<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[199126] trunk/Source/WebCore</title>
</head>
<body>
<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; }
#msg dl a { font-weight: bold}
#msg dl a:link { color:#fc3; }
#msg dl a:active { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/199126">199126</a></dd>
<dt>Author</dt> <dd>eric.carlson@apple.com</dd>
<dt>Date</dt> <dd>2016-04-06 17:14:42 -0700 (Wed, 06 Apr 2016)</dd>
</dl>
<h3>Log Message</h3>
<pre>[iOS Simulator WK1] Crash in MediaPlayer::setPrivateBrowsingMode()
https://bugs.webkit.org/show_bug.cgi?id=155721
<rdar://problem/18590481>
Speculative fix for a crash that appears to happen when the media engine is destroyed
during a callback.
Reviewed by Dean Jackson.
No new tests, this prevents existing tests from crashing.
* html/HTMLMediaElement.cpp:
(WebCore::actionName): Log MediaEngineUpdated.
(WebCore::HTMLMediaElement::scheduleDelayedAction): Support MediaEngineUpdated.
(WebCore::HTMLMediaElement::pendingActionTimerFired): Ditto. Clear m_pendingActionFlags.
(WebCore::HTMLMediaElement::mediaEngineWasUpdated): New.
(WebCore::HTMLMediaElement::mediaPlayerEngineUpdated): Move guts to mediaEngineWasUpdated and
call it on a timer so we can't change the media engine in the middle of a callback from
MediaPlayer or the media engine.
* html/HTMLMediaElement.h:
* html/HTMLMediaElementEnums.h:
* platform/graphics/MediaPlayer.cpp:
(WebCore::MediaPlayer::~MediaPlayer): Assert if new flag m_initializingMediaEngine is set to
catch HTMLMediaElement destroying the media engine during a callback.
(WebCore::MediaPlayer::loadWithNextMediaEngine): Set/clear m_initializingMediaEngine.
* platform/graphics/MediaPlayer.h:</pre>
<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkSourceWebCoreChangeLog">trunk/Source/WebCore/ChangeLog</a></li>
<li><a href="#trunkSourceWebCorehtmlHTMLMediaElementcpp">trunk/Source/WebCore/html/HTMLMediaElement.cpp</a></li>
<li><a href="#trunkSourceWebCorehtmlHTMLMediaElementh">trunk/Source/WebCore/html/HTMLMediaElement.h</a></li>
<li><a href="#trunkSourceWebCorehtmlHTMLMediaElementEnumsh">trunk/Source/WebCore/html/HTMLMediaElementEnums.h</a></li>
<li><a href="#trunkSourceWebCoreplatformgraphicsMediaPlayercpp">trunk/Source/WebCore/platform/graphics/MediaPlayer.cpp</a></li>
<li><a href="#trunkSourceWebCoreplatformgraphicsMediaPlayerh">trunk/Source/WebCore/platform/graphics/MediaPlayer.h</a></li>
</ul>
</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkSourceWebCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/ChangeLog (199125 => 199126)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/ChangeLog 2016-04-07 00:13:51 UTC (rev 199125)
+++ trunk/Source/WebCore/ChangeLog 2016-04-07 00:14:42 UTC (rev 199126)
</span><span class="lines">@@ -1,3 +1,33 @@
</span><ins>+2016-04-06 Eric Carlson <eric.carlson@apple.com>
+
+ [iOS Simulator WK1] Crash in MediaPlayer::setPrivateBrowsingMode()
+ https://bugs.webkit.org/show_bug.cgi?id=155721
+ <rdar://problem/18590481>
+
+ Speculative fix for a crash that appears to happen when the media engine is destroyed
+ during a callback.
+
+ Reviewed by Dean Jackson.
+
+ No new tests, this prevents existing tests from crashing.
+
+ * html/HTMLMediaElement.cpp:
+ (WebCore::actionName): Log MediaEngineUpdated.
+ (WebCore::HTMLMediaElement::scheduleDelayedAction): Support MediaEngineUpdated.
+ (WebCore::HTMLMediaElement::pendingActionTimerFired): Ditto. Clear m_pendingActionFlags.
+ (WebCore::HTMLMediaElement::mediaEngineWasUpdated): New.
+ (WebCore::HTMLMediaElement::mediaPlayerEngineUpdated): Move guts to mediaEngineWasUpdated and
+ call it on a timer so we can't change the media engine in the middle of a callback from
+ MediaPlayer or the media engine.
