2010-01-21 Eric Carlson <eric.carlson@apple.com>
authoreric.carlson@apple.com <eric.carlson@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Thu, 21 Jan 2010 17:46:23 +0000 (17:46 +0000)
committereric.carlson@apple.com <eric.carlson@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Thu, 21 Jan 2010 17:46:23 +0000 (17:46 +0000)
        Reviewed by Darin Adler.

        Intermittent crash when media element is adopted by another document
        https://bugs.webkit.org/show_bug.cgi?id=33919
        rdar://problem/7557527

        Test: media/adopt-node-crash.html

        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::willMoveToNewOwnerDocument): Unregister for
        document callbacks.
        (WebCore::HTMLMediaElement::didMoveToNewOwnerDocument): Register for
        document callbacks.
        * html/HTMLMediaElement.h:

2010-01-21  Eric Carlson  <eric.carlson@apple.com>

        Reviewed by Darin Adler.

        Intermittent crash when media element is adopted by another document
        https://bugs.webkit.org/show_bug.cgi?id=33919
        rdar://problem/7557527

        This test does not always crash the un-patched version of WebKit because
        the crash is so timing-dependant.

        * media/adopt-node-crash-expected.txt: Added.
        * media/adopt-node-crash.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@53629 268f45cc-cd09-0410-ab3c-d52691b4dbfc

LayoutTests/ChangeLog
LayoutTests/media/adopt-node-crash-expected.txt [new file with mode: 0644]
LayoutTests/media/adopt-node-crash.html [new file with mode: 0644]
WebCore/ChangeLog
WebCore/html/HTMLMediaElement.cpp
WebCore/html/HTMLMediaElement.h

index a9cd4d4..875ba2e 100644 (file)
@@ -1,3 +1,17 @@
+2010-01-21  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Intermittent crash when media element is adopted by another document
+        https://bugs.webkit.org/show_bug.cgi?id=33919
+        rdar://problem/7557527
+
+        This test does not always crash the un-patched version of WebKit because
+        the crash is so timing-dependant.
+
+        * media/adopt-node-crash-expected.txt: Added.
+        * media/adopt-node-crash.html: Added.
+
 2010-01-21  Simon Hausmann  <simon.hausmann@nokia.com>
 
         No review, rolling out 53615 as it causes two
diff --git a/LayoutTests/media/adopt-node-crash-expected.txt b/LayoutTests/media/adopt-node-crash-expected.txt
new file mode 100644 (file)
index 0000000..ff43ca4
--- /dev/null
@@ -0,0 +1 @@
+SUCCESS
diff --git a/LayoutTests/media/adopt-node-crash.html b/LayoutTests/media/adopt-node-crash.html
new file mode 100644 (file)
index 0000000..993a14d
--- /dev/null
@@ -0,0 +1,66 @@
+<!DOCTYPE HTML>
+
+<html>
+    <head>
+        <script src=media-file.js></script>
+
+        <script>
+
+            if (window.layoutTestController) {
+                layoutTestController.dumpAsText();
+                layoutTestController.waitUntilDone();
+            }
+
+            function log(msg)
+            {
+                document.getElementById('console').appendChild(document.createTextNode(msg + "\n"));
+            }
+
+            function forceGC()
+            {
+                if (window.GCController)
+                    return GCController.collect();
+            
+                // Force garbage collection
+                for (var ndx = 0; ndx < 99000; ndx++)
+                    var str = new String("1234");
+            }
+
+            function finish()
+            {
+                log("EVENT(loadstart) from iframe"); 
+                
+                forceGC();
+                location.href="data:text/html,SUCCESS<script>if (window.layoutTestController) layoutTestController.notifyDone()<" + "/script>";
+            }
+
+            function loadstart()
+            {
+                log("EVENT(loadstart)"); 
+
+                var video = document.getElementsByTagName('video')[0];
+                var newVideo = video.cloneNode(true);
+                newVideo.addEventListener("loadstart", finish);
+
+                var iframeDocument = document.getElementById("iframe").contentDocument;
+                iframeDocument.body.appendChild(newVideo); 
+            }
+
+            function start()
+            {
+                var video = document.getElementsByTagName('video')[0];
+                video.addEventListener("loadstart", loadstart);
+                video.src = findMediaFile("video", "content/test");
+            }
+        </script>
+    </head>
+    <body>
+        <iframe id="iframe" width=340 height=260 ></iframe>
+        <div id=parent><video id=vid></video></div>
+        <p>Tests that we don't crash when moving a video element to a new document.</p>
+        <script>start()</script>
+        <pre id="console"></pre>
+    </body>
+</html>
+
+
index d24d415..07b2def 100644 (file)
@@ -1,3 +1,20 @@
+2010-01-21  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Intermittent crash when media element is adopted by another document
+        https://bugs.webkit.org/show_bug.cgi?id=33919
+        rdar://problem/7557527
+        
+        Test: media/adopt-node-crash.html
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::willMoveToNewOwnerDocument): Unregister for
+        document callbacks.
+        (WebCore::HTMLMediaElement::didMoveToNewOwnerDocument): Register for
+        document callbacks.
+        * html/HTMLMediaElement.h:
+
 2010-01-21  Adam Roben  <aroben@apple.com>
 
         More Windows build fixing
index 01b0fae..360bfb2 100644 (file)
@@ -132,6 +132,21 @@ HTMLMediaElement::~HTMLMediaElement()
     document()->unregisterForMediaVolumeCallbacks(this);
 }
 
+void HTMLMediaElement::willMoveToNewOwnerDocument()
+{
+    document()->unregisterForDocumentActivationCallbacks(this);
+    document()->unregisterForMediaVolumeCallbacks(this);
+    HTMLElement::willMoveToNewOwnerDocument();
+}
+
+void HTMLMediaElement::didMoveToNewOwnerDocument()
+{
+    document()->registerForDocumentActivationCallbacks(this);
+    document()->registerForMediaVolumeCallbacks(this);
+    HTMLElement::didMoveToNewOwnerDocument();
+}
+
+
 bool HTMLMediaElement::checkDTD(const Node* newChild)
 {
     return newChild->hasTagName(sourceTag) || HTMLElement::checkDTD(newChild);
index 3e9ae2a..9ee2c25 100644 (file)
@@ -187,7 +187,10 @@ protected:
     
     void setReadyState(MediaPlayer::ReadyState);
     void setNetworkState(MediaPlayer::NetworkState);
-    
+
+    virtual void willMoveToNewOwnerDocument();
+    virtual void didMoveToNewOwnerDocument();
+
 private: // MediaPlayerClient
     virtual void mediaPlayerNetworkStateChanged(MediaPlayer*);
     virtual void mediaPlayerReadyStateChanged(MediaPlayer*);