Fix use-after-free in HTMLMediaElement::contextDestroyed

Source/core/html/HTMLMediaElement.cpp

 /*
  * Copyright (C) 2007, 2008, 2009, 2010, 2011, 2012, 2013 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 313 matching lines @@
     m_asyncEventQueue->close();
 
     setShouldDelayLoadEvent(false);
     if (m_textTracks)
         m_textTracks->clearOwner();
     if (m_textTracks) {
         for (unsigned i = 0; i < m_textTracks->length(); ++i)
             m_textTracks->item(i)->clearClient();
     }
 
-    if (m_mediaController)
+    if (m_mediaController) {
         m_mediaController->removeMediaElement(this);
+        m_mediaController = 0;
+    }
 
     closeMediaSource();
 
 #if ENABLE(ENCRYPTED_MEDIA_V2)
     setMediaKeys(0);
 #endif
 
     removeElementFromDocumentMap(this, &document());
 
     // Destroying the player may cause a resource load to be canceled,
@@ skipping 3645 matching lines @@
 {
     m_restrictions = NoRestrictions;
 }
 
 void HTMLMediaElement::mediaPlayerScheduleLayerUpdate()
 {
     scheduleLayerUpdate();
 }
 
 }