Title: [135215] branches/chromium/1312
- Revision
- 135215
- Author
- [email protected]
- Date
- 2012-11-19 16:49:30 -0800 (Mon, 19 Nov 2012)
Log Message
Merge 133609
BUG=158992
Review URL: https://codereview.chromium.org/11280078
Modified Paths
Added Paths
Diff
Copied: branches/chromium/1312/LayoutTests/media/track/track-remove-by-setting-innerHTML-expected.txt (from rev 133609, trunk/LayoutTests/media/track/track-remove-by-setting-innerHTML-expected.txt) (0 => 135215)
--- branches/chromium/1312/LayoutTests/media/track/track-remove-by-setting-innerHTML-expected.txt (rev 0)
+++ branches/chromium/1312/LayoutTests/media/track/track-remove-by-setting-innerHTML-expected.txt 2012-11-20 00:49:30 UTC (rev 135215)
@@ -0,0 +1,9 @@
+This test makes sure that removing a track by setting video.innerHTML doesn't crash (https://bugs.webkit.org/show_bug.cgi?id=100981).
+If this test does not crash, it passes.
+
+EVENT(canplaythrough)
+EVENT(seeked)
+RUN(video.currentTime = 7.9)
+EVENT(seeked)
+END OF TEST
+
Copied: branches/chromium/1312/LayoutTests/media/track/track-remove-by-setting-innerHTML.html (from rev 133609, trunk/LayoutTests/media/track/track-remove-by-setting-innerHTML.html) (0 => 135215)
--- branches/chromium/1312/LayoutTests/media/track/track-remove-by-setting-innerHTML.html (rev 0)
+++ branches/chromium/1312/LayoutTests/media/track/track-remove-by-setting-innerHTML.html 2012-11-20 00:49:30 UTC (rev 135215)
@@ -0,0 +1,46 @@
+<!doctype html>
+<html>
+ <head>
+ <script src=""
+ <script src=""
+ <script type="text/_javascript_">
+ var firstSeek = true;
+
+ function seeked()
+ {
+ if (!firstSeek) {
+ endTest();
+ return;
+ }
+
+ // Remove the text tra
+ video.innerHTML = "This is a test";
+
+ // Seek again to force a repaint.
+ run("video.currentTime = 7.9");
+ firstSeek = false;
+ }
+
+ function loaded()
+ {
+ findMediaElement();
+ waitForEvent('error');
+ waitForEvent('seeked', seeked);
+ waitForEvent('canplaythrough', function()
+ {
+ video.currentTime = 0.5;
+ });
+ video.src = "" '../content/counting');
+ }
+ </script>
+ </head>
+ <body _onload_=loaded()>
+ <video>
+ <track default="" src=""
+ </video>
+ <div>
+ This test makes sure that removing a track by setting video.innerHTML doesn't crash (https://bugs.webkit.org/show_bug.cgi?id=100981).
+ <p>If this test does not crash, it passes.</p>
+ </div>
+ </body>
+</html>
Modified: branches/chromium/1312/Source/WebCore/html/HTMLMediaElement.cpp (135214 => 135215)
--- branches/chromium/1312/Source/WebCore/html/HTMLMediaElement.cpp 2012-11-20 00:44:42 UTC (rev 135214)
+++ branches/chromium/1312/Source/WebCore/html/HTMLMediaElement.cpp 2012-11-20 00:49:30 UTC (rev 135215)
@@ -2832,6 +2832,14 @@
// then the user agent must remove the track element's corresponding text track from the
// media element's list of text tracks.
m_textTracks->remove(textTrack.get());
+ if (textTrack->cues()) {
+ TextTrackCueList* cues = textTrack->cues();
+ beginIgnoringTrackDisplayUpdateRequests();
+ for (size_t i = 0; i < cues->length(); ++i)
+ textTrackRemoveCue(cues->item(i)->track(), cues->item(i));
+ endIgnoringTrackDisplayUpdateRequests();
+ }
+
size_t index = m_textTracksWhenResourceSelectionBegan.find(textTrack.get());
if (index != notFound)
m_textTracksWhenResourceSelectionBegan.remove(index);
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo/webkit-changes
