Audio|VideoDecoderBroker: Don't do work after firing callback

Callers may destruct the broker in response to the callback, so its
unsafe to make additional changes to broker state after the callback
fires.

Bug: 1120924, 1120431, 1121015
Change-Id: I72a42106b0d432ba7d3bd2170f3d31175b7955eb
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2370713
Auto-Submit: Chrome Cunningham <chcunningham@chromium.org>
Commit-Queue: Dan Sanders <sandersd@chromium.org>
Reviewed-by: Dan Sanders <sandersd@chromium.org>
Cr-Commit-Position: refs/heads/master@{#801122}

third_party/blink/renderer/modules/webcodecs/audio_decoder_broker.cc

@@ -353,8 +353,12 @@ void AudioDecoderBroker::OnDecodeDone(int cb_id, media::DecodeStatus status) {
   DCHECK(pending_decode_cb_map_.Contains(cb_id));
 
   auto iter = pending_decode_cb_map_.find(cb_id);
-  std::move(iter->value).Run(status);
+  DecodeCB decode_cb = std::move(iter->value);
   pending_decode_cb_map_.erase(cb_id);
+
+  // Do this last. Caller may destruct |this| in response to the callback while
+  // this method is still on the stack.
+  std::move(decode_cb).Run(status);
 }
 
 void AudioDecoderBroker::Reset(base::OnceClosure reset_cb) {
@@ -382,8 +386,12 @@ void AudioDecoderBroker::OnReset(int cb_id) {
   DCHECK(pending_reset_cb_map_.Contains(cb_id));
 
   auto iter = pending_reset_cb_map_.find(cb_id);
-  std::move(iter->value).Run();
+  base::OnceClosure reset_cb = std::move(iter->value);
   pending_reset_cb_map_.erase(cb_id);
+
+  // Do this last. Caller may destruct |this| in response to the callback while
+  // this method is still on the stack.
+  std::move(reset_cb).Run();
 }
 
 void AudioDecoderBroker::OnDecodeOutput(

third_party/blink/renderer/modules/webcodecs/video_decoder_broker.cc

@@ -396,8 +396,12 @@ void VideoDecoderBroker::OnDecodeDone(int cb_id, media::DecodeStatus status) {
   DCHECK(pending_decode_cb_map_.Contains(cb_id));
 
   auto iter = pending_decode_cb_map_.find(cb_id);
-  std::move(iter->value).Run(status);
+  DecodeCB decode_cb = std::move(iter->value);
   pending_decode_cb_map_.erase(cb_id);
+
+  // Do this last. Caller may destruct |this| in response to the callback while
+  // this method is still on the stack.
+  std::move(decode_cb).Run(status);
 }
 
 void VideoDecoderBroker::Reset(base::OnceClosure reset_cb) {
@@ -433,8 +437,12 @@ void VideoDecoderBroker::OnReset(int cb_id) {
   DCHECK(pending_reset_cb_map_.Contains(cb_id));
 
   auto iter = pending_reset_cb_map_.find(cb_id);
-  std::move(iter->value).Run();
+  base::OnceClosure reset_cb = std::move(iter->value);
   pending_reset_cb_map_.erase(cb_id);
+
+  // Do this last. Caller may destruct |this| in response to the callback while
+  // this method is still on the stack.
+  std::move(reset_cb).Run();
 }
 
 void VideoDecoderBroker::OnDecodeOutput(scoped_refptr<media::VideoFrame> frame,