Bug 1443803 - Protect against destroyed MediaStream in MediaEngineWebRTCMicrophoneSource. r?padenot draft
authorAndreas Pehrson <pehrsons@mozilla.com>
Wed, 14 Mar 2018 16:46:46 +0100
changeset 767457 27318fe8222c668d1a5b913a2ce1dfb2a1e62c2e
parent 764177 cb3b2b090314e6b1c4bc0bc7ebe7814ba474d974
push id102606
push userbmo:apehrson@mozilla.com
push dateWed, 14 Mar 2018 17:17:55 +0000
reviewerspadenot
bugs1443803
milestone60.0a1
Bug 1443803 - Protect against destroyed MediaStream in MediaEngineWebRTCMicrophoneSource. r?padenot MozReview-Commit-ID: 3vyzS0DceKI
dom/media/webrtc/MediaEngineWebRTCAudio.cpp
--- a/dom/media/webrtc/MediaEngineWebRTCAudio.cpp
+++ b/dom/media/webrtc/MediaEngineWebRTCAudio.cpp
@@ -515,17 +515,17 @@ MediaEngineWebRTCMicrophoneSource::Apply
 {
   AssertIsOnOwningThread();
 
   mLastPrefs = aPrefs;
 
   RefPtr<MediaEngineWebRTCMicrophoneSource> that = this;
   RefPtr<MediaStreamGraphImpl> graph;
   for (const Allocation& allocation : mAllocations) {
-    if (allocation.mStream) {
+    if (allocation.mStream && allocation.mStream->GraphImpl()) {
       graph = allocation.mStream->GraphImpl();
       break;
     }
   }
   MOZ_DIAGNOSTIC_ASSERT(graph);
   NS_DispatchToMainThread(media::NewRunnableFrom([that, graph, aPrefs]() mutable {
     that->mSettings->mEchoCancellation.Value() = aPrefs.mAecOn;
     that->mSettings->mAutoGainControl.Value() = aPrefs.mAgcOn;
@@ -1022,16 +1022,24 @@ MediaEngineWebRTCMicrophoneSource::Packe
     }
 
     AudioSegment segment;
     for (Allocation& allocation : mAllocations) {
       if (!allocation.mStream) {
         continue;
       }
 
+      if (!allocation.mStream->GraphImpl()) {
+        // The DOMMediaStream that owns allocation.mStream has been cleaned up
+        // and MediaStream::DestroyImpl() has run in the MSG. This is fine and
+        // can happen before the MediaManager thread gets to stop capture for
+        // this allocation.
+        continue;
+      }
+
       if (!allocation.mEnabled) {
         continue;
       }
 
       LOG_FRAMES(("Appending %" PRIu32 " frames of packetized audio for allocation %p",
                   mPacketizerInput->PacketSize(), allocation.mHandle.get()));
 
 #ifdef DEBUG
@@ -1089,16 +1097,24 @@ MediaEngineWebRTCMicrophoneSource::Inser
     }
   }
 
   for (Allocation& allocation : mAllocations) {
     if (!allocation.mStream) {
       continue;
     }
 
+    if (!allocation.mStream->GraphImpl()) {
+      // The DOMMediaStream that owns allocation.mStream has been cleaned up
+      // and MediaStream::DestroyImpl() has run in the MSG. This is fine and
+      // can happen before the MediaManager thread gets to stop capture for
+      // this allocation.
+      continue;
+    }
+
     if (!allocation.mEnabled) {
       continue;
     }
 
 #ifdef DEBUG
     allocation.mLastCallbackAppendTime =
       allocation.mStream->GraphImpl()->IterationEnd();
 #endif