Bug 1419897 - Crash in mozilla::dom::HTMLMediaElement::RemoveMediaKeys. r=jwwang

The process of |TryRemoveMediaKeysAssociation()| is a 2-step async procedue in mainthread.
mMediaKeys might be set to null inside |NotifyOwnerDocumentActivityChanged()| in between
|TryRemoveMediaKeysAssociation| and |RemoveMediaKeys|.

MozReview-Commit-ID: HtiADt3UTvp

--HG--
extra : rebase_source : 9eff95040b3e900fb778187e4e432bce0b41396b
This commit is contained in:
Kilik Kuo 2017-11-28 23:06:34 +08:00
parent 9bba600ffc
commit fea69fe34f

View File

@ -7136,7 +7136,9 @@ HTMLMediaElement::RemoveMediaKeys()
LOG(LogLevel::Debug, ("%s", __func__));
// 5.2.3 Stop using the CDM instance represented by the mediaKeys attribute
// to decrypt media data and remove the association with the media element.
mMediaKeys->Unbind();
if (mMediaKeys) {
mMediaKeys->Unbind();
}
mMediaKeys = nullptr;
}