Title: [202928] branches/safari-602.1.40-branch/Source/WebCore
- Revision
- 202928
- Author
- [email protected]
- Date
- 2016-07-07 13:13:58 -0700 (Thu, 07 Jul 2016)
Log Message
Merged r202923. rdar://problem/27221109
Modified Paths
Diff
Modified: branches/safari-602.1.40-branch/Source/WebCore/ChangeLog (202927 => 202928)
--- branches/safari-602.1.40-branch/Source/WebCore/ChangeLog 2016-07-07 19:32:33 UTC (rev 202927)
+++ branches/safari-602.1.40-branch/Source/WebCore/ChangeLog 2016-07-07 20:13:58 UTC (rev 202928)
@@ -1,5 +1,32 @@
2016-07-07 Babak Shafiei <[email protected]>
+ Merge r202923.
+
+ 2016-07-07 Jer Noble <[email protected]>
+
+ Crash due to HTMLMediaElement at _javascript_Core: JSC::JSLockHolder::JSLockHolder
+ https://bugs.webkit.org/show_bug.cgi?id=159517
+ <rdar://problem/27221109>
+
+ Reviewed by Eric Carlson.
+
+ When WebKit on iOS gets a notification that the UIProcess has been backgrounded, it sends an
+ interruption event to the WebProcess to pause any playing HTMLMediaElements. When the
+ elements which get this interruption have pending promises created during a previous call to
+ play(), these promises get rejected.
+
+ However, if the HTMLMediaElement's document has already been destroyed, the pending Promises
+ are in an inconsistent state: their script execution context (the document) has been
+ destroyed, leading to the crash in JSLockHolder.
+
+ When HTMLMediaElement is notified that its ScriptExecutionContext has been destroyed, also
+ clear the list of pending Promises.
+
+ * html/HTMLMediaElement.cpp:
+ (WebCore::HTMLMediaElement::contextDestroyed):
+
+2016-07-07 Babak Shafiei <[email protected]>
+
Merge patch for rdar://problem/27175583.
2016-06-23 Dean Jackson <[email protected]>
Modified: branches/safari-602.1.40-branch/Source/WebCore/html/HTMLMediaElement.cpp (202927 => 202928)
--- branches/safari-602.1.40-branch/Source/WebCore/html/HTMLMediaElement.cpp 2016-07-07 19:32:33 UTC (rev 202927)
+++ branches/safari-602.1.40-branch/Source/WebCore/html/HTMLMediaElement.cpp 2016-07-07 20:13:58 UTC (rev 202928)
@@ -5094,6 +5094,8 @@
m_promiseTaskQueue.close();
m_pauseAfterDetachedTaskQueue.close();
+ m_pendingPlayPromises.clear();
+
ActiveDOMObject::contextDestroyed();
}
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
