<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[169781] trunk/Source/WebCore</title>
</head>
<body>
<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; }
#msg dl a { font-weight: bold}
#msg dl a:link { color:#fc3; }
#msg dl a:active { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/169781">169781</a></dd>
<dt>Author</dt> <dd>bfulgham@apple.com</dd>
<dt>Date</dt> <dd>2014-06-10 16:30:43 -0700 (Tue, 10 Jun 2014)</dd>
</dl>
<h3>Log Message</h3>
<pre>REGRESSION (<a href="http://trac.webkit.org/projects/webkit/changeset/167962">r167962</a>): Out of bounds read in JSC::StructureIDTable::get()
https://bugs.webkit.org/show_bug.cgi?id=133463
<rdar://problem/17098100>
Reviewed by Geoffrey Garen.
Revise MediaControllerHost implementation so that instead of holding its
own pointer to the JS Controller object, it uses new properties added to
the internal media controls DOM hierarchy. This allows the GC to see the
needed lifecycle of the various media control objects and avoids the
premature deallocation that caused this bug.
* Modules/mediacontrols/MediaControlsHost.h:
(WebCore::MediaControlsHost::controllerJSValue): Deleted.
(WebCore::MediaControlsHost::setControllerJSValue): Deleted.
* html/HTMLMediaElement.cpp:
(WebCore::HTMLMediaElement::controllerJSValue): Added convenience function
to share logic for retrieving the controller object.
(WebCore::HTMLMediaElement::updateCaptionContainer): Revise to use new method
for accessing the controller.
(WebCore::HTMLMediaElement::didAddUserAgentShadowRoot): Connect the media
elements JS wrapper object to the MediaControlsHost JS wrapper. Then connect
the MediaControlsHost JS wrapper to the Controller JS object.
(WebCore::HTMLMediaElement::pageScaleFactorChanged): Revise to use new method
for accessing the controller.</pre>
<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkSourceWebCoreChangeLog">trunk/Source/WebCore/ChangeLog</a></li>
<li><a href="#trunkSourceWebCoreModulesmediacontrolsMediaControlsHosth">trunk/Source/WebCore/Modules/mediacontrols/MediaControlsHost.h</a></li>
<li><a href="#trunkSourceWebCorehtmlHTMLMediaElementcpp">trunk/Source/WebCore/html/HTMLMediaElement.cpp</a></li>
</ul>
</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkSourceWebCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/ChangeLog (169780 => 169781)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/ChangeLog 2014-06-10 23:23:46 UTC (rev 169780)
+++ trunk/Source/WebCore/ChangeLog 2014-06-10 23:30:43 UTC (rev 169781)
</span><span class="lines">@@ -1,3 +1,31 @@
</span><ins>+2014-06-09 Brent Fulgham <bfulgham@apple.com>
+
+ REGRESSION (r167962): Out of bounds read in JSC::StructureIDTable::get()
+ https://bugs.webkit.org/show_bug.cgi?id=133463
+ <rdar://problem/17098100>
+
+ Reviewed by Geoffrey Garen.
+
+ Revise MediaControllerHost implementation so that instead of holding its
+ own pointer to the JS Controller object, it uses new properties added to
+ the internal media controls DOM hierarchy. This allows the GC to see the
+ needed lifecycle of the various media control objects and avoids the
+ premature deallocation that caused this bug.
+
+ * Modules/mediacontrols/MediaControlsHost.h:
+ (WebCore::MediaControlsHost::controllerJSValue): Deleted.
+ (WebCore::MediaControlsHost::setControllerJSValue): Deleted.
+ * html/HTMLMediaElement.cpp:
+ (WebCore::HTMLMediaElement::controllerJSValue): Added convenience function
+ to share logic for retrieving the controller object.
+ (WebCore::HTMLMediaElement::updateCaptionContainer): Revise to use new method
+ for accessing the controller.
+ (WebCore::HTMLMediaElement::didAddUserAgentShadowRoot): Connect the media
+ elements JS wrapper object to the MediaControlsHost JS wrapper. Then connect
+ the MediaControlsHost JS wrapper to the Controller JS object.
+ (WebCore::HTMLMediaElement::pageScaleFactorChanged): Revise to use new method
+ for accessing the controller.
