[webkit-changes] [179892] branches/safari-600.1.4.15-branch

Tue, 10 Feb 2015 15:46:38 -0800

Title: [179892] branches/safari-600.1.4.15-branch

Diff

Modified: branches/safari-600.1.4.15-branch/LayoutTests/ChangeLog (179891 => 179892)


--- branches/safari-600.1.4.15-branch/LayoutTests/ChangeLog	2015-02-10 23:42:41 UTC (rev 179891)
+++ branches/safari-600.1.4.15-branch/LayoutTests/ChangeLog	2015-02-10 23:45:53 UTC (rev 179892)
@@ -1,3 +1,17 @@
+2015-02-10  Babak Shafiei  <[email protected]>
+
+        Merge r178426.
+
+    2015-01-14  Jer Noble  <[email protected]>
+
+            Null-deref crash when seeking immediately before looping.
+            https://bugs.webkit.org/show_bug.cgi?id=140394
+
+            Reviewed by Eric Carlson.
+
+            * media/video-ended-seek-crash-expected.txt: Added.
+            * media/video-ended-seek-crash.html: Added.
+
 2015-02-05  Lucas Forschler  <[email protected]>
 
         Merge r179567

Copied: branches/safari-600.1.4.15-branch/LayoutTests/media/video-ended-seek-crash-expected.txt (from rev 178426, trunk/LayoutTests/media/video-ended-seek-crash-expected.txt) (0 => 179892)


--- branches/safari-600.1.4.15-branch/LayoutTests/media/video-ended-seek-crash-expected.txt	                        (rev 0)
+++ branches/safari-600.1.4.15-branch/LayoutTests/media/video-ended-seek-crash-expected.txt	2015-02-10 23:45:53 UTC (rev 179892)
@@ -0,0 +1,11 @@
+
+EVENT(canplaythrough)
+RUN(video.currentTime = video.duration - 0.1)
+RUN(video.play())
+EVENT(ended)
+RUN(video.setAttribute("loop", "loop"))
+RUN(video.currentTime = 0)
+RUN(video.play())
+EVENT(seeked)
+END OF TEST
+

Copied: branches/safari-600.1.4.15-branch/LayoutTests/media/video-ended-seek-crash.html (from rev 178426, trunk/LayoutTests/media/video-ended-seek-crash.html) (0 => 179892)


--- branches/safari-600.1.4.15-branch/LayoutTests/media/video-ended-seek-crash.html	                        (rev 0)
+++ branches/safari-600.1.4.15-branch/LayoutTests/media/video-ended-seek-crash.html	2015-02-10 23:45:53 UTC (rev 179892)
@@ -0,0 +1,39 @@
+<!DOCTYPE html>
+<html>
+<head>
+    <title>video-ended-seek-crash</title>
+    <script src=""
+    <script src=""
+    <script>
+        function startTest()
+        {
+            findMediaElement();
+            waitForEventOnce('canplaythrough', canPlayThrough);
+            video.src = "" 'content/test');
+        }
+
+        function canPlayThrough()
+        {
+            waitForEventOnce('ended', ended);
+            run('video.currentTime = video.duration - 0.1');
+            run('video.play()');
+        }
+
+        function ended()
+        {
+            waitForEventOnce('seeked', seekedToBeginning);
+            run('video.setAttribute("loop", "loop")');
+            run('video.currentTime = 0');
+            run('video.play()');
+        }
+
+        function seekedToBeginning()
+        {
+            endTest();
+        }
+    </script>
+</head>
+<body _onload_="startTest()">
+    <video controls></video>
+</body>
+</html>
\ No newline at end of file

Modified: branches/safari-600.1.4.15-branch/Source/WebCore/ChangeLog (179891 => 179892)


--- branches/safari-600.1.4.15-branch/Source/WebCore/ChangeLog	2015-02-10 23:42:41 UTC (rev 179891)
+++ branches/safari-600.1.4.15-branch/Source/WebCore/ChangeLog	2015-02-10 23:45:53 UTC (rev 179892)
@@ -1,5 +1,29 @@
 2015-02-10  Babak Shafiei  <[email protected]>
 
+        Merge r178426.
+
+    2015-01-14  Jer Noble  <[email protected]>
+
+            Null-deref crash when seeking immediately before looping.
+            https://bugs.webkit.org/show_bug.cgi?id=140394
+
+            Reviewed by Eric Carlson.
+
+            It is possible for finishSeek() to be called when a seek() has caused a pending seek task
+            to be scheduled, but before that pending seek task is run. In this case, if a seek request
+            is issued, the existing pending seek task will not be cancelled, which will cause a crash
+            when the pending seek task is run.
+
+            When checking whether an existing seek task needs to be cancelled, check the actual timer,
+            rather than the m_seeking boolean, so that this case is covered.
+
+            Test: media/video-ended-seek-crash.html
+
+            * html/HTMLMediaElement.cpp:
+            (WebCore::HTMLMediaElement::seekWithTolerance):
+
+2015-02-10  Babak Shafiei  <[email protected]>
+
         Merge r176240.
 
     2014-11-17  Simon Fraser  <[email protected]>

Modified: branches/safari-600.1.4.15-branch/Source/WebCore/html/HTMLMediaElement.cpp (179891 => 179892)


--- branches/safari-600.1.4.15-branch/Source/WebCore/html/HTMLMediaElement.cpp	2015-02-10 23:42:41 UTC (rev 179891)
+++ branches/safari-600.1.4.15-branch/Source/WebCore/html/HTMLMediaElement.cpp	2015-02-10 23:45:53 UTC (rev 179892)
@@ -2371,7 +2371,7 @@
     // 3 - If the element's seeking IDL attribute is true, then another instance of this algorithm is
     // already running. Abort that other instance of the algorithm without waiting for the step that
     // it is running to complete.
-    if (m_seeking) {
+    if (m_seekTimer.isActive()) {
         m_seekTimer.stop();
         m_pendingSeek = nullptr;
     }

_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes

Reply via email to