diff options
3 files changed, 17 insertions, 3 deletions
diff --git a/chromium/third_party/blink/renderer/modules/peerconnection/rtc_peer_connection.cc b/chromium/third_party/blink/renderer/modules/peerconnection/rtc_peer_connection.cc index 636aa342529..be9196ee034 100644 --- a/chromium/third_party/blink/renderer/modules/peerconnection/rtc_peer_connection.cc +++ b/chromium/third_party/blink/renderer/modules/peerconnection/rtc_peer_connection.cc @@ -893,12 +893,18 @@ RTCPeerConnection::~RTCPeerConnection() { } void RTCPeerConnection::Dispose() { - // Promptly clears the handler - // so that content/ doesn't access it in a lazy sweeping phase. - // Other references to the handler use a weak pointer, preventing access. + // Promptly clears the handler so that content doesn't access it in a lazy + // sweeping phase. Other references to the handler use a weak pointer, + // preventing access. if (peer_handler_) { peer_handler_.reset(); } + // Memory owned by RTCPeerConnection must not be touched after Dispose(). + // Shut down the cache to cancel any in-flight tasks that may otherwise have + // used the cache. + if (rtp_contributing_source_cache_.has_value()) { + rtp_contributing_source_cache_.value().Shutdown(); + } } ScriptPromise RTCPeerConnection::createOffer(ScriptState* script_state, diff --git a/chromium/third_party/blink/renderer/modules/peerconnection/rtp_contributing_source_cache.cc b/chromium/third_party/blink/renderer/modules/peerconnection/rtp_contributing_source_cache.cc index a52ddd405eb..d4b21570e64 100644 --- a/chromium/third_party/blink/renderer/modules/peerconnection/rtp_contributing_source_cache.cc +++ b/chromium/third_party/blink/renderer/modules/peerconnection/rtp_contributing_source_cache.cc @@ -100,6 +100,10 @@ RtpContributingSourceCache::RtpContributingSourceCache( DCHECK(worker_thread_runner_); } +void RtpContributingSourceCache::Shutdown() { + weak_factory_.InvalidateWeakPtrs(); +} + HeapVector<Member<RTCRtpSynchronizationSource>> RtpContributingSourceCache::getSynchronizationSources( ScriptState* script_state, diff --git a/chromium/third_party/blink/renderer/modules/peerconnection/rtp_contributing_source_cache.h b/chromium/third_party/blink/renderer/modules/peerconnection/rtp_contributing_source_cache.h index b8d78d80aee..827f5eb3524 100644 --- a/chromium/third_party/blink/renderer/modules/peerconnection/rtp_contributing_source_cache.h +++ b/chromium/third_party/blink/renderer/modules/peerconnection/rtp_contributing_source_cache.h @@ -43,6 +43,10 @@ class RtpContributingSourceCache { RTCPeerConnection* pc, scoped_refptr<base::SingleThreadTaskRunner> worker_thread_runner); + // When the owner of this object is Disposed(), this method must be called to + // cancel any in-flight tasks. + void Shutdown(); + HeapVector<Member<RTCRtpSynchronizationSource>> getSynchronizationSources( ScriptState* script_state, ExceptionState& exception_state, |