[Webkit-unassigned] [Bug 121537] Crashed while visit http://html5video.org/wiki/HTML5_Demos

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=121537


Darin Adler <darin at apple.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
 Attachment #211979|review?, commit-queue?      |review-, commit-queue-
               Flag|                            |




--- Comment #9 from Darin Adler <darin at apple.com>  2013-09-19 20:38:18 PST ---
(From update of attachment 211979)
View in context: https://bugs.webkit.org/attachment.cgi?id=211979&action=review

>>>>> Source/WebCore/bindings/js/JSNodeCustom.cpp:115
>>>>> +            // |audioConstructor| then HTMLUnknowElement was created to instead HTMLAudioElement.
>>>> 
>>>> Why does paused return false for HTMLUnknownElement?
>>> 
>>> The problem was HTMLUnknownElement has not paused() member function, We convert HTMLUnknownElement to HTMLAudioElement illegally then call paused() will crash.
>> 
>> How does that happen if the isHTMLAudioElement(node) check succeeded on the line just before?
> 
> isHTMLAudioElement(node) only check whether element has a tag name "audio", see HTMLElementTypeHelpers.h.
> But |audioConstructor| in HTMLElementFactory.cpp create HTMLAudioElement failed since MediaPlayer::isAvailable() return false because QuickTime did not installed. HTMLUnknownELement was created as fallback, see HTMLElementFactory::createHTMLElement.

That is the bug we have to fix. We need to make isHTMLAudioElement return false in such cases.

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.