Bug 1471800 - Ensure HTMLMediaElement doesn't play its MediaDecoder in a readyState update after it's OwnerDoc has been removed from its DocShell. r=jya

It's possible that if the HTMLMediaElement is loading while we're loading a new
document into a docshell, that the HTMLMediaElement can reach readyState
HAVE_FUTURE_DATA just after its OwnerDoc is removed from the docshell. If the
HTMLMediaElement wasn't paused, then it may start playing due to the readyState
change in HTMLMediaElement::ChangeReadyState().

For years we've had hard to reproduce issues where media started playing after
we've closed the tab; I bet this was the cause!

When we detect that the document has been removed from its DocShell,
HTMLMediaElement::NotifyOwnerDocumentActivityChanged() is called, and that
suspends the MediaDecoder just in case we need to resurrect the media element,
for example if the tab comes out of the BF cache. When we suspend we set
mPausedForInactiveDocumentOrChannel=true, and all other calls to
MediaDecoder::Play() are guarded by checks on
mPausedForInactiveDocumentOrChannel.

So we should also guard the MediaDecoder::Play() call in ChangeReadyState()
with a check on mPausedForInactiveDocumentOrChannel too.

MozReview-Commit-ID: GfmZasT9jdr

dom/html/HTMLMediaElement.cpp

@@ -6052,7 +6052,7 @@ HTMLMediaElement::ChangeReadyState(nsMediaReadyState aState)
   if (oldState < HAVE_FUTURE_DATA && mReadyState >= HAVE_FUTURE_DATA) {
     DispatchAsyncEvent(NS_LITERAL_STRING("canplay"));
     if (!mPaused) {
-      if (mDecoder) {
+      if (mDecoder && !mPausedForInactiveDocumentOrChannel) {
         mDecoder->Play();
       }
       NotifyAboutPlaying();
@@ -6178,6 +6178,7 @@ HTMLMediaElement::CheckAutoplayDataReady()
     if (mCurrentPlayRangeStart == -1.0) {
       mCurrentPlayRangeStart = CurrentTime();
     }
+    MOZ_ASSERT(!mPausedForInactiveDocumentOrChannel);
     mDecoder->Play();
   } else if (mSrcStream) {
     SetPlayedOrSeeked(true);