Bug 926665 - Clear mMediaSource when Attach fails. r=doublec.
authorMatthew Gregan <kinetik@flim.org>
Wed, 16 Oct 2013 15:23:39 +1300
changeset 165444 909898f24e71a72bb8957d90ac02dd7b53d366af
parent 165443 b6c3b8cbf7ee4029a2aca564f4253295ff247f12
child 165445 98e8d843d9e95213157304daa74f2fd957dc5117
push id3066
push userakeybl@mozilla.com
push dateMon, 09 Dec 2013 19:58:46 +0000
treeherdermozilla-beta@a31a0dce83aa [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersdoublec
bugs926665
milestone27.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 926665 - Clear mMediaSource when Attach fails. r=doublec.
content/html/content/src/HTMLMediaElement.cpp
content/media/test/crashtests/926665.html
content/media/test/crashtests/crashtests.list
--- a/content/html/content/src/HTMLMediaElement.cpp
+++ b/content/html/content/src/HTMLMediaElement.cpp
@@ -1132,24 +1132,24 @@ nsresult HTMLMediaElement::LoadResource(
     if (NS_FAILED(rv)) {
       nsCString specUTF8;
       mLoadingSrc->GetSpec(specUTF8);
       NS_ConvertUTF8toUTF16 spec(specUTF8);
       const PRUnichar* params[] = { spec.get() };
       ReportLoadError("MediaLoadInvalidURI", params, ArrayLength(params));
       return rv;
     }
-    mMediaSource = source.forget();
     nsRefPtr<MediaSourceDecoder> decoder = new MediaSourceDecoder(this);
-    if (!mMediaSource->Attach(decoder)) {
+    if (!source->Attach(decoder)) {
       // TODO: Handle failure: run "If the media data cannot be fetched at
       // all, due to network errors, causing the user agent to give up
       // trying to fetch the resource" section of resource fetch algorithm.
       return NS_ERROR_FAILURE;
     }
+    mMediaSource = source.forget();
     nsRefPtr<MediaResource> resource = new MediaSourceResource();
     return FinishDecoderSetup(decoder, resource, nullptr, nullptr);
   }
 
   nsCOMPtr<nsILoadGroup> loadGroup = GetDocumentLoadGroup();
 
   // check for a Content Security Policy to pass down to the channel
   // created to load the media content
new file mode 100644
--- /dev/null
+++ b/content/media/test/crashtests/926665.html
@@ -0,0 +1,26 @@
+<html>
+<head>
+<meta charset="UTF-8">
+<script style="display: none;" id="fuzz1" type="text/javascript;version=1.7">
+
+function boom()
+{
+    var mediaSource = new window.MediaSource();
+    var mediaSourceURL = URL.createObjectURL(mediaSource);
+    var v1 = document.createElement('video');
+    v1.src = mediaSourceURL;
+    mediaSource.addEventListener("sourceopen", function (e) {
+        var v2 = document.createElement('video');
+        v2.src = mediaSourceURL;
+        setTimeout(function () {
+            v2.src = "data:text/plain,1";
+            v1.src = "data:text/plain,2";
+        }, 0);
+    });
+}
+
+</script>
+</head>
+
+<body onload="boom();"></body>
+</html>
--- a/content/media/test/crashtests/crashtests.list
+++ b/content/media/test/crashtests/crashtests.list
@@ -54,8 +54,9 @@ test-pref(media.webvtt.enabled,true) loa
 load 907986-1.html
 load 907986-2.html
 load 907986-3.html
 load 907986-4.html
 load 910171-1.html
 load 920987.html
 skip-if(B2G) load oscillator-ended-1.html # intermittent B2G timeouts, bug 920338
 skip-if(B2G) load oscillator-ended-2.html # intermittent B2G timeouts, bug 920338
+test-pref(media.mediasource.enabled,true) load 926665.html