Avoid accessing context's fields after destruction
AudioHandler::Context() returns an untraced raw pointer to the
context so checking its value might be pointing some non-null
garbage after the context is gone. In that case, invoking
GetExecutionContext() might return a pointer to some random
memory space.
By checking a local flag on ExecutionContext's validity,
we can avoid such memory access.
(cherry picked from commit 2e0071db3e8af7c47a9962353913ffd7b7436e13)
Bug: 977107
Test: ASAN build does not crash on a repro code with the fix.
Change-Id: I19020e019cc3d9d52de3bebbe23129e7dd7b0a5e
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1693163
Reviewed-by: Kentaro Hara <haraken@chromium.org>
Commit-Queue: Hongchan Choi <hongchan@chromium.org>
Cr-Original-Commit-Position: refs/heads/master@{#676431}
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1701610
Reviewed-by: Hongchan Choi <hongchan@chromium.org>
Cr-Commit-Position: refs/branch-heads/3809@{#843}
Cr-Branched-From: d82dec1a818f378c464ba307ddd9c92133eac355-refs/heads/master@{#665002}
diff --git a/third_party/blink/renderer/modules/webaudio/offline_audio_destination_node.cc b/third_party/blink/renderer/modules/webaudio/offline_audio_destination_node.cc
index dc49288a..e0b3e9c 100644
--- a/third_party/blink/renderer/modules/webaudio/offline_audio_destination_node.cc
+++ b/third_party/blink/renderer/modules/webaudio/offline_audio_destination_node.cc
@@ -266,7 +266,7 @@
void OfflineAudioDestinationHandler::NotifySuspend(size_t frame) {
DCHECK(IsMainThread());
- if (Context() && Context()->GetExecutionContext())
+ if (!IsExecutionContextDestroyed() && Context())
Context()->ResolveSuspendOnMainThread(frame);
}
