Block load event dispatching on old document when an HTMLMediaElement is moved between documents.

Source/core/html/HTMLMediaElement.cpp

 /*
  * Copyright (C) 2007, 2008, 2009, 2010, 2011, 2012, 2013 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 351 matching lines @@
         audioSourceProvider()->setClient(0);
 #endif
     document().decrementLoadEventDelayCount();
 }
 
 void HTMLMediaElement::didMoveToNewDocument(Document* oldDocument)
 {
     LOG(Media, "HTMLMediaElement::didMoveToNewDocument");
 
     if (m_shouldDelayLoadEvent) {
-        if (oldDocument)
-            oldDocument->decrementLoadEventDelayCount();
         document().incrementLoadEventDelayCount();
+        // Note: Keeping the load event delay count increment on oldDocument that was added
+        // when m_shouldDelayLoadEvent was set so that destruction of m_player can not
+        // cause load event dispatching in oldDocument.
+    } else if (oldDocument) {
+        // Incrementing the load event delay count so that destruction of m_player can not
+        // cause load event dispatching in oldDocument.
+        oldDocument->incrementLoadEventDelayCount();
     }
 
     if (oldDocument)
         removeElementFromDocumentMap(this, oldDocument);
 
     addElementToDocumentMap(this, &document());
 
     // FIXME: This is a temporary fix to prevent this object from causing the
     // MediaPlayer to dereference Frame and FrameLoader pointers from the
     // previous document. A proper fix would provide a mechanism to allow this
     // object to refresh the MediaPlayer's Frame and FrameLoader references on
     // document changes so that playback can be resumed properly.
     userCancelledLoad();
 
+    // Decrement the load event delay count on oldDocument now that m_player has been destroyed
+    // and there is no risk of dispatching a load event from within the destructor.
+    if (oldDocument)
+        oldDocument->decrementLoadEventDelayCount();
+
     HTMLElement::didMoveToNewDocument(oldDocument);
 }
 
 bool HTMLMediaElement::hasCustomFocusLogic() const
 {
     return true;
 }
 
 bool HTMLMediaElement::supportsFocus() const
 {
@@ skipping 3575 matching lines @@
 {
     m_restrictions = NoRestrictions;
 }
 
 void HTMLMediaElement::mediaPlayerScheduleLayerUpdate()
 {
     scheduleLayerUpdate();
 }
 
 }