I created a cl to update TestExpectations.
https://codereview.chromium.org/2393823002

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/9c2cb09bbe46c0492207b0039549704c2e352eae

commit 9c2cb09bbe46c0492207b0039549704c2e352eae
Author: Tsuyoshi Horo <horo@chromium.org>
Date: Wed Oct 05 08:39:59 2016

Add media/encrypted-media/encrypted-media-lifetime-reload.html to TestExpectations

BUG= 653001 
TBR=jrummell@chromium.org

Review URL: https://codereview.chromium.org/2393823002 .

Cr-Commit-Position: refs/heads/master@{#423117}

[modify] https://crrev.com/9c2cb09bbe46c0492207b0039549704c2e352eae/third_party/WebKit/LayoutTests/TestExpectations

The media thread is shutting down:
    ~VideoRendererImpl()
    ~DecoderStream()
    ~DecryptingDemuxerStream()
        decryptor_->CancelDecrypt();
But |decryptor_| points to AesDecryptor, which the main thread has destroyed.

The main thread trace:
    shutdown()
    ~WebContentDecryptionModuleSessionImpl()
    ~CdmSessionAdapter()
    ~MediaKeys() (in this case ~AesDecryptor())

Not aware of any recent changes that impact teardown, so this may have been around for a while, and we just haven't seen it. Investigating.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/e616ee95642ecc0b168a8e807abc86ff3633cda8

commit e616ee95642ecc0b168a8e807abc86ff3633cda8
Author: jrummell <jrummell@chromium.org>
Date: Sat Oct 08 02:15:44 2016

Keep reference to CDM to avoid it's premature destruction

Occassionally the CDM object is destroyed before the pipeline that
uses it is stopped, so have WebMediaPlayerImpl keep a reference to
it to prevent this from happening.

This worked in the past as the pipeline was destroyed from
HTMLMediaElement::stop() while the CDM was destroyed later from
MediaKeys::contextDestroyed(). A recent change merged stop()
and contextDestroyed(), so the CDM can be freed before
WebMediaPlayerImpl is done with it.

BUG= 652978 , 653001 
TEST=EME layout tests pass

Review-Url: https://codereview.chromium.org/2402563002
Cr-Commit-Position: refs/heads/master@{#424046}

[modify] https://crrev.com/e616ee95642ecc0b168a8e807abc86ff3633cda8/media/blink/cdm_session_adapter.cc
[modify] https://crrev.com/e616ee95642ecc0b168a8e807abc86ff3633cda8/media/blink/cdm_session_adapter.h
[modify] https://crrev.com/e616ee95642ecc0b168a8e807abc86ff3633cda8/media/blink/webcontentdecryptionmodule_impl.cc
[modify] https://crrev.com/e616ee95642ecc0b168a8e807abc86ff3633cda8/media/blink/webcontentdecryptionmodule_impl.h
[modify] https://crrev.com/e616ee95642ecc0b168a8e807abc86ff3633cda8/media/blink/webmediaplayer_impl.cc
[modify] https://crrev.com/e616ee95642ecc0b168a8e807abc86ff3633cda8/media/blink/webmediaplayer_impl.h

These crashes are also being reported externally.

https://crash.corp.google.com/browse?q=ClientID%3D%279c80fd51-7004-4172-8eb4-92109d756d35%27%20AND%20custom_data.ChromeCrashProto.magic_signature_1.name%3D%27media%3A%3ADecryptingDemuxerStream%3A%3A~DecryptingDemuxerStream%27&ignore_case=false&enable_rewrite=true&omit_field_name=&omit_field_value=&omit_field_opt=%3D

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/6be4d9fbc0b33047dfe901e2bbe2c322efda30cd

commit 6be4d9fbc0b33047dfe901e2bbe2c322efda30cd
Author: jrummell <jrummell@chromium.org>
Date: Tue Oct 11 00:10:46 2016

Reenable encrypted-media tests.

After https://codereview.chromium.org/2402563002/, the encrypted-media
tests are no longer crashing, so reenabling them.

BUG= 652978 , 653001 
TEST=EME layout tests pass

Review-Url: https://codereview.chromium.org/2406013002
Cr-Commit-Position: refs/heads/master@{#424297}

[modify] https://crrev.com/6be4d9fbc0b33047dfe901e2bbe2c322efda30cd/third_party/WebKit/LayoutTests/TestExpectations

Since there are crashes being reported in M55 (and this missed branch cut), requesting permission to merge this change (comment #5) into M55. Tests were reenabled (comment #7) and are no longer crashing.

Your change meets the bar and is auto-approved for M55 (branch: 2883)

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/f5e4c23ccfb23ae1fe6e7aac3aed6b81664f29f6

commit f5e4c23ccfb23ae1fe6e7aac3aed6b81664f29f6
Author: John Rummell <jrummell@chromium.org>
Date: Tue Oct 11 23:28:26 2016

Merge "Keep reference to CDM to avoid it's premature destruction"

Occassionally the CDM object is destroyed before the pipeline that
uses it is stopped, so have WebMediaPlayerImpl keep a reference to
it to prevent this from happening.

This worked in the past as the pipeline was destroyed from
HTMLMediaElement::stop() while the CDM was destroyed later from
MediaKeys::contextDestroyed(). A recent change merged stop()
and contextDestroyed(), so the CDM can be freed before
WebMediaPlayerImpl is done with it.

