Crash in blink::beforeCallEnteredCallback()

third_party/WebKit/Source/core/html/HTMLMediaElement.cpp

Index: third_party/WebKit/Source/core/html/HTMLMediaElement.cpp
diff --git a/third_party/WebKit/Source/core/html/HTMLMediaElement.cpp b/third_party/WebKit/Source/core/html/HTMLMediaElement.cpp
index d03da2e9ca79091341d7e82c4d61eac99a70a038..ff4f0015c35e2c7167b7820b6952efb9d66f65c1 100644
--- a/third_party/WebKit/Source/core/html/HTMLMediaElement.cpp
+++ b/third_party/WebKit/Source/core/html/HTMLMediaElement.cpp
@@ -803,9 +803,13 @@ void HTMLMediaElement::invokeLoadAlgorithm() {
 
       // 4.6.2 - Take pending play promises and reject pending play promises
       // with the result and an "AbortError" DOMException.
-      rejectPlayPromises(
-          AbortError,
-          "The play() request was interrupted by a new load request.");
+      if (!ScriptForbiddenScope::isScriptForbidden()) {

[mlamouri (slow - plz ping), 2016/12/23 12:00:26]

Why is the script forbidden here?

[Anton Obzhirov, 2017/01/09 15:35:54]

Plz check
https://cs.chromium.org/chromium/src/third_party/WebKit/Source/core/dom/TreeS...
- Script is forbidden to protect against event handlers firing in the middle of
rescoping in |didMoveToNewDocument| callbacks.

+        rejectPlayPromises(
+            AbortError,
+            "The play() request was interrupted by a new load request.");
+      } else {
+        scheduleRejectPlayPromises(AbortError);

[foolip, 2017/01/04 15:49:00]

It's fairly likely that it's still forbidden in a moments time, I'd say forget
the promises and leave the promises unresolved instead.

[Anton Obzhirov, 2017/01/09 15:35:54]

I see, will remove it.

[haraken, 2017/01/21 01:49:13]

scheduleRejectPlayPromises schedules a task on a new event loop, so
ScriptForbiddenScope shouldn't be put on the call stack, right?

[Anton Obzhirov, 2017/01/21 20:30:58]

It seemed to work in this particular case, I mean ScriptForbiddenScope wasn't
set when the task run HTMLMediaElement::rejectScheduledPlayPromises on next
event loop.

+      }
     }
 
     // 4.7 - If seeking is true, set it to false.