Attempt to fixed crash on stop mirroring by stopping render thread on a worker thread.

content/browser/renderer_host/media/video_capture_device_impl.cc

Index: content/browser/renderer_host/media/video_capture_device_impl.cc
diff --git a/content/browser/renderer_host/media/video_capture_device_impl.cc b/content/browser/renderer_host/media/video_capture_device_impl.cc
index 3a94d50706dfebbbdc488399472d8f954ef6f3e5..b71004cb4691b12b2e038d40beedd020f7b5cdc1 100644
--- a/content/browser/renderer_host/media/video_capture_device_impl.cc
+++ b/content/browser/renderer_host/media/video_capture_device_impl.cc
@@ -35,7 +35,6 @@ void DeleteCaptureMachineOnUIThread(
     scoped_ptr<VideoCaptureMachine> capture_machine) {
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::UI));
   if (capture_machine) {
-    capture_machine->Stop();
     capture_machine.reset();
   }
 }
@@ -247,7 +246,8 @@ void VideoCaptureDeviceImpl::StopAndDeAllocate() {
   BrowserThread::PostTask(
       BrowserThread::UI, FROM_HERE, base::Bind(
           &VideoCaptureMachine::Stop,
-          base::Unretained(capture_machine_.get())));
+          base::Unretained(capture_machine_.get()),
+          base::Bind(&base::DoNothing)));
 }
 
 void VideoCaptureDeviceImpl::CaptureStarted(bool success) {
@@ -268,8 +268,11 @@ VideoCaptureDeviceImpl::~VideoCaptureDeviceImpl() {
   // safely stop the capture machine.
   if (capture_machine_) {
     BrowserThread::PostTask(
-        BrowserThread::UI, FROM_HERE, base::Bind(
-            &DeleteCaptureMachineOnUIThread, base::Passed(&capture_machine_)));
+        BrowserThread::UI, FROM_HERE,
+        base::Bind(&VideoCaptureMachine::Stop,
+                   base::Unretained(capture_machine_.get()),
+                   base::Bind(&DeleteCaptureMachineOnUIThread,
+                              base::Passed(&capture_machine_))));

[imcheng, 2014/01/09 01:15:17]

Not sure if this is problematic here - will VideoCaptureMachine::Stop be holding
a valid reference to the capture machine?

[Alpha Left Google, 2014/01/09 01:37:07]

when you call base::Bind(&DeleteCaptureMachineOnUIThread,
base::Passed(&capture_machine_)) then the ownership of CaptureMachine is held by
the callback created.

The problem here is the mixed use of capture_machine_.get() and
base::Passed(&capture_machine_). The latter clears the capture_machine_. The
consequence is you'll get undefined behavior.

What you can do is like this:
VideoCaptureMachine* capture_machine_ptr = capture_machine_.get();

and then
base::Unretained(capture_machine_ptr) and
base::Passed(&capture_machine_)

[imcheng, 2014/01/09 23:31:09]

Thanks for the explanation. I changed the code to get the raw pointer first.

On 2014/01/09 01:37:07, Alpha wrote:

   }
   DVLOG(1) << "VideoCaptureDeviceImpl@" << this << " destroying.";
 }