eliott/ladybird
1
0
Fork 0
mirror of https://github.com/LadybirdBrowser/ladybird synced 2026-05-12 18:08:15 +02:00
Code Issues Packages Projects Releases Wiki Activity

LibWeb: Cancel media controls when finalizing the host media element

Browse Source 
Tear down the MediaControls (and its Core::Timer-driven hover handler)
during HTMLMediaElement finalization. Otherwise, between weak-clearing
and incremental sweep destroying the element, a queued hover timer
event can still fire and trip a VERIFY against an already-cleared
GC::Weak reference to a shadow tree node.
This commit is contained in:
Andreas Kling
2026-05-08 13:10:27 +02:00
committed by Andreas Kling
parent 1f30af9f5a
commit 7930a6bd25
Notes: github-actions[bot] 2026-05-10 08:59:38 +00:00 
Author: https://github.com/awesomekling
Commit: https://github.com/LadybirdBrowser/ladybird/commit/7930a6bd255
Pull-request: https://github.com/LadybirdBrowser/ladybird/pull/7663
Reviewed-by: https://github.com/ADKaster
1 changed files with 6 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
Libraries/LibWeb/HTML/HTMLMediaElement.cpp
View File

@@ -125,6 +125,12 @@ void HTMLMediaElement::finalize()
{
Base::finalize();
// Tear down the controls eagerly so the Core::Timer they own (and the
// closures it captures) cannot fire during the window between this GC
// and our sweep, when our GC::Weak references to shadow tree nodes are
// already cleared.
m_controls.clear();
document().page().unregister_media_element({}, unique_id());
}