Oilpan: prevent player from accessing its media element during finalization
When finalizing the media element, its media player is also cleared
out. With Oilpan enabled, that media player object must not touch the
media element while destructing its "client", as it is not in a
valid state (its heap object member may have been finalized already.)
Arrange for that to not happen by having the media element enter a
'finalizing' state, which is explicitly checked for when the player
attempts to access the media element during destruction.
This is a shorter-term solution until the media player object itself
is moved to the Oilpan heap; http://crbug.com/378229 for handling that.
R=haraken@chromium.org,ager@chromium.org
BUG=377567
TEST=media/track/track-removal-crash.html
TEST=media/audio-delete-while-slider-thumb-clicked.html
TEST=http/tests/media/media-source/mediasource-closed-on-htmlmediaelement-destruction.html
Review URL: https://codereview.chromium.org/303593002
git-svn-id: svn://svn.chromium.org/blink/trunk@174964 bbb929c8-8fbe-4397-9dbb-9b2b20218538
4 files changed
