Changeset 231392 in webkit

Timestamp:

May 4, 2018 4:58:04 PM (6 years ago)

Author:

rniwa@webkit.org

Message:

Release assert in ScriptController::canExecuteScripts via HTMLMediaElement::~HTMLMediaElement()
​https://bugs.webkit.org/show_bug.cgi?id=185288

Reviewed by Jer Noble.

The crash is caused by HTMLMediaElement::~HTMLMediaElement canceling the resource load via CachedResource
which ends up calling FrameLoader::checkCompleted() and fire load event on the document synchronously.
Speculatively fix the crash by scheduling the check instead.

In long term, ResourceLoader::cancel should never fire load event synchronously: webkit.org/b/185284.

Unfortunately, no new tests since I can't get MediaResource to get destructed at the right time.

• html/HTMLMediaElement.cpp:

(WebCore::HTMLMediaElement::isRunningDestructor): Added to detect this specific case.
(WebCore::HTMLMediaElementDestructorScope): Added.
(WebCore::HTMLMediaElementDestructorScope::HTMLMediaElementDestructorScope): Added.
(WebCore::HTMLMediaElementDestructorScope::~HTMLMediaElementDestructorScope): Added.
(WebCore::HTMLMediaElement::~HTMLMediaElement): Instantiate HTMLMediaElement.

• html/HTMLMediaElement.h:
• loader/FrameLoader.cpp:

(WebCore::FrameLoader::checkCompleted): Call scheduleCheckCompleted instead of synchronously calling
checkCompleted if we're in the middle of destructing a HTMLMediaElement.

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• html/HTMLMediaElement.cpp (modified) (1 diff)
• html/HTMLMediaElement.h (modified) (1 diff)
• loader/FrameLoader.cpp (modified) (1 diff)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2018-05-03  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Release assert in ScriptController::canExecuteScripts via HTMLMediaElement::~HTMLMediaElement()
+        https://bugs.webkit.org/show_bug.cgi?id=185288
+
+        Reviewed by Jer Noble.
+
+        The crash is caused by HTMLMediaElement::~HTMLMediaElement canceling the resource load via CachedResource
+        which ends up calling FrameLoader::checkCompleted() and fire load event on the document synchronously.
+        Speculatively fix the crash by scheduling the check instead.
+
+        In long term, ResourceLoader::cancel should never fire load event synchronously: webkit.org/b/185284.
+
+        Unfortunately, no new tests since I can't get MediaResource to get destructed at the right time.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::isRunningDestructor): Added to detect this specific case.
+        (WebCore::HTMLMediaElementDestructorScope): Added.
+        (WebCore::HTMLMediaElementDestructorScope::HTMLMediaElementDestructorScope): Added.
+        (WebCore::HTMLMediaElementDestructorScope::~HTMLMediaElementDestructorScope): Added.
+        (WebCore::HTMLMediaElement::~HTMLMediaElement): Instantiate HTMLMediaElement.
+        * html/HTMLMediaElement.h:
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::checkCompleted): Call scheduleCheckCompleted instead of synchronously calling
+        checkCompleted if we're in the middle of destructing a HTMLMediaElement.
+
 2018-05-04  Ryosuke Niwa  <rniwa@webkit.org>
 

trunk/Source/WebCore/html/HTMLMediaElement.cpp

@@ -577 +577 @@
 }
 
+// FIXME: Remove this code once https://webkit.org/b/185284 is fixed.
+static unsigned s_destructorCount = 0;
+
+bool HTMLMediaElement::isRunningDestructor()
+{
+    return !!s_destructorCount;
+}
+
+class HTMLMediaElementDestructorScope {
+public:
+    HTMLMediaElementDestructorScope() { ++s_destructorCount; }
+    ~HTMLMediaElementDestructorScope() { --s_destructorCount; }
+};
+
 HTMLMediaElement::~HTMLMediaElement()
 {
+    HTMLMediaElementDestructorScope destructorScope;
     ALWAYS_LOG(LOGIDENTIFIER);
 

trunk/Source/WebCore/html/HTMLMediaElement.h

@@ -158 +158 @@
     static HTMLMediaElement* bestMediaElementForShowingPlaybackControlsManager(MediaElementSession::PlaybackControlsPurpose);
 
+    static bool isRunningDestructor();
+
     WEBCORE_EXPORT void rewind(double timeDelta);
     WEBCORE_EXPORT void returnToRealtime() override;

trunk/Source/WebCore/loader/FrameLoader.cpp

@@ -806 +806 @@
     if (m_isComplete)
         return;
+    
+    // FIXME: Remove this code once https://webkit.org/b/185284 is fixed.
+    if (HTMLMediaElement::isRunningDestructor()) {
+        ASSERT_NOT_REACHED();
+        scheduleCheckCompleted();
+        return;
+    }
 
     // FIXME: It would be better if resource loads were kicked off after render tree update (or didn't complete synchronously).