Bug 1419897 - Crash in mozilla::dom::HTMLMediaElement::RemoveMediaKeys. r=jwwang

The process of |TryRemoveMediaKeysAssociation()| is a 2-step async procedue in mainthread.
mMediaKeys might be set to null inside |NotifyOwnerDocumentActivityChanged()| in between
|TryRemoveMediaKeysAssociation| and |RemoveMediaKeys|.

MozReview-Commit-ID: HtiADt3UTvp
This commit is contained in:
Kilik Kuo
2017-11-28 23:06:34 +08:00
parent 57b4fe4c83
commit 9af080a497

View File

@@ -7136,7 +7136,9 @@ HTMLMediaElement::RemoveMediaKeys()
LOG(LogLevel::Debug, ("%s", __func__));
// 5.2.3 Stop using the CDM instance represented by the mediaKeys attribute
// to decrypt media data and remove the association with the media element.
mMediaKeys->Unbind();
if (mMediaKeys) {
mMediaKeys->Unbind();
}
mMediaKeys = nullptr;
}