[go: nahoru, domu]

[MediaSource] Treat missing attachment as append error.

Crashes show the main frame's context undergoing destruction
between when SourceBuffer checks IsRemoved() and attempts to
use the attachment.

R=tmathmeyer

(cherry picked from commit d911cdd7a76cdf8895915eae6b88e3bff02a3072)

Fixed: 326522155, 40922118
Change-Id: I22a4fe10b1178b52f563987146a32ab7e9cd23fa
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5325091
Auto-Submit: Dale Curtis <dalecurtis@chromium.org>
Reviewed-by: Ted (Chromium) Meyer <tmathmeyer@chromium.org>
Commit-Queue: Ted (Chromium) Meyer <tmathmeyer@chromium.org>
Cr-Original-Commit-Position: refs/heads/main@{#1265573}
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5341050
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Owners-Override: Srinivas Sista <srinivassista@chromium.org>
Commit-Queue: Srinivas Sista <srinivassista@chromium.org>
Cr-Commit-Position: refs/branch-heads/6312@{#530}
Cr-Branched-From: 6711dcdae48edaf98cbc6964f90fac85b7d9986e-refs/heads/main@{#1262506}
diff --git a/third_party/blink/renderer/modules/mediasource/media_source.cc b/third_party/blink/renderer/modules/mediasource/media_source.cc
index ecd994d..89fa056 100644
--- a/third_party/blink/renderer/modules/mediasource/media_source.cc
+++ b/third_party/blink/renderer/modules/mediasource/media_source.cc
@@ -711,11 +711,10 @@
   DCHECK(IsMainThread() ||
          !tracer);  // Cross-thread attachments do not use a tracer.
 
-  // TODO(https://crbug.com/878133): Relax to DCHECK once clear that same-thread
-  // indeed always has attachment here and is not regressed by requiring one to
-  // run |cb|.
-  CHECK(attachment) << "Attempt to run operation requiring attachment, but "
-                       "without having one.";
+  if (!attachment) {
+    // Element's context destruction may be in flight.
+    return false;
+  }
 
   if (!attachment->RunExclusively(true /* abort if not fully attached */,
                                   std::move(cb))) {