[iOS WK2] Video with reflection crashes WebKit and Safari

https://bugs.webkit.org/show_bug.cgi?id=145905
rdar://problem/18364939

Reviewed by Anders Carlsson.

On iOS, AVPlayerLayers are contained inside a WebVideoContainerLayer, but
the layer type is still LayerTypeAVPlayerLayer.

Avoid throwing exceptions when cloning such layers by checking the layer class.

* WebProcess/WebPage/mac/PlatformCALayerRemoteCustom.mm:
(WebKit::PlatformCALayerRemoteCustom::clone):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@185511 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/Source/WebKit2/ChangeLog b/Source/WebKit2/ChangeLog
index 7344d3c..ff5d619 100644 (file)
--- a/Source/WebKit2/ChangeLog
+++ b/Source/WebKit2/ChangeLog
@@ -1,3 +1,19 @@
+2015-06-12  Simon Fraser  <simon.fraser@apple.com>
+
+        [iOS WK2] Video with reflection crashes WebKit and Safari
+        https://bugs.webkit.org/show_bug.cgi?id=145905
+        rdar://problem/18364939
+
+        Reviewed by Anders Carlsson.
+        
+        On iOS, AVPlayerLayers are contained inside a WebVideoContainerLayer, but
+        the layer type is still LayerTypeAVPlayerLayer.
+        
+        Avoid throwing exceptions when cloning such layers by checking the layer class.
+
+        * WebProcess/WebPage/mac/PlatformCALayerRemoteCustom.mm:
+        (WebKit::PlatformCALayerRemoteCustom::clone):
+
 2015-06-12  Csaba Osztrogonác  <ossy@webkit.org>
 
         [EFL] Fix unused private field warning in WebContextMenuProxyEfl.cpp

diff --git a/Source/WebKit2/WebProcess/WebPage/mac/PlatformCALayerRemoteCustom.mm b/Source/WebKit2/WebProcess/WebPage/mac/PlatformCALayerRemoteCustom.mm
index 1ef9a99..2018bbf 100644 (file)
--- a/Source/WebKit2/WebProcess/WebPage/mac/PlatformCALayerRemoteCustom.mm
+++ b/Source/WebKit2/WebProcess/WebPage/mac/PlatformCALayerRemoteCustom.mm
@@ -104,13 +104,20 @@ PassRefPtr<WebCore::PlatformCALayer> PlatformCALayerRemoteCustom::clone(Platform
     bool copyContents = true;
 
     if (layerType() == LayerTypeAVPlayerLayer) {
-        clonedLayer = adoptNS([allocAVPlayerLayerInstance() init]);
+        
+        if ([platformLayer() isKindOfClass:getAVPlayerLayerClass()]) {
+            clonedLayer = adoptNS([allocAVPlayerLayerInstance() init]);
+
+            AVPlayerLayer* destinationPlayerLayer = static_cast<AVPlayerLayer *>(clonedLayer.get());
+            AVPlayerLayer* sourcePlayerLayer = static_cast<AVPlayerLayer *>(platformLayer());
+            dispatch_async(dispatch_get_main_queue(), ^{
+                [destinationPlayerLayer setPlayer:[sourcePlayerLayer player]];
+            });
+        } else {
+            // On iOS, the AVPlayerLayer is inside a WebVideoContainerLayer. This code needs to share logic with MediaPlayerPrivateAVFoundationObjC::createAVPlayerLayer().
+            clonedLayer = adoptNS([[CALayer alloc] init]);
+        }
 
-        AVPlayerLayer* destinationPlayerLayer = static_cast<AVPlayerLayer *>(clonedLayer.get());
-        AVPlayerLayer* sourcePlayerLayer = static_cast<AVPlayerLayer *>(platformLayer());
-        dispatch_async(dispatch_get_main_queue(), ^{
-            [destinationPlayerLayer setPlayer:[sourcePlayerLayer player]];
-        });
         copyContents = false;
     } else if (layerType() == LayerTypeWebGLLayer) {
         clonedLayer = adoptNS([[CALayer alloc] init]);