Bug 1329075 - Fix potential null deref issues in media element track sources. r=jesup, a=jcristau
authorAndreas Pehrson <pehrsons@gmail.com>
Mon, 09 Jan 2017 17:00:43 +0100
changeset 353522 5086cf9061bdb5693d6c7031cc63dc894b14ffdf
parent 353521 bde4edd2b386c1b66998ca06128524de9ead31b1
child 353523 99745f6d10aa44d85b1d3f8765c07b8de62f2fb9
push id6795
push userjlund@mozilla.com
push dateMon, 23 Jan 2017 14:19:46 +0000
treeherdermozilla-esr52@76101b503191 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersjesup, jcristau
bugs1329075
milestone52.0a2
Bug 1329075 - Fix potential null deref issues in media element track sources. r=jesup, a=jcristau MozReview-Commit-ID: ExUh2magc2z
dom/html/HTMLMediaElement.cpp
--- a/dom/html/HTMLMediaElement.cpp
+++ b/dom/html/HTMLMediaElement.cpp
@@ -2367,16 +2367,21 @@ public:
 
   MediaSourceEnum GetMediaSource() const override
   {
     return MediaSourceEnum::Other;
   }
 
   CORSMode GetCORSMode() const override
   {
+    if (!mCapturedTrackSource) {
+      // This could happen during shutdown.
+      return CORS_NONE;
+    }
+
     return mCapturedTrackSource->GetCORSMode();
   }
 
   void Stop() override
   {
     if (mElement && mElement->mSrcStream) {
       // Only notify if we're still playing the source stream. GC might have
       // cleared it before the track sources.
@@ -2385,16 +2390,21 @@ public:
     mElement = nullptr;
     mOwningStream = nullptr;
 
     Destroy();
   }
 
   void PrincipalChanged() override
   {
+    if (!mCapturedTrackSource) {
+      // This could happen during shutdown.
+      return;
+    }
+
     mPrincipal = mCapturedTrackSource->GetPrincipal();
     MediaStreamTrackSource::PrincipalChanged();
   }
 
 private:
   virtual ~StreamCaptureTrackSource() {}
 
   RefPtr<HTMLMediaElement> mElement;
@@ -2430,29 +2440,36 @@ public:
     , mElement(aElement)
   {
     MOZ_ASSERT(mElement);
     mElement->AddDecoderPrincipalChangeObserver(this);
   }
 
   void Destroy() override
   {
-    MOZ_ASSERT(mElement);
-    DebugOnly<bool> res = mElement->RemoveDecoderPrincipalChangeObserver(this);
-    NS_ASSERTION(res, "Removing decoder principal changed observer failed. "
-                      "Had it already been removed?");
+    if (mElement) {
+      DebugOnly<bool> res = mElement->RemoveDecoderPrincipalChangeObserver(this);
+      NS_ASSERTION(res, "Removing decoder principal changed observer failed. "
+                        "Had it already been removed?");
+      mElement = nullptr;
+    }
   }
 
   MediaSourceEnum GetMediaSource() const override
   {
     return MediaSourceEnum::Other;
   }
 
   CORSMode GetCORSMode() const override
   {
+    if (!mElement) {
+      MOZ_ASSERT(false, "Should always have an element if in use");
+      return CORS_NONE;
+    }
+
     return mElement->GetCORSMode();
   }
 
   void Stop() override
   {
     // We don't notify the source that a track was stopped since it will keep
     // producing tracks until the element ends. The decoder also needs the
     // tracks it created to be live at the source since the decoder's clock is