Fix heap-use-after-free issue with WebAudioCapturerSource.

content/renderer/media/webaudio_capturer_source.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/renderer/media/webaudio_capturer_source.h"
 
 #include "base/logging.h"
 #include "base/time/time.h"
 #include "content/renderer/media/webrtc_local_audio_track.h"
 
 using media::AudioBus;
 using media::AudioFifo;
 using media::AudioParameters;
 using media::ChannelLayout;
 using media::CHANNEL_LAYOUT_MONO;
 using media::CHANNEL_LAYOUT_STEREO;
 
 static const int kMaxNumberOfBuffersInFifo = 5;
 
 namespace content {
 
-WebAudioCapturerSource::WebAudioCapturerSource()
+WebAudioCapturerSource::WebAudioCapturerSource(
+    const blink::WebMediaStreamSource &blink_source)
     : track_(NULL),
-      audio_format_changed_(false) {
+      audio_format_changed_(false),
+      blink_source_(blink_source) {
 }
 
 WebAudioCapturerSource::~WebAudioCapturerSource() {
+  removeFromBlinkSource();
 }
 
 void WebAudioCapturerSource::setFormat(
     size_t number_of_channels, float sample_rate) {
   DCHECK(thread_checker_.CalledOnValidThread());
   DVLOG(1) << "WebAudioCapturerSource::setFormat(sample_rate="
            << sample_rate << ")";
   if (number_of_channels > 2) {
     // TODO(xians): Handle more than just the mono and stereo cases.
     LOG(WARNING) << "WebAudioCapturerSource::setFormat() : unhandled format.";
@@ skipping 23 matching lines @@
   DCHECK(thread_checker_.CalledOnValidThread());
   DCHECK(track);
   base::AutoLock auto_lock(lock_);
   track_ = track;
 }
 
 void WebAudioCapturerSource::Stop() {
   DCHECK(thread_checker_.CalledOnValidThread());
   base::AutoLock auto_lock(lock_);
   track_ = NULL;
+  removeFromBlinkSource();
 }
 
 void WebAudioCapturerSource::consumeAudio(
     const blink::WebVector<const float*>& audio_data,
     size_t number_of_frames) {
   base::AutoLock auto_lock(lock_);
   if (!track_)
     return;
 
   // Update the downstream client if the audio format has been changed.
@@ skipping 28 matching lines @@
     fifo_->Consume(capture_bus_.get(), 0, capture_bus_->frames());
     track_->Capture(*capture_bus_, estimated_capture_time, false);
 
     // Advance the estimated capture time for the next FIFO consume operation.
     estimated_capture_time +=
         capture_bus_->frames() * base::TimeDelta::FromSeconds(1) /
             params_.sample_rate();
   }
 }
 
+void WebAudioCapturerSource::removeFromBlinkSource() {

[henrika (OOO until Aug 14), 2015/04/09 11:53:40]

Can you add some comments about what happens here exactly. And why it is needed.

+  if (!blink_source_.isNull()) {
+    blink_source_.removeAudioConsumer(this);
+    blink_source_.reset();
+  }
+}
+
 }  // namespace content