[Chromoting] A crash in DesktopSessionProxy::OnCaptureResult

remoting/host/desktop_session_proxy.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "remoting/host/desktop_session_proxy.h"
 
 #include <stddef.h>
 
 #include <utility>
 
@@ skipping 466 matching lines @@
   shared_buffers_.erase(id);
 }
 
 void DesktopSessionProxy::OnCaptureResult(
     webrtc::DesktopCapturer::Result result,
     const SerializedDesktopFrame& serialized_frame) {
   DCHECK(caller_task_runner_->BelongsToCurrentThread());
 
   --pending_capture_frame_requests_;
 
+  if (!video_capturer_) {
+    // video_capturer_ has been released before DesktopSessionAgent returns this

[Sergey Ulanov, 2016/08/12 04:15:18]

nit: 
 1. the capturer was deleted, not released.
 2. reader may not be aware what is DesktopSessionAgent and it's not that
important here. If it has to be mentioned here, then it's better to call it "the
desktop process".
suggest rephrasing: "Capturer was deleted while capture request was pending." Or
maybe just remove this comment, as it should be clear what's happening without
this comment

+    // frame.
+    return;
+  }
+
   if (result != webrtc::DesktopCapturer::Result::SUCCESS) {
     video_capturer_->OnCaptureResult(result, nullptr);
     return;
   }
 
   // Assume that |serialized_frame| is well-formed because it was received from
   // a more privileged process.
   scoped_refptr<IpcSharedBufferCore> shared_buffer_core =
       GetSharedBufferCore(serialized_frame.shared_buffer_id);
   CHECK(shared_buffer_core.get());
@@ skipping 49 matching lines @@
 }
 
 // static
 void DesktopSessionProxyTraits::Destruct(
     const DesktopSessionProxy* desktop_session_proxy) {
   desktop_session_proxy->caller_task_runner_->DeleteSoon(FROM_HERE,
                                                          desktop_session_proxy);
 }
 
 }  // namespace remoting