Don't update the active cue set in detached Documents

Source/core/html/track/CueTimeline.cpp

Index: Source/core/html/track/CueTimeline.cpp
diff --git a/Source/core/html/track/CueTimeline.cpp b/Source/core/html/track/CueTimeline.cpp
index 51cb6ae6062d59a6d43fa2e87a30e598b6c91038..bbfdc95164a7afa4e682a3142a3ed3606223efa0 100644
--- a/Source/core/html/track/CueTimeline.cpp
+++ b/Source/core/html/track/CueTimeline.cpp
@@ -132,6 +132,12 @@ void CueTimeline::updateActiveCues(double movieTime)
 
     HTMLMediaElement& mediaElement = this->mediaElement();
 
+    // Don't run the "time marches on" algorithm if the document has been
+    // detached. This primarily guards against dispatch of events w/
+    // HTMLTrackElement targets.
+    if (mediaElement.document().isDetached())

[philipj_slow, 2015/08/12 07:39:33]

Do you think we should make if conditional on !OILPAN? If not this seems like
the kind of code everyone will be afraid to touch because it's no longer
possible to reproduce the original problem.

[fs, 2015/08/12 07:55:45]

I've been pondering whether the (somewhat similar) condition below
(endIgnoringUpdateRequests) should use inDocument() && !isDetached() (maybe even
without the first part if we think that the timeline should be running in
inactive documents). I could make a follow-up to either move this check into
ignoreUpdateRequests, or make all updates go through endIgnoringUpdateRequests
(== always use display-scope).
If we think we'll never hit this w/ Oilpan (dispose replaced by GC) I guess that
would be another possible follow-up (which then may or may not apply below as
well.)

+        return;
+
     // https://html.spec.whatwg.org/#time-marches-on
 
     // 1 - Let current cues be a list of cues, initialized to contain all the