Fixing segfault caused by TurnServer.

webrtc/p2p/base/turnserver.cc

 /*
  *  Copyright 2012 The WebRTC Project Authors. All rights reserved.
  *
  *  Use of this source code is governed by a BSD-style license
  *  that can be found in the LICENSE file in the root of the source
  *  tree. An additional intellectual property rights grant can be found
  *  in the file PATENTS.  All contributing project authors may
  *  be found in the AUTHORS file in the root of the source tree.
  */
 
 #include "webrtc/p2p/base/turnserver.h"
 
 #include <tuple>  // for std::tie
 
 #include "webrtc/p2p/base/asyncstuntcpsocket.h"
 #include "webrtc/p2p/base/common.h"
 #include "webrtc/p2p/base/packetsocketfactory.h"
 #include "webrtc/p2p/base/stun.h"
+#include "webrtc/base/bind.h"
 #include "webrtc/base/bytebuffer.h"
 #include "webrtc/base/helpers.h"
 #include "webrtc/base/logging.h"
 #include "webrtc/base/messagedigest.h"
 #include "webrtc/base/socketadapters.h"
 #include "webrtc/base/stringencode.h"
 #include "webrtc/base/thread.h"
 
 namespace cricket {
 
@@ skipping 489 matching lines @@
   if (it != allocations_.end()) {
     it->second.release();
     allocations_.erase(it);
   }
 }
 
 void TurnServer::DestroyInternalSocket(rtc::AsyncPacketSocket* socket) {
   InternalSocketMap::iterator iter = server_sockets_.find(socket);
   if (iter != server_sockets_.end()) {
     rtc::AsyncPacketSocket* socket = iter->first;
+    server_sockets_.erase(iter);
     // We must destroy the socket async to avoid invalidating the sigslot
-    // callback list iterator inside a sigslot callback.
-    rtc::Thread::Current()->Dispose(socket);
-    server_sockets_.erase(iter);
+    // callback list iterator inside a sigslot callback. (In other words,
+    // deleting an object from within a callback from that object).
+    sockets_to_delete_.push_back(
+        std::unique_ptr<rtc::AsyncPacketSocket>(socket));
+    invoker_.AsyncInvoke<void>(RTC_FROM_HERE, rtc::Thread::Current(),
+                               rtc::Bind(&TurnServer::FreeSockets, this));
   }
 }
 
+void TurnServer::FreeSockets() {
+  sockets_to_delete_.clear();
+}
+
 TurnServerConnection::TurnServerConnection(const rtc::SocketAddress& src,
                                            ProtocolType proto,
                                            rtc::AsyncPacketSocket* socket)
     : src_(src),
       dst_(socket->GetRemoteAddress()),
       proto_(proto),
       socket_(socket) {
 }
 
 bool TurnServerConnection::operator==(const TurnServerConnection& c) const {
@@ skipping 408 matching lines @@
                        MSG_ALLOCATION_TIMEOUT);
 }
 
 void TurnServerAllocation::Channel::OnMessage(rtc::Message* msg) {
   ASSERT(msg->message_id == MSG_ALLOCATION_TIMEOUT);
   SignalDestroyed(this);
   delete this;
 }
 
 }  // namespace cricket