Don't update the active cue set in detached Documents

Source/core/html/track/CueTimeline.cpp

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "config.h"
 #include "core/html/track/CueTimeline.h"
 
 #include "core/events/Event.h"
 #include "core/html/HTMLMediaElement.h"
 #include "core/html/HTMLTrackElement.h"
@@ skipping 114 matching lines @@
     // 4.8.10.8 Playing the media resource
 
     //  If the current playback position changes while the steps are running,
     //  then the user agent must wait for the steps to complete, and then must
     //  immediately rerun the steps.
     if (ignoreUpdateRequests())
         return;
 
     HTMLMediaElement& mediaElement = this->mediaElement();
 
+#if !ENABLE(OILPAN)
+    // Don't run the "time marches on" algorithm if the document has been
+    // detached. This primarily guards against dispatch of events w/
+    // HTMLTrackElement targets.
+    if (mediaElement.document().isDetached())
+        return;
+#endif
+
     // https://html.spec.whatwg.org/#time-marches-on
 
     // 1 - Let current cues be a list of cues, initialized to contain all the
     // cues of all the hidden, showing, or showing by default text tracks of the
     // media element (not the disabled ones) whose start times are less than or
     // equal to the current playback position and whose end times are greater
     // than the current playback position.
     CueList currentCues;
 
     // The user agent must synchronously unset [the text track cue active] flag
@@ skipping 196 matching lines @@
 
 void CueTimeline::beginIgnoringUpdateRequests()
 {
     ++m_ignoreUpdate;
 }
 
 void CueTimeline::endIgnoringUpdateRequests()
 {
     ASSERT(m_ignoreUpdate);
     --m_ignoreUpdate;
-    if (!m_ignoreUpdate && mediaElement().inActiveDocument())
+    if (!m_ignoreUpdate)
         updateActiveCues(mediaElement().currentTime());
 }
 
 DEFINE_TRACE(CueTimeline)
 {
     visitor->trace(m_mediaElement);
 }
 
 } // namespace blink