From cc183492c23b447b2a682530129a1262806f6714 Mon Sep 17 00:00:00 2001
From: Feras Aldahlawi <[email protected]>
Date: Tue, 13 Oct 2026 15:08:15 -0700
Subject: [PATCH] media: Safely drain promises in CdmPromiseAdapter::Clear

Rejecting a promise during CdmPromiseAdapter::Clear() may trigger
client callbacks that call SavePromise(). Move promises_ to a local
map before iterating to avoid iterator invalidation and use-after-free.

Bug: 568831768
Change-Id: If8364c9ace5d0f5eb06104b065a2187b6a6a6964
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8518406
Reviewed-by: Ted (Chromium) Meyer <[email protected]>
Commit-Queue: Feras Aldahlawi <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1717947}
---
diff --git a/media/base/cdm_promise_adapter.cc b/media/base/cdm_promise_adapter.cc
index 4c0f8b2..2a5ef7a 100644
--- a/media/base/cdm_promise_adapter.cc
+++ b/media/base/cdm_promise_adapter.cc
@@ -93,13 +93,20 @@
 void CdmPromiseAdapter::Clear(ClearReason reason) {
   // Reject all outstanding promises.
   DCHECK(thread_checker_.CalledOnValidThread());
-  for (auto& [promise_id, promise] : promises_) {
-    TRACE_EVENT_END("media", perfetto::NamedTrack("CdmPromise", promise_id),
-                    "status", "cleared");
-    promise->reject(CdmPromise::Exception::INVALID_STATE_ERROR,
-                    ToSystemCode(reason), "Operation aborted.");
+  // Rejecting a promise runs client code, which may re-enter this class, e.g.
+  // SavePromise() to close a session, or ResolvePromise()/RejectPromise() from
+  // a nested run loop. Move the promises out of `promises_` before rejecting
+  // them so that re-entrant calls cannot invalidate the iteration or settle a
+  // promise twice, and repeat until no new promises were saved.
+  while (!promises_.empty()) {
+    PromiseMap promises = std::exchange(promises_, {});
+    for (auto& [promise_id, promise] : promises) {
+      TRACE_EVENT_END("media", perfetto::NamedTrack("CdmPromise", promise_id),
+                      "status", "cleared");
+      promise->reject(CdmPromise::Exception::INVALID_STATE_ERROR,
+                      ToSystemCode(reason), "Operation aborted.");
+    }
   }
-  promises_.clear();
 }
 
 std::unique_ptr<CdmPromise> CdmPromiseAdapter::TakePromise(