GitLab

When finalizing the media element, its media player is also cleared
out. With Oilpan enabled, that media player object must not touch the
media element while destructing its "client", as it is not in a
valid state (its heap object member may have been finalized already.)

Arrange for that to not happen by having the media element enter a
'finalizing' state, which is explicitly checked for when the player
attempts to access the media element during destruction.

This is a shorter-term solution until the media player object itself
is moved to the Oilpan heap; http://crbug.com/378229 for handling that.

R=haraken@chromium.org,ager@chromium.org
BUG=377567
TEST=media/track/track-removal-crash.html
TEST=media/audio-delete-while-slider-thumb-clicked.html
TEST=http/tests/media/media-source/mediasource-closed-on-htmlmediaelement-destruction.html

Review URL: https://codereview.chromium.org/303593002

git-svn-id: svn://svn.chromium.org/blink/trunk@174964 bbb929c8-8fbe-4397-9dbb-9b2b20218538