Merge 146044 - fix use after free case in VideoCaptureImpl.

content/renderer/media/video_capture_impl.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/renderer/media/video_capture_impl.h"
 
 #include "base/bind.h"
 #include "base/stl_util.h"
 #include "content/common/child_process.h"
 #include "content/common/media/video_capture_messages.h"
@@ skipping 209 matching lines @@
   if (it != clients_pending_on_filter_.end()) {
     handler->OnStopped(this);
     handler->OnRemoved(this);
     clients_pending_on_filter_.erase(it);
     return;
   }
   it = clients_pending_on_restart_.find(handler);
   if (it != clients_pending_on_restart_.end()) {
     handler->OnStopped(this);
     handler->OnRemoved(this);
-    clients_pending_on_filter_.erase(it);
+    clients_pending_on_restart_.erase(it);
     return;
   }
 
   if (clients_.find(handler) == clients_.end())
     return;
 
   clients_.erase(handler);
 
   if (clients_.empty()) {
     DVLOG(1) << "StopCapture: No more client, stopping ...";
     StopDevice();
   }
   handler->OnStopped(this);
   handler->OnRemoved(this);
 }
 
 void VideoCaptureImpl::DoFeedBuffer(scoped_refptr<VideoFrameBuffer> buffer) {
   DCHECK(capture_message_loop_proxy_->BelongsToCurrentThread());
 
   CachedDIB::iterator it;
   for (it = cached_dibs_.begin(); it != cached_dibs_.end(); it++) {
     if (buffer == it->second->mapped_memory)
       break;
   }
 
-  DCHECK(it != cached_dibs_.end());
-  DCHECK_GT(it->second->references, 0);
-  it->second->references--;
-  if (it->second->references == 0) {
-    Send(new VideoCaptureHostMsg_BufferReady(device_id_, it->first));
+  if (it != cached_dibs_.end() && it->second) {
+    DCHECK_GT(it->second->references, 0);
+    it->second->references--;
+    if (it->second->references == 0) {
+      Send(new VideoCaptureHostMsg_BufferReady(device_id_, it->first));
+    }
   }
 }
 
 void VideoCaptureImpl::DoBufferCreated(
     base::SharedMemoryHandle handle,
     int length, int buffer_id) {
   DCHECK(capture_message_loop_proxy_->BelongsToCurrentThread());
   DCHECK(device_info_available_);
 
   media::VideoCapture::VideoFrameBuffer* buffer;
@@ skipping 160 matching lines @@
 }
 
 bool VideoCaptureImpl::ClientHasDIB() {
   CachedDIB::iterator it;
   for (it = cached_dibs_.begin(); it != cached_dibs_.end(); it++) {
     if (it->second->references > 0)
       return true;
   }
   return false;
 }