<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[169630] trunk/Source/WebCore</title>
</head>
<body>
<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; }
#msg dl a { font-weight: bold}
#msg dl a:link { color:#fc3; }
#msg dl a:active { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/169630">169630</a></dd>
<dt>Author</dt> <dd>bfulgham@apple.com</dd>
<dt>Date</dt> <dd>2014-06-05 16:46:33 -0700 (Thu, 05 Jun 2014)</dd>
</dl>
<h3>Log Message</h3>
<pre>REGRESSION (<a href="http://trac.webkit.org/projects/webkit/changeset/167962">r167962</a>): Out of bounds read in JSC::StructureIDTable::get()
https://bugs.webkit.org/show_bug.cgi?id=133463
<rdar://problem/17098100>
Reviewed by Dean Jackson.
Revise MediaControllerHost implementation so that it holds a Strong
reference to the JavaScript 'Controller' object it mirrors. The
MediaControllerHost is constructed when we create an HTMLMediaElement,
and is the logical place to retain ownership of the JS object so that
it does not get garbage collected as long as HTMLMediaElement exists.
* Modules/mediacontrols/MediaControlsHost.cpp:
(WebCore::MediaControlsHost::setControllerJSObject): Create a strong
reference to the JavaScript Controller object.
* Modules/mediacontrols/MediaControlsHost.h: Use JSC::Strong to hold a
JSObject, rather than a bare JSValue.
(WebCore::MediaControlsHost::controllerJSObject): Change name to reflect
that we are working with JSObjects, not JSValues.
(WebCore::MediaControlsHost::controllerJSValue): Deleted.
(WebCore::MediaControlsHost::setControllerJSValue): Deleted.
* html/HTMLMediaElement.cpp:
(WebCore::HTMLMediaElement::parseAttribute): Revise for changed method
signature.</pre>
<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkSourceWebCoreChangeLog">trunk/Source/WebCore/ChangeLog</a></li>
<li><a href="#trunkSourceWebCoreModulesmediacontrolsMediaControlsHostcpp">trunk/Source/WebCore/Modules/mediacontrols/MediaControlsHost.cpp</a></li>
<li><a href="#trunkSourceWebCoreModulesmediacontrolsMediaControlsHosth">trunk/Source/WebCore/Modules/mediacontrols/MediaControlsHost.h</a></li>
<li><a href="#trunkSourceWebCorehtmlHTMLMediaElementcpp">trunk/Source/WebCore/html/HTMLMediaElement.cpp</a></li>
</ul>
</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkSourceWebCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/ChangeLog (169629 => 169630)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/ChangeLog 2014-06-05 23:19:54 UTC (rev 169629)
+++ trunk/Source/WebCore/ChangeLog 2014-06-05 23:46:33 UTC (rev 169630)
</span><span class="lines">@@ -1,3 +1,30 @@
</span><ins>+2014-06-05 Brent Fulgham <bfulgham@apple.com>
+
+ REGRESSION (r167962): Out of bounds read in JSC::StructureIDTable::get()
+ https://bugs.webkit.org/show_bug.cgi?id=133463
+ <rdar://problem/17098100>
+
+ Reviewed by Dean Jackson.
+
+ Revise MediaControllerHost implementation so that it holds a Strong
+ reference to the JavaScript 'Controller' object it mirrors. The
+ MediaControllerHost is constructed when we create an HTMLMediaElement,
+ and is the logical place to retain ownership of the JS object so that
+ it does not get garbage collected as long as HTMLMediaElement exists.
+
+ * Modules/mediacontrols/MediaControlsHost.cpp:
+ (WebCore::MediaControlsHost::setControllerJSObject): Create a strong
+ reference to the JavaScript Controller object.
+ * Modules/mediacontrols/MediaControlsHost.h: Use JSC::Strong to hold a
+ JSObject, rather than a bare JSValue.
+ (WebCore::MediaControlsHost::controllerJSObject): Change name to reflect
+ that we are working with JSObjects, not JSValues.
+ (WebCore::MediaControlsHost::controllerJSValue): Deleted.
+ (WebCore::MediaControlsHost::setControllerJSValue): Deleted.
+ * html/HTMLMediaElement.cpp:
+ (WebCore::HTMLMediaElement::parseAttribute): Revise for changed method
+ signature.
