Remove dangling PlayingState pointers in WebRtcAudioRenderer.

content/renderer/media/webrtc_audio_renderer.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/renderer/media/webrtc_audio_renderer.h"
 
 #include <utility>
 
 #include "base/bind.h"
 #include "base/bind_helpers.h"
@@ skipping 36 matching lines @@
 
 // This is a simple wrapper class that's handed out to users of a shared
 // WebRtcAudioRenderer instance.  This class maintains the per-user 'playing'
 // and 'started' states to avoid problems related to incorrect usage which
 // might violate the implementation assumptions inside WebRtcAudioRenderer
 // (see the play reference count).
 class SharedAudioRenderer : public MediaStreamAudioRenderer {
  public:
   // Callback definition for a callback that is called when when Play(), Pause()
   // or SetVolume are called (whenever the internal |playing_state_| changes).
-  typedef base::Callback<void(const blink::WebMediaStream&,
-                              WebRtcAudioRenderer::PlayingState*)>
-      OnPlayStateChanged;
+  using OnPlayStateChanged =
+      base::Callback<void(const blink::WebMediaStream&,
+                          WebRtcAudioRenderer::PlayingState*)>;
+
+  // Signals that the PlayingState* is about to become invalid, see comment in
+  // OnPlayStateRemoved.
+  using OnPlayStateRemoved =
+      base::OnceCallback<void(WebRtcAudioRenderer::PlayingState*)>;
 
   SharedAudioRenderer(const scoped_refptr<MediaStreamAudioRenderer>& delegate,
                       const blink::WebMediaStream& media_stream,
-                      const OnPlayStateChanged& on_play_state_changed)
+                      const OnPlayStateChanged& on_play_state_changed,
+                      OnPlayStateRemoved on_play_state_removed)
       : delegate_(delegate),
         media_stream_(media_stream),
         started_(false),
-        on_play_state_changed_(on_play_state_changed) {
+        on_play_state_changed_(on_play_state_changed),
+        on_play_state_removed_(std::move(on_play_state_removed)) {
     DCHECK(!on_play_state_changed_.is_null());
     DCHECK(!media_stream_.isNull());
   }
 
  protected:
   ~SharedAudioRenderer() override {
     DCHECK(thread_checker_.CalledOnValidThread());
     DVLOG(1) << __func__;
     Stop();
+    std::move(on_play_state_removed_).Run(&playing_state_);
   }
 
   void Start() override {
     DCHECK(thread_checker_.CalledOnValidThread());
     if (started_)
       return;
     started_ = true;
     delegate_->Start();
   }
 
@@ skipping 54 matching lines @@
     return delegate_->IsLocalRenderer();
   }
 
  private:
   base::ThreadChecker thread_checker_;
   const scoped_refptr<MediaStreamAudioRenderer> delegate_;
   const blink::WebMediaStream media_stream_;
   bool started_;
   WebRtcAudioRenderer::PlayingState playing_state_;
   OnPlayStateChanged on_play_state_changed_;
+  OnPlayStateRemoved on_play_state_removed_;
 };
 
 }  // namespace
 
 WebRtcAudioRenderer::WebRtcAudioRenderer(
     const scoped_refptr<base::SingleThreadTaskRunner>& signaling_thread,
     const blink::WebMediaStream& media_stream,
     int source_render_frame_id,
     int session_id,
     const std::string& device_id,
@@ skipping 52 matching lines @@
   }
   sink_->Start();
   sink_->Play();  // Not all the sinks play on start.
 
   return true;
 }
 
 scoped_refptr<MediaStreamAudioRenderer>
 WebRtcAudioRenderer::CreateSharedAudioRendererProxy(
     const blink::WebMediaStream& media_stream) {
-  content::SharedAudioRenderer::OnPlayStateChanged on_play_state_changed =
+  SharedAudioRenderer::OnPlayStateChanged on_play_state_changed =
       base::Bind(&WebRtcAudioRenderer::OnPlayStateChanged, this);
-  return new SharedAudioRenderer(this, media_stream, on_play_state_changed);
+  SharedAudioRenderer::OnPlayStateRemoved on_play_state_removed =
+      base::BindOnce(&WebRtcAudioRenderer::OnPlayStateRemoved, this);
+  return new SharedAudioRenderer(this, media_stream, on_play_state_changed,
+                                 std::move(on_play_state_removed));
 }
 
 bool WebRtcAudioRenderer::IsStarted() const {
   DCHECK(thread_checker_.CalledOnValidThread());
   return start_ref_count_ != 0;
 }
 
 bool WebRtcAudioRenderer::CurrentThreadIsRenderingThread() {
   return sink_->CurrentThreadIsRenderingThread();
 }
@@ skipping 350 matching lines @@
     if (!state->playing()) {
       if (RemovePlayingState(source, state))
         EnterPauseState();
     } else if (AddPlayingState(source, state)) {
       EnterPlayState();
     }
     UpdateSourceVolume(source);
   }
 }
 
+void WebRtcAudioRenderer::OnPlayStateRemoved(PlayingState* state) {
+  // It is possible we associated |state| to a source for a track that is no
+  // longer easily reachable. We iterate over |source_playing_states_| to
+  // ensure there are no dangling pointers to |state| there. See
+  // crbug.com/697256.
+  // TODO(maxmorin): Clean up cleanup code in this and related classes so that
+  // this hack isn't necessary.
+  DCHECK(thread_checker_.CalledOnValidThread());
+  for (auto it = source_playing_states_.begin();
+       it != source_playing_states_.end();) {
+    PlayingStates& states = it->second;
+    // We cannot use RemovePlayingState as it might invalidate |it|.
+    states.erase(std::remove(states.begin(), states.end(), state),
+                 states.end());
+    if (states.empty())
+      it = source_playing_states_.erase(it);
+    else
+      ++it;
+  }
+}
+
 void WebRtcAudioRenderer::PrepareSink() {
   DCHECK(thread_checker_.CalledOnValidThread());
   media::AudioParameters new_sink_params;
   {
     base::AutoLock lock(lock_);
     new_sink_params = sink_params_;
   }
 
   const media::OutputDeviceInfo& device_info = sink_->GetOutputDeviceInfo();
   DCHECK_EQ(device_info.device_status(), media::OUTPUT_DEVICE_STATUS_OK);
@@ skipping 52 matching lines @@
     sink_params_ = new_sink_params;
   }
 
   // Specify the latency info to be passed to the browser side.
   new_sink_params.set_latency_tag(AudioDeviceFactory::GetSourceLatencyType(
       AudioDeviceFactory::AudioDeviceFactory::kSourceWebRtc));
   sink_->Initialize(new_sink_params, this);
 }
 
 }  // namespace content