diff --git a/pc/jsep_transport_collection.cc b/pc/jsep_transport_collection.cc index 2f10c6ad24..981ef0e40c 100644 --- a/pc/jsep_transport_collection.cc +++ b/pc/jsep_transport_collection.cc @@ -267,17 +267,20 @@ void JsepTransportCollection::RemoveTransportForMid(absl::string_view mid) { bool JsepTransportCollection::RollbackTransports() { RTC_DCHECK_RUN_ON(&sequence_checker_); bool ret = true; - // First, remove any new mid->transport mappings. + // First, remove any new mid->transport mappings. Note: do NOT short-circuit + // these callbacks — every mid must be notified before its transport is + // unconditionally dropped/destroyed below, otherwise consumers (e.g. + // BaseChannel::rtp_transport_) are left with dangling pointers. for (const auto& kv : mid_to_transport_) { if (stable_mid_to_transport_.count(kv.first) == 0) { - ret = ret && map_change_callback_(kv.first, nullptr); + ret = map_change_callback_(kv.first, nullptr) && ret; } } // Next, restore old mappings. for (const auto& kv : stable_mid_to_transport_) { auto it = mid_to_transport_.find(kv.first); if (it == mid_to_transport_.end() || it->second != kv.second) { - ret = ret && map_change_callback_(kv.first, kv.second); + ret = map_change_callback_(kv.first, kv.second) && ret; } } mid_to_transport_ = stable_mid_to_transport_;