BUG= 652978 , 653001 
TEST=EME layout tests pass

Review-Url: https://codereview.chromium.org/2402563002
Cr-Commit-Position: refs/heads/master@{#424046}
(cherry picked from commit e616ee95642ecc0b168a8e807abc86ff3633cda8)

Review URL: https://codereview.chromium.org/2412773002 .

Cr-Commit-Position: refs/branch-heads/2883@{#51}
Cr-Branched-From: 614d31daee2f61b0180df403a8ad43f20b9f6dd7-refs/heads/master@{#423768}

[modify] https://crrev.com/f5e4c23ccfb23ae1fe6e7aac3aed6b81664f29f6/media/blink/cdm_session_adapter.cc
[modify] https://crrev.com/f5e4c23ccfb23ae1fe6e7aac3aed6b81664f29f6/media/blink/cdm_session_adapter.h
[modify] https://crrev.com/f5e4c23ccfb23ae1fe6e7aac3aed6b81664f29f6/media/blink/webcontentdecryptionmodule_impl.cc
[modify] https://crrev.com/f5e4c23ccfb23ae1fe6e7aac3aed6b81664f29f6/media/blink/webcontentdecryptionmodule_impl.h
[modify] https://crrev.com/f5e4c23ccfb23ae1fe6e7aac3aed6b81664f29f6/media/blink/webmediaplayer_impl.cc
[modify] https://crrev.com/f5e4c23ccfb23ae1fe6e7aac3aed6b81664f29f6/media/blink/webmediaplayer_impl.h

Issue 654333 has been merged into this issue.

Update the title to better reflect the root cause of the issue.

For the record (summarized by jrummell@):

It appears that the CL https://codereview.chromium.org/2366253002 (which combined ActiveDOMObject::stop() with ContextLifecycleObserver::contextDestroyed()) broke the assumptions about destruction order that have existed for some time.

The new crashes are due to objects being destructed in the wrong order. For example, MediaKeys::contextDestroyed() has:
  // We don't need the CDM anymore. Only destroyed after all related
  // ActiveDOMObjects have been stopped.

With this change, this is no longer always true, and if contextDestroyed() is called on MediaKeys before HTMLMediaElement, we get a crash.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/9c2cb09bbe46c0492207b0039549704c2e352eae

commit 9c2cb09bbe46c0492207b0039549704c2e352eae
Author: Tsuyoshi Horo <horo@chromium.org>
Date: Wed Oct 05 08:39:59 2016

Add media/encrypted-media/encrypted-media-lifetime-reload.html to TestExpectations

BUG= 653001 
TBR=jrummell@chromium.org

Review URL: https://codereview.chromium.org/2393823002 .

Cr-Commit-Position: refs/heads/master@{#423117}

[modify] https://crrev.com/9c2cb09bbe46c0492207b0039549704c2e352eae/third_party/WebKit/LayoutTests/TestExpectations

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/f5e4c23ccfb23ae1fe6e7aac3aed6b81664f29f6

commit f5e4c23ccfb23ae1fe6e7aac3aed6b81664f29f6
Author: John Rummell <jrummell@chromium.org>
Date: Tue Oct 11 23:28:26 2016

Merge "Keep reference to CDM to avoid it's premature destruction"

Occassionally the CDM object is destroyed before the pipeline that
uses it is stopped, so have WebMediaPlayerImpl keep a reference to
it to prevent this from happening.

This worked in the past as the pipeline was destroyed from
HTMLMediaElement::stop() while the CDM was destroyed later from
MediaKeys::contextDestroyed(). A recent change merged stop()
and contextDestroyed(), so the CDM can be freed before
WebMediaPlayerImpl is done with it.

BUG= 652978 , 653001 
TEST=EME layout tests pass

Review-Url: https://codereview.chromium.org/2402563002
Cr-Commit-Position: refs/heads/master@{#424046}
(cherry picked from commit e616ee95642ecc0b168a8e807abc86ff3633cda8)

Review URL: https://codereview.chromium.org/2412773002 .

Cr-Commit-Position: refs/branch-heads/2883@{#51}
Cr-Branched-From: 614d31daee2f61b0180df403a8ad43f20b9f6dd7-refs/heads/master@{#423768}

[modify] https://crrev.com/f5e4c23ccfb23ae1fe6e7aac3aed6b81664f29f6/media/blink/cdm_session_adapter.cc
[modify] https://crrev.com/f5e4c23ccfb23ae1fe6e7aac3aed6b81664f29f6/media/blink/cdm_session_adapter.h
[modify] https://crrev.com/f5e4c23ccfb23ae1fe6e7aac3aed6b81664f29f6/media/blink/webcontentdecryptionmodule_impl.cc
[modify] https://crrev.com/f5e4c23ccfb23ae1fe6e7aac3aed6b81664f29f6/media/blink/webcontentdecryptionmodule_impl.h
[modify] https://crrev.com/f5e4c23ccfb23ae1fe6e7aac3aed6b81664f29f6/media/blink/webmediaplayer_impl.cc
[modify] https://crrev.com/f5e4c23ccfb23ae1fe6e7aac3aed6b81664f29f6/media/blink/webmediaplayer_impl.h

[Automated comment] removing mislabelled merge-merged-2840