Copy sinks before ReadyState change notification

MediaStreamVideoSinks may disconnect from a MediaStreamVideoTrack in
response to a OnReadyStateChanged() nofitication. This can lead to an
invalid iterator if the sinks disconnect synchronously.

This CL fixes the issue by iterating over a copy of sinks instead.

Bug: 1143213
Change-Id: I71fc43696d6b239f0bc4668b85474dc713e674b8
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2505552
Auto-Submit: Thomas Guilbert <tguilbert@chromium.org>
Commit-Queue: Guido Urdaneta <guidou@chromium.org>
Reviewed-by: Guido Urdaneta <guidou@chromium.org>
Cr-Commit-Position: refs/heads/master@{#822022}

third_party/blink/renderer/modules/mediastream/media_stream_video_track.cc

@@ -682,9 +682,16 @@ void MediaStreamVideoTrack::GetSettings(
 void MediaStreamVideoTrack::OnReadyStateChanged(
     WebMediaStreamSource::ReadyState state) {
   DCHECK_CALLED_ON_VALID_THREAD(main_render_thread_checker_);
-  for (auto* sink : sinks_)
+
+  // Copy the vectors first, since sinks might DisconnectFromTrack() and
+  // invalidate iterators.
+
+  Vector<WebMediaStreamSink*> sinks_copy(sinks_);
+  for (auto* sink : sinks_copy)
     sink->OnReadyStateChanged(state);
-  for (auto* encoded_sink : encoded_sinks_)
+
+  Vector<WebMediaStreamSink*> encoded_sinks_copy(encoded_sinks_);
+  for (auto* encoded_sink : encoded_sinks_copy)
     encoded_sink->OnReadyStateChanged(state);
 }