From 5625d2ec93730e93927ffad958fc3a0f90073218 Mon Sep 17 00:00:00 2001
From: Feras Aldahlawi <frs@chromium.org>
Date: Wed, 15 Apr 2026 17:59:47 -0700
Subject: [PATCH] cdm: Synchronize calls to MediaDrmBridge

Introduce a synchronization lock and a pending call counter
to ensure that MediaDrmBridge's destroy() method waits for all in-flight
JNI callbacks to complete before proceeding with destruction. This
prevents race conditions where a callback might attempt to use the
native pointer after it has been invalidated.

Bug: 499023054
Change-Id: I50838e4d0592a0b2c6ac6851d5f199c76a6a6964
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7737728
Reviewed-by: Frank Liberato <liberato@chromium.org>
Reviewed-by: Vikram Pasupathy <vpasupathy@chromium.org>
Commit-Queue: Feras Aldahlawi <frs@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1615537}
---

diff --git a/media/base/android/java/src/org/chromium/media/MediaDrmBridge.java b/media/base/android/java/src/org/chromium/media/MediaDrmBridge.java
index 6a706db7..698fe564 100644
--- a/media/base/android/java/src/org/chromium/media/MediaDrmBridge.java
+++ b/media/base/android/java/src/org/chromium/media/MediaDrmBridge.java
@@ -102,6 +102,10 @@
     // Reference to the C++ media::MediaDrmBridge object.
     private long mNativeMediaDrmBridge;
 
+    private int mPendingNativeCalls;
+
+    private final Object mNativeMediaDrmBridgeLock = new Object();
+
     private final UUID mKeySystemUuid;
     private final boolean mRequiresMediaCrypto;
 
@@ -642,7 +646,7 @@
         // Provision only works for origin isolated storage.
         if (!mOriginSet) {
             Log.e(TAG, "Calling provision() without an origin.");
-            MediaDrmBridgeJni.get().onProvisioningComplete(mNativeMediaDrmBridge, false);
+            onProvisioningComplete(false);
             return;
         }
 
@@ -663,12 +667,12 @@
             }
 
             // Indicate that provisioning succeeded.
-            MediaDrmBridgeJni.get().onProvisioningComplete(mNativeMediaDrmBridge, true);
+            onProvisioningComplete(true);
 
         } catch (android.media.NotProvisionedException e) {
             if (!startProvisioning()) {
                 // Indicate that provisioning failed.
-                MediaDrmBridgeJni.get().onProvisioningComplete(mNativeMediaDrmBridge, false);
+                onProvisioningComplete(false);
             }
         }
     }
@@ -692,7 +696,18 @@
     @CalledByNative
     private void destroy() {
         Log.i(TAG, "Destroying MediaDrmBridge for origin %s", mOrigin);
-        mNativeMediaDrmBridge = INVALID_NATIVE_MEDIA_DRM_BRIDGE;
+        synchronized (mNativeMediaDrmBridgeLock) {
+            mNativeMediaDrmBridge = INVALID_NATIVE_MEDIA_DRM_BRIDGE;
+            // If mPendingNativeCalls is greater than 0, that means there are threads still
+            // accessing this object.
+            while (mPendingNativeCalls > 0) {
+                try {
+                    mNativeMediaDrmBridgeLock.wait();
+                } catch (InterruptedException e) {
+                    Log.e(TAG, "Interrupted while waiting for pending native calls", e);
+                }
+            }
+        }
         if (mMediaDrm != null) {
             try {
                 release();
@@ -1399,9 +1414,7 @@
         }
 
         Log.i(TAG, "Provisioning origin ID %s", mOriginSet ? mOrigin : "<none>");
-        MediaDrmBridgeJni.get()
-                .onProvisionRequest(
-                        mNativeMediaDrmBridge, request.getDefaultUrl(), request.getData());
+        onProvisionRequest(request.getDefaultUrl(), request.getData());
         return true;
     }
 
@@ -1487,7 +1500,7 @@
     void onProvisioned(boolean success) {
         if (!mRequiresMediaCrypto) {
             // No MediaCrypto required, so notify provisioning complete.
-            MediaDrmBridgeJni.get().onProvisioningComplete(mNativeMediaDrmBridge, success);
+            onProvisioningComplete(success);
             if (!success) {
                 release();
             }
@@ -1538,50 +1551,89 @@
 
     // Helper functions to make native calls.
 
