Bug 1443803 - Protect against destroyed MediaStream in MediaEngineWebRTCMicrophoneSource. r=padenot
authorAndreas Pehrson <pehrsons@mozilla.com>
Wed, 14 Mar 2018 16:46:46 +0100
changeset 464573 908d9d7f5c3e159f76cec5e30516296c4778bd2b
parent 464572 67e1a9a6ed7a5cc39113eb7705bb790d073ebe9b
child 464574 0b77c1e6a87e0763eb0ef58fd1074efeb4e0f58d
push id1728
push userjlund@mozilla.com
push dateMon, 18 Jun 2018 21:12:27 +0000
treeherdermozilla-release@c296fde26f5f [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewerspadenot
bugs1443803
milestone61.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1443803 - Protect against destroyed MediaStream in MediaEngineWebRTCMicrophoneSource. r=padenot MozReview-Commit-ID: 3vyzS0DceKI
dom/media/webrtc/MediaEngineWebRTCAudio.cpp
--- a/dom/media/webrtc/MediaEngineWebRTCAudio.cpp
+++ b/dom/media/webrtc/MediaEngineWebRTCAudio.cpp
@@ -530,17 +530,17 @@ MediaEngineWebRTCMicrophoneSource::Apply
 {
   AssertIsOnOwningThread();
 
   mLastPrefs = aPrefs;
 
   RefPtr<MediaEngineWebRTCMicrophoneSource> that = this;
   RefPtr<MediaStreamGraphImpl> graph;
   for (const Allocation& allocation : mAllocations) {
-    if (allocation.mStream) {
+    if (allocation.mStream && allocation.mStream->GraphImpl()) {
       graph = allocation.mStream->GraphImpl();
       break;
     }
   }
   MOZ_DIAGNOSTIC_ASSERT(graph);
   NS_DispatchToMainThread(media::NewRunnableFrom([that, graph, aPrefs]() mutable {
     that->mSettings->mEchoCancellation.Value() = aPrefs.mAecOn;
     that->mSettings->mAutoGainControl.Value() = aPrefs.mAgcOn;
@@ -1037,16 +1037,24 @@ MediaEngineWebRTCMicrophoneSource::Packe
     }
 
     AudioSegment segment;
     for (Allocation& allocation : mAllocations) {
       if (!allocation.mStream) {
         continue;
       }
 
+      if (!allocation.mStream->GraphImpl()) {
+        // The DOMMediaStream that owns allocation.mStream has been cleaned up
+        // and MediaStream::DestroyImpl() has run in the MSG. This is fine and
+        // can happen before the MediaManager thread gets to stop capture for
+        // this allocation.
+        continue;
+      }
+
       if (!allocation.mEnabled) {
         continue;
       }
 
       LOG_FRAMES(("Appending %" PRIu32 " frames of packetized audio for allocation %p",
                   mPacketizerInput->PacketSize(), allocation.mHandle.get()));
 
 #ifdef DEBUG
@@ -1104,16 +1112,24 @@ MediaEngineWebRTCMicrophoneSource::Inser
     }
   }
 
   for (Allocation& allocation : mAllocations) {
     if (!allocation.mStream) {
       continue;
     }
 
+    if (!allocation.mStream->GraphImpl()) {
+      // The DOMMediaStream that owns allocation.mStream has been cleaned up
+      // and MediaStream::DestroyImpl() has run in the MSG. This is fine and
+      // can happen before the MediaManager thread gets to stop capture for
+      // this allocation.
+      continue;
+    }
+
     if (!allocation.mEnabled) {
       continue;
     }
 
 #ifdef DEBUG
     allocation.mLastCallbackAppendTime =
       allocation.mStream->GraphImpl()->IterationEnd();
 #endif