Closed Bug 825235 Opened 9 years ago Closed 6 years ago

Resolve use of raw SourceMediaStream pointer in GetUserMediaCallbackMediaStreamListener::Invalidate


(Core :: WebRTC: Audio/Video, defect)

17 Branch
Not set





(Reporter: jesup, Assigned: jesup)



(Whiteboard: [getUserMedia] [blocking-gum-])

From bug 802538:

Tim Terriberry writes:
@@ +226,5 @@
>      // We can't take a chance on blocking here, so proxy this to another
>      // thread.
>      // XXX FIX! I'm cheating and passing a raw pointer to the sourcestream
>      // which is valid as long as the mStream pointer here is.  Need a better

I think you should fix this. A couple possible, though ugly solutions:

A) If we're on the main thread, pass mStream instead of
mStream->GetStream()->AsSourceStream(). This increments the ref count properly
and keeps mStream alive until the runnable executes (and, given your changes
above, properly cleans up after itself).
B) Otherwise, we're being called from NotifyFinished() on the MediaStreamGraph
thread. If Remove() has been called from the main thread, but RemoveListener()
has not yet executed on the MediaStreamGraph thread, then there's a chance that
RemoveListener will destroy this listener and release the last reference to the
nsDOMMediaStream on the main thread before the runnable executes. We can solve
this by
  1) Dispatching with NS_DISPATCH_SYNC (which blocks the MediaStreamGraph
thread, sadly), or
  2) Dispatching a runnable to the main thread to re-call Invalidate() (which
would need to hold an nsRefPtr to this listener to keep it from being destroyed
until that runnable executes).

Option 2 is more work, but a better solution. The best way to do it would be to
assert we're on the main thread in this function, and dispatch the runnable in
Overtaken by later work on Invalidate()
Closed: 6 years ago
Resolution: --- → INCOMPLETE
You need to log in before you can comment on or make changes to this bug.