Title: [89762] trunk
- Revision
- 89762
- Author
- [email protected]
- Date
- 2011-06-25 21:33:36 -0700 (Sat, 25 Jun 2011)
Log Message
2011-06-25 Dimitri Glazkov <[email protected]>
Reviewed by Adam Barth.
Crash in frameless document with media element.
https://bugs.webkit.org/show_bug.cgi?id=63393
* fast/dom/shadow/frameless-media-element-crash.html: Added.
* fast/dom/shadow/frameless-media-element-crash-expected.txt: Added.
2011-06-25 Dimitri Glazkov <[email protected]>
Reviewed by Adam Barth.
Crash in frameless document with media element.
https://bugs.webkit.org/show_bug.cgi?id=63393
Since MediaControls::create can return 0 (and does for frameless documents), we must anticipate it
in the calling code.
Test: fast/dom/shadow/frameless-media-element-crash.html
* html/HTMLMediaElement.cpp:
(WebCore::HTMLMediaElement::attributeChanged): Changed to bail out if controls weren't successfully created.
(WebCore::HTMLMediaElement::createMediaControls): Renamed to better reflect the purpose, changed to handle failure of creation.
(WebCore::HTMLMediaElement::preDispatchEventHandler): Changed to bail out if controls weren't successfully created.
* html/HTMLMediaElement.h: Adjusted def.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (89761 => 89762)
--- trunk/LayoutTests/ChangeLog 2011-06-26 04:09:40 UTC (rev 89761)
+++ trunk/LayoutTests/ChangeLog 2011-06-26 04:33:36 UTC (rev 89762)
@@ -1,3 +1,13 @@
+2011-06-25 Dimitri Glazkov <[email protected]>
+
+ Reviewed by Adam Barth.
+
+ Crash in frameless document with media element.
+ https://bugs.webkit.org/show_bug.cgi?id=63393
+
+ * fast/dom/shadow/frameless-media-element-crash.html: Added.
+ * fast/dom/shadow/frameless-media-element-crash-expected.txt: Added.
+
2011-06-25 Dirk Schulze <[email protected]>
Reviewed by Nikolas Zimmermann.
Added: trunk/LayoutTests/fast/dom/shadow/frameless-media-element-crash-expected.txt (0 => 89762)
--- trunk/LayoutTests/fast/dom/shadow/frameless-media-element-crash-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/dom/shadow/frameless-media-element-crash-expected.txt 2011-06-26 04:33:36 UTC (rev 89762)
@@ -0,0 +1,3 @@
+Creating a video element in a frameless document should not crash WebKit.
+
+This test passes if it does not crash.
Added: trunk/LayoutTests/fast/dom/shadow/frameless-media-element-crash.html (0 => 89762)
--- trunk/LayoutTests/fast/dom/shadow/frameless-media-element-crash.html (rev 0)
+++ trunk/LayoutTests/fast/dom/shadow/frameless-media-element-crash.html 2011-06-26 04:33:36 UTC (rev 89762)
@@ -0,0 +1,12 @@
+<script>
+if (window.layoutTestController)
+ layoutTestController.dumpAsText();
+
+var doc = document.implementation.createHTMLDocument();
+doc.open();
+doc.write('<video controls></video>');
+doc.close();
+
+</script>
+<p>Creating a video element in a frameless document should not crash WebKit.
+<p>This test passes if it does not crash.
\ No newline at end of file
Modified: trunk/Source/WebCore/ChangeLog (89761 => 89762)
--- trunk/Source/WebCore/ChangeLog 2011-06-26 04:09:40 UTC (rev 89761)
+++ trunk/Source/WebCore/ChangeLog 2011-06-26 04:33:36 UTC (rev 89762)
@@ -1,3 +1,21 @@
+2011-06-25 Dimitri Glazkov <[email protected]>
+
+ Reviewed by Adam Barth.
+
+ Crash in frameless document with media element.
+ https://bugs.webkit.org/show_bug.cgi?id=63393
+
+ Since MediaControls::create can return 0 (and does for frameless documents), we must anticipate it
+ in the calling code.
+
+ Test: fast/dom/shadow/frameless-media-element-crash.html
+
+ * html/HTMLMediaElement.cpp:
+ (WebCore::HTMLMediaElement::attributeChanged): Changed to bail out if controls weren't successfully created.
+ (WebCore::HTMLMediaElement::createMediaControls): Renamed to better reflect the purpose, changed to handle failure of creation.
+ (WebCore::HTMLMediaElement::preDispatchEventHandler): Changed to bail out if controls weren't successfully created.
+ * html/HTMLMediaElement.h: Adjusted def.
+
2011-06-25 Joseph Pecoraro <[email protected]>
Reviewed by Darin Adler.
Modified: trunk/Source/WebCore/html/HTMLMediaElement.cpp (89761 => 89762)
--- trunk/Source/WebCore/html/HTMLMediaElement.cpp 2011-06-26 04:09:40 UTC (rev 89761)
+++ trunk/Source/WebCore/html/HTMLMediaElement.cpp 2011-06-26 04:33:36 UTC (rev 89762)
@@ -232,7 +232,9 @@
#if !ENABLE(PLUGIN_PROXY_FOR_VIDEO)
if (controls()) {
if (!hasMediaControls()) {
- ensureMediaControls();
+ if (!createMediaControls())
+ return;
+
mediaControls()->reset();
}
mediaControls()->show();
@@ -2755,13 +2757,18 @@
return node && node->isMediaControls();
}
-void HTMLMediaElement::ensureMediaControls()
+bool HTMLMediaElement::createMediaControls()
{
if (hasMediaControls())
- return;
+ return true;
ExceptionCode ec;
- ensureShadowRoot()->appendChild(MediaControls::create(this), ec);
+ RefPtr<MediaControls> controls = MediaControls::create(this);
+ if (!controls)
+ return false;
+
+ ensureShadowRoot()->appendChild(controls, ec);
+ return true;
}
void* HTMLMediaElement::preDispatchEventHandler(Event* event)
@@ -2769,7 +2776,9 @@
if (event && event->type() == eventNames().webkitfullscreenchangeEvent) {
if (controls()) {
if (!hasMediaControls()) {
- ensureMediaControls();
+ if (!createMediaControls())
+ return 0;
+
mediaControls()->reset();
}
mediaControls()->show();
Modified: trunk/Source/WebCore/html/HTMLMediaElement.h (89761 => 89762)
--- trunk/Source/WebCore/html/HTMLMediaElement.h 2011-06-26 04:09:40 UTC (rev 89761)
+++ trunk/Source/WebCore/html/HTMLMediaElement.h 2011-06-26 04:33:36 UTC (rev 89762)
@@ -338,7 +338,7 @@
void refreshCachedTime() const;
bool hasMediaControls();
- void ensureMediaControls();
+ bool createMediaControls();
virtual void* preDispatchEventHandler(Event*);
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
