Title: [187673] branches/safari-601.1-branch/Source/WebCore
- Revision
- 187673
- Author
- [email protected]
- Date
- 2015-07-31 13:15:31 -0700 (Fri, 31 Jul 2015)
Log Message
Merge r187655. rdar://problem/21632211
Modified Paths
Diff
Modified: branches/safari-601.1-branch/Source/WebCore/ChangeLog (187672 => 187673)
--- branches/safari-601.1-branch/Source/WebCore/ChangeLog 2015-07-31 20:15:29 UTC (rev 187672)
+++ branches/safari-601.1-branch/Source/WebCore/ChangeLog 2015-07-31 20:15:31 UTC (rev 187673)
@@ -1,5 +1,31 @@
2015-07-31 Matthew Hanson <[email protected]>
+ Merge r187655. rdar://problem/21632211
+
+ 2015-07-31 Jer Noble <[email protected]>
+
+ CRASH at WebCore::TaskDispatcher<WebCore::ScriptExecutionContext>::postTask + 38
+ https://bugs.webkit.org/show_bug.cgi?id=147485
+
+ Reviewed by Eric Carlson.
+
+ CrashLogs indicate a use-after-free of the ScriptExecutionContext (i.e., Document) used by
+ the GenericTaskQueue objects owned by HTMLMediaElement. When the ScriptExecutionContext
+ notifies its ActiveDOMObjects that it is about to be destroyed, close() the
+ GenericTaskQueues so that they can no longer accept new tasks.
+
+ Previously, enqueueing a task on a closed GenericTaskQueue ASSERTed in debug builds, but
+ silently succeeded in release builds. Calling enqueueTask() on a closed GenericTaskQueue is
+ now a no-op.
+
+ * html/HTMLMediaElement.cpp:
+ (WebCore::HTMLMediaElement::contextDestroyed):
+ * html/HTMLMediaElement.h:
+ * platform/GenericTaskQueue.h:
+ (WebCore::GenericTaskQueue::enqueueTask):
+
+2015-07-31 Matthew Hanson <[email protected]>
+
Merge r187630. rdar://problem/18835799
2015-07-30 Andreas Kling <[email protected]>
Modified: branches/safari-601.1-branch/Source/WebCore/html/HTMLMediaElement.cpp (187672 => 187673)
--- branches/safari-601.1-branch/Source/WebCore/html/HTMLMediaElement.cpp 2015-07-31 20:15:29 UTC (rev 187672)
+++ branches/safari-601.1-branch/Source/WebCore/html/HTMLMediaElement.cpp 2015-07-31 20:15:31 UTC (rev 187673)
@@ -4903,6 +4903,13 @@
updateSleepDisabling();
}
+void HTMLMediaElement::contextDestroyed()
+{
+ m_seekTaskQueue.close();
+ m_resizeTaskQueue.close();
+ m_shadowDOMTaskQueue.close();
+}
+
void HTMLMediaElement::stop()
{
LOG(Media, "HTMLMediaElement::stop(%p)", this);
Modified: branches/safari-601.1-branch/Source/WebCore/html/HTMLMediaElement.h (187672 => 187673)
--- branches/safari-601.1-branch/Source/WebCore/html/HTMLMediaElement.h 2015-07-31 20:15:29 UTC (rev 187672)
+++ branches/safari-601.1-branch/Source/WebCore/html/HTMLMediaElement.h 2015-07-31 20:15:31 UTC (rev 187673)
@@ -507,6 +507,7 @@
void resume() override;
void stop() override;
void stopWithoutDestroyingMediaPlayer();
+ virtual void contextDestroyed() override;
virtual void mediaVolumeDidChange() override;
Modified: branches/safari-601.1-branch/Source/WebCore/platform/GenericTaskQueue.h (187672 => 187673)
--- branches/safari-601.1-branch/Source/WebCore/platform/GenericTaskQueue.h 2015-07-31 20:15:29 UTC (rev 187672)
+++ branches/safari-601.1-branch/Source/WebCore/platform/GenericTaskQueue.h 2015-07-31 20:15:31 UTC (rev 187673)
@@ -94,7 +94,9 @@
void enqueueTask(TaskFunction task)
{
- ASSERT(!m_isClosed);
+ if (m_isClosed)
+ return;
+
++m_pendingTasks;
auto weakThis = m_weakPtrFactory.createWeakPtr();
m_dispatcher.postTask([weakThis, task] {
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
