Fix crash when closing window containing video element (#31413)

* Forbid casting DOM objects when JS runtime is shutting down.

* Remove media controls from document when element is removed from the tree.

2 files changed, 11 insertions, 2 deletions

diff --git a/components/script/dom/bindings/inheritance.rs b/components/script/dom/bindings/inheritance.rs
index 9ef1f7ad0a1..58dafb2972f 100644
--- a/components/script/dom/bindings/inheritance.rs
+++ b/components/script/dom/bindings/inheritance.rs
@@ -9,6 +9,7 @@ use std::mem;
 pub use crate::dom::bindings::codegen::InheritTypes::*;
 use crate::dom::bindings::conversions::{get_dom_class, DerivedFrom, IDLInterface};
 use crate::dom::bindings::reflector::DomObject;
+use crate::script_runtime::runtime_is_alive;
 
 /// A trait to hold the cast functions of IDL interfaces that either derive
 /// or are derived from other interfaces.
@@ -18,6 +19,14 @@ pub trait Castable: IDLInterface + DomObject + Sized {
     where
         T: DerivedFrom<Self>,
     {
+        // This is a weird place for this check to live, but it should catch any
+        // attempts to interact with DOM objects from Drop implementations that run
+        // as a result of the runtime shutting down and finalizing all remaining objects.
+        debug_assert!(
+            runtime_is_alive(),
+            "Attempting to interact with DOM objects after JS runtime has shut down."
+        );
+
         let class = unsafe { get_dom_class(self.reflector().get_jsobject().get()).unwrap() };
         T::derives(class)
     }
diff --git a/components/script/dom/htmlmediaelement.rs b/components/script/dom/htmlmediaelement.rs
index 0b2ed564c19..e9de8cb20d5 100644
--- a/components/script/dom/htmlmediaelement.rs
+++ b/components/script/dom/htmlmediaelement.rs
@@ -1998,8 +1998,6 @@ impl Drop for HTMLMediaElement {
                 warn!("GLPlayer disappeared!: {:?}", err);
             }
         }
-
-        self.remove_controls();
     }
 }
 
@@ -2454,6 +2452,8 @@ impl VirtualMethods for HTMLMediaElement {
     fn unbind_from_tree(&self, context: &UnbindContext) {
         self.super_type().unwrap().unbind_from_tree(context);
 
+        self.remove_controls();
+
         if context.tree_connected {
             let task = MediaElementMicrotask::PauseIfNotInDocumentTask {
                 elem: DomRoot::from_ref(self),