+
</ins><span class="cx"> 2014-06-05 Benjamin Poulain <bpoulain@apple.com>
</span><span class="cx">
</span><span class="cx"> [iOS][WK2] Add device orientation
</span></span></pre></div>
<a id="trunkSourceWebCoreModulesmediacontrolsMediaControlsHostcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/Modules/mediacontrols/MediaControlsHost.cpp (169629 => 169630)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/Modules/mediacontrols/MediaControlsHost.cpp 2014-06-05 23:19:54 UTC (rev 169629)
+++ trunk/Source/WebCore/Modules/mediacontrols/MediaControlsHost.cpp 2014-06-05 23:46:33 UTC (rev 169630)
</span><span class="lines">@@ -226,6 +226,11 @@
</span><span class="cx"> m_mediaElement->setMediaControlsDependOnPageScaleFactor(value);
</span><span class="cx"> }
</span><span class="cx">
</span><ins>+void MediaControlsHost::setControllerJSObject(JSC::ExecState* exec, JSC::JSObject* controller)
+{
+ m_controller = JSC::Strong<JSC::JSObject>(exec->vm(), controller);
</ins><span class="cx"> }
</span><span class="cx">
</span><ins>+}
+
</ins><span class="cx"> #endif
</span></span></pre></div>
<a id="trunkSourceWebCoreModulesmediacontrolsMediaControlsHosth"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/Modules/mediacontrols/MediaControlsHost.h (169629 => 169630)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/Modules/mediacontrols/MediaControlsHost.h 2014-06-05 23:19:54 UTC (rev 169629)
+++ trunk/Source/WebCore/Modules/mediacontrols/MediaControlsHost.h 2014-06-05 23:46:33 UTC (rev 169630)
</span><span class="lines">@@ -30,6 +30,7 @@
</span><span class="cx">
</span><span class="cx"> #include "ScriptState.h"
</span><span class="cx"> #include <bindings/ScriptObject.h>
</span><ins>+#include <heap/Strong.h>
</ins><span class="cx"> #include <wtf/RefCounted.h>
</span><span class="cx"> #include <wtf/Vector.h>
</span><span class="cx"> #include <wtf/text/WTFString.h>
</span><span class="lines">@@ -69,15 +70,15 @@
</span><span class="cx"> bool controlsDependOnPageScaleFactor() const;
</span><span class="cx"> void setControlsDependOnPageScaleFactor(bool v);
</span><span class="cx">
</span><del>- JSC::JSValue controllerJSValue() const { return m_controller; }
- void setControllerJSValue(JSC::JSValue controller) { m_controller = controller; }
</del><ins>+ JSC::JSObject* controllerJSObject() const { return m_controller.get(); }
+ void setControllerJSObject(JSC::ExecState*, JSC::JSObject*);
</ins><span class="cx">
</span><span class="cx"> private:
</span><span class="cx"> MediaControlsHost(HTMLMediaElement*);
</span><span class="cx">
</span><span class="cx"> HTMLMediaElement* m_mediaElement;
</span><span class="cx"> RefPtr<MediaControlTextTrackContainerElement> m_textTrackContainer;
</span><del>- JSC::JSValue m_controller;
</del><ins>+ JSC::Strong<JSC::JSObject> m_controller;
</ins><span class="cx"> };
</span><span class="cx">
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceWebCorehtmlHTMLMediaElementcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/html/HTMLMediaElement.cpp (169629 => 169630)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/html/HTMLMediaElement.cpp 2014-06-05 23:19:54 UTC (rev 169629)
+++ trunk/Source/WebCore/html/HTMLMediaElement.cpp 2014-06-05 23:46:33 UTC (rev 169630)
</span><span class="lines">@@ -3662,12 +3662,10 @@
</span><span class="cx"> JSC::ExecState* exec = globalObject->globalExec();
</span><span class="cx"> JSC::JSLockHolder lock(exec);
</span><span class="cx">
</span><del>- JSC::JSValue controllerValue = m_mediaControlsHost->controllerJSValue();
- if (controllerValue.isUndefinedOrNull() || !controllerValue.isObject())
</del><ins>+ JSC::JSObject* controllerObject = m_mediaControlsHost->controllerJSObject();
+ if (!controllerObject)
</ins><span class="cx"> return;
</span><span class="cx">
</span><del>- JSC::JSObject* controllerObject = controllerValue.toObject(exec);
-
</del><span class="cx"> // The media controls script must provide a method on the Controller object with the following details.
</span><span class="cx"> // Name: updateCaptionContainer
</span><span class="cx"> // Parameters:
</span><span class="lines">@@ -5792,8 +5790,14 @@
</span><span class="cx"> return;
</span><span class="cx">
</span><span class="cx"> JSC::JSValue controllerValue = JSC::call(exec, function, callType, callData, globalObject, argList);
</span><del>- m_mediaControlsHost->setControllerJSValue(controllerValue);
</del><span class="cx">
</span><ins>+ if (controllerValue.isUndefinedOrNull() || !controllerValue.isObject())
+ return;
+
+ JSC::JSObject* controllerObject = controllerValue.toObject(exec);
+
+ m_mediaControlsHost->setControllerJSObject(exec, controllerObject);
+
</ins><span class="cx"> setPageScaleFactorProperty(exec, controllerValue, page->pageScaleFactor());
</span><span class="cx">
</span><span class="cx"> if (exec->hadException())
</span><span class="lines">@@ -5827,9 +5831,9 @@
</span><span class="cx"> JSC::ExecState* exec = globalObject->globalExec();
</span><span class="cx"> JSC::JSLockHolder lock(exec);
</span><span class="cx">
</span><del>- JSC::JSValue controllerValue = m_mediaControlsHost->controllerJSValue();
</del><ins>+ JSC::JSObject* controllerObject = m_mediaControlsHost->controllerJSObject();
</ins><span class="cx">
</span><del>- setPageScaleFactorProperty(exec, controllerValue, page->pageScaleFactor());
</del><ins>+ setPageScaleFactorProperty(exec, controllerObject, page->pageScaleFactor());
</ins><span class="cx"> }
</span><span class="cx"> #endif // ENABLE(MEDIA_CONTROLS_SCRIPT)
</span><span class="cx">
</span></span></pre>
</div>
</div>
</body>
</html>