Bug 1015662: Drop the edge from <track> to its channel once the load is completed. r=bz
authorKyle Huey <khuey@kylehuey.com>
Wed, 18 Jun 2014 13:10:24 -0700
changeset 189465 81af21d6b216003f943e6e394a36f13f60d067e4
parent 189464 157947d5fe31b8028f3d7c160d0e8f6aebb85841
child 189466 ed9d62bef0df94f75f27a8d98fb4089b2f188cd4
push id1
push userroot
push dateMon, 20 Oct 2014 17:29:22 +0000
reviewersbz
bugs1015662
milestone33.0a1
Bug 1015662: Drop the edge from <track> to its channel once the load is completed. r=bz
content/html/content/src/HTMLTrackElement.cpp
content/html/content/src/HTMLTrackElement.h
content/media/WebVTTListener.cpp
content/media/test/crashtests/1015662.html
content/media/test/crashtests/crashtests.list
--- a/content/html/content/src/HTMLTrackElement.cpp
+++ b/content/html/content/src/HTMLTrackElement.cpp
@@ -90,18 +90,17 @@ HTMLTrackElement::~HTMLTrackElement()
 }
 
 NS_IMPL_ELEMENT_CLONE(HTMLTrackElement)
 
 NS_IMPL_ADDREF_INHERITED(HTMLTrackElement, Element)
 NS_IMPL_RELEASE_INHERITED(HTMLTrackElement, Element)
 
 NS_IMPL_CYCLE_COLLECTION_INHERITED(HTMLTrackElement, nsGenericHTMLElement,
-                                   mTrack, mChannel, mMediaParent,
-                                   mListener)
+                                   mTrack, mMediaParent, mListener)
 
 NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION_INHERITED(HTMLTrackElement)
 NS_INTERFACE_MAP_END_INHERITING(nsGenericHTMLElement)
 
 void
 HTMLTrackElement::GetKind(DOMString& aKind) const
 {
   GetEnumAttr(nsGkAtoms::kind, kKindTableDefaultString, aKind);
@@ -365,10 +364,16 @@ HTMLTrackElement::DispatchTrustedEvent(c
   nsIDocument* doc = OwnerDoc();
   if (!doc) {
     return;
   }
   nsContentUtils::DispatchTrustedEvent(doc, static_cast<nsIContent*>(this),
                                        aName, false, false);
 }
 
+void
+HTMLTrackElement::DropChannel()
+{
+  mChannel = nullptr;
+}
+
 } // namespace dom
 } // namespace mozilla
--- a/content/html/content/src/HTMLTrackElement.h
+++ b/content/html/content/src/HTMLTrackElement.h
@@ -119,16 +119,19 @@ public:
                               bool aCompileEventHandlers) MOZ_OVERRIDE;
   virtual void UnbindFromTree(bool aDeep, bool aNullParent) MOZ_OVERRIDE;
 
   // Check enabling preference.
   static bool IsWebVTTEnabled();
 
   void DispatchTrackRunnable(const nsString& aEventName);
   void DispatchTrustedEvent(const nsAString& aName);
+
+  void DropChannel();
+
 protected:
   virtual JSObject* WrapNode(JSContext* aCx) MOZ_OVERRIDE;
   void OnChannelRedirect(nsIChannel* aChannel, nsIChannel* aNewChannel,
                          uint32_t aFlags);
   // Open a new channel to the HTMLTrackElement's src attribute and call
   // mListener's LoadResource().
   void LoadResource();
 
--- a/content/media/WebVTTListener.cpp
+++ b/content/media/WebVTTListener.cpp
@@ -109,16 +109,19 @@ WebVTTListener::OnStopRequest(nsIRequest
   if (NS_FAILED(aStatus)) {
     mElement->SetReadyState(TextTrackReadyState::FailedToLoad);
   }
   // Attempt to parse any final data the parser might still have.
   mParserWrapper->Flush();
   if (mElement->ReadyState() != TextTrackReadyState::FailedToLoad) {
     mElement->SetReadyState(TextTrackReadyState::Loaded);
   }
+
+  mElement->DropChannel();
+
   return aStatus;
 }
 
 NS_METHOD
 WebVTTListener::ParseChunk(nsIInputStream* aInStream, void* aClosure,
                            const char* aFromSegment, uint32_t aToOffset,
                            uint32_t aCount, uint32_t* aWriteCount)
 {
new file mode 100644
--- /dev/null
+++ b/content/media/test/crashtests/1015662.html
@@ -0,0 +1,4 @@
+<!DOCTYPE html>
+<body>
+<video><track src="javascript:5"></track></video>
+</body>
--- a/content/media/test/crashtests/crashtests.list
+++ b/content/media/test/crashtests/crashtests.list
@@ -65,9 +65,10 @@ load 933151.html
 load 933156.html
 load 952756.html
 load 986901.html
 load buffer-source-ended-1.html
 load offline-buffer-source-ended-1.html
 HTTP load media-element-source-seek-1.html
 skip-if(B2G) load oscillator-ended-1.html # intermittent B2G timeouts, bug 920338
 skip-if(B2G) load oscillator-ended-2.html # intermittent B2G timeouts, bug 920338
+load 1015662.html
 include ../../mediasource/test/crashtests/crashtests.list