Changeset 55917 in webkit

Timestamp:

Mar 12, 2010 11:03:06 AM (14 years ago)

Author:

eric@webkit.org

Message:

2010-03-12 Alpha Lam <​hclam@chromium.org>

Reviewed by Eric Carlson.

HTMLMediaElement crash when it is used after resource loading is canceled.
​https://bugs.webkit.org/show_bug.cgi?id=35992

Adding a test to access the duration property of a video element after
resource loading was canceled.

• http/tests/media/video-cancel-load-expected.txt: Added.
• http/tests/media/video-cancel-load.html: Added.

2010-03-12 Alpha Lam <​hclam@chromium.org>

Reviewed by Eric Carlson.

Fix a crash when resource loading of media element is canceled.
​https://bugs.webkit.org/show_bug.cgi?id=35992

Use of HTMLMediaElement::duration() after resource loading was canceled
will cause a crash. This is because HTMLMediaElement::m_player is used
when NULL.
Test: http/tests/media/video-cancel-load.html

• html/HTMLMediaElement.cpp: (WebCore::HTMLMediaElement::duration): Avoid calling to m_player when it is null. (WebCore::HTMLMediaElement::userCancelledLoad): Set m_readyState to HAVE_NOTHING.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/http/tests/media/video-cancel-load-expected.txt (added)
• LayoutTests/http/tests/media/video-cancel-load.html (added)
• WebCore/ChangeLog (modified) (1 diff)
• WebCore/html/HTMLMediaElement.cpp (modified) (2 diffs)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2010-03-12  Alpha Lam  <hclam@chromium.org>
+
+        Reviewed by Eric Carlson.
+
+        HTMLMediaElement crash when it is used after resource loading is canceled.
+        https://bugs.webkit.org/show_bug.cgi?id=35992
+
+        Adding a test to access the duration property of a video element after
+        resource loading was canceled.
+
+        * http/tests/media/video-cancel-load-expected.txt: Added.
+        * http/tests/media/video-cancel-load.html: Added.
+
 2010-03-05  Ojan Vafai  <ojan@chromium.org>
 

trunk/WebCore/ChangeLog

@@ +1 @@
+2010-03-12  Alpha Lam  <hclam@chromium.org>
+
+        Reviewed by Eric Carlson.
+
+        Fix a crash when resource loading of media element is canceled.
+        https://bugs.webkit.org/show_bug.cgi?id=35992
+
+        Use of HTMLMediaElement::duration() after resource loading was canceled
+        will cause a crash. This is because HTMLMediaElement::m_player is used
+        when NULL.
+        Test: http/tests/media/video-cancel-load.html
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::duration):
+        Avoid calling to m_player when it is null.
+        (WebCore::HTMLMediaElement::userCancelledLoad):
+        Set m_readyState to HAVE_NOTHING.
+
 2010-03-12  Dan Bernstein  <mitz@apple.com>
 

trunk/WebCore/html/HTMLMediaElement.cpp

@@ -1079 +1079 @@
 float HTMLMediaElement::duration() const
 {
-    if (m_readyState >= HAVE_METADATA)
+    if (m_player && m_readyState >= HAVE_METADATA)
         return m_player->duration();
 
@@ -1786 +1786 @@
     // 7 - Abort the overall resource selection algorithm.
     m_currentSourceNode = 0;
+
+    // Reset m_readyState since m_player is gone.
+    m_readyState = HAVE_NOTHING;
 }