Diff
Modified: branches/safari-605-branch/LayoutTests/ChangeLog (228831 => 228832)
--- branches/safari-605-branch/LayoutTests/ChangeLog 2018-02-20 22:29:43 UTC (rev 228831)
+++ branches/safari-605-branch/LayoutTests/ChangeLog 2018-02-20 22:29:46 UTC (rev 228832)
@@ -1,3 +1,21 @@
+2018-02-20 Jason Marcell <[email protected]>
+
+ Cherry-pick r228574. rdar://problem/37697675
+
+ 2018-02-16 Chris Dumez <[email protected]>
+
+ Crash under WebCore::EventTarget::fireEventListeners
+ https://bugs.webkit.org/show_bug.cgi?id=182880
+ <rdar://problem/20788804>
+
+ Reviewed by Youenn Fablet.
+
+ Add layout test coverage.
+
+ * webaudio/audiobuffersource-ended-detached-frame-expected.txt: Added.
+ * webaudio/audiobuffersource-ended-detached-frame.html: Added.
+ * webaudio/resources/audiobuffersource-ended-detached-frame-iframe.html: Added.
+
2018-02-19 Ryan Haddad <[email protected]>
Cherry-pick r228541. rdar://problem/36837397
Added: branches/safari-605-branch/LayoutTests/webaudio/audiobuffersource-ended-detached-frame-expected.txt (0 => 228832)
--- branches/safari-605-branch/LayoutTests/webaudio/audiobuffersource-ended-detached-frame-expected.txt (rev 0)
+++ branches/safari-605-branch/LayoutTests/webaudio/audiobuffersource-ended-detached-frame-expected.txt 2018-02-20 22:29:46 UTC (rev 228832)
@@ -0,0 +1,9 @@
+Test that we do not crash when trying to fire an 'ended' event at a audiobuffersource node in a detached frame.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
Added: branches/safari-605-branch/LayoutTests/webaudio/audiobuffersource-ended-detached-frame.html (0 => 228832)
--- branches/safari-605-branch/LayoutTests/webaudio/audiobuffersource-ended-detached-frame.html (rev 0)
+++ branches/safari-605-branch/LayoutTests/webaudio/audiobuffersource-ended-detached-frame.html 2018-02-20 22:29:46 UTC (rev 228832)
@@ -0,0 +1,24 @@
+<!DOCTYPE html>
+<head>
+ <script src=""
+ <script>
+ function runTest()
+ {
+ description("Test that we do not crash when trying to fire an 'ended' event at a audiobuffersource node in a detached frame.");
+ jsTestIsAsync = true;
+
+ frame = document.createElement("iframe");
+ frame.src = ""
+ frame._onload_ = function() {
+ frame.contentWindow.runTest();
+ frame.remove();
+ setTimeout(function() {
+ finishJSTest();
+ }, 10);
+ };
+ document.body.appendChild(frame);
+ }
+ </script>
+</head>
+<body _onload_="runTest()">
+</body>
Added: branches/safari-605-branch/LayoutTests/webaudio/resources/audiobuffersource-ended-detached-frame-iframe.html (0 => 228832)
--- branches/safari-605-branch/LayoutTests/webaudio/resources/audiobuffersource-ended-detached-frame-iframe.html (rev 0)
+++ branches/safari-605-branch/LayoutTests/webaudio/resources/audiobuffersource-ended-detached-frame-iframe.html 2018-02-20 22:29:46 UTC (rev 228832)
@@ -0,0 +1,26 @@
+<!DOCTYPE html>
+<html>
+<body>
+<script src=""
+<script src=""
+<script>
+ var context;
+ var source;
+
+ function runTest()
+ {
+ var sampleRate = 44100.0;
+ var numberOfFrames = 32;
+ context = new webkitOfflineAudioContext(1, numberOfFrames, sampleRate);
+ source = context.createBufferSource();
+ source.buffer = createTestBuffer(context, numberOfFrames);
+ source.connect(context.destination);
+ source._onended_ = function()
+ {
+ }
+ source.start(0);
+ context.startRendering();
+ }
+</script>
+</body>
+</html>
Modified: branches/safari-605-branch/Source/WebCore/ChangeLog (228831 => 228832)
--- branches/safari-605-branch/Source/WebCore/ChangeLog 2018-02-20 22:29:43 UTC (rev 228831)
+++ branches/safari-605-branch/Source/WebCore/ChangeLog 2018-02-20 22:29:46 UTC (rev 228832)
@@ -1,3 +1,23 @@
+2018-02-20 Jason Marcell <[email protected]>
+
+ Cherry-pick r228574. rdar://problem/37697675
+
+ 2018-02-16 Chris Dumez <[email protected]>
+
+ Crash under WebCore::EventTarget::fireEventListeners
+ https://bugs.webkit.org/show_bug.cgi?id=182880
+ <rdar://problem/20788804>
+
+ Reviewed by Youenn Fablet.
+
+ Make sure the 'ended' event does not get dispatched on a
+ AudioScheduledSourceNode after ActiveDOMObjects have been stopped.
+
+ Test: webaudio/audiobuffersource-ended-detached-frame.html
+
+ * Modules/webaudio/AudioScheduledSourceNode.cpp:
+ (WebCore::AudioScheduledSourceNode::finish):
+
2018-02-19 Jason Marcell <[email protected]>
Apply patch. rdar://problem/37590759
Modified: branches/safari-605-branch/Source/WebCore/Modules/webaudio/AudioScheduledSourceNode.cpp (228831 => 228832)
--- branches/safari-605-branch/Source/WebCore/Modules/webaudio/AudioScheduledSourceNode.cpp 2018-02-20 22:29:43 UTC (rev 228831)
+++ branches/safari-605-branch/Source/WebCore/Modules/webaudio/AudioScheduledSourceNode.cpp 2018-02-20 22:29:46 UTC (rev 228832)
@@ -33,6 +33,7 @@
#include "Event.h"
#include "EventNames.h"
#include "ScriptController.h"
+#include "ScriptExecutionContext.h"
#include <algorithm>
#include <wtf/MathExtras.h>
@@ -166,11 +167,20 @@
context().decrementActiveSourceCount();
}
- if (m_hasEndedListener) {
- callOnMainThread([protectedThis = makeRef(*this)] () mutable {
- protectedThis->dispatchEvent(Event::create(eventNames().endedEvent, false, false));
- });
- }
+ if (!m_hasEndedListener)
+ return;
+
+ auto* scriptExecutionContext = this->scriptExecutionContext();
+ if (!scriptExecutionContext)
+ return;
+
+ scriptExecutionContext->postTask([this, protectedThis = makeRef(*this)] (auto&) {
+ // Make sure ActiveDOMObjects have not been stopped after scheduling this task.
+ if (!this->scriptExecutionContext())
+ return;
+
+ this->dispatchEvent(Event::create(eventNames().endedEvent, false, false));
+ });
}
bool AudioScheduledSourceNode::addEventListener(const AtomicString& eventType, Ref<EventListener>&& listener, const AddEventListenerOptions& options)
