Do not notify MediaSessionControllersManager after MediaWebContentsObserver dies

Fix a crash caused by posting a callback to the UI thread with a pointer
to a member variable without checking that the originating object is still
alive.

Bug: 1115364
Change-Id: Idf1594e8072d6269d3a0d2e04c17a583400e71c0
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2353396Reviewed-by: Tommy Steimel <steimel@chromium.org>
Reviewed-by: Dale Curtis <dalecurtis@chromium.org>
Commit-Queue: Noah Rose Ledesma <noahrose@google.com>
Cr-Commit-Position: refs/heads/master@{#798288}

content/browser/media/media_web_contents_observer.cc

@@ -43,6 +43,21 @@ static void SuspendAllMediaPlayersInRenderFrame(
 }
 #endif  // defined(OS_ANDROID)
 
+static void OnAudioOutputDeviceIdTranslated(
+    base::WeakPtr<MediaWebContentsObserver> observer,
+    RenderFrameHost* render_frame_host,
+    int delegate_id,
+    const base::Optional<std::string>& raw_device_id) {
+  if (!raw_device_id)
+    return;
+
+  content::GetUIThreadTaskRunner({})->PostTask(
+      FROM_HERE,
+      base::BindOnce(&MediaWebContentsObserver::OnReceivedTranslatedDeviceId,
+                     std::move(observer), render_frame_host, delegate_id,
+                     raw_device_id.value()));
+}
+
 }  // anonymous namespace
 
 // Maintains state for a single player.  Issues WebContents and power-related
@@ -402,7 +417,7 @@ void MediaWebContentsObserver::OnAudioOutputSinkChanged(
       },
       salt_and_origin.device_id_salt, std::move(salt_and_origin.origin),
       hashed_device_id,
-      base::BindOnce(&MediaWebContentsObserver::OnAudioOutputDeviceIdTranslated,
+      base::BindOnce(&OnAudioOutputDeviceIdTranslated,
                      weak_ptr_factory_.GetWeakPtr(), render_frame_host,
                      delegate_id));
 
@@ -410,25 +425,12 @@ void MediaWebContentsObserver::OnAudioOutputSinkChanged(
       FROM_HERE, std::move(callback_on_io_thread));
 }
 
-void MediaWebContentsObserver::OnAudioOutputDeviceIdTranslated(
+void MediaWebContentsObserver::OnReceivedTranslatedDeviceId(
     RenderFrameHost* render_frame_host,
     int delegate_id,
-    const base::Optional<std::string>& raw_device_id) {
-  if (!raw_device_id.has_value())
-    return;
-
-  auto callback_on_ui_thread = base::BindOnce(
-      [](MediaSessionControllersManager* controllers_manager,
-         RenderFrameHost* render_frame_host, int delegate_id,
     const std::string& raw_device_id) {
-        controllers_manager->OnAudioOutputSinkChanged(
+  session_controllers_manager_.OnAudioOutputSinkChanged(
       MediaPlayerId(render_frame_host, delegate_id), raw_device_id);
-      },
-      session_controllers_manager(), render_frame_host, delegate_id,
-      raw_device_id.value());
-
-  content::GetUIThreadTaskRunner({})->PostTask(
-      FROM_HERE, std::move(callback_on_ui_thread));
 }
 
 void MediaWebContentsObserver::OnBufferUnderflow(

content/browser/media/media_web_contents_observer.h

@@ -99,6 +99,10 @@ class CONTENT_EXPORT MediaWebContentsObserver : public WebContentsObserver {
     audible_metrics_ = audible_metrics;
   }
 
+  void OnReceivedTranslatedDeviceId(RenderFrameHost* render_frame_host,
+                                    int delegate_id,
+                                    const std::string& raw_device_id);
+
 #if defined(OS_ANDROID)
   // Called by the WebContents when a tab has been closed but may still be
   // available for "undo" -- indicates that all media players (even audio only
@@ -152,10 +156,6 @@ class CONTENT_EXPORT MediaWebContentsObserver : public WebContentsObserver {
   void OnAudioOutputSinkChanged(RenderFrameHost* render_frame_host,
                                 int delegate_id,
                                 std::string hashed_device_id);
-  void OnAudioOutputDeviceIdTranslated(
-      RenderFrameHost* render_frame_host,
-      int delegate_id,
-      const base::Optional<std::string>& raw_device_id);
   void OnBufferUnderflow(RenderFrameHost* render_frame_host, int delegate_id);
 
   device::mojom::WakeLock* GetAudioWakeLock();