Fix potential null pointer access in HTMLMediaElement::seek

third_party/WebKit/Source/core/html/HTMLVideoElementTest.cpp

Index: third_party/WebKit/Source/core/html/HTMLVideoElementTest.cpp
diff --git a/third_party/WebKit/Source/core/html/HTMLVideoElementTest.cpp b/third_party/WebKit/Source/core/html/HTMLVideoElementTest.cpp
index 61e2b501371780c3dc4932c32ea3943aa943fcc2..506d03e06a2cf33877644ccb903a8c4b53eec3a1 100644
--- a/third_party/WebKit/Source/core/html/HTMLVideoElementTest.cpp
+++ b/third_party/WebKit/Source/core/html/HTMLVideoElementTest.cpp
@@ -88,6 +88,22 @@ protected:
         testing::runPendingTasks();
     }
 
+    void breakReadyState()
+    {
+        // Manually setup a situation when ready state goes out of sync with
+        // m_webMediaPlayer. The real call sequence that results in error is unkown.

[philipj_slow, 2016/04/06 15:08:01]

This isn't very reassuring. Can you look at all the places that change
readyState and m_webMediaPlayer and list what the remaining candidates are? It
could be that nobody has tried very hard to figure this out, at least I haven't.

[pavor, 2016/05/12 12:03:36]

I tried to figure it out, but without any success. If there is no possibility of
concurrent calls to HTMLMediaElement methods from different threads, I
completely have no idea. I consider the candidate for the cause is
clearMediaPlayerAndAudioSourceProviderClientWithoutLocking, but I couldn't
reproduce the crash and find the scenario.

+        m_video->setPreload("none");
+        setSrc("http://foo.bar/");
+        m_video->setReadyState(HTMLMediaElement::HAVE_FUTURE_DATA);
+        m_video->remoteRouteAvailabilityChanged(true);
+    }
+
+    void callPrivateWebMediaPlayerAccessors()
+    {
+        m_video->updatePlayState();
+        m_video->audioTracksTimerFired(nullptr);
+    }
+
     MockWebMediaPlayer* webMediaPlayer()
     {
         return static_cast<MockWebMediaPlayer*>(m_video->webMediaPlayer());
@@ -143,4 +159,22 @@ TEST_F(HTMLVideoElementTest, setBufferingStrategy_UserPause)
     ::testing::Mock::VerifyAndClearExpectations(player);
 }
 
+TEST_F(HTMLVideoElementTest, webMediaPlayerOutOfSyncWithReadyState)
+{
+    breakReadyState();
+
+    MockWebMediaPlayer* player = webMediaPlayer();
+    ASSERT_FALSE(player);
+
+    // Call public methods that access m_webMediaPlayer
+    // If a check of m_webMediaPlayer for nullptr is missing,
+    // the test crashes.
+    m_video->setCurrentTime(0.0);
+    m_video->requestRemotePlayback();
+    m_video->requestRemotePlaybackControl();
+    m_video->selectedVideoTrackChanged(nullptr);
+
+    callPrivateWebMediaPlayerAccessors();
+}
+
 } // namespace blink