Bug 1608286 - Crash in [@ mozilla::dom::MediaKeySystemAccessManager::CheckDoesWindowSupportProtectedMedia] r=bryce,bzbarsky

thomasmo · thomasmo · commit fa7b42ae1ec2 · 2020-01-22T16:47:26.000Z
This changes fixes a failfast in a call to Navigator.requestMediaKeySystemAccess for the case where there is no browser available from a window when e10s is on. This can happen when a document is disconnected from the DOM. The fix is to reject the promise in this case. Differential Revision: https://phabricator.services.mozilla.com/D60022 --HG-- extra : moz-landing-system : lando
diff --git a/dom/media/eme/MediaKeySystemAccessManager.cpp b/dom/media/eme/MediaKeySystemAccessManager.cpp
@@ -134,12 +134,18 @@ void MediaKeySystemAccessManager::CheckDoesWindowSupportProtectedMedia(
   RefPtr<BrowserChild> browser(BrowserChild::GetFrom(mWindow));
   if (!browser) {
     if (!XRE_IsParentProcess() || XRE_IsE10sParentProcess()) {
-      MOZ_CRASH("BrowserChild should only be unavailable with e10s off");
-    }
+      // In this case, there is no browser because the Navigator object has
+      // been disconnected from its window. Thus, reject the promise.
+      aRequest->mPromise->MaybeRejectWithTypeError(
+          u"Browsing context is no longer available");
+    } else {
+      // In this case, there is no browser because e10s is off. Proceed with
+      // the request with support since this scenario is always supported.
+      MKSAM_LOG_DEBUG("Allowing protected media on Windows with e10s off.");
 
-    MKSAM_LOG_DEBUG("Allowing protected media on Windows with e10s off.");
+      OnDoesWindowSupportProtectedMedia(true, std::move(aRequest));
+    }
 
-    OnDoesWindowSupportProtectedMedia(true, std::move(aRequest));
     return;
   }
 
diff --git a/dom/media/test/crashtests/1608286.html b/dom/media/test/crashtests/1608286.html
@@ -0,0 +1,50 @@
+<html class="reftest-wait">
+<head>
+  <script>
+    function test() {
+      function checkResolve(value) {
+        // Let the test timeout and fail
+        throw new Error("This promise should not resolve");
+      }
+
+      function checkReject(reason) {
+        if (reason.message !== "Browsing context is no longer available") {
+          // Let the test timeout and fail
+          throw new Error("Unexpected rejected promise reason");          
+        }
+        // Otherwise, successfully rejected a request not attached to a
+        // window without crashing
+      }
+
+      var i = document.querySelector("iframe");
+      var nav = i.contentWindow.navigator;
+      i.remove();
+
+      // First, check with valid args
+      nav.requestMediaKeySystemAccess(
+        "com.widevine.alpha",
+        [{
+            initDataTypes: ["webm"],
+            videoCapabilities: [{ contentType: 'video/webm; codecs="vp9"' }]
+        }]
+      ).then(
+        checkResolve,
+        (reason) => {
+          checkReject(reason);
+
+          // Then, check with invalid args
+          nav.requestMediaKeySystemAccess("", []).then(
+            checkResolve,
+            (reason) => {
+              checkReject(reason);
+              document.documentElement.removeAttribute("class");
+            }
+          );
+        });
+    }
+  </script>
+</head>
+<body onload="test()">
+  <iframe></iframe>
+</body>
+</html>
diff --git a/dom/media/test/crashtests/crashtests.list b/dom/media/test/crashtests/crashtests.list
@@ -135,3 +135,4 @@ load 1577184.html
 pref(media.autoplay.default,0) load 1587248.html
 load 1594466.html
 load 1604941.html
+load 1608286.html
