[Windows] Moving back in history from a page with <video>, then moving forward causes...

https://bugs.webkit.org/show_bug.cgi?id=120475

Reviewed by Anders Carlsson.

* platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.cpp:
(WebCore::AVFWrapper::AVFWrapper): Add assertion that creation is on main thread.
(WebCore::AVFWrapper::~AVFWrapper): Add assertion that destruction is on main thread.
(WebCore::destroyAVFWrapper): Helper function to dispatch on main queue.
(WebCore::AVFWrapper::disconnectAndDeleteAVFWrapper): Spawn AVFoundationCF destruction to
main queue.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@156315 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
index c3ff82f368c3f8d5517a4894465129c762f88830..0ebe9df08c207d5453896d00496f69efee34b2c2 100644 (file)
--- a/Source/WebCore/ChangeLog
+++ b/Source/WebCore/ChangeLog
@@ -1,3 +1,17 @@
+2013-09-23  Brent Fulgham  <bfulgham@apple.com>
+
+        [Windows] Moving back in history from a page with <video>, then moving forward causes crash.
+        https://bugs.webkit.org/show_bug.cgi?id=120475
+
+        Reviewed by Anders Carlsson.
+
+        * platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.cpp:
+        (WebCore::AVFWrapper::AVFWrapper): Add assertion that creation is on main thread.
+        (WebCore::AVFWrapper::~AVFWrapper): Add assertion that destruction is on main thread.
+        (WebCore::destroyAVFWrapper): Helper function to dispatch on main queue.
+        (WebCore::AVFWrapper::disconnectAndDeleteAVFWrapper): Spawn AVFoundationCF destruction to
+        main queue.
+
 2013-09-23  Andreas Kling  <akling@apple.com>
 
         RenderTextControlSingleLine::updateFromElement() override not needed.

diff --git a/Source/WebCore/platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.cpp b/Source/WebCore/platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.cpp
index 44f53293b82d176a865507a4c098c76ba78950e4..cacdde3bd0d2f3247dce298b624f2b3dc3aa8ce3 100644 (file)
--- a/Source/WebCore/platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.cpp
+++ b/Source/WebCore/platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.cpp
@@ -1161,6 +1161,7 @@ AVFWrapper::AVFWrapper(MediaPlayerPrivateAVFoundationCF* owner)
     , m_objectID(s_nextAVFWrapperObjectID++)
     , m_currentTrack(0)
 {
+    ASSERT(isMainThread());
     LOG(Media, "AVFWrapper::AVFWrapper(%p)", this);
 
     m_notificationQueue = dispatch_queue_create("MediaPlayerPrivateAVFoundationCF.notificationQueue", 0);
@@ -1169,6 +1170,7 @@ AVFWrapper::AVFWrapper(MediaPlayerPrivateAVFoundationCF* owner)
 
 AVFWrapper::~AVFWrapper()
 {
+    ASSERT(isMainThread());
     LOG(Media, "AVFWrapper::~AVFWrapper(%p %d)", this, m_objectID);
 
     destroyVideoLayer();
@@ -1247,6 +1249,15 @@ void AVFWrapper::scheduleDisconnectAndDelete()
     dispatch_async_f(dispatchQueue(), this, disconnectAndDeleteAVFWrapper);
 }
 
+static void destroyAVFWrapper(void* context)
+{
+    AVFWrapper* avfWrapper = static_cast<AVFWrapper*>(context);
+    if (!avfWrapper)
+        return;
+
+    delete avfWrapper;
+}
+
 void AVFWrapper::disconnectAndDeleteAVFWrapper(void* context)
 {
     AVFWrapper* avfWrapper = static_cast<AVFWrapper*>(context);
@@ -1279,7 +1290,8 @@ void AVFWrapper::disconnectAndDeleteAVFWrapper(void* context)
     AVCFPlayerItemRemoveOutput(avfWrapper->avPlayerItem(), avfWrapper->legibleOutput());
 #endif
 
-    delete avfWrapper;
+    // We must release the AVCFPlayer and other items on the same thread that created them.
+    dispatch_async_f(dispatch_get_main_queue(), context, destroyAVFWrapper);
 }
 
 void AVFWrapper::createAssetForURL(const String& url)