Bug 1443803 - Protect against destroyed MediaStream in MediaEngineWebRTCMicrophoneSource. r=padenot

MozReview-Commit-ID: 3vyzS0DceKI

--HG--
extra : rebase_source : 127ff05f24c28c813af9cd3c90484fdedbf8faa2

dom/media/webrtc/MediaEngineWebRTCAudio.cpp

@@ -535,7 +535,7 @@ MediaEngineWebRTCMicrophoneSource::ApplySettings(const MediaEnginePrefs& aPrefs)
   RefPtr<MediaEngineWebRTCMicrophoneSource> that = this;
   RefPtr<MediaStreamGraphImpl> graph;
   for (const Allocation& allocation : mAllocations) {
-    if (allocation.mStream) {
+    if (allocation.mStream && allocation.mStream->GraphImpl()) {
       graph = allocation.mStream->GraphImpl();
       break;
     }
@@ -1042,6 +1042,14 @@ MediaEngineWebRTCMicrophoneSource::PacketizeAndProcess(MediaStreamGraph* aGraph,
         continue;
       }
 
+      if (!allocation.mStream->GraphImpl()) {
+        // The DOMMediaStream that owns allocation.mStream has been cleaned up
+        // and MediaStream::DestroyImpl() has run in the MSG. This is fine and
+        // can happen before the MediaManager thread gets to stop capture for
+        // this allocation.
+        continue;
+      }
+
       if (!allocation.mEnabled) {
         continue;
       }
@@ -1109,6 +1117,14 @@ MediaEngineWebRTCMicrophoneSource::InsertInGraph(const T* aBuffer,
       continue;
     }
 
+    if (!allocation.mStream->GraphImpl()) {
+      // The DOMMediaStream that owns allocation.mStream has been cleaned up
+      // and MediaStream::DestroyImpl() has run in the MSG. This is fine and
+      // can happen before the MediaManager thread gets to stop capture for
+      // this allocation.
+      continue;
+    }
+
     if (!allocation.mEnabled) {
       continue;
     }