Title: [202923] trunk/Source/WebCore
- Revision
- 202923
- Author
- [email protected]
- Date
- 2016-07-07 11:53:19 -0700 (Thu, 07 Jul 2016)
Log Message
Crash due to HTMLMediaElement at _javascript_Core: JSC::JSLockHolder::JSLockHolder
https://bugs.webkit.org/show_bug.cgi?id=159517
<rdar://problem/27221109>
Reviewed by Eric Carlson.
When WebKit on iOS gets a notification that the UIProcess has been backgrounded, it sends an
interruption event to the WebProcess to pause any playing HTMLMediaElements. When the
elements which get this interruption have pending promises created during a previous call to
play(), these promises get rejected.
However, if the HTMLMediaElement's document has already been destroyed, the pending Promises
are in an inconsistent state: their script execution context (the document) has been
destroyed, leading to the crash in JSLockHolder.
When HTMLMediaElement is notified that its ScriptExecutionContext has been destroyed, also
clear the list of pending Promises.
* html/HTMLMediaElement.cpp:
(WebCore::HTMLMediaElement::contextDestroyed):
Modified Paths
Diff
Modified: trunk/Source/WebCore/ChangeLog (202922 => 202923)
--- trunk/Source/WebCore/ChangeLog 2016-07-07 18:47:51 UTC (rev 202922)
+++ trunk/Source/WebCore/ChangeLog 2016-07-07 18:53:19 UTC (rev 202923)
@@ -1,3 +1,26 @@
+2016-07-07 Jer Noble <[email protected]>
+
+ Crash due to HTMLMediaElement at _javascript_Core: JSC::JSLockHolder::JSLockHolder
+ https://bugs.webkit.org/show_bug.cgi?id=159517
+ <rdar://problem/27221109>
+
+ Reviewed by Eric Carlson.
+
+ When WebKit on iOS gets a notification that the UIProcess has been backgrounded, it sends an
+ interruption event to the WebProcess to pause any playing HTMLMediaElements. When the
+ elements which get this interruption have pending promises created during a previous call to
+ play(), these promises get rejected.
+
+ However, if the HTMLMediaElement's document has already been destroyed, the pending Promises
+ are in an inconsistent state: their script execution context (the document) has been
+ destroyed, leading to the crash in JSLockHolder.
+
+ When HTMLMediaElement is notified that its ScriptExecutionContext has been destroyed, also
+ clear the list of pending Promises.
+
+ * html/HTMLMediaElement.cpp:
+ (WebCore::HTMLMediaElement::contextDestroyed):
+
2016-07-05 Jer Noble <[email protected]>
Facebook videos without audio tracks will sometimes cause playback controls to appear.
Modified: trunk/Source/WebCore/html/HTMLMediaElement.cpp (202922 => 202923)
--- trunk/Source/WebCore/html/HTMLMediaElement.cpp 2016-07-07 18:47:51 UTC (rev 202922)
+++ trunk/Source/WebCore/html/HTMLMediaElement.cpp 2016-07-07 18:53:19 UTC (rev 202923)
@@ -5096,6 +5096,8 @@
m_pauseAfterDetachedTaskQueue.close();
m_updatePlaybackControlsManagerQueue.close();
+ m_pendingPlayPromises.clear();
+
ActiveDOMObject::contextDestroyed();
}
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
