Crash in blink::beforeCallEnteredCallback()

third_party/WebKit/Source/core/html/HTMLMediaElement.cpp

 /*
  * Copyright (C) 2007, 2008, 2009, 2010, 2011, 2012, 2013 Apple Inc. All rights
  * reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
@@ skipping 785 matching lines @@
 
     DCHECK(!m_paused || m_playPromiseResolvers.isEmpty());
 
     // 4.6 - If the paused attribute is false, then run these substeps
     if (!m_paused) {
       // 4.6.1 - Set the paused attribute to true.
       m_paused = true;
 
       // 4.6.2 - Take pending play promises and reject pending play promises
       // with the result and an "AbortError" DOMException.
-      rejectPlayPromises(
-          AbortError,
-          "The play() request was interrupted by a new load request.");
+      if (!ScriptForbiddenScope::isScriptForbidden()) {

[mlamouri (slow - plz ping), 2016/12/23 12:00:26]

Why is the script forbidden here?

[Anton Obzhirov, 2017/01/09 15:35:54]

Plz check
https://cs.chromium.org/chromium/src/third_party/WebKit/Source/core/dom/TreeS...
- Script is forbidden to protect against event handlers firing in the middle of
rescoping in |didMoveToNewDocument| callbacks.

+        rejectPlayPromises(
+            AbortError,
+            "The play() request was interrupted by a new load request.");
+      } else {
+        scheduleRejectPlayPromises(AbortError);

[foolip, 2017/01/04 15:49:00]

It's fairly likely that it's still forbidden in a moments time, I'd say forget
the promises and leave the promises unresolved instead.

[Anton Obzhirov, 2017/01/09 15:35:54]

I see, will remove it.

[haraken, 2017/01/21 01:49:13]

scheduleRejectPlayPromises schedules a task on a new event loop, so
ScriptForbiddenScope shouldn't be put on the call stack, right?

[Anton Obzhirov, 2017/01/21 20:30:58]

It seemed to work in this particular case, I mean ScriptForbiddenScope wasn't
set when the task run HTMLMediaElement::rejectScheduledPlayPromises on next
event loop.

+      }
     }
 
     // 4.7 - If seeking is true, set it to false.
     m_seeking = false;
 
     // 4.8 - Set the current playback position to 0.
     //       Set the official playback position to 0.
     //       If this changed the official playback position, then queue a task
     //       to fire a simple event named timeupdate at the media element.
     // 4.9 - Set the initial playback position to 0.
@@ skipping 3287 matching lines @@
       kMostlyFillViewportBecomeStableSeconds, BLINK_FROM_HERE);
 }
 
 void HTMLMediaElement::viewportFillDebouncerTimerFired(TimerBase*) {
   m_mostlyFillingViewport = true;
   if (m_webMediaPlayer)
     m_webMediaPlayer->becameDominantVisibleContent(m_mostlyFillingViewport);
 }
 
 }  // namespace blink