Title: [112636] branches/chromium/1084/Source/WebCore
Revision
112636
Author
[email protected]
Date
2012-03-29 19:21:27 -0700 (Thu, 29 Mar 2012)

Log Message

Merge 112623 - Crash in GenericEventQueue::~GenericEventQueue.

BUG=119281
Review URL: https://chromiumcodereview.appspot.com/9937009

Modified Paths

Diff

Modified: branches/chromium/1084/Source/WebCore/dom/GenericEventQueue.cpp (112635 => 112636)


--- branches/chromium/1084/Source/WebCore/dom/GenericEventQueue.cpp	2012-03-30 01:57:59 UTC (rev 112635)
+++ branches/chromium/1084/Source/WebCore/dom/GenericEventQueue.cpp	2012-03-30 02:21:27 UTC (rev 112636)
@@ -31,8 +31,14 @@
 
 namespace WebCore {
 
-GenericEventQueue::GenericEventQueue()
-    : m_timer(this, &GenericEventQueue::timerFired)
+PassOwnPtr<GenericEventQueue> GenericEventQueue::create(EventTarget* owner)
+{
+    return adoptPtr(new GenericEventQueue(owner));
+}
+
+GenericEventQueue::GenericEventQueue(EventTarget* owner)
+    : m_owner(owner)
+    , m_timer(this, &GenericEventQueue::timerFired)
     , m_isClosed(false)
 {
 }
@@ -47,6 +53,9 @@
         return false;
 
     ASSERT(event->target());
+    if (event->target() == m_owner)
+        event->setTarget(0);
+
     m_pendingEvents.append(event);
 
     if (!m_timer.isActive())
@@ -76,8 +85,10 @@
     Vector<RefPtr<Event> > pendingEvents;
     m_pendingEvents.swap(pendingEvents);
 
-    for (unsigned i = 0; i < pendingEvents.size(); ++i)
-        pendingEvents[i]->target()->dispatchEvent(pendingEvents[i].release());
+    for (unsigned i = 0; i < pendingEvents.size(); ++i) {
+        EventTarget* target = pendingEvents[i]->target() ? pendingEvents[i]->target() : m_owner;
+        target->dispatchEvent(pendingEvents[i].release());
+    }
 }
 
 void GenericEventQueue::close()

Modified: branches/chromium/1084/Source/WebCore/dom/GenericEventQueue.h (112635 => 112636)


--- branches/chromium/1084/Source/WebCore/dom/GenericEventQueue.h	2012-03-30 01:57:59 UTC (rev 112635)
+++ branches/chromium/1084/Source/WebCore/dom/GenericEventQueue.h	2012-03-30 02:21:27 UTC (rev 112636)
@@ -27,7 +27,9 @@
 #define GenericEventQueue_h
 
 #include "EventQueue.h"
+#include "EventTarget.h"
 #include "Timer.h"
+#include <wtf/PassOwnPtr.h>
 #include <wtf/RefPtr.h>
 #include <wtf/Vector.h>
 
@@ -36,7 +38,8 @@
 class GenericEventQueue : public EventQueue {
 
 public:
-    GenericEventQueue();
+    GenericEventQueue(EventTarget*);
+    static PassOwnPtr<GenericEventQueue> create(EventTarget*);
     virtual ~GenericEventQueue();
 
     // EventQueue
@@ -50,6 +53,7 @@
 private:
     void timerFired(Timer<GenericEventQueue>*);
 
+    EventTarget* m_owner;
     Vector<RefPtr<Event> > m_pendingEvents;
     Timer<GenericEventQueue> m_timer;
 

Modified: branches/chromium/1084/Source/WebCore/html/HTMLMediaElement.cpp (112635 => 112636)


--- branches/chromium/1084/Source/WebCore/html/HTMLMediaElement.cpp	2012-03-30 01:57:59 UTC (rev 112635)
+++ branches/chromium/1084/Source/WebCore/html/HTMLMediaElement.cpp	2012-03-30 02:21:27 UTC (rev 112636)
@@ -182,6 +182,7 @@
     , m_progressEventTimer(this, &HTMLMediaElement::progressEventTimerFired)
     , m_playbackProgressTimer(this, &HTMLMediaElement::playbackProgressTimerFired)
     , m_playedTimeRanges()
+    , m_asyncEventQueue(GenericEventQueue::create(this))
     , m_playbackRate(1.0f)
     , m_defaultPlaybackRate(1.0f)
     , m_webkitPreservesPitch(true)
@@ -550,7 +551,7 @@
     RefPtr<Event> event = Event::create(eventName, false, true);
     event->setTarget(this);
 
-    m_asyncEventQueue.enqueueEvent(event.release());
+    m_asyncEventQueue->enqueueEvent(event.release());
 }
 
 void HTMLMediaElement::loadTimerFired(Timer<HTMLMediaElement>*)
@@ -1149,7 +1150,7 @@
             event = Event::create(eventNames().exitEvent, false, false);
 
         event->setTarget(eventTasks[i].second);
-        m_asyncEventQueue.enqueueEvent(event.release());
+        m_asyncEventQueue->enqueueEvent(event.release());
     }
 
     // 14 - Sort affected tracks in the same order as the text tracks appear in
@@ -1164,7 +1165,7 @@
         RefPtr<Event> event = Event::create(eventNames().cuechangeEvent, false, false);
         event->setTarget(affectedTracks[i]);
 
-        m_asyncEventQueue.enqueueEvent(event.release());
+        m_asyncEventQueue->enqueueEvent(event.release());
 
         // Fire syncronous cue change event for track elements.
         if (affectedTracks[i]->trackType() == TextTrack::TrackElement)
@@ -1399,7 +1400,7 @@
 void HTMLMediaElement::cancelPendingEventsAndCallbacks()
 {
     LOG(Media, "HTMLMediaElement::cancelPendingEventsAndCallbacks");
-    m_asyncEventQueue.cancelAllEvents();
+    m_asyncEventQueue->cancelAllEvents();
 
     for (Node* node = firstChild(); node; node = node->nextSibling()) {
         if (node->hasTagName(sourceTag))
@@ -3466,7 +3467,7 @@
 
 bool HTMLMediaElement::hasPendingActivity() const
 {
-    return m_asyncEventQueue.hasPendingEvents();
+    return m_asyncEventQueue->hasPendingEvents();
 }
 
 void HTMLMediaElement::mediaVolumeDidChange()

Modified: branches/chromium/1084/Source/WebCore/html/HTMLMediaElement.h (112635 => 112636)


--- branches/chromium/1084/Source/WebCore/html/HTMLMediaElement.h	2012-03-30 01:57:59 UTC (rev 112635)
+++ branches/chromium/1084/Source/WebCore/html/HTMLMediaElement.h	2012-03-30 02:21:27 UTC (rev 112636)
@@ -501,7 +501,7 @@
     Timer<HTMLMediaElement> m_progressEventTimer;
     Timer<HTMLMediaElement> m_playbackProgressTimer;
     RefPtr<TimeRanges> m_playedTimeRanges;
-    GenericEventQueue m_asyncEventQueue;
+    OwnPtr<GenericEventQueue> m_asyncEventQueue;
 
     float m_playbackRate;
     float m_defaultPlaybackRate;
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes

Reply via email to