Deal with DOM modifications when evaluating source elements.
authoreric.carlson@apple.com <eric.carlson@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Fri, 23 Mar 2012 20:26:17 +0000 (20:26 +0000)
committereric.carlson@apple.com <eric.carlson@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Fri, 23 Mar 2012 20:26:17 +0000 (20:26 +0000)
commit9a76ee0907c687888b3feb3b7123f5071047ff3b
tree9f8fcc50c5fe067f6b703e96b958031d2659d3e4
parentc00c67852574638589beb646b39542956b9b858a
Deal with DOM modifications when evaluating source elements.
https://bugs.webkit.org/show_bug.cgi?id=81163

Reviewed by Alexey Proskuryakov.

Source/WebCore:

Test: media/video-beforeload-remove-source.html

* dom/ContainerNode.cpp: Make NodeVector and collectNodes public, renamed as getChildNodes.
(WebCore::ContainerNode::takeAllChildrenFrom): collectNodes -> getChildNodes.
(WebCore::ContainerNode::willRemove): collectNodes -> getChildNodes.
(WebCore::ContainerNode::willRemoveChildren): collectNodes -> getChildNodes.
(WebCore::ContainerNode::insertedIntoDocument): collectNodes -> getChildNodes.
(WebCore::ContainerNode::removedFromDocument): collectNodes -> getChildNodes.
* dom/ContainerNode.h:
(WebCore::getChildNodes):

* editing/ReplaceSelectionCommand.cpp: Remove unused NodeVector declaration.

* html/HTMLMediaElement.cpp:
(WebCore::HTMLMediaElement::HTMLMediaElement): m_nextChildNodeToConsider and m_currentSourceNode
    are now RefPtrs.
(WebCore::HTMLMediaElement::loadTimerFired): Protect HTMLMediaElement from being deleted during
    a DOM modification during an event callback.
(WebCore::HTMLMediaElement::load): Ditto.
(WebCore::HTMLMediaElement::selectMediaResource): Set m_nextChildNodeToConsider to the first
    child node, it will be the first node considered.
(WebCore::HTMLMediaElement::havePotentialSourceChild): m_nextChildNodeToConsider and m_currentSourceNode
    are now RefPtrs.
(WebCore::HTMLMediaElement::selectNextSourceChild): Collect all child nodes in a vector before
    looking for <source> nodes because 'beforeload' event handlers can mutate the DOM. Don't
    use a <source> that is no longer a child node after 'beforeload'. Use 0 to represent the end
    of the child node list because m_nextChildNodeToConsider is now a RefPtr so using the previous
    sentinel, "this", would cause a retain cycle.
(WebCore::HTMLMediaElement::sourceWasAdded):  m_nextChildNodeToConsider and m_currentSourceNode
    are now RefPtrs.
(WebCore::HTMLMediaElement::sourceWillBeRemoved): Ditto.
(WebCore::HTMLMediaElement::getPluginProxyParams): Protect HTMLMediaElement from being deleted during
    a DOM modification during an event callback.
* html/HTMLMediaElement.h:

LayoutTests:

* media/video-beforeload-remove-source-expected.txt: Added.
* media/video-beforeload-remove-source.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@111895 268f45cc-cd09-0410-ab3c-d52691b4dbfc
LayoutTests/ChangeLog
LayoutTests/media/video-beforeload-remove-source-expected.txt [new file with mode: 0644]
LayoutTests/media/video-beforeload-remove-source.html [new file with mode: 0644]
Source/WebCore/ChangeLog
Source/WebCore/dom/ContainerNode.cpp
Source/WebCore/dom/ContainerNode.h
Source/WebCore/editing/ReplaceSelectionCommand.cpp
Source/WebCore/html/HTMLMediaElement.cpp
Source/WebCore/html/HTMLMediaElement.h