Fix heap-use-after-free issue with WebAudioCapturerSource.

content/renderer/media/webaudio_capturer_source.cc

Index: content/renderer/media/webaudio_capturer_source.cc
diff --git a/content/renderer/media/webaudio_capturer_source.cc b/content/renderer/media/webaudio_capturer_source.cc
index 3447cc9519965b83b9f5a2ec45634454273038e0..fb142d64299770720c502e7bbd4c991b02832c6b 100644
--- a/content/renderer/media/webaudio_capturer_source.cc
+++ b/content/renderer/media/webaudio_capturer_source.cc
@@ -19,12 +19,15 @@ static const int kMaxNumberOfBuffersInFifo = 5;
 
 namespace content {
 
-WebAudioCapturerSource::WebAudioCapturerSource()
+WebAudioCapturerSource::WebAudioCapturerSource(
+    const blink::WebMediaStreamSource &blink_source)
     : track_(NULL),
-      audio_format_changed_(false) {
+      audio_format_changed_(false),
+      blink_source_(blink_source) {
 }
 
 WebAudioCapturerSource::~WebAudioCapturerSource() {
+  removeFromBlinkSource();
 }
 
 void WebAudioCapturerSource::setFormat(
@@ -68,6 +71,7 @@ void WebAudioCapturerSource::Stop() {
   DCHECK(thread_checker_.CalledOnValidThread());
   base::AutoLock auto_lock(lock_);
   track_ = NULL;
+  removeFromBlinkSource();
 }
 
 void WebAudioCapturerSource::consumeAudio(
@@ -116,4 +120,11 @@ void WebAudioCapturerSource::consumeAudio(
   }
 }
 
+void WebAudioCapturerSource::removeFromBlinkSource() {

[henrika (OOO until Aug 14), 2015/04/09 11:53:40]

Can you add some comments about what happens here exactly. And why it is needed.

+  if (!blink_source_.isNull()) {
+    blink_source_.removeAudioConsumer(this);
+    blink_source_.reset();
+  }
+}
+
 }  // namespace content