 media/track/track-in-band-duplicate-tracks-when-source-changes.html [ Crash Timeout Pass ]
+webkit.org/b/160131 media/track/track-in-band-duplicate-tracks-when-source-changes.html [ Timeout Pass ]
 
 webkit.org/b/160131 plugins/return-error-from-new-stream-doesnt-invoke-destroy-stream.html [ Timeout Pass ]

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2017-12-05  Fujii Hironori  <Hironori.Fujii@sony.com>
+
+        [GTK] Layout test media/track/track-in-band-duplicate-tracks-when-source-changes.html crashes and times out
+        https://bugs.webkit.org/show_bug.cgi?id=160131
+
+        Reviewed by Eric Carlson.
+
+        Null dereference can be happen if VideoTrack and AudioTrack are
+        disconnected from its media element.
+
+        No new tests, no behavior change.
+
+        * html/track/AudioTrack.cpp:
+        (WebCore::AudioTrack::willRemove): Null-check mediaElement.
+        * html/track/VideoTrack.cpp:
+        (WebCore::VideoTrack::setLanguage): Ditto.
+
 2017-12-05  Chris Dumez  <cdumez@apple.com>
 

trunk/Source/WebCore/html/track/AudioTrack.cpp

@@ -161 +161 @@
 void AudioTrack::willRemove()
 {
-    mediaElement()->removeAudioTrack(*this);
+    auto element = makeRefPtr(mediaElement());
+    if (!element)
+        return;
+    element->removeAudioTrack(*this);
 }
 

trunk/Source/WebCore/html/track/VideoTrack.cpp

@@ -211 +211 @@
     // 4. Queue a task to fire a simple event named change at the VideoTrackList object referenced by
     // the videoTracks attribute on the HTMLMediaElement.
-    mediaElement()->videoTracks().scheduleChangeEvent();
+    if (mediaElement())
+        mediaElement()->videoTracks().scheduleChangeEvent();
 }