commit 7aa89cedbacb0f3c1a85f4e178eb640f8fc27126
author Byoungchan Lee <daniel.l@hpcnt.com> Fri Oct 29 02:00:31 2021
committer WebRTC LUCI CQ <webrtc-scoped@luci-project-accounts.iam.gserviceaccount.com> Mon Nov 08 10:40:18 2021
tree 310748d09b1de92d6c525ff2a710ef4039904a69
parent 3da25770384751ef09e29654d048e4d284ebdf76

Fix use after free in VideoSendStreamTest.MinTransmitBitrateRespectsRemb

https://chromium-swarm.appspot.com/task?id=56dfaf30fa11e510
Due to recent changes, this test sometimes crashes because of
use after free.
Fix this by adding a PendingTaskSafetyFlag to not access `stream_`
after it has been deleted.

Bug: webrtc:13315, webrtc:13351
Change-Id: I7cb180bcab1d79b39737c53704c5fe8a2ca28b7e
Reviewed-on: https://webrtc-review.googlesource.com/c/src/+/236660
Commit-Queue: Byoungchan Lee <daniel.l@hpcnt.com>
Reviewed-by: Ilya Nikolaevskiy <ilnik@webrtc.org>
Reviewed-by: Artem Titov <titovartem@webrtc.org>
Cr-Commit-Position: refs/heads/main@{#35319}

video/video_send_stream_tests.cc

diff --git a/video/video_send_stream_tests.cc b/video/video_send_stream_tests.cc
index 16b7f09..7bf47af 100644
--- a/video/video_send_stream_tests.cc
+++ b/video/video_send_stream_tests.cc
@@ -1470,7 +1470,8 @@
           task_queue_(task_queue),
           retranmission_rate_limiter_(Clock::GetRealTimeClock(), 1000),
           stream_(nullptr),
-          bitrate_capped_(false) {}
+          bitrate_capped_(false),
+          task_safety_flag_(PendingTaskSafetyFlag::CreateDetached()) {}
 
     ~BitrateObserver() override {
       // Make sure we free `rtp_rtcp_` in the same context as we constructed it.
@@ -1487,7 +1488,7 @@
       const uint32_t ssrc = rtp_packet.Ssrc();
       RTC_DCHECK(stream_);
 
-      task_queue_->PostTask(ToQueuedTask([this, ssrc]() {
+      task_queue_->PostTask(ToQueuedTask(task_safety_flag_, [this, ssrc]() {
         VideoSendStream::Stats stats = stream_->GetStats();
         if (!stats.substreams.empty()) {
           EXPECT_EQ(1u, stats.substreams.size());
@@ -1532,6 +1533,8 @@
       encoder_config->min_transmit_bitrate_bps = kMinTransmitBitrateBps;
     }
 
+    void OnStreamsStopped() override { task_safety_flag_->SetNotAlive(); }
+
     void PerformTest() override {
       EXPECT_TRUE(Wait())
           << "Timeout while waiting for low bitrate stats after REMB.";
@@ -1543,6 +1546,7 @@
     RateLimiter retranmission_rate_limiter_;
     VideoSendStream* stream_;
     bool bitrate_capped_;
+    rtc::scoped_refptr<PendingTaskSafetyFlag> task_safety_flag_;
   } test(task_queue());
 
   RunBaseTest(&test);