Oilpan: prevent player from accessing its media element during finalization

When finalizing the media element, its media player is also cleared
out. With Oilpan enabled, that media player object must not touch the
media element while destructing its "client", as it is not in a
valid state (its heap object member may have been finalized already.)

Arrange for that to not happen by having the media element enter a
'finalizing' state, which is explicitly checked for when the player
attempts to access the media element during destruction.

This is a shorter-term solution until the media player object itself
is moved to the Oilpan heap; http://crbug.com/378229 for handling that.

R=haraken@chromium.org,ager@chromium.org
BUG=377567
TEST=media/track/track-removal-crash.html
TEST=media/audio-delete-while-slider-thumb-clicked.html
TEST=http/tests/media/media-source/mediasource-closed-on-htmlmediaelement-destruction.html

Review URL: https://codereview.chromium.org/303593002

git-svn-id: svn://svn.chromium.org/blink/trunk@174964 bbb929c8-8fbe-4397-9dbb-9b2b20218538

third_party/WebKit/LayoutTests/OilpanExpectations

@@ -20,7 +20,7 @@ crbug.com/342574 [ Mac Debug ] fast/css-generated-content/crash-selection-editin
 crbug.com/350316 [ Linux Win Debug ] http/tests/eventsource/workers/eventsource-simple.html [ Crash ]
 crbug.com/350316 [ Mac Debug ] http/tests/eventsource/workers/eventsource-simple.html [ Timeout ]
 
-# While moving object onto the oilpan heap the timing changed such that the order in which 
+# While moving object onto the oilpan heap the timing changed such that the order in which
 # scrollbars are added to an iframe has changed.
 crbug.com/345655 compositing/iframes/scrolling-iframe.html [ Failure ]
 crbug.com/345655 virtual/softwarecompositing/iframes/scrolling-iframe.html [ Failure ]
@@ -54,6 +54,3 @@ Bug(alph) [ Win ] virtual/windows-directwrite/fast/text/orientation-sideways.htm
 crbug.com/377567 [ Debug ] editing/selection/extend-selection-character.html [ Timeout Pass ]
 crbug.com/377567 [ Debug ] editing/selection/programmatic-selection-on-mac-is-directionless.html [ Timeout Pass ]
 crbug.com/377567 [ Debug ] fast/css/large-list-of-rules-crash.html [ Timeout Pass ]
-crbug.com/377567 [ Debug ] http/tests/media/media-source/mediasource-closed-on-htmlmediaelement-destruction.html [ Timeout Pass ]
-crbug.com/377567 [ Debug ] media/audio-delete-while-slider-thumb-clicked.html [ Timeout Pass ]
-crbug.com/377567 [ Debug ] media/track/track-removal-crash.html [ Timeout Pass ]

third_party/WebKit/Source/core/html/HTMLMediaElement.cpp

@@ -282,6 +282,9 @@ HTMLMediaElement::HTMLMediaElement(const QualifiedName& tagName, Document& docum
     , m_tracksAreReady(true)
     , m_haveVisibleTextTrack(false)
     , m_processingPreferenceChange(false)
+#if ENABLE(OILPAN)
+    , m_isFinalizing(false)
+#endif
     , m_lastTextTrackUpdateTime(-1)
     , m_textTracks(nullptr)
     , m_ignoreTrackDisplayUpdate(0)
@@ -363,6 +366,20 @@ HTMLMediaElement::~HTMLMediaElement()
     document().incrementLoadEventDelayCount();
 #endif
 
+#if ENABLE(OILPAN)
+    // Oilpan: the player must be released, but the player object
+    // cannot safely access this player client any longer as parts of
+    // it may have been finalized already (like the media element's
+    // supplementable table.)  Handled for now by entering an
+    // is-finalizing state, which is explicitly checked for if the
+    // player tries to access the media element during shutdown.
+    //
+    // FIXME: Oilpan: move the media player to the heap instead and
+    // avoid having to finalize it from here; this whole #if block
+    // could then be removed (along with the state bit it depends on.)
+    // crbug.com/378229
+    m_isFinalizing = true;
+#endif
     clearMediaPlayerAndAudioSourceProviderClient();
 
 #if !ENABLE(OILPAN)

third_party/WebKit/Source/core/html/HTMLMediaElement.h

@@ -274,6 +274,10 @@ public:
     // and m_mediaController multipliers into account.
     double playerVolume() const;
 
+#if ENABLE(OILPAN)
+    bool isFinalizing() const { return m_isFinalizing; }
+#endif
+
 protected:
     HTMLMediaElement(const QualifiedName&, Document&);
     virtual ~HTMLMediaElement();
@@ -502,6 +506,9 @@ private:
     bool m_tracksAreReady : 1;
     bool m_haveVisibleTextTrack : 1;
     bool m_processingPreferenceChange : 1;
+#if ENABLE(OILPAN)
+    bool m_isFinalizing : 1;
+#endif
     double m_lastTextTrackUpdateTime;
 
     RefPtrWillBeMember<TextTrackList> m_textTracks;

third_party/WebKit/Source/modules/encryptedmedia/HTMLMediaElementEncryptedMedia.cpp

@@ -338,6 +338,12 @@ void HTMLMediaElementEncryptedMedia::keyNeeded(HTMLMediaElement& element, const
 
 void HTMLMediaElementEncryptedMedia::playerDestroyed(HTMLMediaElement& element)
 {
+#if ENABLE(OILPAN)
+    // FIXME: Oilpan: remove this once the media player is on the heap. crbug.com/378229
+    if (element.isFinalizing())
+        return;
+#endif
+
     HTMLMediaElementEncryptedMedia& thisElement = HTMLMediaElementEncryptedMedia::from(element);
     thisElement.setMediaKeysInternal(element, 0);
 }