PlaybackManager's ref counting was only used to keep it alive in a few
callbacks. Instead, the callbacks can use weak references that can only
be used from the thread that the PlaybackManager was created on, to
ensure that the PlaybackManager can't be destroyed while being
accessed.
This ensures that:
- The PlaybackManager is destroyed immediately when it is reassigned
by HTMLMediaElement
- No callbacks are invoked after that point
This fixes the crash initially being addressed by #8081. The test from
that PR has been included as a regression test.
Add 18 crash tests covering various scenarios where image loading
callbacks fire after an iframe has been removed from the DOM,
making its document inactive. These tests cover microtasks,
element tasks, batching dispatcher callbacks, decode promises,
lazy loading, srcset, picture elements, nested iframes, document
adoption, and iframe reattach/remove cycles.
Previously, click handling for labels was handled in layout and
painting code. This change implements activation_behavior on
HTMLLabelElement, which clicks and focuses the element.
This recovers 750+ WPT subtests that were lost when
https://github.com/web-platform-tests/wpt/pull/56913 was merged and
added new testcases, two of which exposed this crash.
I have added my own testcase instead of importing the affected WPT tests
since they are large and complex, which makes it hard to understand
where the problem is coming from based on them alone. Also this is only
a crash test (i.e. not a different kind) because the tested scenario
doesn't actually behave correctly yet for seemingly unrelated reasons.
