Bug 1329075 - Fix potential null deref issues in media element track sources. r?jesup
MozReview-Commit-ID: ExUh2magc2z
--- a/dom/html/HTMLMediaElement.cpp
+++ b/dom/html/HTMLMediaElement.cpp
@@ -2928,16 +2928,21 @@ public:
MediaSourceEnum GetMediaSource() const override
{
return MediaSourceEnum::Other;
}
CORSMode GetCORSMode() const override
{
+ if (!mCapturedTrackSource) {
+ // This could happen during shutdown.
+ return CORS_NONE;
+ }
+
return mCapturedTrackSource->GetCORSMode();
}
void Stop() override
{
if (mElement && mElement->mSrcStream) {
// Only notify if we're still playing the source stream. GC might have
// cleared it before the track sources.
@@ -2946,16 +2951,21 @@ public:
mElement = nullptr;
mOwningStream = nullptr;
Destroy();
}
void PrincipalChanged() override
{
+ if (!mCapturedTrackSource) {
+ // This could happen during shutdown.
+ return;
+ }
+
mPrincipal = mCapturedTrackSource->GetPrincipal();
MediaStreamTrackSource::PrincipalChanged();
}
private:
virtual ~StreamCaptureTrackSource() {}
RefPtr<HTMLMediaElement> mElement;
@@ -2991,29 +3001,36 @@ public:
, mElement(aElement)
{
MOZ_ASSERT(mElement);
mElement->AddDecoderPrincipalChangeObserver(this);
}
void Destroy() override
{
- MOZ_ASSERT(mElement);
- DebugOnly<bool> res = mElement->RemoveDecoderPrincipalChangeObserver(this);
- NS_ASSERTION(res, "Removing decoder principal changed observer failed. "
- "Had it already been removed?");
+ if (mElement) {
+ DebugOnly<bool> res = mElement->RemoveDecoderPrincipalChangeObserver(this);
+ NS_ASSERTION(res, "Removing decoder principal changed observer failed. "
+ "Had it already been removed?");
+ mElement = nullptr;
+ }
}
MediaSourceEnum GetMediaSource() const override
{
return MediaSourceEnum::Other;
}
CORSMode GetCORSMode() const override
{
+ if (!mElement) {
+ MOZ_ASSERT(false, "Should always have an element if in use");
+ return CORS_NONE;
+ }
+
return mElement->GetCORSMode();
}
void Stop() override
{
// We don't notify the source that a track was stopped since it will keep
// producing tracks until the element ends. The decoder also needs the
// tracks it created to be live at the source since the decoder's clock is