Fix use-after-free in HTMLMediaElement::contextDestroyed

Fix use-after-free in HTMLMediaElement::contextDestroyed

A use-after-free happens in the following scenario:

(1) ~HTMLMediaElement() is called
(2) ~MediaController() is called. But HTMLMediaElement::m_mediaController is not cleared out.
(3) ~Document() is called.
(4) HTMLMediaElement::contextDestroyed() is called. It accesses HTMLMediaElement::m_mediaController.

This CL clears out HTMLMediaElement::m_mediaController in (2) and fixes the issue.

For more details, see a crash report in the bug.

No test, since this bug is just detected in ASAN builds.

BUG=305278
Committed: https://src.chromium.org/viewvc/blink?view=rev&revision=159237

[haraken, 2013-10-09 00:30:10]

acolwell: would you take a look?

[acolwell GONE FROM CHROMIUM, 2013-10-09 00:51:40]

On 2013/10/09 00:30:10, haraken wrote:
> acolwell: would you take a look?

The change looks ok, but shouldn't we be worried about the virtual function call
on HTMLMediaElement after its destructor has been called. That seem like
something is wrong.

[haraken, 2013-10-09 01:47:04]

Thanks for reviewing!

On 2013/10/09 00:51:40, acolwell wrote:
> On 2013/10/09 00:30:10, haraken wrote:
> > acolwell: would you take a look?
> 
> The change looks ok, but shouldn't we be worried about the virtual function
call
> on HTMLMediaElement after its destructor has been called. That seem like
> something is wrong.

I don't think this would be wrong. The contextDestroyed() is called not _after_
~HTMLMediaElement() but _during_ ~HTMLMediaElement(). Because HTMLMediaElement
has RefPtrs to the Nodes in the same document, it's possible that
contextDestoyed() for the document is called during ~HTMLMediaElement().

See the stack trace here:
https://cluster-fuzz.appspot.com/testcase?key=5666470277152768

[acolwell GONE FROM CHROMIUM, 2013-10-09 14:53:16]

lgtm

[commit-bot: I haz the power, 2013-10-09 14:53:55]

CQ is trying da patch. Follow status at
https://chromium-status.appspot.com/cq/haraken@chromium.org/26129006/1

[commit-bot: I haz the power, 2013-10-09 15:58:31]

Change committed as 159237