Heap-use-after-free in WebCore::HTMLMediaElement::~HTMLMediaElement
https://bugs.webkit.org/show_bug.cgi?id=110623
Reviewed by Eric Seidel.
Source/WebCore:
Test: http/tests/misc/delete-frame-during-readystatechange-with-gc-after-video-removal.html
* html/HTMLAudioElement.h:
(HTMLAudioElement):
* html/HTMLAudioElement.idl:
* html/HTMLMediaElement.cpp:
(WebCore::HTMLMediaElement::hasPendingActivity):
* html/HTMLMediaElement.idl:
LayoutTests:
* http/tests/misc/delete-frame-during-readystatechange-with-gc-after-video-removal-expected.txt: Added.
* http/tests/misc/delete-frame-during-readystatechange-with-gc-after-video-removal.html: Added.
* http/tests/misc/resources/delete-frame-during-readystatechange-frame-with-gc-after-video-removal.html: Added.
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@144859
268f45cc-cd09-0410-ab3c-
d52691b4dbfc
git://git.webkit.org / WebKit-https.git / commit