From 3b819f3d8bbeb72eb0aa2532564fec2f404284c8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Niels=20M=C3=B6ller?= Date: Thu, 10 Oct 2019 12:42:41 +0200 Subject: [PATCH] Move video_sources_.clear() call to CallTest::DestroyStreams When one of the sources is a FrameGeneratorCapturer, this implies that its TaskQueue is stopped. Before this change, the FrameGeneratorCapturer was destroyed later, by the CallTest destructor, which led to a use-after-free race on the Clock object passed to the capturer. Bug: webrtc:11018 Change-Id: I3e53f95a725b6fb53b13e182ecd2caf03ea15bc4 Reviewed-on: https://webrtc-review.googlesource.com/c/src/+/156170 Reviewed-by: Philip Eliasson Reviewed-by: Yves Gerey Reviewed-by: Ilya Nikolaevskiy Reviewed-by: Sebastian Jansson Commit-Queue: Niels Moller Cr-Commit-Position: refs/heads/master@{#29443} --- test/call_test.cc | 2 +- video/video_quality_test.cc | 2 -- 2 files changed, 1 insertion(+), 3 deletions(-) diff --git a/test/call_test.cc b/test/call_test.cc index 30369a638c..31e4e645e3 100644 --- a/test/call_test.cc +++ b/test/call_test.cc @@ -203,7 +203,6 @@ void CallTest::RunBaseTest(BaseTest* test) { receive_transport_.reset(); frame_generator_capturer_ = nullptr; - video_sources_.clear(); DestroyCalls(); fake_send_audio_device_ = nullptr; @@ -666,6 +665,7 @@ void CallTest::DestroyStreams() { receiver_call_->DestroyFlexfecReceiveStream(flexfec_recv_stream); video_receive_streams_.clear(); + video_sources_.clear(); } void CallTest::DestroyVideoSendStreams() { diff --git a/video/video_quality_test.cc b/video/video_quality_test.cc index db98dc0416..be1d15ad76 100644 --- a/video/video_quality_test.cc +++ b/video/video_quality_test.cc @@ -1342,7 +1342,6 @@ void VideoQualityTest::RunWithAnalyzer(const Params& params) { if (graph_data_output_file) fclose(graph_data_output_file); - video_sources_.clear(); send_transport.reset(); recv_transport.reset(); @@ -1569,7 +1568,6 @@ void VideoQualityTest::RunWithRenderers(const Params& params) { Stop(); DestroyStreams(); - video_sources_.clear(); send_transport.reset(); recv_transport.reset();