Bug 83377 – Setting mode for track element results in ASSERT

• Status: RESOLVED
• Resolution: FIXED
• Component: Media

[Anna Cavender]

If the TextTrack mode is set from JavaScript, the tab crashes.

For example: http://www.annacavender.com/track/demo1/track-setmode.html

Crash log:

ASSERTION FAILED: cue->isActive()
<snip>WebKit/Source/WebCore/WebCore.gyp/../html/shadow/MediaControlElements.cpp(1284) : void WebCore::MediaControlTextTrackContainerElement::updateDisplay()
1   0x1d240aa8 WebCore::MediaControlTextTrackContainerElement::updateDisplay()
2   0x1d25046c WebCore::MediaControlRootElementChromium::updateTextTrackDisplay()
3   0x1d0cf731 WebCore::HTMLMediaElement::updateActiveTextTrackCues(float)
4   0x1d0c9bbf WebCore::HTMLMediaElement::playbackProgressTimerFired(WebCore::Timer<WebCore::HTMLMediaElement>*)
5   0x1d0f2647 WebCore::Timer<WebCore::HTMLMediaElement>::fired()
6   0x1d2cfdee WebCore::ThreadTimers::sharedTimerFiredInternal()
7   0x1d2cfb7f WebCore::ThreadTimers::sharedTimerFired()
8   0x1ec16ba9 webkit_glue::WebKitPlatformSupportImpl::DoTimeout()
9   0x1ec17fd4 base::internal::RunnableAdapter<void (webkit_glue::WebKitPlatformSupportImpl::*)()>::Run(webkit_glue::WebKitPlatformSupportImpl*)
10  0x1ec17ed3 base::internal::InvokeHelper<false, void, base::internal::RunnableAdapter<void (webkit_glue::WebKitPlatformSupportImpl::*)()>, void ()(webkit_glue::WebKitPlatformSupportImpl*)>::MakeItSo(base::internal::RunnableAdapter<void (webkit_glue::WebKitPlatformSupportImpl::*)()>, webkit_glue::WebKitPlatformSupportImpl*)
11  0x1ec17e13 base::internal::Invoker<1, base::internal::BindState<base::internal::RunnableAdapter<void (webkit_glue::WebKitPlatformSupportImpl::*)()>, void ()(webkit_glue::WebKitPlatformSupportImpl*), void ()(base::internal::UnretainedWrapper<webkit_glue::WebKitPlatformSupportImpl>)>, void ()(webkit_glue::WebKitPlatformSupportImpl*)>::Run(base::internal::BindStateBase*)
12  0x1a59e6bb base::Callback<void ()()>::Run() const
13  0x1ad05b5b base::Timer::RunScheduledTask()
14  0x1ad05d69 base::BaseTimerTaskInternal::Run()
15  0x1ad06634 base::internal::RunnableAdapter<void (base::BaseTimerTaskInternal::*)()>::Run(base::BaseTimerTaskInternal*)
16  0x1ad06533 base::internal::InvokeHelper<false, void, base::internal::RunnableAdapter<void (base::BaseTimerTaskInternal::*)()>, void ()(base::BaseTimerTaskInternal*)>::MakeItSo(base::internal::RunnableAdapter<void (base::BaseTimerTaskInternal::*)()>, base::BaseTimerTaskInternal*)
17  0x1ad0646e base::internal::Invoker<1, base::internal::BindState<base::internal::RunnableAdapter<void (base::BaseTimerTaskInternal::*)()>, void ()(base::BaseTimerTaskInternal*), void ()(base::internal::OwnedWrapper<base::BaseTimerTaskInternal>)>, void ()(base::BaseTimerTaskInternal*)>::Run(base::internal::BindStateBase*)
18  0x1a59e6bb base::Callback<void ()()>::Run() const
19  0x1ac4744e MessageLoop::RunTask(base::PendingTask const&)
20  0x1ac477f1 MessageLoop::DeferOrRunPendingTask(base::PendingTask const&)
21  0x1ac47d83 MessageLoop::DoDelayedWork(base::TimeTicks*)
22  0x1abb17c8 base::MessagePumpCFRunLoopBase::RunWork()
23  0x1abb0e92 base::MessagePumpCFRunLoopBase::RunWorkSource(void*)
24  0x9951b42b __CFRunLoopDoSources0
25  0x99518eef __CFRunLoopRun
26  0x995183c4 CFRunLoopRunSpecific
27  0x995181f1 CFRunLoopRunInMode
28  0x961671b3 -[NSRunLoop(NSRunLoop) runMode:beforeDate:]
29  0x1abb21f9 base::MessagePumpNSRunLoop::DoRun(base::MessagePump::Delegate*)
30  0x1abb148d base::MessagePumpCFRunLoopBase::Run(base::MessagePump::Delegate*)
31  0x1ac46db3 MessageLoop::RunInternal()
Program received signal:  “EXC_BAD_ACCESS”.
[Switching to process 44366]
[Switching to process 44366]
sharedlibrary apply-load-rules all
(gdb)

[Anna Cavender]

Created attachment 136711 [details]
Patch

[Anna Cavender]

Comment on attachment 136711 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=136711&action=review

> LayoutTests/media/track/track-mode-expected.txt:25
> +EXPECTED (textTrack.activeCues.length == '1'), OBSERVED '0' FAIL

This cuechange event occurs because there is a cue within range at the time that the mode changes from DISABLED to HIDDEN and so it becomes activated.  However, the cue is not found in the activeCues list because we fire the event before we update the list.  I've filed a bug to report this here: https://www.w3.org/Bugs/Public/show_bug.cgi?id=16701

[Eric Carlson]

Comment on attachment 136711 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=136711&action=review

> LayoutTests/media/track/track-mode.html:51
> +                setTimeout(testHiddenAndShowing, 1100);

The 1100ms timer makes this a *very* long test for DRT. Is there any way to use a substantially shorter timeout?

[Anna Cavender]

Comment on attachment 136711 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=136711&action=review

>> LayoutTests/media/track/track-mode.html:51
>> +                setTimeout(testHiddenAndShowing, 1100);
> 
> The 1100ms timer makes this a *very* long test for DRT. Is there any way to use a substantially shorter timeout?

Yes.  I'll create a .vtt file with faster cues so we can still check that no events are fired during a period of mode=DISABLED.

[Anna Cavender]

Created attachment 136740 [details]
patch with faster test

[Radar WebKit Bug Importer]

<rdar://problem/11238352>

[WebKit Review Bot]

Comment on attachment 136740 [details]
patch with faster test

Clearing flags on attachment: 136740

Committed r114026: <http://trac.webkit.org/changeset/114026>

[WebKit Review Bot]

All reviewed patches have been landed.  Closing bug.