Destroy WebRTCStatsReportCallbackResolver on main thread, fixes crash.

content/renderer/media/rtc_peer_connection_handler.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/renderer/media/rtc_peer_connection_handler.h"
 
 #include <string.h>
 
 #include <string>
 #include <utility>
@@ skipping 720 matching lines @@
             main_thread, callback.release()));
   }
 
   void OnStatsDelivered(
       const rtc::scoped_refptr<const webrtc::RTCStatsReport>& report) override {
     main_thread_->PostTask(FROM_HERE,
         base::Bind(&GetRTCStatsCallback::OnStatsDeliveredOnMainThread,
             this, report));
   }
 
-  void OnStatsDeliveredOnMainThread(
-      const rtc::scoped_refptr<const webrtc::RTCStatsReport>& report) {
-    DCHECK(main_thread_->BelongsToCurrentThread());
-    DCHECK(report);
-    callback_->OnStatsDelivered(std::unique_ptr<blink::WebRTCStatsReport>(
-        new RTCStatsReport(make_scoped_refptr(report.get()))));
-  }
-
  protected:
   GetRTCStatsCallback(
       const scoped_refptr<base::SingleThreadTaskRunner>& main_thread,
       blink::WebRTCStatsReportCallback* callback)
       : main_thread_(main_thread),
         callback_(callback) {
   }
+  ~GetRTCStatsCallback() override { DCHECK(!callback_); }
+
+  void OnStatsDeliveredOnMainThread(
+      const rtc::scoped_refptr<const webrtc::RTCStatsReport>& report) {
+    DCHECK(main_thread_->BelongsToCurrentThread());
+    DCHECK(report);
+    callback_->OnStatsDelivered(std::unique_ptr<blink::WebRTCStatsReport>(
+        new RTCStatsReport(make_scoped_refptr(report.get()))));
+    // Make sure the callback is destroyed in the main thread as well.
+    callback_.release();

[Guido Urdaneta, 2017/03/27 12:19:46]

I think you want .reset() here.
release() does not delete the pointer.

[hbos_chromium, 2017/03/27 12:22:44]

Oops, yes, done.

+  }
 
   const scoped_refptr<base::SingleThreadTaskRunner> main_thread_;
   std::unique_ptr<blink::WebRTCStatsReportCallback> callback_;
 };
 
 void GetRTCStatsOnSignalingThread(
     const scoped_refptr<base::SingleThreadTaskRunner>& main_thread,
     scoped_refptr<webrtc::PeerConnectionInterface> native_peer_connection,
     std::unique_ptr<blink::WebRTCStatsReportCallback> callback) {
   TRACE_EVENT0("webrtc", "GetRTCStatsOnSignalingThread");
@@ skipping 1239 matching lines @@
 }
 
 void RTCPeerConnectionHandler::ResetUMAStats() {
   DCHECK(thread_checker_.CalledOnValidThread());
   num_local_candidates_ipv6_ = 0;
   num_local_candidates_ipv4_ = 0;
   ice_connection_checking_start_ = base::TimeTicks();
   memset(ice_state_seen_, 0, sizeof(ice_state_seen_));
 }
 }  // namespace content