diff --git a/patches/chromium/.patches b/patches/chromium/.patches index 0e4718c6fedfe..e5ab781620128 100644 --- a/patches/chromium/.patches +++ b/patches/chromium/.patches @@ -101,6 +101,7 @@ streams_convert_state_dchecks_to_checks.patch -_point_usrsctp_to_a68325e7d9ed844cc84ec134192d788586ea6cc1.patch audiocontext_haspendingactivity_unless_it_s_closed.patch protect_automatic_pull_handlers_with_mutex.patch +break_connections_before_removing_from_active_source_handlers.patch mojovideoencodeacceleratorservice_handle_potential_later.patch speculative_fix_for_crashes_in_filechooserimpl.patch reland_sequentialise_access_to_callbacks_in.patch diff --git a/patches/chromium/break_connections_before_removing_from_active_source_handlers.patch b/patches/chromium/break_connections_before_removing_from_active_source_handlers.patch new file mode 100644 index 0000000000000..d5b756bb444fc --- /dev/null +++ b/patches/chromium/break_connections_before_removing_from_active_source_handlers.patch @@ -0,0 +1,37 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Raymond Toy +Date: Mon, 2 Mar 2020 23:22:26 +0000 +Subject: Break connections before removing from active_source_handlers_. + +In DeferredTaskHandler::BreakConnections, we want to remove finished +handlers and break the connection. when a finished handler is removed +from active_source_handlers_, it might be deleted, but we were still +using that to create the connection. Instead, break the connection +first and then remove it. + +Manually ran test from the bug and it passes with this change. Without +this, it failed right away. + +Bug: 1057593 +Change-Id: I3c9346a6842f412100d608876adb268befb80470 +Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2083436 +Commit-Queue: Raymond Toy +Reviewed-by: Hongchan Choi +Cr-Commit-Position: refs/heads/master@{#746142} + +diff --git a/third_party/blink/renderer/modules/webaudio/deferred_task_handler.cc b/third_party/blink/renderer/modules/webaudio/deferred_task_handler.cc +index 6ecedccc14ed15b81e916f0e1ff8f635489dcecc..b4a376aa8f5cb06efcc71032ed089db46dadf902 100644 +--- a/third_party/blink/renderer/modules/webaudio/deferred_task_handler.cc ++++ b/third_party/blink/renderer/modules/webaudio/deferred_task_handler.cc +@@ -78,8 +78,10 @@ void DeferredTaskHandler::BreakConnections() { + wtf_size_t size = finished_source_handlers_.size(); + if (size > 0) { + for (auto* finished : finished_source_handlers_) { +- active_source_handlers_.erase(finished); ++ // Break connection first and then remove from the list because that can ++ // cause the handler to be deleted. + finished->BreakConnectionWithLock(); ++ active_source_handlers_.erase(finished); + } + finished_source_handlers_.clear(); + }