Prevent garbage collection of MediaStream objects with pending events.

This fixes a clusterfuzz crash that is hard to reproduce in test
environments.

Bug: 899575
Change-Id: Ic901c580769ab539850d97360e28727078033e56
Reviewed-on: https://chromium-review.googlesource.com/c/1338084
Commit-Queue: Guido Urdaneta <guidou@chromium.org>
Reviewed-by: Kentaro Hara <haraken@chromium.org>
Cr-Commit-Position: refs/heads/master@{#608745}

third_party/blink/renderer/modules/mediastream/media_stream.cc

@@ -198,6 +198,10 @@ MediaStream::MediaStream(ExecutionContext* context,
 
 MediaStream::~MediaStream() = default;
 
+bool MediaStream::HasPendingActivity() const {
+  return !scheduled_events_.IsEmpty();
+}
+
 bool MediaStream::EmptyOrOnlyEndedTracks() {
   if (!audio_tracks_.size() && !video_tracks_.size()) {
     return true;

third_party/blink/renderer/modules/mediastream/media_stream.h

@@ -26,6 +26,7 @@
 #ifndef THIRD_PARTY_BLINK_RENDERER_MODULES_MEDIASTREAM_MEDIA_STREAM_H_
 #define THIRD_PARTY_BLINK_RENDERER_MODULES_MEDIASTREAM_MEDIA_STREAM_H_
 
+#include "third_party/blink/renderer/bindings/core/v8/active_script_wrappable.h"
 #include "third_party/blink/renderer/modules/event_target_modules.h"
 #include "third_party/blink/renderer/modules/mediastream/media_stream_track.h"
 #include "third_party/blink/renderer/modules/modules_export.h"
@@ -50,9 +51,11 @@ class MODULES_EXPORT MediaStreamObserver : public GarbageCollectedMixin {
   void Trace(blink::Visitor* visitor) override {}
 };
 
-class MODULES_EXPORT MediaStream final : public EventTargetWithInlineData,
-                                         public ContextClient,
-                                         public MediaStreamDescriptorClient {
+class MODULES_EXPORT MediaStream final
+    : public EventTargetWithInlineData,
+      public ContextClient,
+      public ActiveScriptWrappable<MediaStream>,
+      public MediaStreamDescriptorClient {
   USING_GARBAGE_COLLECTED_MIXIN(MediaStream);
   DEFINE_WRAPPERTYPEINFO();
 
@@ -125,6 +128,9 @@ class MODULES_EXPORT MediaStream final : public EventTargetWithInlineData,
     return ContextClient::GetExecutionContext();
   }
 
+  // ActiveScriptWrappable
+  bool HasPendingActivity() const override;
+
   void Trace(blink::Visitor*) override;
 
  protected:

third_party/blink/renderer/modules/mediastream/media_stream.idl

@@ -26,6 +26,7 @@
 // https://w3c.github.io/mediacapture-main/#idl-def-mediastream
 
 [
+    ActiveScriptWrappable,
     Constructor,
     Constructor(MediaStream stream),
     Constructor(sequence<MediaStreamTrack> tracks),