diff --git a/components/cast_streaming/renderer/frame/demuxer_connector.cc b/components/cast_streaming/renderer/frame/demuxer_connector.cc index 547e5ef0d2ca6b..2a53854f99e5ec 100644 --- a/components/cast_streaming/renderer/frame/demuxer_connector.cc +++ b/components/cast_streaming/renderer/frame/demuxer_connector.cc @@ -43,7 +43,6 @@ void DemuxerConnector::SetDemuxer(FrameInjectingDemuxer* demuxer) { void DemuxerConnector::OnDemuxerDestroyed() { DVLOG(1) << __func__; DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_); - DCHECK(demuxer_); demuxer_ = nullptr; is_demuxer_initialized_ = false; diff --git a/components/cast_streaming/renderer/frame/frame_injecting_demuxer.cc b/components/cast_streaming/renderer/frame/frame_injecting_demuxer.cc index ec9fbd31e356e8..c3292419fa8217 100644 --- a/components/cast_streaming/renderer/frame/frame_injecting_demuxer.cc +++ b/components/cast_streaming/renderer/frame/frame_injecting_demuxer.cc @@ -325,11 +325,12 @@ FrameInjectingDemuxer::FrameInjectingDemuxer( FrameInjectingDemuxer::~FrameInjectingDemuxer() { DVLOG(1) << __func__; - if (was_initialization_successful_) { - original_task_runner_->PostTask( - FROM_HERE, base::BindOnce(&DemuxerConnector::OnDemuxerDestroyed, - base::Unretained(demuxer_connector_))); - } + // Always notify the connector so it can clear its raw |demuxer_| pointer. + // Skipping this when initialization failed left a dangling pointer that was + // dereferenced in DemuxerConnector::OnReceiverDisconnected(). + original_task_runner_->PostTask( + FROM_HERE, base::BindOnce(&DemuxerConnector::OnDemuxerDestroyed, + base::Unretained(demuxer_connector_))); } void FrameInjectingDemuxer::OnStreamsInitialized(