931453 - Crash removing a <track> from a <video>

Status: VERIFIED FIXED

(Core :: Audio/Video, defect)

Description

[Jesse Ruderman]

Attachment: testcase (crashes Firefox when loaded)

With
  user_pref("media.webvtt.enabled", true);

The testcase hits a crash in mozilla::dom::TextTrack::SetReadyState.

I think this a regression from bug 882665.

Comment 1

[Jesse Ruderman]

Attachment: stack

Comment 2

[Andrew Quartey [:drexler]]

Attachment: fix

Ensure that the media element is non-null at time of use and likewise a similar potential problem fix the TextTrack in WebVTTListener::OnStopRequest.

Comment 3

[Kyle Huey (Exited; not receiving bugmail, old account, do not use)]

Comment on attachment 823070 [details] [diff] [review]
fix

Review of attachment 823070 [details] [diff] [review]:
-----------------------------------------------------------------

::: content/media/WebVTTListener.cpp
@@ +107,5 @@
>                                nsresult aStatus)
>  {
>    if (mElement->ReadyState() != HTMLTrackElement::ERROR) {
> +    TextTrack* track = mElement->Track();
> +    track->SetReadyState(HTMLTrackElement::LOADED);

What's the point of this change?

Comment 4

[Andrew Quartey [:drexler]]

(In reply to Kyle Huey [:khuey] ([e-mail]) from comment #3)
> Comment on attachment 823070 [details] [diff] [review]
> fix
> 
> Review of attachment 823070 [details] [diff] [review]:
> -----------------------------------------------------------------
> 
> ::: content/media/WebVTTListener.cpp
> @@ +107,5 @@
> >                                nsresult aStatus)
> >  {
> >    if (mElement->ReadyState() != HTMLTrackElement::ERROR) {
> > +    TextTrack* track = mElement->Track();
> > +    track->SetReadyState(HTMLTrackElement::LOADED);
> 
> What's the point of this change?

Just a precaution since HTMLTrackElement::Track() guarantees that that |mTrack| is non-null.

Comment 5

[Andrew Quartey [:drexler]]

remote:   https://hg.mozilla.org/integration/mozilla-inbound/rev/7c4c2e8d2267

Comment 6

[Phil Ringnalda (:philor)]

https://hg.mozilla.org/mozilla-central/rev/7c4c2e8d2267

Comment 7

[Paul Silaghi, QA [:pauly]]

Reproduced on nightly 2013-10-27.
Verified fixed FF 28.0a1 (2013-11-14) Win 7 x64

Comment 8

[Tracy Walker [:tracy]]

This landed prior to the merge, In addition, I verified latest Aurora doesn't crash with STR's from comment 0