Title: [187655] trunk/Source/WebCore
- Revision
- 187655
- Author
- [email protected]
- Date
- 2015-07-31 10:49:15 -0700 (Fri, 31 Jul 2015)
Log Message
CRASH at WebCore::TaskDispatcher<WebCore::ScriptExecutionContext>::postTask + 38
https://bugs.webkit.org/show_bug.cgi?id=147485
Reviewed by Eric Carlson.
CrashLogs indicate a use-after-free of the ScriptExecutionContext (i.e., Document) used by
the GenericTaskQueue objects owned by HTMLMediaElement. When the ScriptExecutionContext
notifies its ActiveDOMObjects that it is about to be destroyed, close() the
GenericTaskQueues so that they can no longer accept new tasks.
Previously, enqueueing a task on a closed GenericTaskQueue ASSERTed in debug builds, but
silently succeeded in release builds. Calling enqueueTask() on a closed GenericTaskQueue is
now a no-op.
* html/HTMLMediaElement.cpp:
(WebCore::HTMLMediaElement::contextDestroyed):
* html/HTMLMediaElement.h:
* platform/GenericTaskQueue.h:
(WebCore::GenericTaskQueue::enqueueTask):
Modified Paths
Diff
Modified: trunk/Source/WebCore/ChangeLog (187654 => 187655)
--- trunk/Source/WebCore/ChangeLog 2015-07-31 17:08:51 UTC (rev 187654)
+++ trunk/Source/WebCore/ChangeLog 2015-07-31 17:49:15 UTC (rev 187655)
@@ -1,3 +1,25 @@
+2015-07-31 Jer Noble <[email protected]>
+
+ CRASH at WebCore::TaskDispatcher<WebCore::ScriptExecutionContext>::postTask + 38
+ https://bugs.webkit.org/show_bug.cgi?id=147485
+
+ Reviewed by Eric Carlson.
+
+ CrashLogs indicate a use-after-free of the ScriptExecutionContext (i.e., Document) used by
+ the GenericTaskQueue objects owned by HTMLMediaElement. When the ScriptExecutionContext
+ notifies its ActiveDOMObjects that it is about to be destroyed, close() the
+ GenericTaskQueues so that they can no longer accept new tasks.
+
+ Previously, enqueueing a task on a closed GenericTaskQueue ASSERTed in debug builds, but
+ silently succeeded in release builds. Calling enqueueTask() on a closed GenericTaskQueue is
+ now a no-op.
+
+ * html/HTMLMediaElement.cpp:
+ (WebCore::HTMLMediaElement::contextDestroyed):
+ * html/HTMLMediaElement.h:
+ * platform/GenericTaskQueue.h:
+ (WebCore::GenericTaskQueue::enqueueTask):
+
2015-07-31 Zan Dobersek <[email protected]>
[GTK] Have DataObjectGtk::unknownTypes() return a reference to the HashMap object
Modified: trunk/Source/WebCore/html/HTMLMediaElement.cpp (187654 => 187655)
--- trunk/Source/WebCore/html/HTMLMediaElement.cpp 2015-07-31 17:08:51 UTC (rev 187654)
+++ trunk/Source/WebCore/html/HTMLMediaElement.cpp 2015-07-31 17:49:15 UTC (rev 187655)
@@ -4908,6 +4908,13 @@
updateSleepDisabling();
}
+void HTMLMediaElement::contextDestroyed()
+{
+ m_seekTaskQueue.close();
+ m_resizeTaskQueue.close();
+ m_shadowDOMTaskQueue.close();
+}
+
void HTMLMediaElement::stop()
{
LOG(Media, "HTMLMediaElement::stop(%p)", this);
Modified: trunk/Source/WebCore/html/HTMLMediaElement.h (187654 => 187655)
--- trunk/Source/WebCore/html/HTMLMediaElement.h 2015-07-31 17:08:51 UTC (rev 187654)
+++ trunk/Source/WebCore/html/HTMLMediaElement.h 2015-07-31 17:49:15 UTC (rev 187655)
@@ -511,6 +511,7 @@
void resume() override;
void stop() override;
void stopWithoutDestroyingMediaPlayer();
+ virtual void contextDestroyed() override;
virtual void mediaVolumeDidChange() override;
Modified: trunk/Source/WebCore/platform/GenericTaskQueue.h (187654 => 187655)
--- trunk/Source/WebCore/platform/GenericTaskQueue.h 2015-07-31 17:08:51 UTC (rev 187654)
+++ trunk/Source/WebCore/platform/GenericTaskQueue.h 2015-07-31 17:49:15 UTC (rev 187655)
@@ -94,7 +94,9 @@
void enqueueTask(TaskFunction task)
{
- ASSERT(!m_isClosed);
+ if (m_isClosed)
+ return;
+
++m_pendingTasks;
auto weakThis = m_weakPtrFactory.createWeakPtr();
m_dispatcher.postTask([weakThis, task] {
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
