From 839f33256e792606993c2fae501babe68cd31921 Mon Sep 17 00:00:00 2001
From: Dale Curtis <dalecurtis@chromium.org>
Date: Thu, 08 Oct 2026 13:57:55 -0700
Subject: [PATCH] Cancel have_enough_after_lazy_load_cb_ in WebMediaPlayerImpl::Shutdown()

When a lazy-loaded video suspends during startup, OnPipelineSuspended()
posts have_enough_after_lazy_load_cb_ with a 250ms delay using
base::Unretained(demuxer_manager_.get()).

Previously, WebMediaPlayerImpl::Shutdown() moved demuxer_manager_ to
DestructionHelper without cancelling have_enough_after_lazy_load_cb_.
Because ~WebMediaPlayerImpl() is posted asynchronously via DeleteSoon,
if demuxer_manager_ is destroyed and the 250ms delayed task runs before
~WebMediaPlayerImpl(), DemuxerManager::StopPreloading() is invoked on a
freed DemuxerManager.

Cancel have_enough_after_lazy_load_cb_ in WebMediaPlayerImpl::Shutdown()
before transferring ownership of demuxer_manager_ to DestructionHelper.

Fixed: 568719352
Change-Id: Ia70f3549f38985bfd7bdb57d33ebe3ac6d6664ec
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8542870
Commit-Queue: Dale Curtis <dalecurtis@chromium.org>
Auto-Submit: Dale Curtis <dalecurtis@chromium.org>
Reviewed-by: Thomas Guilbert <tguilbert@chromium.org>
Commit-Queue: Thomas Guilbert <tguilbert@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1714912}
---
diff --git a/third_party/blink/renderer/platform/media/web_media_player_impl.cc b/third_party/blink/renderer/platform/media/web_media_player_impl.cc
index 643e67a..f57bac24 100644
--- a/third_party/blink/renderer/platform/media/web_media_player_impl.cc
+++ b/third_party/blink/renderer/platform/media/web_media_player_impl.cc
@@ -699,6 +699,7 @@
   simple_watch_timer_.Stop();
   memory_usage_reporting_timer_.Stop();
   update_background_status_cb_.Cancel();
+  have_enough_after_lazy_load_cb_.Cancel();
   media_log_->OnWebMediaPlayerDestroyed();
 
   demuxer_manager_->StopAndResetClient();
@@ -1940,9 +1941,9 @@
       // connection, briefly (250ms chosen arbitrarily) delay signaling "have
       // enough" to the MultiBufferDataSource.
       //
-      // Unretained() is safe here since the base::CancelableOnceClosure will
-      // cancel upon destruction of this class and `demuxer_manager_` is
-      // gauranteeed to outlive us as a result of the DestructionHelper.
+      // Unretained() is safe here since `have_enough_after_lazy_load_cb_` is
+      // cancelled in Shutdown() before `demuxer_manager_` is destroyed via
+      // DestructionHelper.
       have_enough_after_lazy_load_cb_.Reset(
           BindOnce(&media::DemuxerManager::StopPreloading,
                    Unretained(demuxer_manager_.get())));
diff --git a/third_party/blink/renderer/core/exported/web_media_player_impl_unittest.cc b/third_party/blink/renderer/core/exported/web_media_player_impl_unittest.cc
index fa28b63..7f24df0 100644
--- a/third_party/blink/renderer/core/exported/web_media_player_impl_unittest.cc
+++ b/third_party/blink/renderer/core/exported/web_media_player_impl_unittest.cc
@@ -1282,6 +1282,45 @@
   EXPECT_CALL(*surface_layer_bridge_ptr_, ClearObserver());
 }
 
