Bug 27101 - Possible crashes when mouse clicks not dispatched because range input destroyed while thumb is being dragged (e.g. scrub to end of movie)
Summary: Possible crashes when mouse clicks not dispatched because range input destroy...
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: WebCore Misc. (show other bugs)
Version: 528+ (Nightly build)
Hardware: All All
: P2 Normal
Assignee: Eric Carlson
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2009-07-08 16:05 PDT by Eric Carlson
Modified: 2009-07-09 10:07 PDT (History)
0 users

See Also:


Attachments
Proposed patch (20.87 KB, patch)
2009-07-08 16:13 PDT, Eric Carlson
adele: review+
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Eric Carlson 2009-07-08 16:05:00 PDT
The videos on http://iphone.akamai.com/ delete the video element when it posts an 'ended' event. If you scrub to the end and the event is fired and the element is deleted while the mouse is down in the controller thumb, mouse clicks stop working on elements in the page and occasionally we crash in vent handling code in the media control elements, with a deleted m_mediaElement.

The problem is that the slider thumb "captures" all mouse events from mouseDown to mouseUp so it continue to get mouse events even when the mouse is moved outside of the thumb. This is done by putting EventHandler into a mode where it sends all mouse events to the thumb regardless of the actual mouse position. The mode is set on mouseDown and cleared on mouseUp but if the controller is deleted while in the this mode, the mouseUp is never sent and EventHandler continues to try to send events to the non-existent node.
Comment 1 Eric Carlson 2009-07-08 16:13:53 PDT
Created attachment 32485 [details]
Proposed patch
Comment 2 Adele Peterson 2009-07-08 21:11:47 PDT
Comment on attachment 32485 [details]
Proposed patch

looks good!
Comment 3 Eric Carlson 2009-07-09 10:07:01 PDT
http://trac.webkit.org/changeset/45662