Fix an AutoplayUmaHelper crash

There is a crash which happens when AutoplayUmaHelper receives unload
event from window, but m_element is already garbage collected. This CL
fixes this crash by making Element as a Member of AutoplayerUmaHelper.

BUG=646890
R=avayvod@chromium.org,mlamouri@chromium.org

Review-Url: https://codereview.chromium.org/2341783002
Cr-Commit-Position: refs/heads/master@{#418659}

third_party/WebKit/Source/core/html/AutoplayUmaHelper.cpp

@@ -98,7 +98,7 @@ void AutoplayUmaHelper::didMoveToNewDocument(Document& oldDocument)
 
     if (oldDocument.domWindow())
         oldDocument.domWindow()->removeEventListener(EventTypeNames::unload, this, false);
-    if (m_element && m_element->document().domWindow())
+    if (m_element->document().domWindow())
         m_element->document().domWindow()->addEventListener(EventTypeNames::unload, this, false);
 }
 
@@ -220,7 +220,7 @@ void AutoplayUmaHelper::maybeStopRecordingMutedVideoOffscreenDuration()
 
 void AutoplayUmaHelper::maybeUnregisterUnloadListener()
 {
-    if (!shouldListenToUnloadEvent() && m_element && m_element->document().domWindow())
+    if (!shouldListenToUnloadEvent() && m_element->document().domWindow())
         m_element->document().domWindow()->removeEventListener(EventTypeNames::unload, this, false);
 }
 

third_party/WebKit/Source/core/html/AutoplayUmaHelper.h

@@ -81,7 +81,7 @@ private:
     // The autoplay source. Use AutoplaySource::NumberOfSources for invalid source.
     AutoplaySource m_source;
     // The media element this UMA helper is attached to. |m_element| owns |this|.
-    WeakMember<HTMLMediaElement> m_element;
+    Member<HTMLMediaElement> m_element;
 
     // The observer is used to observe whether a muted video autoplaying by play()
     // method become visible at some point.