commit e7e520ba3669bb812732cb0490b204d9df432968
author Matt Wolenetz <wolenetz@chromium.org> Thu Jun 16 01:01:28 2022
committer Chromium LUCI CQ <chromium-scoped@luci-project-accounts.iam.gserviceaccount.com> Thu Jun 16 01:01:28 2022
tree 3a9c1c0c0b356083975a2df98f10d28964b6105c
parent 334fb112459f785a9d6721f5b332df63fe7262c2

MSE-in-Workers: Fix leak of HTMLME+MSE due to strong attachment ref

This change releases the MediaSourceHandle's reference to the CrossThreadMediaSourceAttachment when it is retrieved via TakeAttachment() (formerly named GetAttachment()).

TakeAttachment() is only called from 2 places:
1) HTMLMediaElement::LoadResource : if the retrieved attachment is
   nullptr, then invalid attempt to reuse the attachment is detected
   and usual load failure occurs.
2) Serialization of MediaSourceHandle : if the handle has already been
   serialized or assigned as srcObject, then TakeAttachment() won't be
   called.
The fix for the leak also adjusts the code to handle (1), allowing for
the possibility of a nullptr-valued attachment being retrieved that
leads to media element load failure.

Without this change, if a MediaSourceHandle has been used to attach
via srcObject ever, then the underlying CrossThreadMediaSourceAttachment
will have persistent Oilpan references to both the worker MediaSource and the main thread HTMLMediaElement. Those are only dropped if the refcounted attachment itself is destructed, which cannot happen if there remains any strong reference to it.

BUG=878133
TEST=local build with srcObject part 5 included with this no longer
     reproduces the leak failure that caused revert [1] of part 5.
[1] https://chromium-review.googlesource.com/c/chromium/src/+/3695890

Change-Id: I1403e09dffdfddd4eae240b8e2345bd4672e874a
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3704191
Auto-Submit: Matthew Wolenetz <wolenetz@chromium.org>
Reviewed-by: Kentaro Hara <haraken@chromium.org>
Commit-Queue: Kentaro Hara <haraken@chromium.org>
Reviewed-by: Dale Curtis <dalecurtis@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1014736}