Oilpan: prevent player from accessing its media element during finalization

Source/core/html/HTMLMediaElement.cpp

 /*
  * Copyright (C) 2007, 2008, 2009, 2010, 2011, 2012, 2013 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 345 matching lines @@
 #if !ENABLE(OILPAN)
     // Destroying the player may cause a resource load to be canceled,
     // which could result in Document::dispatchWindowLoadEvent() being
     // called via ResourceFetch::didLoadResource() then
     // FrameLoader::loadDone(). To prevent load event dispatching during
     // object destruction, we use Document::incrementLoadEventDelayCount().
     // See http://crbug.com/275223 for more details.
     document().incrementLoadEventDelayCount();
 #endif
 
+#if ENABLE(OILPAN)
+    // Oilpan: the player must be released, but it cannot safely access

[haraken, 2014/05/27 23:09:09]

but => because ?

+    // this client any longer as parts of it may have been finalized
+    // already (like the media element's supplementable table.)
+    // Detach and render the client inaccessible first.
+    if (m_player)
+        m_player->detach();
+#endif
     clearMediaPlayerAndAudioSourceProviderClient();
 
 #if !ENABLE(OILPAN)
     document().decrementLoadEventDelayCount();
 #endif
 }
 
 void HTMLMediaElement::didMoveToNewDocument(Document& oldDocument)
 {
     WTF_LOG(Media, "HTMLMediaElement::didMoveToNewDocument");
@@ skipping 3278 matching lines @@
     visitor->trace(m_error);
     visitor->trace(m_currentSourceNode);
     visitor->trace(m_nextChildNodeToConsider);
     visitor->trace(m_textTracks);
     visitor->trace(m_textTracksWhenResourceSelectionBegan);
     WillBeHeapSupplementable<HTMLMediaElement>::trace(visitor);
     HTMLElement::trace(visitor);
 }
 
 }