Reset MediaSourcePrivateAVFObjC's m_sourceBufferWithSelectedVideo when the underlying...
authorjer.noble@apple.com <jer.noble@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Wed, 17 Jan 2018 00:04:56 +0000 (00:04 +0000)
committerjer.noble@apple.com <jer.noble@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Wed, 17 Jan 2018 00:04:56 +0000 (00:04 +0000)
https://bugs.webkit.org/show_bug.cgi?id=181707
<rdar://problem/34809474>

Reviewed by Eric Carlson.

Source/WebCore:

Test: media/media-source/media-source-remove-unload-crash.html

* platform/graphics/avfoundation/objc/MediaSourcePrivateAVFObjC.mm:
(WebCore::MediaSourcePrivateAVFObjC::removeSourceBuffer):

LayoutTests:

* media/media-source/media-source-remove-unload-crash-expected.txt: Added.
* media/media-source/media-source-remove-unload-crash.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@227009 268f45cc-cd09-0410-ab3c-d52691b4dbfc

LayoutTests/ChangeLog
LayoutTests/media/media-source/media-source-remove-unload-crash-expected.txt [new file with mode: 0644]
LayoutTests/media/media-source/media-source-remove-unload-crash.html [new file with mode: 0644]
Source/WebCore/ChangeLog
Source/WebCore/platform/graphics/avfoundation/objc/MediaSourcePrivateAVFObjC.mm

index 78b250e..9568fc9 100644 (file)
@@ -1,3 +1,14 @@
+2018-01-16  Jer Noble  <jer.noble@apple.com>
+
+        Reset MediaSourcePrivateAVFObjC's m_sourceBufferWithSelectedVideo when the underlying SourceBufferPrivate is removed.
+        https://bugs.webkit.org/show_bug.cgi?id=181707
+        <rdar://problem/34809474>
+
+        Reviewed by Eric Carlson.
+
+        * media/media-source/media-source-remove-unload-crash-expected.txt: Added.
+        * media/media-source/media-source-remove-unload-crash.html: Added.
+
 2018-01-12  Jiewen Tan  <jiewen_tan@apple.com>
 
         [WebAuthN] Implement dummy WebAuthN IDLs
diff --git a/LayoutTests/media/media-source/media-source-remove-unload-crash-expected.txt b/LayoutTests/media/media-source/media-source-remove-unload-crash-expected.txt
new file mode 100644 (file)
index 0000000..86cc993
--- /dev/null
@@ -0,0 +1,18 @@
+
+RUN(video.src = URL.createObjectURL(source))
+EVENT(sourceopen)
+RUN(source.duration = loader.duration())
+RUN(sourceBuffer = source.addSourceBuffer(loader.type()))
+RUN(sourceBuffer.appendBuffer(loader.initSegment()))
+EVENT(update)
+Append a media segment.
+RUN(sourceBuffer.appendBuffer(loader.mediaSegment(0)))
+EVENT(update)
+Remove the SourceBuffer from its MediaSource, then unload the video element. Should not crash.
+RUN(source.removeSourceBuffer(sourceBuffer))
+RUN(sourceBuffer = null)
+RUN(gc())
+RUN(video.src = "")
+RUN(video.load())
+END OF TEST
+
diff --git a/LayoutTests/media/media-source/media-source-remove-unload-crash.html b/LayoutTests/media/media-source/media-source-remove-unload-crash.html
new file mode 100644 (file)
index 0000000..7eac2d6
--- /dev/null
@@ -0,0 +1,62 @@
+<!DOCTYPE html>
+<html>
+<head>
+    <title>media-source-remove-unload-crash</title>
+    <script src="media-source-loader.js"></script>
+    <script src="../video-test.js"></script>
+    <script src="../../resources/gc.js"></script>
+    <script>
+    var loader;
+    var source;
+    var sourceBuffer;
+
+    function runTest() {
+        findMediaElement();
+
+        loader = new MediaSourceLoader('content/test-fragmented-manifest.json');
+        loader.onload = mediaDataLoaded;
+        loader.onerror = mediaDataLoadingFailed;
+    }
+
+    function mediaDataLoadingFailed() {
+        failTest('Media data loading failed');
+    }
+
+    function mediaDataLoaded() {
+        source = new MediaSource();
+        waitForEvent('sourceopen', sourceOpen, false, false, source);
+        run('video.src = URL.createObjectURL(source)');
+    }
+
+    function sourceOpen() {
+        run('source.duration = loader.duration()');
+        run('sourceBuffer = source.addSourceBuffer(loader.type())');
+        waitForEventOn(sourceBuffer, 'update', sourceInitialized, false, true);
+        run('sourceBuffer.appendBuffer(loader.initSegment())');
+    }
+
+    function sourceInitialized() {
+        consoleWrite('Append a media segment.')
+        waitForEventOn(sourceBuffer, 'update', mediaSegmentAppended, false, true);
+        run('sourceBuffer.appendBuffer(loader.mediaSegment(0))');
+    }
+
+    function mediaSegmentAppended() {
+        consoleWrite('Remove the SourceBuffer from its MediaSource, then unload the video element. Should not crash.')
+        run('source.removeSourceBuffer(sourceBuffer)');
+        run('sourceBuffer = null');
+        setTimeout(afterRemove, 100);
+    }
+
+    function afterRemove(event) {
+        run('gc()');
+        run('video.src = ""');
+        run('video.load()');
+        endTest();
+    }
+    </script>
+</head>
+<body onload="runTest()">
+    <video controls></video>
+</body>
+</html>
index a4bd223..c3242fa 100644 (file)
@@ -1,3 +1,16 @@
+2018-01-16  Jer Noble  <jer.noble@apple.com>
+
+        Reset MediaSourcePrivateAVFObjC's m_sourceBufferWithSelectedVideo when the underlying SourceBufferPrivate is removed.
+        https://bugs.webkit.org/show_bug.cgi?id=181707
+        <rdar://problem/34809474>
+
+        Reviewed by Eric Carlson.
+
+        Test: media/media-source/media-source-remove-unload-crash.html
+
+        * platform/graphics/avfoundation/objc/MediaSourcePrivateAVFObjC.mm:
+        (WebCore::MediaSourcePrivateAVFObjC::removeSourceBuffer):
+
 2018-01-12  Jiewen Tan  <jiewen_tan@apple.com>
 
         [WebAuthN] Implement dummy WebAuthN IDLs
index 7cf94b5..0a2b043 100644 (file)
@@ -80,6 +80,9 @@ void MediaSourcePrivateAVFObjC::removeSourceBuffer(SourceBufferPrivate* buffer)
 {
     ASSERT(m_sourceBuffers.contains(buffer));
 
+    if (buffer == m_sourceBufferWithSelectedVideo)
+        m_sourceBufferWithSelectedVideo = nullptr;
+
     size_t pos = m_activeSourceBuffers.find(buffer);
     if (pos != notFound) {
         m_activeSourceBuffers.remove(pos);