501535 - Crash [@ nsHTMLAudioElement::GetNodeName] with <audio poster>

Status: RESOLVED FIXED

(Core :: Audio/Video, defect)

Description

[Jesse Ruderman]

Attachment: testcase (crashes Firefox when loaded)

###!!! ASSERTION: Only call this on <video> elements.: 'HasVideoElement()', file /Users/jruderman/central/layout/generic/nsVideoFrame.cpp, line 464

Crash [@ nsHTMLAudioElement::GetNodeName], likely exploitable (due to static cast?).

Comment 1

[Jesse Ruderman]

Attachment: stack trace

Comment 2

[Chris Pearce [:cpearce (Not reading bugmail)]]

Attachment: Patch v1

Pretty simple. I wasn't checking that we were only updating the poster attribute for nsVideoFrames which correspond to video elements.

Comment 4

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Comment on attachment 386181 [details] [diff] [review]
Patch v1

Please add Jesse's test as a crashtest.

Comment 5

[Chris Pearce [:cpearce (Not reading bugmail)]]

Attachment: Patch v1 with crashtest

As Patch v1, but with crashtest. r+/sr+ roc.

Comment 6

[Chris Pearce [:cpearce (Not reading bugmail)]]

Pushed: http://hg.mozilla.org/mozilla-central/rev/48e6821dff34