Title: [187687] trunk/Source/WebCore
- Revision
- 187687
- Author
- [email protected]
- Date
- 2015-07-31 15:43:55 -0700 (Fri, 31 Jul 2015)
Log Message
Crashes under HTMLMediaElement::updateActiveTextTrackCues() when destroying CachedPage.
<https://webkit.org/b/147506>
<rdar://problem/21939014>
Reviewed by Chris Dumez.
Don't mess with the media element's text tracks below its ActiveDOMObject::stop()
implementation, since that may cause DOM mutations.
I don't have a repro or a test for this, but plenty of crash logs to indicate that
we're getting ourselves into trouble by modifying the DOM during CachedPage teardown.
* html/HTMLMediaElement.cpp:
(WebCore::HTMLMediaElement::configureTextTrackDisplay):
Modified Paths
Diff
Modified: trunk/Source/WebCore/ChangeLog (187686 => 187687)
--- trunk/Source/WebCore/ChangeLog 2015-07-31 22:34:23 UTC (rev 187686)
+++ trunk/Source/WebCore/ChangeLog 2015-07-31 22:43:55 UTC (rev 187687)
@@ -1,3 +1,20 @@
+2015-07-31 Andreas Kling <[email protected]>
+
+ Crashes under HTMLMediaElement::updateActiveTextTrackCues() when destroying CachedPage.
+ <https://webkit.org/b/147506>
+ <rdar://problem/21939014>
+
+ Reviewed by Chris Dumez.
+
+ Don't mess with the media element's text tracks below its ActiveDOMObject::stop()
+ implementation, since that may cause DOM mutations.
+
+ I don't have a repro or a test for this, but plenty of crash logs to indicate that
+ we're getting ourselves into trouble by modifying the DOM during CachedPage teardown.
+
+ * html/HTMLMediaElement.cpp:
+ (WebCore::HTMLMediaElement::configureTextTrackDisplay):
+
2015-07-31 Tim Horton <[email protected]>
[iOS] DOMNode preview snapshot rects are wrong for user-select: none links
Modified: trunk/Source/WebCore/html/HTMLMediaElement.cpp (187686 => 187687)
--- trunk/Source/WebCore/html/HTMLMediaElement.cpp 2015-07-31 22:34:23 UTC (rev 187686)
+++ trunk/Source/WebCore/html/HTMLMediaElement.cpp 2015-07-31 22:43:55 UTC (rev 187687)
@@ -5548,6 +5548,9 @@
if (m_processingPreferenceChange)
return;
+ if (document().activeDOMObjectsAreStopped())
+ return;
+
bool haveVisibleTextTrack = false;
for (unsigned i = 0; i < m_textTracks->length(); ++i) {
if (m_textTracks->item(i)->mode() == TextTrack::showingKeyword()) {
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
