WebCore:
authordarin@apple.com <darin@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Fri, 8 May 2009 01:31:45 +0000 (01:31 +0000)
committerdarin@apple.com <darin@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Fri, 8 May 2009 01:31:45 +0000 (01:31 +0000)
2009-05-07  Darin Adler  <darin@apple.com>

        Reviewed by Simon Fraser.

        Bug 25575: Registered mutation event listener crashes HTMLMediaElement
        https://bugs.webkit.org/show_bug.cgi?id=25575

        Test: fast/media/video-controls-with-mutation-event-handler.html

        * rendering/MediaControlElements.cpp:
        (WebCore::MediaControlTimelineElement::MediaControlTimelineElement): Don't call setAttribute.
        * rendering/RenderMedia.cpp:
        (WebCore::RenderMedia::createTimeline): Call setAttribute here.

LayoutTests:

2009-05-07  Darin Adler  <darin@apple.com>

        Reviewed by Simon Fraser.

        Bug 25575: Registered mutation event listener crashes HTMLMediaElement
        https://bugs.webkit.org/show_bug.cgi?id=25575

        * fast/media/video-controls-with-mutation-event-handler-expected.txt: Added.
        * fast/media/video-controls-with-mutation-event-handler.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@43381 268f45cc-cd09-0410-ab3c-d52691b4dbfc

LayoutTests/ChangeLog
LayoutTests/fast/media/video-controls-with-mutation-event-handler-expected.txt [new file with mode: 0644]
LayoutTests/fast/media/video-controls-with-mutation-event-handler.html [new file with mode: 0644]
WebCore/ChangeLog
WebCore/rendering/MediaControlElements.cpp
WebCore/rendering/RenderMedia.cpp

index f552699..fb04669 100644 (file)
@@ -1,3 +1,13 @@
+2009-05-07  Darin Adler  <darin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Bug 25575: Registered mutation event listener crashes HTMLMediaElement
+        https://bugs.webkit.org/show_bug.cgi?id=25575
+
+        * fast/media/video-controls-with-mutation-event-handler-expected.txt: Added.
+        * fast/media/video-controls-with-mutation-event-handler.html: Added.
+
 2009-05-07  Eric Seidel  <eric@webkit.org>
 
         Reviewed by Beth Dakin.
diff --git a/LayoutTests/fast/media/video-controls-with-mutation-event-handler-expected.txt b/LayoutTests/fast/media/video-controls-with-mutation-event-handler-expected.txt
new file mode 100644 (file)
index 0000000..1889004
--- /dev/null
@@ -0,0 +1,6 @@
+This tests that we don't crash while creating a video element while a DOMSubtreeModified even handler is registered.
+
+If you can see the movie below, the test passed.
+
+
+SUCCESS: The test ran without crashing
diff --git a/LayoutTests/fast/media/video-controls-with-mutation-event-handler.html b/LayoutTests/fast/media/video-controls-with-mutation-event-handler.html
new file mode 100644 (file)
index 0000000..d4881f2
--- /dev/null
@@ -0,0 +1,39 @@
+<html>
+    <head>
+        <title>&lt;video&gt; controls with mutation event handler</title>
+
+        <style type="text/css" media="screen">
+            body { background: #cccccc; }
+            video { background: yellow; border: 1px solid black; border-bottom: none; }
+        </style>
+
+        <script>
+            function runTest()
+            {
+                if (window.layoutTestController)
+                    layoutTestController.dumpAsText();
+
+                document.body.addEventListener("DOMSubtreeModified", function () { }, false);
+
+                var video = document.createElement('video');
+                video.setAttribute('id', 'vid'); 
+                video.setAttribute('width', '320'); 
+                video.setAttribute('height', '240'); 
+                video.setAttribute('autoplay', '');
+                video.setAttribute('controls', ''); 
+                var paragraph = document.createElement('p');
+                paragraph.appendChild(video);
+                document.body.appendChild(paragraph);
+
+                paragraph = document.createElement('p');
+                paragraph.appendChild(document.createTextNode("SUCCESS: The test ran without crashing"));
+                document.body.appendChild(paragraph);
+            }
+        </script>
+    </head>
+
+    <body onload="runTest()">
+        <p>This tests that we don't crash while creating a video element while a DOMSubtreeModified even handler is registered.</p>
+        <p>If you can see the movie below, the test passed.</p>
+    </body>
+</html>
index ed6c96a..ff117e8 100644 (file)
@@ -1,3 +1,17 @@
+2009-05-07  Darin Adler  <darin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Bug 25575: Registered mutation event listener crashes HTMLMediaElement
+        https://bugs.webkit.org/show_bug.cgi?id=25575
+
+        Test: fast/media/video-controls-with-mutation-event-handler.html
+
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlTimelineElement::MediaControlTimelineElement): Don't call setAttribute.
+        * rendering/RenderMedia.cpp:
+        (WebCore::RenderMedia::createTimeline): Call setAttribute here.
+
 2009-05-07  Simon Fraser  <simon.fraser@apple.com>
 
         Rubber Stamped by Dave Hyatt
index ddd6170..dbf680f 100644 (file)
@@ -32,9 +32,7 @@
 
 #include "MediaControlElements.h"
 
-#include "Event.h"
 #include "EventNames.h"
-#include "EventHandler.h"
 #include "FloatConversion.h"
 #include "Frame.h"
 #include "HTMLNames.h"
@@ -247,10 +245,9 @@ void MediaControlSeekButtonElement::seekTimerFired(Timer<MediaControlSeekButtonE
 
 // ----------------------------
 
-MediaControlTimelineElement::MediaControlTimelineElement(Document* doc, HTMLMediaElement* element)
-    : MediaControlInputElement(doc, MEDIA_CONTROLS_TIMELINE, "range", element)
+MediaControlTimelineElement::MediaControlTimelineElement(Document* document, HTMLMediaElement* element)
+    : MediaControlInputElement(document, MEDIA_CONTROLS_TIMELINE, "range", element)
 { 
-    setAttribute(precisionAttr, "float");
 }
 
 void MediaControlTimelineElement::defaultEventHandler(Event* event)
index 6585fa4..2ffa2f6 100644 (file)
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007, 2008 Apple Inc.  All rights reserved.
+ * Copyright (C) 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
 #if ENABLE(VIDEO)
 #include "RenderMedia.h"
 
-#include "CSSStyleSelector.h"
-#include "Event.h"
 #include "EventNames.h"
 #include "FloatConversion.h"
-#include "FrameView.h"
-#include "GraphicsContext.h"
-#include "HTMLMediaElement.h"
 #include "HTMLNames.h"
 #include "MediaControlElements.h"
 #include "MouseEvent.h"
-#include "MediaPlayer.h"
 #include <wtf/CurrentTime.h>
 #include <wtf/MathExtras.h>
 
@@ -46,6 +40,8 @@ using namespace std;
 
 namespace WebCore {
 
+using namespace HTMLNames;
+
 static const double cTimeUpdateRepeatDelay = 0.2;
 static const double cOpacityAnimationRepeatDelay = 0.05;
 // FIXME get this from style
@@ -216,6 +212,7 @@ void RenderMedia::createTimeline()
 {
     ASSERT(!m_timeline);
     m_timeline = new MediaControlTimelineElement(document(), mediaElement());
+    m_timeline->setAttribute(precisionAttr, "float");
     m_timeline->attachToParent(m_timelineContainer.get());
 }