Fix 99596.

media/filters/ffmpeg_demuxer.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "base/bind.h"
 #include "base/callback.h"
 #include "base/command_line.h"
 #include "base/memory/scoped_ptr.h"
 #include "base/message_loop.h"
 #include "base/stl_util.h"
@@ skipping 142 matching lines @@
 }
 
 DemuxerStream::Type FFmpegDemuxerStream::type() {
   return type_;
 }
 
 void FFmpegDemuxerStream::Read(const ReadCallback& read_callback) {
   DCHECK(!read_callback.is_null());
 
   base::AutoLock auto_lock(lock_);
+  // Don't accept any additional reads if we've been told to stop.
+  // The demuxer_ may have been destroyed in the pipleine thread.
+  //
+  // TODO(scherkus): it would be cleaner if we replied with an error message.
+  if (stopped_) {
+    return;

[acolwell GONE FROM CHROMIUM, 2011/10/14 21:37:35]

I think it would be better to return an EndOfStream buffer in this case. I don't
remember the exact situation, but I believe we can hang if we just drop the
callbacks.

[ddorwin, 2011/10/14 23:41:54]

Okay. I suppose we should be doing that in ReadTask() below too.

+  }
+
   if (!buffer_queue_.empty()) {
     // Dequeue a buffer send back.
     scoped_refptr<Buffer> buffer = buffer_queue_.front();
     buffer_queue_.pop_front();
 
     // Execute the callback.
     read_callback.Run(buffer);
 
     if (!read_queue_.empty())
       demuxer_->PostDemuxTask();
@@ skipping 547 matching lines @@
   read_event_.Wait();
   return last_read_bytes_;
 }
 
 void FFmpegDemuxer::SignalReadCompleted(size_t size) {
   last_read_bytes_ = size;
   read_event_.Signal();
 }
 
 }  // namespace media