Fix deadlock in WebRtcMediaStreamTrackAdapterMap.

content/renderer/media/webrtc/webrtc_media_stream_track_adapter_map.cc

 // Copyright (c) 2017 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/renderer/media/webrtc/webrtc_media_stream_track_adapter_map.h"
 
 #include <utility>
 
 #include "content/renderer/media/webrtc/peer_connection_dependency_factory.h"
 
 namespace content {
 
 WebRtcMediaStreamTrackAdapterMap::AdapterEntry::AdapterEntry(
     const scoped_refptr<WebRtcMediaStreamTrackAdapter>& adapter)
     : adapter(adapter) {}
 
 WebRtcMediaStreamTrackAdapterMap::AdapterEntry::AdapterEntry(
     AdapterEntry&& other)
     : adapter(other.adapter) {
   other.adapter = nullptr;
 }
 
 WebRtcMediaStreamTrackAdapterMap::AdapterEntry::~AdapterEntry() {
-  DCHECK(!adapter || !adapter->is_initialized());
 }
 
 WebRtcMediaStreamTrackAdapterMap::AdapterRef::AdapterRef(
     const scoped_refptr<WebRtcMediaStreamTrackAdapterMap>& map,
     Type type,
     const MapEntryIterator& it)
     : map_(map), type_(type), it_(it), adapter_(entry()->adapter) {
   DCHECK(map_);
   DCHECK(adapter_);
 }
 
 WebRtcMediaStreamTrackAdapterMap::AdapterRef::~AdapterRef() {
   DCHECK(map_->main_thread_->BelongsToCurrentThread());
-  base::AutoLock scoped_lock(map_->lock_);
-  adapter_ = nullptr;
-  if (entry()->adapter->HasOneRef()) {
-    entry()->adapter->Dispose();
-    if (type_ == Type::kLocal)
-      map_->local_track_adapters_.erase(it_);
-    else
-      map_->remote_track_adapters_.erase(it_);
+  scoped_refptr<WebRtcMediaStreamTrackAdapter> removed_adapter;
+  {
+    base::AutoLock scoped_lock(map_->lock_);
+    adapter_ = nullptr;
+    if (entry()->adapter->HasOneRef()) {
+      removed_adapter = entry()->adapter;
+      if (type_ == Type::kLocal)
+        map_->local_track_adapters_.erase(it_);
+      else
+        map_->remote_track_adapters_.erase(it_);
+    }
+  }
+  // Dispose the adapter if it was removed. This is performed after releasing
+  // the lock so that it is safe for any disposal mechanism to do synchronous
+  // invokes to the signaling thread without any risk of deadlock.
+  if (removed_adapter) {
+    removed_adapter->Dispose();
   }
 }
 
 WebRtcMediaStreamTrackAdapterMap::WebRtcMediaStreamTrackAdapterMap(
     PeerConnectionDependencyFactory* const factory)
     : factory_(factory), main_thread_(base::ThreadTaskRunnerHandle::Get()) {
   DCHECK(factory_);
   DCHECK(main_thread_);
 }
 
@@ skipping 74 matching lines @@
   if (it == track_adapters->end()) {
     scoped_refptr<WebRtcMediaStreamTrackAdapter> adapter =
         create_adapter_callback.Run();
     it =
         track_adapters->insert(std::make_pair(id, AdapterEntry(adapter))).first;
   }
   return base::WrapUnique(new AdapterRef(this, type, it));
 }
 
 }  // namespace content