+ * html/HTMLMediaElement.h:
+ * html/HTMLMediaElementEnums.h:
+
+ * platform/graphics/MediaPlayer.cpp:
+ (WebCore::MediaPlayer::~MediaPlayer): Assert if new flag m_initializingMediaEngine is set to
+ catch HTMLMediaElement destroying the media engine during a callback.
+ (WebCore::MediaPlayer::loadWithNextMediaEngine): Set/clear m_initializingMediaEngine.
+ * platform/graphics/MediaPlayer.h:
+
</ins><span class="cx"> 2016-04-06 Brady Eidson <beidson@apple.com>
</span><span class="cx">
</span><span class="cx"> Modern IDB: Make sure SQLite backing store records have a INTEGER PRIMARY KEY column.
</span></span></pre></div>
<a id="trunkSourceWebCorehtmlHTMLMediaElementcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/html/HTMLMediaElement.cpp (199125 => 199126)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/html/HTMLMediaElement.cpp 2016-04-07 00:13:51 UTC (rev 199125)
+++ trunk/Source/WebCore/html/HTMLMediaElement.cpp 2016-04-07 00:14:42 UTC (rev 199126)
</span><span class="lines">@@ -191,23 +191,24 @@
</span><span class="cx"> {
</span><span class="cx"> StringBuilder actionBuilder;
</span><span class="cx">
</span><del>-#define CASE(_actionType) \
</del><ins>+#define ACTION(_actionType) \
</ins><span class="cx"> if (action & (HTMLMediaElementEnums::_actionType)) { \
</span><span class="cx"> if (!actionBuilder.isEmpty()) \
</span><span class="cx"> actionBuilder.append(", "); \
</span><span class="cx"> actionBuilder.append(#_actionType); \
</span><span class="cx"> } \
</span><span class="cx">
</span><del>- CASE(LoadMediaResource);
- CASE(ConfigureTextTracks);
- CASE(TextTrackChangesNotification);
- CASE(ConfigureTextTrackDisplay);
- CASE(CheckPlaybackTargetCompatablity);
- CASE(CheckMediaState);
</del><ins>+ ACTION(LoadMediaResource);
+ ACTION(ConfigureTextTracks);
+ ACTION(TextTrackChangesNotification);
+ ACTION(ConfigureTextTrackDisplay);
+ ACTION(CheckPlaybackTargetCompatablity);
+ ACTION(CheckMediaState);
+ ACTION(MediaEngineUpdated);
</ins><span class="cx">
</span><span class="cx"> return actionBuilder.toString();
</span><span class="cx">
</span><del>-#undef CASE
</del><ins>+#undef ACTION
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> #endif
</span><span class="lines">@@ -869,6 +870,9 @@
</span><span class="cx"> if (actionType & CheckMediaState)
</span><span class="cx"> setFlags(m_pendingActionFlags, CheckMediaState);
</span><span class="cx">
</span><ins>+ if (actionType & MediaEngineUpdated)
+ setFlags(m_pendingActionFlags, MediaEngineUpdated);
+
</ins><span class="cx"> m_pendingActionTimer.startOneShot(0);
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -896,13 +900,15 @@
</span><span class="cx"> void HTMLMediaElement::pendingActionTimerFired()
</span><span class="cx"> {
</span><span class="cx"> Ref<HTMLMediaElement> protect(*this); // loadNextSourceChild may fire 'beforeload', which can make arbitrary DOM mutations.