-    private void onMediaCryptoReady(@Nullable MediaCrypto mediaCrypto) {
-        if (isNativeMediaDrmBridgeValid()) {
-            MediaDrmBridgeJni.get().onMediaCryptoReady(mNativeMediaDrmBridge, mediaCrypto);
+    private interface NativeCall {
+        void run(long nativeMediaDrmBridge);
+    }
+
+    /**
+     * Safely executes a JNI call, ensuring the native pointer remains valid for the duration of the
+     * call and blocking destroy() until it completes.
+     */
+    private void runNativeCallback(NativeCall call) {
+        long nativePtr;
+        synchronized (mNativeMediaDrmBridgeLock) {
+            if (mNativeMediaDrmBridge == INVALID_NATIVE_MEDIA_DRM_BRIDGE) return;
+            nativePtr = mNativeMediaDrmBridge;
+            mPendingNativeCalls++;
         }
+
+        try {
+            call.run(nativePtr);
+        } finally {
+            synchronized (mNativeMediaDrmBridgeLock) {
+                mPendingNativeCalls--;
+                if (mPendingNativeCalls == 0
+                        && mNativeMediaDrmBridge == INVALID_NATIVE_MEDIA_DRM_BRIDGE) {
+                    mNativeMediaDrmBridgeLock.notifyAll();
+                }
+            }
+        }
+    }
+
+    private void onMediaCryptoReady(@Nullable MediaCrypto mediaCrypto) {
+        runNativeCallback(
+                (nativePtr) -> MediaDrmBridgeJni.get().onMediaCryptoReady(nativePtr, mediaCrypto));
+    }
+
+    private void onProvisioningComplete(boolean success) {
+        runNativeCallback(
+                (nativePtr) -> MediaDrmBridgeJni.get().onProvisioningComplete(nativePtr, success));
+    }
+
+    private void onProvisionRequest(String defaultUrl, byte[] requestData) {
+        runNativeCallback(
+                (nativePtr) ->
+                        MediaDrmBridgeJni.get()
+                                .onProvisionRequest(nativePtr, defaultUrl, requestData));
     }
 
     private void onPromiseResolved(final long promiseId) {
-        if (isNativeMediaDrmBridgeValid()) {
-            MediaDrmBridgeJni.get().onPromiseResolved(mNativeMediaDrmBridge, promiseId);
-        }
+        runNativeCallback(
+                (nativePtr) -> MediaDrmBridgeJni.get().onPromiseResolved(nativePtr, promiseId));
     }
 
     private void onPromiseResolvedWithSession(final long promiseId, final SessionId sessionId) {
-        if (isNativeMediaDrmBridgeValid()) {
-            MediaDrmBridgeJni.get()
-                    .onPromiseResolvedWithSession(
-                            mNativeMediaDrmBridge, promiseId, sessionId.emeId());
-        }
+        byte[] emeId = sessionId.emeId();
+        runNativeCallback(
+                (nativePtr) ->
+                        MediaDrmBridgeJni.get()
+                                .onPromiseResolvedWithSession(nativePtr, promiseId, emeId));
     }
 
     private void onPromiseRejected(
             final long promiseId, final long systemCode, final String errorMessage) {
         Log.e(TAG, "onPromiseRejected: %s", errorMessage);
-        if (isNativeMediaDrmBridgeValid()) {
-            MediaDrmBridgeJni.get()
-                    .onPromiseRejected(mNativeMediaDrmBridge, promiseId, systemCode, errorMessage);
-        }
+        runNativeCallback(
+                (nativePtr) ->
+                        MediaDrmBridgeJni.get()
+                                .onPromiseRejected(nativePtr, promiseId, systemCode, errorMessage));
     }
 
     private void onSessionMessage(final SessionId sessionId, final MediaDrm.KeyRequest request) {
-        if (!isNativeMediaDrmBridgeValid()) return;
-
         int requestType = request.getRequestType();
-        MediaDrmBridgeJni.get()
-                .onSessionMessage(
-                        mNativeMediaDrmBridge, sessionId.emeId(), requestType, request.getData());
+        byte[] requestData = request.getData();
+        byte[] emeId = sessionId.emeId();
+        runNativeCallback(
+                (nativePtr) ->
+                        MediaDrmBridgeJni.get()
+                                .onSessionMessage(nativePtr, emeId, requestType, requestData));
     }