tree 3f54b39d44cbff958df694be8692dd349fd85f2e
parent ff8cce37b69c8ea48399e42a7a36485eaf83e420
author Sebastian Jansson <srte@webrtc.org> 1554997710 +0200
committer Commit Bot <commit-bot@chromium.org> 1555063574 +0000

Fix for use after free in  simulated time controller.

We need to keep the lock until we have finished using the task runner
returned by GetNextReadyRunner to ensure that we don't remove it from
another thread. Additionally, we must get only one runner at a time in
case the first runner removes the second runner.

Bug: webrtc:10538
Change-Id: Idbd5610b67666238545b3a321fb79f7e86fcac56
Reviewed-on: https://webrtc-review.googlesource.com/c/src/+/132342
Reviewed-by: Niels Moller <nisse@webrtc.org>
Reviewed-by: Ilya Nikolaevskiy <ilnik@webrtc.org>
Commit-Queue: Sebastian Jansson <srte@webrtc.org>
Cr-Commit-Position: refs/heads/master@{#27584}