Avoid referencing an HTMLMediaElement if is currently being deleted

Source/core/html/HTMLMediaElement.cpp

 /*
  * Copyright (C) 2007, 2008, 2009, 2010, 2011, 2012, 2013 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 272 matching lines @@
     }
 
     setHasCustomStyleCallbacks();
     addElementToDocumentMap(this, document);
 
 }
 
 HTMLMediaElement::~HTMLMediaElement()
 {
     LOG(Media, "HTMLMediaElement::~HTMLMediaElement");
+
+    m_asyncEventQueue->close();
+
     setShouldDelayLoadEvent(false);
     if (m_textTracks)
         m_textTracks->clearOwner();
     if (m_textTracks) {
         for (unsigned i = 0; i < m_textTracks->length(); ++i)
             m_textTracks->item(i)->clearClient();
     }
 
     if (m_mediaController)
         m_mediaController->removeMediaElement(this);
@@ skipping 232 matching lines @@
     // Schedule the timer to try the next <source> element WITHOUT resetting state ala prepareForLoad.
     m_pendingActionFlags |= LoadMediaResource;
     m_loadTimer.startOneShot(0);
 }
 
 void HTMLMediaElement::scheduleEvent(const AtomicString& eventName)
 {
 #if LOG_MEDIA_EVENTS
     LOG(Media, "HTMLMediaElement::scheduleEvent - scheduling '%s'", eventName.string().ascii().data());
 #endif
+
     RefPtr<Event> event = Event::create(eventName, false, true);
-    event->setTarget(this);
-
     m_asyncEventQueue->enqueueEvent(event.release());
 }
 
 void HTMLMediaElement::loadTimerFired(Timer<HTMLMediaElement>*)
 {
     RefPtr<HTMLMediaElement> protect(this); // loadNextSourceChild may fire 'beforeload', which can make arbitrary DOM mutations.
 
     if (RuntimeEnabledFeatures::videoTrackEnabled() && (m_pendingActionFlags & LoadTextTrackResource))
         configureTextTracks();
 
@@ skipping 340 matching lines @@
 
     // 12 - Further sort tasks in events that have the same time by the
     // relative text track cue order of the text track cues associated
     // with these tasks.
     return a.second->cueIndex() - b.second->cueIndex() < 0;
 }
 
 
 void HTMLMediaElement::updateActiveTextTrackCues(double movieTime)
 {
-    LOG(Media, "HTMLMediaElement::updateActiveTextTrackCues");
-
     // 4.8.10.8 Playing the media resource
 
     //  If the current playback position changes while the steps are running,
     //  then the user agent must wait for the steps to complete, and then must
     //  immediately rerun the steps.
     if (ignoreTrackDisplayUpdateRequests())
         return;
 
+    LOG(Media, "HTMLMediaElement::updateActiveTextTrackCues");
+
     // 1 - Let current cues be a list of cues, initialized to contain all the
     // cues of all the hidden, showing, or showing by default text tracks of the
     // media element (not the disabled ones) whose start times are less than or
     // equal to the current playback position and whose end times are greater
     // than the current playback position.
     CueList currentCues;
 
     // The user agent must synchronously unset [the text track cue active] flag
     // whenever ... the media element's readyState is changed back to HAVE_NOTHING.
     if (m_readyState != HAVE_NOTHING && m_player)
@@ skipping 2573 matching lines @@
 
     // Stop the playback without generating events
     m_playing = false;
     setPausedInternal(true);
 
     if (renderer())
         renderer()->updateFromElement();
 
     stopPeriodicTimers();
     cancelPendingEventsAndCallbacks();
+
+    m_asyncEventQueue->close();
 }
 
 void HTMLMediaElement::suspend(ReasonForSuspension why)
 {
     LOG(Media, "HTMLMediaElement::suspend");
 
     switch (why)
     {
         case DocumentWillBecomeInactive:
             stop();
@@ skipping 510 matching lines @@
     info.addMember(m_mediaGroup, "mediaGroup");
     info.addMember(m_mediaController, "mediaController");
 
 #if ENABLE(WEB_AUDIO)
     info.addMember(m_audioSourceNode, "audioSourceNode");
 #endif
 
 }
 
 }