Diff
Modified: branches/safari-536.28-branch/LayoutTests/ChangeLog (133702 => 133703)
--- branches/safari-536.28-branch/LayoutTests/ChangeLog 2012-11-07 01:58:54 UTC (rev 133702)
+++ branches/safari-536.28-branch/LayoutTests/ChangeLog 2012-11-07 02:02:17 UTC (rev 133703)
@@ -1,5 +1,21 @@
2012-11-06 Lucas Forschler <[email protected]>
+ Merge r128654
+
+ 2012-09-14 Tom Sepez <[email protected]>
+
+ ImageLoader can't be cleared when video element poster attribute removed.
+ https://bugs.webkit.org/show_bug.cgi?id=96301
+
+ Reviewed by Abhishek Arya.
+
+ Added test case.
+
+ * fast/dom/beforeload/clear-video-poster-in-beforeload-listener-expected.txt: Added.
+ * fast/dom/beforeload/clear-video-poster-in-beforeload-listener.html: Added.
+
+2012-11-06 Lucas Forschler <[email protected]>
+
Merge r127082
2012-08-29 Michael Saboff <[email protected]>
@@ -11157,3 +11173,4 @@
.
.
.
+.
Copied: branches/safari-536.28-branch/LayoutTests/fast/dom/beforeload/clear-video-poster-in-beforeload-listener-expected.txt (from rev 128654, trunk/LayoutTests/fast/dom/beforeload/clear-video-poster-in-beforeload-listener-expected.txt) (0 => 133703)
--- branches/safari-536.28-branch/LayoutTests/fast/dom/beforeload/clear-video-poster-in-beforeload-listener-expected.txt (rev 0)
+++ branches/safari-536.28-branch/LayoutTests/fast/dom/beforeload/clear-video-poster-in-beforeload-listener-expected.txt 2012-11-07 02:02:17 UTC (rev 133703)
@@ -0,0 +1,3 @@
+This page tests that you can correctly clear a video object's poster attribute in a beforeload listener without causing a crash.
+
+PASS: test completed.
Copied: branches/safari-536.28-branch/LayoutTests/fast/dom/beforeload/clear-video-poster-in-beforeload-listener.html (from rev 128654, trunk/LayoutTests/fast/dom/beforeload/clear-video-poster-in-beforeload-listener.html) (0 => 133703)
--- branches/safari-536.28-branch/LayoutTests/fast/dom/beforeload/clear-video-poster-in-beforeload-listener.html (rev 0)
+++ branches/safari-536.28-branch/LayoutTests/fast/dom/beforeload/clear-video-poster-in-beforeload-listener.html 2012-11-07 02:02:17 UTC (rev 133703)
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<html>
+<body>
+<p>This page tests that you can correctly clear a video object's poster attribute in a beforeload listener without causing a crash.</p>
+<div id="console">FAIL: test didn't run to completion.</div>
+<script>
+if (window.testRunner) {
+ testRunner.dumpAsText();
+ testRunner.waitUntilDone();
+}
+x = document.createElement('video');
+x.addEventListener('beforeload', function () {
+ x.removeAttribute('poster');
+ document.getElementById('console').textContent = 'PASS: test completed.';
+ if (window.testRunner)
+ testRunner.notifyDone();
+}, false);
+x.poster = 'foobar';
+</script>
+</body>
+</html>
Modified: branches/safari-536.28-branch/Source/WebCore/ChangeLog (133702 => 133703)
--- branches/safari-536.28-branch/Source/WebCore/ChangeLog 2012-11-07 01:58:54 UTC (rev 133702)
+++ branches/safari-536.28-branch/Source/WebCore/ChangeLog 2012-11-07 02:02:17 UTC (rev 133703)
@@ -1,5 +1,34 @@
2012-11-06 Lucas Forschler <[email protected]>
+ Merge r128654
+
+ 2012-09-14 Tom Sepez <[email protected]>
+
+ ImageLoader can't be cleared when video element poster attribute removed.
+ https://bugs.webkit.org/show_bug.cgi?id=96301
+
+ Reviewed by Abhishek Arya.
+
+ Same problem as in https://bugs.webkit.org/show_bug.cgi?id=90801. We can't
+ clear the image loader when the src attribute is cleared, because we might be
+ inside a handler called on top of an image loader event dispatch. Instead we
+ will rely on the OwnPtr relationship between the Element and the Image Loader
+ to limit the lifetime of the loader to that of the element.
+
+ Test: fast/dom/beforeload/clear-video-poster-in-beforeload-listener.html
+
+ * html/HTMLVideoElement.cpp:
+ (WebCore::HTMLVideoElement::parseAttribute):
+ Remove permature clearing of m_imageLoader.
+ * html/HTMLEmbedElement.cpp:
+ (WebCore::HTMLEmbedElement::parseAttribute):
+ Remove permature clearing of m_imageLoader.
+ * html/HTMLObjectElement.cpp:
+ (WebCore::HTMLObjectElement::parseAttribute):
+ Remove permature clearing of m_imageLoader.
+
+2012-11-06 Lucas Forschler <[email protected]>
+
Merge r127082
2012-08-29 Michael Saboff <[email protected]>
@@ -206839,3 +206868,4 @@
.
.
.
+.
Modified: branches/safari-536.28-branch/Source/WebCore/html/HTMLEmbedElement.cpp (133702 => 133703)
--- branches/safari-536.28-branch/Source/WebCore/html/HTMLEmbedElement.cpp 2012-11-07 01:58:54 UTC (rev 133702)
+++ branches/safari-536.28-branch/Source/WebCore/html/HTMLEmbedElement.cpp 2012-11-07 02:02:17 UTC (rev 133703)
@@ -101,8 +101,6 @@
size_t pos = m_serviceType.find(";");
if (pos != notFound)
m_serviceType = m_serviceType.left(pos);
- if (!isImageType() && m_imageLoader)
- m_imageLoader.clear();
} else if (attr->name() == codeAttr)
m_url = stripLeadingAndTrailingHTMLSpaces(value.string());
else if (attr->name() == srcAttr) {
Modified: branches/safari-536.28-branch/Source/WebCore/html/HTMLObjectElement.cpp (133702 => 133703)
--- branches/safari-536.28-branch/Source/WebCore/html/HTMLObjectElement.cpp 2012-11-07 01:58:54 UTC (rev 133702)
+++ branches/safari-536.28-branch/Source/WebCore/html/HTMLObjectElement.cpp 2012-11-07 02:02:17 UTC (rev 133703)
@@ -105,8 +105,6 @@
m_serviceType = m_serviceType.left(pos);
if (renderer())
setNeedsWidgetUpdate(true);
- if (!isImageType() && m_imageLoader)
- m_imageLoader.clear();
} else if (attr->name() == dataAttr) {
m_url = stripLeadingAndTrailingHTMLSpaces(attr->value());
if (renderer()) {
Modified: branches/safari-536.28-branch/Source/WebCore/html/HTMLVideoElement.cpp (133702 => 133703)
--- branches/safari-536.28-branch/Source/WebCore/html/HTMLVideoElement.cpp 2012-11-07 01:58:54 UTC (rev 133702)
+++ branches/safari-536.28-branch/Source/WebCore/html/HTMLVideoElement.cpp 2012-11-07 02:02:17 UTC (rev 133703)
@@ -118,8 +118,6 @@
m_imageLoader = adoptPtr(new HTMLImageLoader(this));
m_imageLoader->updateFromElementIgnoringPreviousError();
} else {
- if (m_imageLoader)
- m_imageLoader.clear();
if (renderer())
toRenderImage(renderer())->imageResource()->setCachedImage(0);
}
