Cherry-pick WebKit change r89762 to fix a LayoutTest crash

fast/dom/shadow/frameless-media-element-crash.html

See http://trac.webkit.org/changeset/89762

Bug: 6329068
Change-Id: I73db520557e2ab4c04a4a2198276439e6c7932ec

2 files changed, 15 insertions, 6 deletions

diff --git a/Source/WebCore/html/HTMLMediaElement.cpp b/Source/WebCore/html/HTMLMediaElement.cpp
index 5cd2ddd..46e8a12 100644
--- a/Source/WebCore/html/HTMLMediaElement.cpp
+++ b/Source/WebCore/html/HTMLMediaElement.cpp
@@ -238,7 +238,9 @@ void HTMLMediaElement::attributeChanged(Attribute* attr, bool preserveDecls)
 #if !ENABLE(PLUGIN_PROXY_FOR_VIDEO)
         if (controls()) {
             if (!hasMediaControls()) {
-                ensureMediaControls();
+                if (!createMediaControls())
+                    return;
+
                 mediaControls()->reset();
             }
             mediaControls()->show();
@@ -2739,13 +2741,18 @@ bool HTMLMediaElement::hasMediaControls()
     return node && node->isMediaControls();
 }
 
-void HTMLMediaElement::ensureMediaControls()
+bool HTMLMediaElement::createMediaControls()
 {
     if (hasMediaControls())
-        return;
+        return true;
 
     ExceptionCode ec;
-    ensureShadowRoot()->appendChild(MediaControls::create(this), ec);
+    RefPtr<MediaControls> controls = MediaControls::create(this);
+    if (!controls)
+        return false;
+
+    ensureShadowRoot()->appendChild(controls, ec);
+    return true;
 }
 
 void* HTMLMediaElement::preDispatchEventHandler(Event* event)
@@ -2753,7 +2760,9 @@ void* HTMLMediaElement::preDispatchEventHandler(Event* event)
     if (event && event->type() == eventNames().webkitfullscreenchangeEvent) {
         if (controls()) {
             if (!hasMediaControls()) {
-                ensureMediaControls();
+                if (!createMediaControls())
+                    return 0;
+
                 mediaControls()->reset();
             }
             mediaControls()->show();
diff --git a/Source/WebCore/html/HTMLMediaElement.h b/Source/WebCore/html/HTMLMediaElement.h
index 2144ea1..0b11861 100644
--- a/Source/WebCore/html/HTMLMediaElement.h
+++ b/Source/WebCore/html/HTMLMediaElement.h
@@ -325,7 +325,7 @@ private:
     void refreshCachedTime() const;
 
     bool hasMediaControls();
-    void ensureMediaControls();
+    bool createMediaControls();
 
     virtual void* preDispatchEventHandler(Event*);