Fix crash when closing window containing video element (#31413)

* Forbid casting DOM objects when JS runtime is shutting down.

* Remove media controls from document when element is removed from the tree.

1 files changed, 9 insertions, 0 deletions

diff --git a/components/script/dom/bindings/inheritance.rs b/components/script/dom/bindings/inheritance.rs
index 9ef1f7ad0a1..58dafb2972f 100644
--- a/components/script/dom/bindings/inheritance.rs
+++ b/components/script/dom/bindings/inheritance.rs
@@ -9,6 +9,7 @@ use std::mem;
 pub use crate::dom::bindings::codegen::InheritTypes::*;
 use crate::dom::bindings::conversions::{get_dom_class, DerivedFrom, IDLInterface};
 use crate::dom::bindings::reflector::DomObject;
+use crate::script_runtime::runtime_is_alive;
 
 /// A trait to hold the cast functions of IDL interfaces that either derive
 /// or are derived from other interfaces.
@@ -18,6 +19,14 @@ pub trait Castable: IDLInterface + DomObject + Sized {
     where
         T: DerivedFrom<Self>,
     {
+        // This is a weird place for this check to live, but it should catch any
+        // attempts to interact with DOM objects from Drop implementations that run
+        // as a result of the runtime shutting down and finalizing all remaining objects.
+        debug_assert!(
+            runtime_is_alive(),
+            "Attempting to interact with DOM objects after JS runtime has shut down."
+        );
+
         let class = unsafe { get_dom_class(self.reflector().get_jsobject().get()).unwrap() };
         T::derives(class)
     }