[webkit-reviews] review granted: [Bug 171529] ASSERTION FAILED: wasRemoved in WebCore::RealtimeMediaSourceCenter::removeDevicesChangedObserver(DevicesChangedObserverToken) : [Attachment 309952] Proposed patch.

[bugzilla-daemon at webkit.org]

Jer Noble <jer.noble at apple.com> has granted Eric Carlson
<eric.carlson at apple.com>'s request for review:
Bug 171529: ASSERTION FAILED: wasRemoved in
WebCore::RealtimeMediaSourceCenter::removeDevicesChangedObserver(DevicesChanged
ObserverToken)
https://bugs.webkit.org/show_bug.cgi?id=171529

Attachment 309952: Proposed patch.

https://bugs.webkit.org/attachment.cgi?id=309952&action=review




--- Comment #10 from Jer Noble <jer.noble at apple.com> ---
Comment on attachment 309952
  --> https://bugs.webkit.org/attachment.cgi?id=309952
Proposed patch.

View in context: https://bugs.webkit.org/attachment.cgi?id=309952&action=review

> Source/WebCore/platform/mediastream/RealtimeMediaSourceCenter.cpp:205
> -    auto callbacks = m_devicesChangedObservers;
> -    for (auto it : callbacks)
> +    // Copy the hash map because the observer callback may call back in and
modify the map.
> +    auto callbacks = observerMap();
> +    for (auto& it : callbacks)

This solves a certain class of problems, but with this change, it's still
possible for a callback to call a freshly deleted object. So please make sure
that the classes registering for observers use a strong- or weak-pointer to
protect against being called back after destruction time.