Allow multiple URL.createObjectURL invocations for MediaSource

third_party/WebKit/Source/modules/mediasource/MediaSource.cpp

Index: third_party/WebKit/Source/modules/mediasource/MediaSource.cpp
diff --git a/third_party/WebKit/Source/modules/mediasource/MediaSource.cpp b/third_party/WebKit/Source/modules/mediasource/MediaSource.cpp
index 16149c109ac69d0b8115ab7b43ecbb26ccd1707d..e4a0fb49531c731d901d47e871c2588341c1216b 100644
--- a/third_party/WebKit/Source/modules/mediasource/MediaSource.cpp
+++ b/third_party/WebKit/Source/modules/mediasource/MediaSource.cpp
@@ -106,7 +106,7 @@ MediaSource::MediaSource(ExecutionContext* context)
     , m_sourceBuffers(SourceBufferList::create(getExecutionContext(), m_asyncEventQueue.get()))
     , m_activeSourceBuffers(SourceBufferList::create(getExecutionContext(), m_asyncEventQueue.get()))
     , m_liveSeekableRange(TimeRanges::create())
-    , m_isAddedToRegistry(false)
+    , m_addedToRegistryCounter(0)
 {
     MSLOG << __FUNCTION__ << " this=" << this;
 }
@@ -302,14 +302,13 @@ void MediaSource::setWebMediaSourceAndOpen(std::unique_ptr<WebMediaSource> webMe
 
 void MediaSource::addedToRegistry()
 {
-    DCHECK(!m_isAddedToRegistry);
-    m_isAddedToRegistry = true;
+    ++m_addedToRegistryCounter;

[wolenetz, 2016/07/11 18:03:17]

A web app would have to work really hard to overflow the int type here (e.g.
10,000 createObjectURL/second for about 60 hours straight), but that leaves open
the possibility for hasPendingActivity() to return false incorrectly and for
this object to be GC'ed prematurely, leading to potential use-after-free
vulnerability. Please protect against this (perhaps a simple
CHECK_GT(m_addedToRegistryCounter,0), not a DCHECK, here would suffice (after
doing the increment)).

[servolk, 2016/07/11 18:13:25]

Done.

 }
 
 void MediaSource::removedFromRegistry()
 {
-    DCHECK(m_isAddedToRegistry);
-    m_isAddedToRegistry = false;
+    DCHECK_GT(m_addedToRegistryCounter, 0);
+    --m_addedToRegistryCounter;
 }
 
 double MediaSource::duration() const
@@ -648,7 +647,7 @@ bool MediaSource::hasPendingActivity() const
 {
     return m_attachedElement || m_webMediaSource
         || m_asyncEventQueue->hasPendingEvents()
-        || m_isAddedToRegistry;
+        || m_addedToRegistryCounter > 0;
 }
 
 void MediaSource::stop()