+// Verify that shutting down WebMediaPlayerImpl before destroying it cancels the
+// delayed lazy load StopPreloading callback before DemuxerManager is destroyed.
+TEST_F(WebMediaPlayerImplTest,
+       LazyLoadPreloadMetadataSuspendShutdownBeforeDestroy) {
+  InitializeWebMediaPlayerImpl();
+  EXPECT_CALL(*client_, CouldPlayIfEnoughData()).WillRepeatedly(Return(false));
+  wmpi_->SetPreload(WebMediaPlayer::kPreloadMetaData);
+
+  LoadAndWaitForReadyState(kVideoOnlyTestFile,
+                           WebMediaPlayer::kReadyStateHaveMetadata);
+  testing::Mock::VerifyAndClearExpectations(client_.Get());
+  EXPECT_CALL(*client_, ReadyStateChanged()).Times(AnyNumber());
+  CycleThreads();
+  EXPECT_TRUE(IsSuspended());
+  EXPECT_TRUE(wmpi_->DidLazyLoad());
+  EXPECT_FALSE(ShouldCancelUponDefer());
+
+  EXPECT_CALL(*surface_layer_bridge_ptr_, ClearObserver());
+  EXPECT_CALL(*client_, SetCcLayer(nullptr));
+  EXPECT_CALL(*client_, MediaRemotingStopped(_));
+
+  // Shut down the player without destroying it yet, then cycle threads so
+  // DestructionHelper deletes `demuxer_manager_`.
+  wmpi_->Shutdown();
+  CycleThreads();
+
+  // Wait past the 250ms delay used by `have_enough_after_lazy_load_cb_` while
+  // `wmpi_` is still alive.
+  base::RunLoop loop;
+  GetWebLocalFrame()
+      ->Scheduler()
+      ->GetTaskRunner(TaskType::kMediaElementEvent)
+      ->PostDelayedTask(FROM_HERE, loop.QuitClosure(), base::Milliseconds(300));
+  loop.Run();
+
+  wmpi_.reset();
+  CycleThreads();
+}
+
 // Verify that lazy load is skipped when rVFC has been requested.
 TEST_F(WebMediaPlayerImplTest, LazyLoadSkippedForRVFC) {
   InitializeWebMediaPlayerImpl();

diff --git a/third_party/blink/renderer/core/exported/web_media_player_impl_unittest.cc b/third_party/blink/renderer/core/exported/web_media_player_impl_unittest.cc
index fa28b63..7f24df0 100644
--- a/third_party/blink/renderer/core/exported/web_media_player_impl_unittest.cc
+++ b/third_party/blink/renderer/core/exported/web_media_player_impl_unittest.cc
@@ -1282,6 +1282,45 @@
   EXPECT_CALL(*surface_layer_bridge_ptr_, ClearObserver());
 }
 
+// Verify that shutting down WebMediaPlayerImpl before destroying it cancels the
+// delayed lazy load StopPreloading callback before DemuxerManager is destroyed.
+TEST_F(WebMediaPlayerImplTest,
+       LazyLoadPreloadMetadataSuspendShutdownBeforeDestroy) {
+  InitializeWebMediaPlayerImpl();
+  EXPECT_CALL(*client_, CouldPlayIfEnoughData()).WillRepeatedly(Return(false));
+  wmpi_->SetPreload(WebMediaPlayer::kPreloadMetaData);
+
+  LoadAndWaitForReadyState(kVideoOnlyTestFile,
+                           WebMediaPlayer::kReadyStateHaveMetadata);
+  testing::Mock::VerifyAndClearExpectations(client_.Get());
+  EXPECT_CALL(*client_, ReadyStateChanged()).Times(AnyNumber());
+  CycleThreads();
+  EXPECT_TRUE(IsSuspended());
+  EXPECT_TRUE(wmpi_->DidLazyLoad());
+  EXPECT_FALSE(ShouldCancelUponDefer());
+
+  EXPECT_CALL(*surface_layer_bridge_ptr_, ClearObserver());
+  EXPECT_CALL(*client_, SetCcLayer(nullptr));
+  EXPECT_CALL(*client_, MediaRemotingStopped(_));
+
+  // Shut down the player without destroying it yet, then cycle threads so
+  // DestructionHelper deletes `demuxer_manager_`.
+  wmpi_->Shutdown();
+  CycleThreads();
+
+  // Wait past the 250ms delay used by `have_enough_after_lazy_load_cb_` while
+  // `wmpi_` is still alive.
+  base::RunLoop loop;
+  GetWebLocalFrame()
+      ->Scheduler()
+      ->GetTaskRunner(TaskType::kMediaElementEvent)
+      ->PostDelayedTask(FROM_HERE, loop.QuitClosure(), base::Milliseconds(300));
+  loop.Run();
+
+  wmpi_.reset();
+  CycleThreads();
+}
+
 // Verify that lazy load is skipped when rVFC has been requested.
 TEST_F(WebMediaPlayerImplTest, LazyLoadSkippedForRVFC) {
   InitializeWebMediaPlayerImpl();