EME: Improve promise lifetime

third_party/WebKit/Source/modules/encryptedmedia/ContentDecryptionModuleResultPromise.h

Index: third_party/WebKit/Source/modules/encryptedmedia/ContentDecryptionModuleResultPromise.h
diff --git a/third_party/WebKit/Source/modules/encryptedmedia/ContentDecryptionModuleResultPromise.h b/third_party/WebKit/Source/modules/encryptedmedia/ContentDecryptionModuleResultPromise.h
index 104d15b4004d1686527843e6945961a750445c07..e72908bc83b4320b9340f3796b58ee3771aed4b1 100644
--- a/third_party/WebKit/Source/modules/encryptedmedia/ContentDecryptionModuleResultPromise.h
+++ b/third_party/WebKit/Source/modules/encryptedmedia/ContentDecryptionModuleResultPromise.h
@@ -6,6 +6,7 @@
 #define ContentDecryptionModuleResultPromise_h
 
 #include "bindings/core/v8/ScriptPromiseResolver.h"
+#include "core/dom/ContextLifecycleObserver.h"
 #include "core/dom/ExceptionCode.h"
 #include "platform/ContentDecryptionModuleResult.h"
 
@@ -19,8 +20,20 @@ ExceptionCode WebCdmExceptionToExceptionCode(
 // complete(), completeWithSession(), etc. methods will reject the promise
 // with an error. It needs to be subclassed and the appropriate complete()
 // method overridden to resolve the promise as needed.
+//
+// Subclasses need to keep a Member<> to the object that created them so
+// that the creator remains around as long as this promise is pending. This
+// promise is not referenced by the object that created it (e.g MediaKeys,
+// MediaKeySession, Navigator.requestMediaKeySystemAccess), so this promise
+// may be cleaned up before or after it's creator once both become unreachable.
+// If it is after, the destruction of the creator may trigger this promise,
+// so use isValidToFulfillPromise() to verify that it is safe to fulfill
+// the promise.
 class ContentDecryptionModuleResultPromise
-    : public ContentDecryptionModuleResult {
+    : public ContentDecryptionModuleResult,
+      public ContextLifecycleObserver {
+  USING_GARBAGE_COLLECTED_MIXIN(ContentDecryptionModuleResultPromise);
+
  public:
   ~ContentDecryptionModuleResultPromise() override;
 
@@ -46,20 +59,19 @@ class ContentDecryptionModuleResultPromise
   // promise.
   template <typename... T>
   void resolve(T... value) {
+    DCHECK(isValidToFulfillPromise());
+
     m_resolver->resolve(value...);
     m_resolver.clear();
   }
 
-  // Rejects the promise with a DOMException. This will post a task to
-  // actually reject the promise later on.
+  // Rejects the promise with a DOMException.
   void reject(ExceptionCode, const String& errorMessage);
 
-  ExecutionContext* getExecutionContext() const;
+  // Determine if it's OK to resolve/reject this promise.
+  bool isValidToFulfillPromise();
 
  private:
-  // Rejects the promise with a DOMException.
-  void rejectInternal(ExceptionCode, const String& errorMessage);
-
   Member<ScriptPromiseResolver> m_resolver;
 };