commit 177999cdb34b707465670f0feff723922939f278
author haraken@chromium.org <haraken@chromium.org@bbb929c8-8fbe-4397-9dbb-9b2b20218538> Wed Oct 09 15:58:29 2013
committer haraken@chromium.org <haraken@chromium.org@bbb929c8-8fbe-4397-9dbb-9b2b20218538> Wed Oct 09 15:58:29 2013
tree ef24e74ebefc5bdfb17eb0897ea45e8afa0e8e9b
parent 98dc9fc8be976a39a6d07ae664c2a07a06cd938b

Fix use-after-free in HTMLMediaElement::contextDestroyed

A use-after-free happens in the following scenario:

(1) ~HTMLMediaElement() is called
(2) ~MediaController() is called. But HTMLMediaElement::m_mediaController is not cleared out.
(3) ~Document() is called.
(4) HTMLMediaElement::contextDestroyed() is called. It accesses HTMLMediaElement::m_mediaController.

This CL clears out HTMLMediaElement::m_mediaController in (2) and fixes the issue.

For more details, see a crash report in the bug.

No test, since this bug is just detected in ASAN builds.

BUG=305278

Review URL: https://codereview.chromium.org/26129006

git-svn-id: svn://svn.chromium.org/blink/trunk@159237 bbb929c8-8fbe-4397-9dbb-9b2b20218538