Title: [181453] trunk/Source/WebCore
- Revision
- 181453
- Author
- [email protected]
- Date
- 2015-03-12 13:37:13 -0700 (Thu, 12 Mar 2015)
Log Message
REGRESSION: Crash under Heap::reportExtraMemoryAllocatedSlowCase for media element
https://bugs.webkit.org/show_bug.cgi?id=142636
Reviewed by Mark Hahnenberg.
This was a pre-existing bug that I made a lot worse in
<https://trac.webkit.org/changeset/181411>.
* html/HTMLMediaElement.cpp:
(WebCore::HTMLMediaElement::parseAttribute): Compare size before
subtracting rather than subtracting and then comparing to zero. The
latter technique is not valid for unsigned integers, which will happily
underflow into giant numbers.
* Modules/mediasource/SourceBuffer.cpp:
(WebCore::SourceBuffer::reportExtraMemoryAllocated): This code was
technically correct, but I took the opportunity to clean it up a bit.
There's no need to do two checks here, and it smells bad to check for
a negative unsigned integer.
Modified Paths
Diff
Modified: trunk/Source/WebCore/ChangeLog (181452 => 181453)
--- trunk/Source/WebCore/ChangeLog 2015-03-12 20:32:29 UTC (rev 181452)
+++ trunk/Source/WebCore/ChangeLog 2015-03-12 20:37:13 UTC (rev 181453)
@@ -1,3 +1,25 @@
+2015-03-12 Geoffrey Garen <[email protected]>
+
+ REGRESSION: Crash under Heap::reportExtraMemoryAllocatedSlowCase for media element
+ https://bugs.webkit.org/show_bug.cgi?id=142636
+
+ Reviewed by Mark Hahnenberg.
+
+ This was a pre-existing bug that I made a lot worse in
+ <https://trac.webkit.org/changeset/181411>.
+
+ * html/HTMLMediaElement.cpp:
+ (WebCore::HTMLMediaElement::parseAttribute): Compare size before
+ subtracting rather than subtracting and then comparing to zero. The
+ latter technique is not valid for unsigned integers, which will happily
+ underflow into giant numbers.
+
+ * Modules/mediasource/SourceBuffer.cpp:
+ (WebCore::SourceBuffer::reportExtraMemoryAllocated): This code was
+ technically correct, but I took the opportunity to clean it up a bit.
+ There's no need to do two checks here, and it smells bad to check for
+ a negative unsigned integer.
+
2015-03-12 Sebastian Dröge <[email protected]>
Stop using single-include headers that are only available since GStreamer >= 1.2.
Modified: trunk/Source/WebCore/Modules/mediasource/SourceBuffer.cpp (181452 => 181453)
--- trunk/Source/WebCore/Modules/mediasource/SourceBuffer.cpp 2015-03-12 20:32:29 UTC (rev 181452)
+++ trunk/Source/WebCore/Modules/mediasource/SourceBuffer.cpp 2015-03-12 20:37:13 UTC (rev 181453)
@@ -1991,18 +1991,16 @@
void SourceBuffer::reportExtraMemoryAllocated()
{
size_t extraMemoryCost = this->extraMemoryCost();
- if (extraMemoryCost < m_reportedExtraMemoryCost)
+ if (extraMemoryCost <= m_reportedExtraMemoryCost)
return;
size_t extraMemoryCostDelta = extraMemoryCost - m_reportedExtraMemoryCost;
m_reportedExtraMemoryCost = extraMemoryCost;
JSC::JSLockHolder lock(scriptExecutionContext()->vm());
- if (extraMemoryCostDelta > 0) {
- // FIXME: Adopt reportExtraMemoryVisited, and switch to reportExtraMemoryAllocated.
- // https://bugs.webkit.org/show_bug.cgi?id=142595
- scriptExecutionContext()->vm().heap.deprecatedReportExtraMemory(extraMemoryCostDelta);
- }
+ // FIXME: Adopt reportExtraMemoryVisited, and switch to reportExtraMemoryAllocated.
+ // https://bugs.webkit.org/show_bug.cgi?id=142595
+ scriptExecutionContext()->vm().heap.deprecatedReportExtraMemory(extraMemoryCostDelta);
}
Vector<String> SourceBuffer::bufferedSamplesForTrackID(const AtomicString& trackID)
Modified: trunk/Source/WebCore/html/HTMLMediaElement.cpp (181452 => 181453)
--- trunk/Source/WebCore/html/HTMLMediaElement.cpp 2015-03-12 20:32:29 UTC (rev 181452)
+++ trunk/Source/WebCore/html/HTMLMediaElement.cpp 2015-03-12 20:37:13 UTC (rev 181453)
@@ -633,14 +633,13 @@
exitFullscreen();
if (m_player) {
- JSC::VM& vm = JSDOMWindowBase::commonVM();
- JSC::JSLockHolder lock(vm);
-
size_t extraMemoryCost = m_player->extraMemoryCost();
- size_t extraMemoryCostDelta = extraMemoryCost - m_reportedExtraMemoryCost;
- m_reportedExtraMemoryCost = extraMemoryCost;
+ if (extraMemoryCost > m_reportedExtraMemoryCost) {
+ JSC::VM& vm = JSDOMWindowBase::commonVM();
+ JSC::JSLockHolder lock(vm);
- if (extraMemoryCostDelta > 0) {
+ size_t extraMemoryCostDelta = extraMemoryCost - m_reportedExtraMemoryCost;
+ m_reportedExtraMemoryCost = extraMemoryCost;
// FIXME: Adopt reportExtraMemoryVisited, and switch to reportExtraMemoryAllocated.
// https://bugs.webkit.org/show_bug.cgi?id=142595
vm.heap.deprecatedReportExtraMemory(extraMemoryCostDelta);
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
