Fix a crash in WebRtcRtpDumpHandler.

A unit test added.

TBR=vrk@chromium.org

BUG=381873

Review URL: https://codereview.chromium.org/322603003

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@275606 0039d316-1c4b-4281-b951-d872f2087c98

chrome/browser/media/webrtc_rtp_dump_handler.cc

@@ -330,13 +330,14 @@ void WebRtcRtpDumpHandler::OnDumpEnded(const base::Closure& callback,
     }
   }
 
-  if (!callback.is_null())
-    callback.Run();
-
   // Release the writer when it's no longer needed.
   if (incoming_state_ != STATE_STOPPING && outgoing_state_ != STATE_STOPPING &&
       incoming_state_ != STATE_STARTED && outgoing_state_ != STATE_STARTED) {
     dump_writer_.reset();
     --g_ongoing_rtp_dumps;
   }
+
+  // This object might be deleted after running the callback.
+  if (!callback.is_null())
+    callback.Run();
 }

chrome/browser/media/webrtc_rtp_dump_handler_unittest.cc

@@ -79,6 +79,8 @@ class WebRtcRtpDumpHandlerTest : public testing::Test {
     handler_->SetDumpWriterForTesting(writer.Pass());
   }
 
+  void DeleteDumpHandler() { handler_.reset(); }
+
   void WriteFakeDumpFiles(const base::FilePath& dir,
                           base::FilePath* incoming_dump,
                           base::FilePath* outgoing_dump) {
@@ -391,3 +393,19 @@ TEST_F(WebRtcRtpDumpHandlerTest, StopOngoingDumpsWhileStoppingOneDump) {
   EXPECT_FALSE(dumps.incoming_dump_path.empty());
   EXPECT_FALSE(dumps.outgoing_dump_path.empty());
 }
+
+TEST_F(WebRtcRtpDumpHandlerTest, DeleteHandlerBeforeStopCallback) {
+  std::string error;
+
+  EXPECT_CALL(*this, OnStopOngoingDumpsFinished())
+      .WillOnce(testing::InvokeWithoutArgs(
+          this, &WebRtcRtpDumpHandlerTest::DeleteDumpHandler));
+
+  EXPECT_TRUE(handler_->StartDump(RTP_DUMP_BOTH, &error));
+
+  handler_->StopOngoingDumps(
+      base::Bind(&WebRtcRtpDumpHandlerTest::OnStopOngoingDumpsFinished,
+                 base::Unretained(this)));
+
+  base::RunLoop().RunUntilIdle();
+}

chrome/browser/media/webrtc_rtp_dump_writer.cc

@@ -447,5 +447,6 @@ void WebRtcRtpDumpWriter::OnDumpEnded(EndDumpContext context,
     return;
   }
 
+  // This object might be deleted after running the callback.
   context.callback.Run(context.incoming_succeeded, context.outgoing_succeeded);
 }