</span><ins>+ PendingActionFlags pendingActions = m_pendingActionFlags;
+ m_pendingActionFlags = 0;
</ins><span class="cx">
</span><span class="cx"> #if ENABLE(VIDEO_TRACK)
</span><del>- if (RuntimeEnabledFeatures::sharedFeatures().webkitVideoTrackEnabled() && (m_pendingActionFlags & ConfigureTextTracks))
</del><ins>+ if (RuntimeEnabledFeatures::sharedFeatures().webkitVideoTrackEnabled() && (pendingActions & ConfigureTextTracks))
</ins><span class="cx"> configureTextTracks();
</span><span class="cx"> #endif
</span><span class="cx">
</span><del>- if (m_pendingActionFlags & LoadMediaResource) {
</del><ins>+ if (pendingActions & LoadMediaResource) {
</ins><span class="cx"> if (m_loadState == LoadingFromSourceElement)
</span><span class="cx"> loadNextSourceChild();
</span><span class="cx"> else
</span><span class="lines">@@ -910,17 +916,18 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> #if ENABLE(WIRELESS_PLAYBACK_TARGET)
</span><del>- if (m_pendingActionFlags & CheckPlaybackTargetCompatablity && m_player && m_player->isCurrentPlaybackTargetWireless() && !m_player->canPlayToWirelessPlaybackTarget()) {
</del><ins>+ if (pendingActions & CheckPlaybackTargetCompatablity && m_player && m_player->isCurrentPlaybackTargetWireless() && !m_player->canPlayToWirelessPlaybackTarget()) {
</ins><span class="cx"> LOG(Media, "HTMLMediaElement::pendingActionTimerFired(%p) - calling setShouldPlayToPlaybackTarget(false)", this);
</span><span class="cx"> m_failedToPlayToWirelessTarget = true;
</span><span class="cx"> m_player->setShouldPlayToPlaybackTarget(false);
</span><span class="cx"> }
</span><span class="cx">
</span><del>- if (m_pendingActionFlags & CheckMediaState)
</del><ins>+ if (pendingActions & CheckMediaState)
</ins><span class="cx"> updateMediaState();
</span><span class="cx"> #endif
</span><span class="cx">
</span><del>- m_pendingActionFlags = 0;
</del><ins>+ if (pendingActions & MediaEngineUpdated)
+ mediaEngineWasUpdated();
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> PassRefPtr<MediaError> HTMLMediaElement::error() const
</span><span class="lines">@@ -4532,20 +4539,14 @@
</span><span class="cx"> }
</span><span class="cx"> #endif
</span><span class="cx">
</span><del>-void HTMLMediaElement::mediaPlayerEngineUpdated(MediaPlayer*)
</del><ins>+void HTMLMediaElement::mediaEngineWasUpdated()
</ins><span class="cx"> {
</span><del>- LOG(Media, "HTMLMediaElement::mediaPlayerEngineUpdated(%p)", this);
</del><ins>+ LOG(Media, "HTMLMediaElement::mediaEngineWasUpdated(%p)", this);
</ins><span class="cx"> beginProcessingMediaPlayerCallback();
</span><span class="cx"> if (renderer())
</span><span class="cx"> renderer()->updateFromElement();
</span><span class="cx"> endProcessingMediaPlayerCallback();
</span><span class="cx">
</span><del>-#if ENABLE(MEDIA_SOURCE)
- m_droppedVideoFrames = 0;
-#endif
-
- m_havePreparedToPlay = false;
-
</del><span class="cx"> m_mediaSession->mediaEngineUpdated(*this);
</span><span class="cx">
</span><span class="cx"> #if ENABLE(WEB_AUDIO)
</span><span class="lines">@@ -4563,11 +4564,25 @@
</span><span class="cx"> m_player->setVideoFullscreenGravity(m_videoFullscreenGravity);
</span><span class="cx"> m_player->setVideoFullscreenLayer(m_videoFullscreenLayer.get());
</span><span class="cx"> #endif
</span><ins>+
</ins><span class="cx"> #if ENABLE(WIRELESS_PLAYBACK_TARGET)
</span><span class="cx"> updateMediaState(UpdateMediaState::Asynchronously);
</span><span class="cx"> #endif
</span><span class="cx"> }
</span><span class="cx">
</span><ins>+void HTMLMediaElement::mediaPlayerEngineUpdated(MediaPlayer*)
+{
+ LOG(Media, "HTMLMediaElement::mediaPlayerEngineUpdated(%p)", this);
+
+#if ENABLE(MEDIA_SOURCE)
+ m_droppedVideoFrames = 0;
+#endif
+
+ m_havePreparedToPlay = false;
+
+ scheduleDelayedAction(MediaEngineUpdated);
+}
+
</ins><span class="cx"> void HTMLMediaElement::mediaPlayerFirstVideoFrameAvailable(MediaPlayer*)
</span><span class="cx"> {
</span><span class="cx"> LOG(Media, "HTMLMediaElement::mediaPlayerFirstVideoFrameAvailable(%p) - current display mode = %i", this, (int)displayMode());
</span></span></pre></div>
