Fix heap-use-after-free issue with WebAudioCapturerSource.

content/renderer/media/webaudio_capturer_source.cc

Index: content/renderer/media/webaudio_capturer_source.cc
diff --git a/content/renderer/media/webaudio_capturer_source.cc b/content/renderer/media/webaudio_capturer_source.cc
index 3447cc9519965b83b9f5a2ec45634454273038e0..98bda6ea803e22e80b3879ac971d1d383d5a66ff 100644
--- a/content/renderer/media/webaudio_capturer_source.cc
+++ b/content/renderer/media/webaudio_capturer_source.cc
@@ -19,12 +19,15 @@ static const int kMaxNumberOfBuffersInFifo = 5;
 
 namespace content {
 
-WebAudioCapturerSource::WebAudioCapturerSource()
+WebAudioCapturerSource::WebAudioCapturerSource(
+    const blink::WebMediaStreamSource& blink_source)
     : track_(NULL),
-      audio_format_changed_(false) {
+      audio_format_changed_(false),
+      blink_source_(blink_source) {
 }
 
 WebAudioCapturerSource::~WebAudioCapturerSource() {
+  removeFromBlinkSource();

[perkj_chrome, 2015/04/09 14:55:49]

On what thread is this object destroyed? I don't think you can call
removeAudioConsumer(this) from other threads than the main thread.

If it is only ever just one thread add  
DCHECK(thread_checker_.CalledOnValidThread()); 

 }
 
 void WebAudioCapturerSource::setFormat(
@@ -68,6 +71,7 @@ void WebAudioCapturerSource::Stop() {
   DCHECK(thread_checker_.CalledOnValidThread());
   base::AutoLock auto_lock(lock_);
   track_ = NULL;
+  removeFromBlinkSource();
 }
 
 void WebAudioCapturerSource::consumeAudio(
@@ -116,4 +120,16 @@ void WebAudioCapturerSource::consumeAudio(
   }
 }
 
+// If registered as audio consumer in |blink_source_|, deregister from
+// |blink_source_| and stop keeping a reference to |blink_source_|.
+// Failure to call this method when stopping the track might leave an invalid
+// WebAudioCapturerSource reference still registered as an audio consumer on
+// the blink side.
+void WebAudioCapturerSource::removeFromBlinkSource() {
+  if (!blink_source_.isNull()) {
+    blink_source_.removeAudioConsumer(this);
+    blink_source_.reset();
+  }
+}
+
 }  // namespace content