Skip to content

GitLab

T
tangled
Commit c1a066cb authored by acolwell@chromium.org's avatar acolwell@chromium.org
Browse files
Options

Fix a crash caused by track insertion after load(). 

This patch fixes a crash caused by stale LoadMediaResource flag in
m_pendingActionFlags when load() is explicitly called on a media
element. The insertion of a <track> element triggers the crash by
triggering the scheduling of the m_loadTimer, which ends up using the
stale flag data when the timer fires. The fix is to clear the
LoadMediaResource flag from m_pendingActionFlags when a new load is
initiated.

BUG=356352
TEST=LayoutTests/media/track/track-insert-after-load-crash.html

Review URL: https://codereview.chromium.org/211373009

git-svn-id: svn://svn.chromium.org/blink/trunk@170003 bbb929c8-8fbe-4397-9dbb-9b2b20218538
parent 0ab3db3f
Hide whitespace changes
Inline Side-by-side
Showing with 24 additions and 0 deletions
third_party/WebKit/LayoutTests/media/track/track-insert-after-load-crash-expected.txt 0 → 100644
View file @ c1a066cb
Tests that inserting a <track> element immediately after a load() doesn't crash.
END OF TEST
third_party/WebKit/LayoutTests/media/track/track-insert-after-load-crash.html 0 → 100644
View file @ c1a066cb
<!DOCTYPE html>
<html>
<head>
<script src="../media-file.js"></script>
<script src="../video-test.js"></script>
</head>
<body>
<p>Tests that inserting a &lt;track&gt; element immediately after a load() doesn't crash.</p>
<video id="v"></video>
<script>
var v = document.querySelector('#v');
v.src = findMediaFile('video', '../content/test');
v.load();
v.appendChild(document.createElement('track'));
v.addEventListener('loadedmetadata', endTest);
</script>
</body>
</html>
third_party/WebKit/Source/core/html/HTMLMediaElement.cpp
View file @ c1a066cb
...@@ -604,6 +604,8 @@ void HTMLMediaElement::prepareForLoad() ...@@ -604,6 +604,8 @@ void HTMLMediaElement::prepareForLoad()
// Perform the cleanup required for the resource load algorithm to run. // Perform the cleanup required for the resource load algorithm to run.
stopPeriodicTimers(); stopPeriodicTimers();
m_loadTimer.stop(); m_loadTimer.stop();
// FIXME: Figure out appropriate place to reset LoadTextTrackResource if necessary and set m_pendingActionFlags to 0 here.
m_pendingActionFlags &= ~LoadMediaResource;
m_sentEndEvent = false; m_sentEndEvent = false;
m_sentStalledEvent = false; m_sentStalledEvent = false;
m_haveFiredLoadedData = false; m_haveFiredLoadedData = false;
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment