Bug 1419897 - Crash in mozilla::dom::HTMLMediaElement::RemoveMediaKeys.
The process of |TryRemoveMediaKeysAssociation()| is a 2-step async procedue in mainthread.
mMediaKeys might be set to null inside |NotifyOwnerDocumentActivityChanged()| in between
|TryRemoveMediaKeysAssociation| and |RemoveMediaKeys|.
MozReview-Commit-ID: HtiADt3UTvp
--- a/dom/html/HTMLMediaElement.cpp
+++ b/dom/html/HTMLMediaElement.cpp
@@ -7131,17 +7131,19 @@ HTMLMediaElement::SetCDMProxyFailure(con
}
void
HTMLMediaElement::RemoveMediaKeys()
{
LOG(LogLevel::Debug, ("%s", __func__));
// 5.2.3 Stop using the CDM instance represented by the mediaKeys attribute
// to decrypt media data and remove the association with the media element.
- mMediaKeys->Unbind();
+ if (mMediaKeys) {
+ mMediaKeys->Unbind();
+ }
mMediaKeys = nullptr;
}
bool
HTMLMediaElement::TryRemoveMediaKeysAssociation()
{
MOZ_ASSERT(mMediaKeys);
LOG(LogLevel::Debug, ("%s", __func__));