Bug 97951 – Crashing in MediaControlPanelElement::makeTransparent()

• Component: Media
• Status: RESOLVED FIXED

[Andrew Scherkus]

See https://code.google.com/p/chromium/issues/detail?id=153071 for additional crash investigation

This seems to be the makeTransparent() equivalent of bug 76391 where document()->page() isn't checked for being null.

From a crash dump:

chrome_5f7b0000!WebCore::MediaControlPanelElement::makeTransparent+0xc [c:\b\build\slave\win\build\src\third_party\webkit\source\webcore\html\shadow\mediacontrolelements.cpp @ 258]:
  258 5ff62f80 6849040000      push    449h
  258 5ff62f85 682b050000      push    52Bh
  258 5ff62f8a 8bc6            mov     eax,esi
  258 5ff62f8c e8f42ef9ff      call    chrome_5f7b0000!WebCore::StyledElement::setInlineStyleProperty (5fef5e85)
  259 5ff62f91 8b4614          mov     eax,dword ptr [esi+14h]
  259 5ff62f94 8b8040010000    mov     eax,dword ptr [eax+140h]
  259 5ff62f9a 85c0            test    eax,eax
  259 5ff62f9c 7405            je      chrome_5f7b0000!WebCore::MediaControlPanelElement::makeTransparent+0x2f (5ff62fa3)

chrome_5f7b0000!WebCore::MediaControlPanelElement::makeTransparent+0x2a [c:\b\build\slave\win\build\src\third_party\webkit\source\webcore\html\shadow\mediacontrolelements.cpp @ 259]:
  259 5ff62f9e 8b4018          mov     eax,dword ptr [eax+18h]
  259 5ff62fa1 eb02            jmp     chrome_5f7b0000!WebCore::MediaControlPanelElement::makeTransparent+0x31 (5ff62fa5)

chrome_5f7b0000!WebCore::MediaControlPanelElement::makeTransparent+0x2f [c:\b\build\slave\win\build\src\third_party\webkit\source\webcore\html\shadow\mediacontrolelements.cpp @ 259]:
  259 5ff62fa3 33c0            xor     eax,eax

chrome_5f7b0000!WebCore::MediaControlPanelElement::makeTransparent+0x31 [c:\b\build\slave\win\build\src\third_party\webkit\source\webcore\html\shadow\mediacontrolelements.cpp @ 259]:
  259 5ff62fa5 8b4848          mov     ecx,dword ptr [eax+48h]  // *** CRASH ***
  259 5ff62fa8 8b01            mov     eax,dword ptr [ecx]
  259 5ff62faa 8b90a8000000    mov     edx,dword ptr [eax+0A8h]
  259 5ff62fb0 ffd2            call    edx
  259 5ff62fb2 83ec08          sub     esp,8
  259 5ff62fb5 dd1c24          fstp    qword ptr [esp]
  259 5ff62fb8 6a0f            push    0Fh
  259 5ff62fba 682a050000      push    52Ah
  259 5ff62fbf 8bc6            mov     eax,esi
  259 5ff62fc1 e88f2ff9ff      call    chrome_5f7b0000!WebCore::StyledElement::setInlineStyleProperty (5fef5f55)


Notes:
  * esi contains the this pointer
  * Document::page() is inlined
  * Either Document::m_frame or Document::m_frame->page() is null, which makes eax 0x00000000
  * We explode when de-reffing page()->theme()->mediAControlsFadeOutDuration()

Page* Document::page() const
{
    return m_frame ? m_frame->page() : 0;
}

[Andrew Scherkus]

Created attachment 166328 [details]
Patch

[Build Bot]

Comment on attachment 166328 [details]
Patch

Attachment 166328 [details] did not pass mac-ews (mac):
Output: http://queues.webkit.org/results/14090024

New failing tests:
http/tests/workers/terminate-during-sync-operation.html

[Andrew Scherkus]

+jer and sullivan, who wrote and reviewed bug 76391

[WebKit Review Bot]

Comment on attachment 166328 [details]
Patch

Clearing flags on attachment: 166328

Committed r131505: <http://trac.webkit.org/changeset/131505>

[WebKit Review Bot]

All reviewed patches have been landed.  Closing bug.