+
</ins><span class="cx"> 2014-06-10 Myles C. Maxfield <mmaxfield@apple.com>
</span><span class="cx">
</span><span class="cx"> Japanese text in Google search is rendered too low and clipped
</span></span></pre></div>
<a id="trunkSourceWebCoreModulesmediacontrolsMediaControlsHosth"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/Modules/mediacontrols/MediaControlsHost.h (169780 => 169781)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/Modules/mediacontrols/MediaControlsHost.h 2014-06-10 23:23:46 UTC (rev 169780)
+++ trunk/Source/WebCore/Modules/mediacontrols/MediaControlsHost.h 2014-06-10 23:30:43 UTC (rev 169781)
</span><span class="lines">@@ -71,15 +71,11 @@
</span><span class="cx"> bool controlsDependOnPageScaleFactor() const;
</span><span class="cx"> void setControlsDependOnPageScaleFactor(bool v);
</span><span class="cx">
</span><del>- JSC::JSValue controllerJSValue() const { return m_controller; }
- void setControllerJSValue(JSC::JSValue controller) { m_controller = controller; }
-
</del><span class="cx"> private:
</span><span class="cx"> MediaControlsHost(HTMLMediaElement*);
</span><span class="cx">
</span><span class="cx"> HTMLMediaElement* m_mediaElement;
</span><span class="cx"> RefPtr<MediaControlTextTrackContainerElement> m_textTrackContainer;
</span><del>- JSC::JSValue m_controller;
</del><span class="cx"> };
</span><span class="cx">
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceWebCorehtmlHTMLMediaElementcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/html/HTMLMediaElement.cpp (169780 => 169781)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/html/HTMLMediaElement.cpp 2014-06-10 23:23:46 UTC (rev 169780)
+++ trunk/Source/WebCore/html/HTMLMediaElement.cpp 2014-06-10 23:30:43 UTC (rev 169781)
</span><span class="lines">@@ -3649,6 +3649,32 @@
</span><span class="cx"> m_processingPreferenceChange = false;
</span><span class="cx"> }
</span><span class="cx">
</span><ins>+static JSC::JSValue controllerJSValue(JSC::ExecState& exec, JSDOMGlobalObject& globalObject, HTMLMediaElement& media)
+{
+ auto mediaJSWrapper = toJS(&exec, &globalObject, &media);
+
+ // Retrieve the controller through the JS object graph
+ JSC::JSObject* mediaJSWrapperObject = JSC::jsDynamicCast<JSC::JSObject*>(mediaJSWrapper);
+ if (!mediaJSWrapperObject)
+ return JSC::jsNull();
+
+ JSC::Identifier controlsHost(&exec.vm(), "controlsHost");
+ JSC::JSValue controlsHostJSWrapper = mediaJSWrapperObject->get(&exec, controlsHost);
+ if (exec.hadException())
+ return JSC::jsNull();
+
+ JSC::JSObject* controlsHostJSWrapperObject = JSC::jsDynamicCast<JSC::JSObject*>(controlsHostJSWrapper);
+ if (!controlsHostJSWrapperObject)
+ return JSC::jsNull();
+
+ JSC::Identifier controllerID(&exec.vm(), "controller");
+ JSC::JSValue controllerJSWrapper = controlsHostJSWrapperObject->get(&exec, controllerID);
+ if (exec.hadException())
+ return JSC::jsNull();
+
+ return controllerJSWrapper;
+}
+
</ins><span class="cx"> void HTMLMediaElement::updateCaptionContainer()
</span><span class="cx"> {
</span><span class="cx"> LOG(Media, "HTMLMediaElement::updateCaptionContainer");
</span><span class="lines">@@ -3672,12 +3698,11 @@
</span><span class="cx"> JSC::ExecState* exec = globalObject->globalExec();
</span><span class="cx"> JSC::JSLockHolder lock(exec);
</span><span class="cx">
</span><del>- JSC::JSValue controllerValue = m_mediaControlsHost->controllerJSValue();
- if (controllerValue.isUndefinedOrNull() || !controllerValue.isObject())
</del><ins>+ JSC::JSValue controllerValue = controllerJSValue(*exec, *globalObject, *this);
+ JSC::JSObject* controllerObject = JSC::jsDynamicCast<JSC::JSObject*>(controllerValue);
+ if (!controllerObject)
</ins><span class="cx"> return;
</span><span class="cx">
</span><del>- JSC::JSObject* controllerObject = controllerValue.toObject(exec);
-
</del><span class="cx"> // The media controls script must provide a method on the Controller object with the following details.
