chore: cherry-pick 3ac8883297e1 from chromium

patches/chromium/.patches

@@ -100,3 +100,4 @@ move_readablestream_requests_onto_the_stack_before_iteration.patch
 streams_convert_state_dchecks_to_checks.patch
 audiocontext_haspendingactivity_unless_it_s_closed.patch
 protect_automatic_pull_handlers_with_mutex.patch
+cherry-pick-3ac8883297e1.patch

patches/chromium/cherry-pick-3ac8883297e1.patch

@@ -0,0 +1,41 @@
+From 3ac8883297e17ea27828bac2bcf39fa5e009f384 Mon Sep 17 00:00:00 2001
+From: Raymond Toy <rtoy@chromium.org>
+Date: Mon, 2 Mar 2020 23:22:26 +0000
+Subject: [PATCH] Break connections before removing from
+ active_source_handlers_.
+
+In DeferredTaskHandler::BreakConnections, we want to remove finished
+handlers and break the connection.  when a finished handler is removed
+from active_source_handlers_, it might be deleted, but we were still
+using that to create the connection.  Instead, break the connection
+first and then remove it.
+
+Manually ran test from the bug and it passes with this change.  Without
+this, it failed right away.
+
+Bug: 1057593
+Change-Id: I3c9346a6842f412100d608876adb268befb80470
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2083436
+Commit-Queue: Raymond Toy <rtoy@chromium.org>
+Reviewed-by: Hongchan Choi <hongchan@chromium.org>
+Cr-Commit-Position: refs/heads/master@{#746142}
+---
+ .../blink/renderer/modules/webaudio/deferred_task_handler.cc  | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/third_party/blink/renderer/modules/webaudio/deferred_task_handler.cc b/third_party/blink/renderer/modules/webaudio/deferred_task_handler.cc
+index 9fd38f0dde71b..fca70458c5a1f 100644
+--- a/third_party/blink/renderer/modules/webaudio/deferred_task_handler.cc
++++ b/third_party/blink/renderer/modules/webaudio/deferred_task_handler.cc
+@@ -78,8 +78,10 @@ void DeferredTaskHandler::BreakConnections() {
+   wtf_size_t size = finished_source_handlers_.size();
+   if (size > 0) {
+     for (auto* finished : finished_source_handlers_) {
+-      active_source_handlers_.erase(finished);
++      // Break connection first and then remove from the list because that can
++      // cause the handler to be deleted.
+       finished->BreakConnectionWithLock();
++      active_source_handlers_.erase(finished);
+     }
+     finished_source_handlers_.clear();
+   }