Fix potential null pointer access in HTMLMediaElement::seek

third_party/WebKit/Source/core/html/HTMLVideoElementTest.cpp

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/html/HTMLVideoElement.h"
 
 #include "core/dom/Document.h"
 #include "core/loader/EmptyClients.h"
 #include "core/page/NetworkStateNotifier.h"
 #include "core/testing/DummyPageHolder.h"
@@ skipping 70 matching lines @@
         networkStateNotifier().setWebConnection(WebConnectionTypeWifi, 54.0);
         m_video = HTMLVideoElement::create(m_dummyPageHolder->document());
     }
 
     void setSrc(const AtomicString& url)
     {
         m_video->setSrc(url);
         testing::runPendingTasks();
     }
 
+    void breakReadyState()
+    {
+        // Manually setup a situation when ready state goes out of sync with
+        // m_webMediaPlayer. The real call sequence that results in error is unkown.

[philipj_slow, 2016/04/06 15:08:01]

This isn't very reassuring. Can you look at all the places that change
readyState and m_webMediaPlayer and list what the remaining candidates are? It
could be that nobody has tried very hard to figure this out, at least I haven't.

[pavor, 2016/05/12 12:03:36]

I tried to figure it out, but without any success. If there is no possibility of
concurrent calls to HTMLMediaElement methods from different threads, I
completely have no idea. I consider the candidate for the cause is
clearMediaPlayerAndAudioSourceProviderClientWithoutLocking, but I couldn't
reproduce the crash and find the scenario.

+        m_video->setPreload("none");
+        setSrc("http://foo.bar/");
+        m_video->setReadyState(HTMLMediaElement::HAVE_FUTURE_DATA);
+        m_video->remoteRouteAvailabilityChanged(true);
+    }
+
+    void callPrivateWebMediaPlayerAccessors()
+    {
+        m_video->updatePlayState();
+        m_video->audioTracksTimerFired(nullptr);
+    }
+
     MockWebMediaPlayer* webMediaPlayer()
     {
         return static_cast<MockWebMediaPlayer*>(m_video->webMediaPlayer());
     }
 
     OwnPtr<DummyPageHolder> m_dummyPageHolder;
     Persistent<HTMLVideoElement> m_video;
 };
 
 TEST_F(HTMLVideoElementTest, setBufferingStrategy_NonUserPause)
@@ skipping 35 matching lines @@
         m_video->pause();
     }
     ::testing::Mock::VerifyAndClearExpectations(player);
 
     // On play, the strategy is set to normal.
     EXPECT_CALL(*player, setBufferingStrategy(WebMediaPlayer::BufferingStrategy::Normal));
     m_video->play();
     ::testing::Mock::VerifyAndClearExpectations(player);
 }
 
+TEST_F(HTMLVideoElementTest, webMediaPlayerOutOfSyncWithReadyState)
+{
+    breakReadyState();
+
+    MockWebMediaPlayer* player = webMediaPlayer();
+    ASSERT_FALSE(player);
+
+    // Call public methods that access m_webMediaPlayer
+    // If a check of m_webMediaPlayer for nullptr is missing,
+    // the test crashes.
+    m_video->setCurrentTime(0.0);
+    m_video->requestRemotePlayback();
+    m_video->requestRemotePlaybackControl();
+    m_video->selectedVideoTrackChanged(nullptr);
+
+    callPrivateWebMediaPlayerAccessors();
+}
+
 } // namespace blink