</span><span class="cx"> // Name: updateCaptionContainer
</span><span class="cx"> // Parameters:
</span><span class="lines">@@ -3685,11 +3710,10 @@
</span><span class="cx"> // Return value:
</span><span class="cx"> // None
</span><span class="cx"> JSC::JSValue methodValue = controllerObject->get(exec, JSC::Identifier(exec, "updateCaptionContainer"));
</span><del>- if (methodValue.isUndefinedOrNull() || !methodValue.isObject())
</del><ins>+ JSC::JSObject* methodObject = JSC::jsDynamicCast<JSC::JSObject*>(methodValue);
+ if (!methodObject)
</ins><span class="cx"> return;
</span><span class="cx">
</span><del>- JSC::JSObject* methodObject = methodValue.toObject(exec);
-
</del><span class="cx"> JSC::CallData callData;
</span><span class="cx"> JSC::CallType callType = methodObject->methodTable()->getCallData(methodObject, callData);
</span><span class="cx"> if (callType == JSC::CallTypeNone)
</span><span class="lines">@@ -5795,10 +5819,13 @@
</span><span class="cx"> if (!m_mediaControlsHost)
</span><span class="cx"> m_mediaControlsHost = MediaControlsHost::create(this);
</span><span class="cx">
</span><ins>+ auto mediaJSWrapper = toJS(exec, globalObject, this);
+ auto mediaControlsHostJSWrapper = toJS(exec, globalObject, m_mediaControlsHost.get());
+
</ins><span class="cx"> JSC::MarkedArgumentBuffer argList;
</span><span class="cx"> argList.append(toJS(exec, globalObject, root));
</span><del>- argList.append(toJS(exec, globalObject, this));
- argList.append(toJS(exec, globalObject, m_mediaControlsHost.get()));
</del><ins>+ argList.append(mediaJSWrapper);
+ argList.append(mediaControlsHostJSWrapper);
</ins><span class="cx">
</span><span class="cx"> JSC::JSObject* function = functionValue.toObject(exec);
</span><span class="cx"> JSC::CallData callData;
</span><span class="lines">@@ -5807,8 +5834,28 @@
</span><span class="cx"> return;
</span><span class="cx">
</span><span class="cx"> JSC::JSValue controllerValue = JSC::call(exec, function, callType, callData, globalObject, argList);
</span><del>- m_mediaControlsHost->setControllerJSValue(controllerValue);
</del><ins>+ JSC::JSObject* controllerObject = JSC::jsDynamicCast<JSC::JSObject*>(controllerValue);
+ if (!controllerObject)
+ return;
</ins><span class="cx">
</span><ins>+ // Connect the Media, MediaControllerHost, and Controller so the GC knows about their relationship
+ JSC::JSObject* mediaJSWrapperObject = mediaJSWrapper.toObject(exec);
+ JSC::Identifier controlsHost(&exec->vm(), "controlsHost");
+
+ ASSERT(!mediaJSWrapperObject->hasProperty(exec, controlsHost));
+
+ mediaJSWrapperObject->putDirect(exec->vm(), controlsHost, mediaControlsHostJSWrapper, JSC::DontDelete | JSC::DontEnum | JSC::ReadOnly);
+
+ JSC::JSObject* mediaControlsHostJSWrapperObject = JSC::jsDynamicCast<JSC::JSObject*>(mediaControlsHostJSWrapper);
+ if (!mediaControlsHostJSWrapperObject)
+ return;
+
+ JSC::Identifier controller(&exec->vm(), "controller");
+
+ ASSERT(!controllerObject->hasProperty(exec, controller));
+
+ mediaControlsHostJSWrapperObject->putDirect(exec->vm(), controller, controllerValue, JSC::DontDelete | JSC::DontEnum | JSC::ReadOnly);
+
</ins><span class="cx"> setPageScaleFactorProperty(exec, controllerValue, page->pageScaleFactor());
</span><span class="cx">
</span><span class="cx"> if (exec->hadException())
</span><span class="lines">@@ -5842,7 +5889,7 @@
</span><span class="cx"> JSC::ExecState* exec = globalObject->globalExec();
</span><span class="cx"> JSC::JSLockHolder lock(exec);
</span><span class="cx">
</span><del>- JSC::JSValue controllerValue = m_mediaControlsHost->controllerJSValue();
</del><ins>+ JSC::JSValue controllerValue = controllerJSValue(*exec, *globalObject, *this);
</ins><span class="cx">
</span><span class="cx"> setPageScaleFactorProperty(exec, controllerValue, page->pageScaleFactor());
</span><span class="cx"> }
</span></span></pre>
</div>
</div>
</body>
</html>