[webkit-reviews] review denied: [Bug 121537] Crashed while visit http://html5video.org/wiki/HTML5_Demos : [Attachment 211979] patch for reviewing

[bugzilla-daemon at webkit.org]

Darin Adler <darin at apple.com> has denied Xueqing Huang
<xqhuang.webkit at gmail.com>'s request for review:
Bug 121537: Crashed while visit http://html5video.org/wiki/HTML5_Demos
https://bugs.webkit.org/show_bug.cgi?id=121537

Attachment 211979: patch for reviewing
https://bugs.webkit.org/attachment.cgi?id=211979&action=review

------- Additional Comments from Darin Adler <darin at apple.com>
View in context: https://bugs.webkit.org/attachment.cgi?id=211979&action=review


>>>>> Source/WebCore/bindings/js/JSNodeCustom.cpp:115
>>>>> + 	   // |audioConstructor| then HTMLUnknowElement was created to
instead HTMLAudioElement.
>>>> 
>>>> Why does paused return false for HTMLUnknownElement?
>>> 
>>> The problem was HTMLUnknownElement has not paused() member function, We
convert HTMLUnknownElement to HTMLAudioElement illegally then call paused()
will crash.
>> 
>> How does that happen if the isHTMLAudioElement(node) check succeeded on the
line just before?
> 
> isHTMLAudioElement(node) only check whether element has a tag name "audio",
see HTMLElementTypeHelpers.h.
> But |audioConstructor| in HTMLElementFactory.cpp create HTMLAudioElement
failed since MediaPlayer::isAvailable() return false because QuickTime did not
installed. HTMLUnknownELement was created as fallback, see
HTMLElementFactory::createHTMLElement.

That is the bug we have to fix. We need to make isHTMLAudioElement return false
in such cases.