Issues

Resolves https://linear.app/stream/issue/IOS-1483/bugwebrtc-crash-on-audioengine-after-call-left

Summary

This fixes a crash in the AudioEngine-based ADM when RTCAudioDeviceModule outlives its RTCPeerConnectionFactory.

The crash happens on audio route changes (AVAudioSessionRouteChangeNotification) after the factory has already torn down its worker thread. In that state, AudioEngineDevice can still be registered as an RTCAudioSession delegate and attempts to post back to a dead webrtc::Thread*, causing the EXC_BAD_ACCESS seen in crash reports.

Root cause

RTCPeerConnectionFactory owns the worker thread, but callers can retain factory.audioDeviceModule independently.

Before this change:

• the factory could be deallocated
• the worker thread could be destroyed
• the retained ObjC ADM wrapper could still keep the native AudioEngineDevice alive
• AudioEngineDevice remained registered with RTCAudioSession
• the next route change called AudioEngineDevice::OnValidRouteChange()
• that method called thread_->PostTask(...) on a stale raw thread pointer

Repro

A consistent repro sequence is:

1. Create a RTCPeerConnectionFactory with RTCAudioDeviceModuleTypeAudioEngine.
2. Keep a strong reference to factory.audioDeviceModule.
3. Release the factory.
4. Trigger an audio route change:
   • plug/unplug wired headphones
   • connect/disconnect Bluetooth audio
   • switch speaker/receiver output
5. Observe a crash from audioSessionDidChangeRoute -> OnValidRouteChange -> PostTask.

Changes

• Release the factory's native ADM reference before invalidating the ObjC ADM wrapper.
• During wrapper invalidation, drop the wrapper's native ADM reference on the worker thread so native teardown happens while the stored thread is still valid.
• Remove the stale RTCAudioSession delegate as part of that native teardown path.
• Harden RTCAudioDeviceModule so that, once detached from the factory, late calls fail closed instead of touching _workerThread or _native.
  • arrays return empty
  • object accessors return nil
  • booleans return NO
  • mutating calls return -1 / NO
  • void methods become no-ops

Tests

Added an iOS regression test that:

• creates an AudioEngine-backed factory
• retains factory.audioDeviceModule
• deallocates the factory
• verifies the RTCAudioSession delegate count returns to baseline
• verifies late calls on the retained wrapper are safe
• injects a route-change notification to confirm the stale delegate path is gone

Verification

• Generated an iOS simulator build with:
  • gn gen out/ios_sim_audioengine --args='target_os="ios" target_cpu="arm64" target_environment="simulator" enable_run_ios_unittests_with_xctest=true ios_enable_code_signing=false'
• Ran direct clang compile-command checks for:
  • sdk/objc/api/peerconnection/RTCPeerConnectionFactory.mm
  • sdk/objc/api/peerconnection/RTCAudioDeviceModule.mm
  • sdk/objc/unittests/RTCPeerConnectionFactoryAudioEngine_xctest.mm