Bug 167615 - NULL-deref crash in TextTrack::removeCue()
Summary: NULL-deref crash in TextTrack::removeCue()
Status: REOPENED
Alias: None
Product: WebKit
Classification: Unclassified
Component: New Bugs (show other bugs)
Version: WebKit Nightly Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Jer Noble
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2017-01-30 16:47 PST by Jer Noble
Modified: 2017-02-01 10:23 PST (History)
11 users (show)

See Also:


Attachments
Patch (1.93 KB, patch)
2017-01-30 16:50 PST, Jer Noble
no flags Details | Formatted Diff | Diff
Patch (5.79 KB, patch)
2017-01-31 14:11 PST, Jer Noble
eric.carlson: review+
Details | Formatted Diff | Diff
Patch for landing (5.62 KB, patch)
2017-01-31 14:26 PST, Jer Noble
commit-queue: commit-queue-
Details | Formatted Diff | Diff
Archive of layout-test-results from webkit-cq-01 for mac-elcapitan (882.88 KB, application/zip)
2017-01-31 15:29 PST, WebKit Commit Bot
no flags Details
Archive of layout-test-results from ews117 for mac-elcapitan (1.82 MB, application/zip)
2017-01-31 15:44 PST, Build Bot
no flags Details
Archive of layout-test-results from ews105 for mac-elcapitan-wk2 (1.09 MB, application/zip)
2017-01-31 15:45 PST, Build Bot
no flags Details
Patch for landing (5.64 KB, patch)
2017-02-01 09:57 PST, Jer Noble
no flags Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Jer Noble 2017-01-30 16:47:07 PST
NULL-deref crash in TextTrack::removeCue()
Comment 1 Jer Noble 2017-01-30 16:49:26 PST
rdar://problem/30106362
Comment 2 Jer Noble 2017-01-30 16:50:01 PST
Created attachment 300159 [details]
Patch
Comment 3 Eric Carlson 2017-01-30 17:02:03 PST
Caused by changes for bug 166635.
Comment 4 WebKit Commit Bot 2017-01-30 18:39:30 PST
Comment on attachment 300159 [details]
Patch

Clearing flags on attachment: 300159

Committed r211401: <http://trac.webkit.org/changeset/211401>
Comment 5 WebKit Commit Bot 2017-01-30 18:39:35 PST
All reviewed patches have been landed.  Closing bug.
Comment 6 Alexey Proskuryakov 2017-01-31 10:30:02 PST
Can this be tested with a regression test?
Comment 7 Jer Noble 2017-01-31 14:10:57 PST
Reopening to attach new patch.
Comment 8 Jer Noble 2017-01-31 14:11:00 PST
Created attachment 300258 [details]
Patch
Comment 9 Eric Carlson 2017-01-31 14:21:52 PST
Comment on attachment 300258 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=300258&action=review

> LayoutTests/http/tests/media/track-in-band-hls-metadata-crash.html:21
> +
> +

Nit: extra blank line.

> LayoutTests/http/tests/media/track-in-band-hls-metadata-crash.html:22
> +            function cuechange() {

Nit: brace on the next line (or change the other functions to match this).

> LayoutTests/http/tests/media/track-in-band-hls-metadata-crash.html:41
> +        <img id=photo>

Nit: this element isn't used.

> LayoutTests/http/tests/media/track-in-band-hls-metadata-crash.html:42
> +        <p>Test for metadata tracks from Apple HLS stream.</p>

Nit: might as well update this comment.
Comment 10 Jer Noble 2017-01-31 14:26:12 PST
Created attachment 300259 [details]
Patch for landing
Comment 11 WebKit Commit Bot 2017-01-31 15:29:35 PST
Comment on attachment 300259 [details]
Patch for landing

Rejecting attachment 300259 [details] from commit-queue.

New failing tests:
http/tests/media/track-in-band-hls-metadata-crash.html
Full output: http://webkit-queues.webkit.org/results/2981523
Comment 12 WebKit Commit Bot 2017-01-31 15:29:40 PST
Created attachment 300270 [details]
Archive of layout-test-results from webkit-cq-01 for mac-elcapitan

The attached test failures were seen while running run-webkit-tests on the commit-queue.
Bot: webkit-cq-01  Port: mac-elcapitan  Platform: Mac OS X 10.11.6
Comment 13 Build Bot 2017-01-31 15:44:22 PST
Comment on attachment 300259 [details]
Patch for landing

Attachment 300259 [details] did not pass mac-debug-ews (mac):
Output: http://webkit-queues.webkit.org/results/2981541

New failing tests:
http/tests/media/track-in-band-hls-metadata-crash.html
Comment 14 Build Bot 2017-01-31 15:44:27 PST
Created attachment 300276 [details]
Archive of layout-test-results from ews117 for mac-elcapitan

The attached test failures were seen while running run-webkit-tests on the mac-debug-ews.
Bot: ews117  Port: mac-elcapitan  Platform: Mac OS X 10.11.6
Comment 15 Build Bot 2017-01-31 15:45:12 PST
Comment on attachment 300259 [details]
Patch for landing

Attachment 300259 [details] did not pass mac-wk2-ews (mac-wk2):
Output: http://webkit-queues.webkit.org/results/2981601

New failing tests:
http/tests/media/track-in-band-hls-metadata-crash.html
Comment 16 Build Bot 2017-01-31 15:45:17 PST
Created attachment 300277 [details]
Archive of layout-test-results from ews105 for mac-elcapitan-wk2

The attached test failures were seen while running run-webkit-tests on the mac-wk2-ews.
Bot: ews105  Port: mac-elcapitan-wk2  Platform: Mac OS X 10.11.6
Comment 17 Jer Noble 2017-02-01 09:57:38 PST
Created attachment 300334 [details]
Patch for landing
Comment 18 WebKit Commit Bot 2017-02-01 10:23:46 PST
Comment on attachment 300334 [details]
Patch for landing

Clearing flags on attachment: 300334

Committed r211495: <http://trac.webkit.org/changeset/211495>