commit b78306a7d339bfcc3c4a6043023ab57d95444b99
author hbos <hbos@webrtc.org> Mon Dec 19 13:06:57 2016
committer Commit bot <commit-bot@chromium.org> Mon Dec 19 13:06:57 2016
tree 52c26495999ecc651dfad06b57f81e38a210ff6e
parent 0c8c5388355f5df085595d9ea24fa38995708120

Fix segfault when PeerConnection is destroyed during stats collection.

RTCStatsCollector relies on PeerConnection and its WebRtcSession. If the
PeerConnection is destroyed, reference counting keeps the
RTCStatsCollector alive until the request has completed. But the request
is using PeerConnection/WebRtcSession resources that are destroyed in
~PeerConnection().

To get around this problem, RTCStatsCollector::WaitForPendingRequest()
is added, which is invoked at ~PeerConnection().

Integration test added, it caused a segmentation fault before this
change / EXPECT failure.

BUG=chromium:627816

Review-Url: https://codereview.webrtc.org/2583613003
Cr-Commit-Position: refs/heads/master@{#15674}

webrtc/api/rtcstatscollector.cc

diff --git a/webrtc/api/rtcstatscollector.cc b/webrtc/api/rtcstatscollector.cc
index 3628544..f1c7ed7 100644
--- a/webrtc/api/rtcstatscollector.cc
+++ b/webrtc/api/rtcstatscollector.cc
@@ -389,6 +389,10 @@
       this, &RTCStatsCollector::OnDataChannelCreated);
 }
 
+RTCStatsCollector::~RTCStatsCollector() {
+  RTC_DCHECK_EQ(num_pending_partial_reports_, 0);
+}
+
 void RTCStatsCollector::GetStatsReport(
     rtc::scoped_refptr<RTCStatsCollectorCallback> callback) {
   RTC_DCHECK(signaling_thread_->IsCurrent());
@@ -453,6 +457,17 @@
   cached_report_ = nullptr;
 }
 
+void RTCStatsCollector::WaitForPendingRequest() {
+  RTC_DCHECK(signaling_thread_->IsCurrent());
+  if (num_pending_partial_reports_) {
+    rtc::Thread::Current()->ProcessMessages(0);
+    while (num_pending_partial_reports_) {
+      rtc::Thread::Current()->SleepMs(1);
+      rtc::Thread::Current()->ProcessMessages(0);
+    }
+  }
+}
+
 void RTCStatsCollector::ProducePartialResultsOnSignalingThread(
     int64_t timestamp_us) {
   RTC_DCHECK(signaling_thread_->IsCurrent());