[MSE] Intermittent crash with imported/w3c/web-platform-tests/media-s…

…ource/URL-createObjectURL-null.html

https://bugs.webkit.org/show_bug.cgi?id=269656
rdar://123171059

Reviewed by Chris Dumez.

`MediaSource::ensureWeakOnHTMLMediaElementContext` took a strong ref to the HTMLMediaElement but this code can be called while the HTMLMediaElement is being destructed.

`ASSERT(!deletionHasBegun());`

We use a RefPtrAllowingPartiallyDestroyed instead which avoid the problem for now.

Ideally the logic should be refactored to avoid calling the method in the first place
if the HTMLMediaElement has gone away.

* Source/WebCore/Modules/mediasource/MediaSource.cpp:
(WebCore::MediaSource::ensureWeakOnHTMLMediaElementContext const):

Canonical link: https://commits.webkit.org/274942@main

Source/WebCore/Modules/mediasource/MediaSource.cpp

@@ -1337,12 +1337,11 @@ void MediaSource::notifyElementUpdateMediaState() const
 void MediaSource::ensureWeakOnHTMLMediaElementContext(Function<void(HTMLMediaElement&)>&& task) const
 {
     ensureOnMainThread([weakMediaElement = m_mediaElement, task = WTFMove(task)]() mutable {
-        if (RefPtr mediaElement = weakMediaElement.get())
+        if (RefPtrAllowingPartiallyDestroyed<HTMLMediaElement> mediaElement = weakMediaElement.get())
             task(*mediaElement);
     });
 }
 
-
 void MediaSource::sourceBufferBufferedChanged()
 {
     updateBufferedIfNeeded();