Bug 1015662: Drop the edge from <track> to its channel once the load is completed. r=bz
--- a/content/html/content/src/HTMLTrackElement.cpp
+++ b/content/html/content/src/HTMLTrackElement.cpp
@@ -90,18 +90,17 @@ HTMLTrackElement::~HTMLTrackElement()
}
NS_IMPL_ELEMENT_CLONE(HTMLTrackElement)
NS_IMPL_ADDREF_INHERITED(HTMLTrackElement, Element)
NS_IMPL_RELEASE_INHERITED(HTMLTrackElement, Element)
NS_IMPL_CYCLE_COLLECTION_INHERITED(HTMLTrackElement, nsGenericHTMLElement,
- mTrack, mChannel, mMediaParent,
- mListener)
+ mTrack, mMediaParent, mListener)
NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION_INHERITED(HTMLTrackElement)
NS_INTERFACE_MAP_END_INHERITING(nsGenericHTMLElement)
void
HTMLTrackElement::GetKind(DOMString& aKind) const
{
GetEnumAttr(nsGkAtoms::kind, kKindTableDefaultString, aKind);
@@ -365,10 +364,16 @@ HTMLTrackElement::DispatchTrustedEvent(c
nsIDocument* doc = OwnerDoc();
if (!doc) {
return;
}
nsContentUtils::DispatchTrustedEvent(doc, static_cast<nsIContent*>(this),
aName, false, false);
}
+void
+HTMLTrackElement::DropChannel()
+{
+ mChannel = nullptr;
+}
+
} // namespace dom
} // namespace mozilla
--- a/content/html/content/src/HTMLTrackElement.h
+++ b/content/html/content/src/HTMLTrackElement.h
@@ -119,16 +119,19 @@ public:
bool aCompileEventHandlers) MOZ_OVERRIDE;
virtual void UnbindFromTree(bool aDeep, bool aNullParent) MOZ_OVERRIDE;
// Check enabling preference.
static bool IsWebVTTEnabled();
void DispatchTrackRunnable(const nsString& aEventName);
void DispatchTrustedEvent(const nsAString& aName);
+
+ void DropChannel();
+
protected:
virtual JSObject* WrapNode(JSContext* aCx) MOZ_OVERRIDE;
void OnChannelRedirect(nsIChannel* aChannel, nsIChannel* aNewChannel,
uint32_t aFlags);
// Open a new channel to the HTMLTrackElement's src attribute and call
// mListener's LoadResource().
void LoadResource();
--- a/content/media/WebVTTListener.cpp
+++ b/content/media/WebVTTListener.cpp
@@ -109,16 +109,19 @@ WebVTTListener::OnStopRequest(nsIRequest
if (NS_FAILED(aStatus)) {
mElement->SetReadyState(TextTrackReadyState::FailedToLoad);
}
// Attempt to parse any final data the parser might still have.
mParserWrapper->Flush();
if (mElement->ReadyState() != TextTrackReadyState::FailedToLoad) {
mElement->SetReadyState(TextTrackReadyState::Loaded);
}
+
+ mElement->DropChannel();
+
return aStatus;
}
NS_METHOD
WebVTTListener::ParseChunk(nsIInputStream* aInStream, void* aClosure,
const char* aFromSegment, uint32_t aToOffset,
uint32_t aCount, uint32_t* aWriteCount)
{
new file mode 100644
--- /dev/null
+++ b/content/media/test/crashtests/1015662.html
@@ -0,0 +1,4 @@
+<!DOCTYPE html>
+<body>
+<video><track src="javascript:5"></track></video>
+</body>
--- a/content/media/test/crashtests/crashtests.list
+++ b/content/media/test/crashtests/crashtests.list
@@ -65,9 +65,10 @@ load 933151.html
load 933156.html
load 952756.html
load 986901.html
load buffer-source-ended-1.html
load offline-buffer-source-ended-1.html
HTTP load media-element-source-seek-1.html
skip-if(B2G) load oscillator-ended-1.html # intermittent B2G timeouts, bug 920338
skip-if(B2G) load oscillator-ended-2.html # intermittent B2G timeouts, bug 920338
+load 1015662.html
include ../../mediasource/test/crashtests/crashtests.list
