Crash in blink::beforeCallEnteredCallback()

third_party/WebKit/Source/core/html/HTMLMediaElement.cpp

 /*
  * Copyright (C) 2007, 2008, 2009, 2010, 2011, 2012, 2013 Apple Inc. All rights
  * reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
@@ skipping 811 matching lines @@
 
     DCHECK(!m_paused || m_playPromiseResolvers.isEmpty());
 
     // 4.6 - If the paused attribute is false, then run these substeps
     if (!m_paused) {
       // 4.6.1 - Set the paused attribute to true.
       m_paused = true;
 
       // 4.6.2 - Take pending play promises and reject pending play promises
       // with the result and an "AbortError" DOMException.
-      rejectPlayPromises(
-          AbortError,
-          "The play() request was interrupted by a new load request.");
+      if (!ScriptForbiddenScope::isScriptForbidden()) {
+        rejectPlayPromises(
+            AbortError,
+            "The play() request was interrupted by a new load request.");
+      }
     }
 
     // 4.7 - If seeking is true, set it to false.
     m_seeking = false;
 
     // 4.8 - Set the current playback position to 0.
     //       Set the official playback position to 0.
     //       If this changed the official playback position, then queue a task
     //       to fire a simple event named timeupdate at the media element.
     // 4.9 - Set the initial playback position to 0.
@@ skipping 3288 matching lines @@
       kMostlyFillViewportBecomeStableSeconds, BLINK_FROM_HERE);
 }
 
 void HTMLMediaElement::viewportFillDebouncerTimerFired(TimerBase*) {
   m_mostlyFillingViewport = true;
   if (m_webMediaPlayer)
     m_webMediaPlayer->becameDominantVisibleContent(m_mostlyFillingViewport);
 }
 
 }  // namespace blink