<a id="trunkSourceWebCorehtmlHTMLMediaElementh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/html/HTMLMediaElement.h (199125 => 199126)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/html/HTMLMediaElement.h 2016-04-07 00:13:51 UTC (rev 199125)
+++ trunk/Source/WebCore/html/HTMLMediaElement.h 2016-04-07 00:14:42 UTC (rev 199126)
</span><span class="lines">@@ -547,7 +547,8 @@
</span><span class="cx"> bool mediaPlayerRenderingCanBeAccelerated(MediaPlayer*) override;
</span><span class="cx"> void mediaPlayerRenderingModeChanged(MediaPlayer*) override;
</span><span class="cx"> void mediaPlayerEngineUpdated(MediaPlayer*) override;
</span><del>-
</del><ins>+ void mediaEngineWasUpdated();
+
</ins><span class="cx"> void mediaPlayerFirstVideoFrameAvailable(MediaPlayer*) override;
</span><span class="cx"> void mediaPlayerCharacteristicChanged(MediaPlayer*) override;
</span><span class="cx">
</span></span></pre></div>
<a id="trunkSourceWebCorehtmlHTMLMediaElementEnumsh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/html/HTMLMediaElementEnums.h (199125 => 199126)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/html/HTMLMediaElementEnums.h 2016-04-07 00:13:51 UTC (rev 199125)
+++ trunk/Source/WebCore/html/HTMLMediaElementEnums.h 2016-04-07 00:14:42 UTC (rev 199126)
</span><span class="lines">@@ -41,6 +41,7 @@
</span><span class="cx"> ConfigureTextTrackDisplay = 1 << 3,
</span><span class="cx"> CheckPlaybackTargetCompatablity = 1 << 4,
</span><span class="cx"> CheckMediaState = 1 << 5,
</span><ins>+ MediaEngineUpdated = 1 << 6,
</ins><span class="cx">
</span><span class="cx"> EveryDelayedAction = LoadMediaResource | ConfigureTextTracks | TextTrackChangesNotification | ConfigureTextTrackDisplay | CheckPlaybackTargetCompatablity | CheckMediaState,
</span><span class="cx"> };
</span></span></pre></div>
<a id="trunkSourceWebCoreplatformgraphicsMediaPlayercpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/platform/graphics/MediaPlayer.cpp (199125 => 199126)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/platform/graphics/MediaPlayer.cpp 2016-04-07 00:13:51 UTC (rev 199125)
+++ trunk/Source/WebCore/platform/graphics/MediaPlayer.cpp 2016-04-07 00:14:42 UTC (rev 199126)
</span><span class="lines">@@ -328,6 +328,7 @@
</span><span class="cx">
</span><span class="cx"> MediaPlayer::~MediaPlayer()
</span><span class="cx"> {
</span><ins>+ ASSERT(!m_initializingMediaEngine);
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> bool MediaPlayer::load(const URL& url, const ContentType& contentType, const String& keySystem)
</span><span class="lines">@@ -434,6 +435,9 @@
</span><span class="cx"> #define MEDIASTREAM 0
</span><span class="cx"> #endif
</span><span class="cx">
</span><ins>+ ASSERT(!m_initializingMediaEngine);
+ m_initializingMediaEngine = true;
+
</ins><span class="cx"> const MediaPlayerFactory* engine = nullptr;
</span><span class="cx">
</span><span class="cx"> if (!m_contentMIMEType.isEmpty() || MEDIASTREAM || MEDIASOURCE)
</span><span class="lines">@@ -476,6 +480,8 @@
</span><span class="cx"> m_client.mediaPlayerEngineUpdated(this);
</span><span class="cx"> m_client.mediaPlayerResourceNotSupported(this);
</span><span class="cx"> }
</span><ins>+
+ m_initializingMediaEngine = false;
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> bool MediaPlayer::hasAvailableVideoFrame() const
</span></span></pre></div>
<a id="trunkSourceWebCoreplatformgraphicsMediaPlayerh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/platform/graphics/MediaPlayer.h (199125 => 199126)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/platform/graphics/MediaPlayer.h 2016-04-07 00:13:51 UTC (rev 199125)
+++ trunk/Source/WebCore/platform/graphics/MediaPlayer.h 2016-04-07 00:14:42 UTC (rev 199126)
</span><span class="lines">@@ -617,6 +617,7 @@
</span><span class="cx"> bool m_privateBrowsing;
</span><span class="cx"> bool m_shouldPrepareToRender;
</span><span class="cx"> bool m_contentMIMETypeWasInferredFromExtension;
</span><ins>+ bool m_initializingMediaEngine { false };
</ins><span class="cx">
</span><span class="cx"> #if ENABLE(MEDIA_SOURCE)
</span><span class="cx"> RefPtr<MediaSourcePrivateClient> m_mediaSource;
</span></span></pre>
</div>
</div>
</body>
</html>