Fixing crash in buffer bar painting code

media/base/pipeline_impl.cc

 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 //
 // TODO(scherkus): clean up PipelineImpl... too many crazy function names,
 // potential deadlocks, etc...
 
 #include "base/callback.h"
 #include "base/compiler_specific.h"
 #include "base/condition_variable.h"
@@ skipping 276 matching lines @@
   return loaded_;
 }
 
 PipelineError PipelineImpl::GetError() const {
   AutoLock auto_lock(lock_);
   return error_;
 }
 
 void PipelineImpl::SetCurrentReadPosition(int64 offset) {
   AutoLock auto_lock(lock_);
+
+  // The current read position should never be ahead of the buffered byte
+  // position but threading issues between BufferedDataSource::DoneRead_Locked()
+  // and BufferedDataSource::NetworkEventCallback() can cause them to be
+  // temporarily out of sync. The easiest fix for this is to cap both
+  // buffered_bytes_ and current_bytes_ to always be legal values in
+  // SetCurrentReadPosition() and in SetBufferedBytes().
+  if (offset > buffered_bytes_)
+    buffered_bytes_ = offset;
   current_bytes_ = offset;
 }
 
 int64 PipelineImpl::GetCurrentReadPosition() {
   AutoLock auto_lock(lock_);
   return current_bytes_;
 }
 
 void PipelineImpl::SetPipelineEndedCallback(PipelineCallback* ended_callback) {
   DCHECK(!IsRunning())
@@ skipping 135 matching lines @@
 
 void PipelineImpl::SetTotalBytes(int64 total_bytes) {
   DCHECK(IsRunning());
   AutoLock auto_lock(lock_);
   total_bytes_ = total_bytes;
 }
 
 void PipelineImpl::SetBufferedBytes(int64 buffered_bytes) {
   DCHECK(IsRunning());
   AutoLock auto_lock(lock_);
+
+  // See comments in SetCurrentReadPosition() about capping.
+  if (buffered_bytes < current_bytes_)
+    current_bytes_ = buffered_bytes;
   buffered_bytes_ = buffered_bytes;
 }
 
 void PipelineImpl::SetVideoSize(size_t width, size_t height) {
   DCHECK(IsRunning());
   AutoLock auto_lock(lock_);
   video_width_ = width;
   video_height_ = height;
 }
 
@@ skipping 563 matching lines @@
     filters_.front()->Stop(NewCallback(
         this, &PipelineImpl::OnFilterStateTransition));
   } else {
     state_ = kStopped;
     message_loop_->PostTask(FROM_HERE,
         NewRunnableMethod(this, &PipelineImpl::FinishDestroyingFiltersTask));
   }
 }
 
 }  // namespace media