From 7aa89cedbacb0f3c1a85f4e178eb640f8fc27126 Mon Sep 17 00:00:00 2001
From: Byoungchan Lee <daniel.l@hpcnt.com>
Date: Fri, 29 Oct 2021 11:00:31 +0900
Subject: [PATCH] Fix use after free in
 VideoSendStreamTest.MinTransmitBitrateRespectsRemb

https://chromium-swarm.appspot.com/task?id=56dfaf30fa11e510
Due to recent changes, this test sometimes crashes because of
use after free.
Fix this by adding a PendingTaskSafetyFlag to not access `stream_`
after it has been deleted.

Bug: webrtc:13315, webrtc:13351
Change-Id: I7cb180bcab1d79b39737c53704c5fe8a2ca28b7e
Reviewed-on: https://webrtc-review.googlesource.com/c/src/+/236660
Commit-Queue: Byoungchan Lee <daniel.l@hpcnt.com>
Reviewed-by: Ilya Nikolaevskiy <ilnik@webrtc.org>
Reviewed-by: Artem Titov <titovartem@webrtc.org>
Cr-Commit-Position: refs/heads/main@{#35319}
---
 video/video_send_stream_tests.cc | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/video/video_send_stream_tests.cc b/video/video_send_stream_tests.cc
index 16b7f0949e..7bf47af842 100644
--- a/video/video_send_stream_tests.cc
+++ b/video/video_send_stream_tests.cc
@@ -1470,7 +1470,8 @@ TEST_F(VideoSendStreamTest, MinTransmitBitrateRespectsRemb) {
           task_queue_(task_queue),
           retranmission_rate_limiter_(Clock::GetRealTimeClock(), 1000),
           stream_(nullptr),
-          bitrate_capped_(false) {}
+          bitrate_capped_(false),
+          task_safety_flag_(PendingTaskSafetyFlag::CreateDetached()) {}
 
     ~BitrateObserver() override {
       // Make sure we free `rtp_rtcp_` in the same context as we constructed it.
@@ -1487,7 +1488,7 @@ TEST_F(VideoSendStreamTest, MinTransmitBitrateRespectsRemb) {
       const uint32_t ssrc = rtp_packet.Ssrc();
       RTC_DCHECK(stream_);
 
-      task_queue_->PostTask(ToQueuedTask([this, ssrc]() {
+      task_queue_->PostTask(ToQueuedTask(task_safety_flag_, [this, ssrc]() {
         VideoSendStream::Stats stats = stream_->GetStats();
         if (!stats.substreams.empty()) {
           EXPECT_EQ(1u, stats.substreams.size());
@@ -1532,6 +1533,8 @@ TEST_F(VideoSendStreamTest, MinTransmitBitrateRespectsRemb) {
       encoder_config->min_transmit_bitrate_bps = kMinTransmitBitrateBps;
     }
 
+    void OnStreamsStopped() override { task_safety_flag_->SetNotAlive(); }
+
     void PerformTest() override {
       EXPECT_TRUE(Wait())
           << "Timeout while waiting for low bitrate stats after REMB.";
@@ -1543,6 +1546,7 @@ TEST_F(VideoSendStreamTest, MinTransmitBitrateRespectsRemb) {
     RateLimiter retranmission_rate_limiter_;
     VideoSendStream* stream_;
     bool bitrate_capped_;
+    rtc::scoped_refptr<PendingTaskSafetyFlag> task_safety_flag_;
   } test(task_queue());
 
   RunBaseTest(&test);