Bug 941701 - Fix crash in TextTrackCue::GetCueAsHTML. r=rillian, a=lsblakk
authorRick Eyre <rick.eyre@hotmail.com>
Fri, 14 Feb 2014 10:00:00 -0800
changeset 182867 cca60b2c6a4865c4378973bb15df7125b74e9f39
parent 182866 3cc2d13051d09d48afc61d8312d27db0b4dbbfa8
child 182868 caa38669fa1dd9553d04ae8bb6ec9cd3f66d3975
push id3343
push userffxbld
push dateMon, 17 Mar 2014 21:55:32 +0000
treeherdermozilla-beta@2f7d3415f79f [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersrillian, lsblakk
bugs941701
milestone29.0a2
Bug 941701 - Fix crash in TextTrackCue::GetCueAsHTML. r=rillian, a=lsblakk TextTrackCue::GetCueAsHTML gets called when the HTMLMediaElement shutsdown which means that TextTrackCue's mDocument sometimes no longer exists based on when the cycle collector freed it. I've added a null check to make sure that it exists before we start doing anything.
content/media/TextTrackCue.cpp
--- a/content/media/TextTrackCue.cpp
+++ b/content/media/TextTrackCue.cpp
@@ -74,18 +74,18 @@ TextTrackCue::TextTrackCue(nsISupports* 
   SetDefaultCueSettings();
   MOZ_ASSERT(aGlobal);
   SetIsDOMBinding();
   if (NS_FAILED(StashDocument(aGlobal))) {
     aRv.Throw(NS_ERROR_DOM_INVALID_STATE_ERR);
   }
 }
 
-/** Save a reference to our creating document so it's available
- *  even when unlinked during discard/teardown.
+/** Save a reference to our creating document so we don't have to
+ *  keep getting it from our window.
  */
 nsresult
 TextTrackCue::StashDocument(nsISupports* aGlobal)
 {
   nsCOMPtr<nsPIDOMWindow> window(do_QueryInterface(aGlobal));
   if (!window) {
     return NS_ERROR_NO_INTERFACE;
   }
@@ -94,17 +94,21 @@ TextTrackCue::StashDocument(nsISupports*
     return NS_ERROR_NOT_AVAILABLE;
   }
   return NS_OK;
 }
 
 already_AddRefed<DocumentFragment>
 TextTrackCue::GetCueAsHTML()
 {
-  MOZ_ASSERT(mDocument);
+  // mDocument may be null during cycle collector shutdown.
+  // See bug 941701.
+  if (!mDocument) {
+    return nullptr;
+  }
 
   if (!sParserWrapper) {
     nsresult rv;
     nsCOMPtr<nsIWebVTTParserWrapper> parserWrapper =
       do_CreateInstance(NS_WEBVTTPARSERWRAPPER_CONTRACTID, &rv);
     if (NS_FAILED(rv)) {
       return mDocument->CreateDocumentFragment();
     }