Bug 865537 - Part 2: The Range used to track the source element pointer for a media element should not gravitate outside the media element. r=cpearce, a=lsblakk
authorRobert O'Callahan <robert@ocallahan.org>
Fri, 07 Jun 2013 16:26:55 +1200
changeset 142846 23e6f850488d5599811e08f8cb768c6cf69fdd40
parent 142845 d86029bb7e41ebcaaf398c98f2a2c42db56a7970
child 142847 cc8ff267526b690a1f6e33256636780d70f806c2
push id2579
push userakeybl@mozilla.com
push dateMon, 24 Jun 2013 18:52:47 +0000
treeherdermozilla-beta@b69b7de8a05a [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewerscpearce, lsblakk
bugs865537
milestone23.0a2
Bug 865537 - Part 2: The Range used to track the source element pointer for a media element should not gravitate outside the media element. r=cpearce, a=lsblakk
content/html/content/public/HTMLMediaElement.h
content/html/content/src/HTMLMediaElement.cpp
content/media/test/crashtests/865537-1.html
content/media/test/crashtests/crashtests.list
--- a/content/html/content/public/HTMLMediaElement.h
+++ b/content/html/content/public/HTMLMediaElement.h
@@ -36,16 +36,18 @@
 typedef uint16_t nsMediaNetworkState;
 typedef uint16_t nsMediaReadyState;
 
 namespace mozilla {
 class MediaResource;
 class MediaDecoder;
 }
 
+class nsRange;
+
 namespace mozilla {
 namespace dom {
 
 class MediaError;
 
 class HTMLMediaElement : public nsGenericHTMLElement,
                          public nsIObserver,
                          public MediaDecoderOwner,
@@ -860,17 +862,17 @@ protected:
 
   // The current media load ID. This is incremented every time we start a
   // new load. Async events note the ID when they're first sent, and only fire
   // if the ID is unchanged when they come to fire.
   uint32_t mCurrentLoadID;
 
   // Points to the child source elements, used to iterate through the children
   // when selecting a resource to load.
-  nsCOMPtr<nsIDOMRange> mSourcePointer;
+  nsRefPtr<nsRange> mSourcePointer;
 
   // Points to the document whose load we're blocking. This is the document
   // we're bound to when loading starts.
   nsCOMPtr<nsIDocument> mLoadBlockedDoc;
 
   // Contains names of events that have been raised while in the bfcache.
   // These events get re-dispatched when the bfcache is exited.
   nsTArray<nsString> mPendingEvents;
--- a/content/html/content/src/HTMLMediaElement.cpp
+++ b/content/html/content/src/HTMLMediaElement.cpp
@@ -3387,16 +3387,19 @@ nsIContent* HTMLMediaElement::GetNextSou
   nsCOMPtr<nsIDOMNode> thisDomNode = do_QueryObject(this);
 
   mSourceLoadCandidate = nullptr;
 
   nsresult rv = NS_OK;
   if (!mSourcePointer) {
     // First time this has been run, create a selection to cover children.
     mSourcePointer = new nsRange(this);
+    // If this media element is removed from the DOM, don't gravitate the
+    // range up to its ancestor, leave it attached to the media element.
+    mSourcePointer->SetEnableGravitationOnElementRemoval(false);
 
     rv = mSourcePointer->SelectNodeContents(thisDomNode);
     if (NS_FAILED(rv)) return nullptr;
 
     rv = mSourcePointer->Collapse(true);
     if (NS_FAILED(rv)) return nullptr;
   }
 
new file mode 100644
--- /dev/null
+++ b/content/media/test/crashtests/865537-1.html
@@ -0,0 +1,13 @@
+<!DOCTYPE HTML>
+<html>
+<body onload="doTest()">
+<base href="../unknown">
+<div id="test3"></div>
+<video id="test4"><source src="white.webm"></video>
+<script>
+function doTest() {
+  test3.appendChild(test4);
+}
+</script>
+</body>
+</html>
--- a/content/media/test/crashtests/crashtests.list
+++ b/content/media/test/crashtests/crashtests.list
@@ -10,8 +10,9 @@ load 492286-1.xhtml
 load 576612-1.html
 skip-if(Android||B2G) load 691096-1.html # Android sound API can't handle playing large number of sounds at once, bug 852821 for B2G
 load 752784-1.html
 skip-if(Android||B2G) HTTP load 795892-1.html # load failed, bug 833371 for B2G
 skip-if(Android||B2G) load 789075-1.html # load failed, bug 833371 for B2G
 load 844563.html
 load 846612.html
 load 852838.html
+load 865537-1.html