Fix 99596.

media/filters/ffmpeg_demuxer.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "base/bind.h"
 #include "base/callback.h"
 #include "base/command_line.h"
 #include "base/memory/scoped_ptr.h"
 #include "base/message_loop.h"
 #include "base/stl_util.h"
@@ skipping 142 matching lines @@
 }
 
 DemuxerStream::Type FFmpegDemuxerStream::type() {
   return type_;
 }
 
 void FFmpegDemuxerStream::Read(const ReadCallback& read_callback) {
   DCHECK(!read_callback.is_null());
 
   base::AutoLock auto_lock(lock_);
+  // Don't accept any additional reads if we've been told to stop.
+  // The demuxer_ may have been destroyed in the pipleine thread.
+  //
+  // TODO(scherkus): it would be cleaner if we replied with an error message.
+  if (stopped_) {
+    read_callback.Run(new DataBuffer(0));
+    return;
+  }
+
   if (!buffer_queue_.empty()) {
     // Dequeue a buffer send back.
     scoped_refptr<Buffer> buffer = buffer_queue_.front();
     buffer_queue_.pop_front();
 
     // Execute the callback.
     read_callback.Run(buffer);
 
     if (!read_queue_.empty())
       demuxer_->PostDemuxTask();
 
   } else {
     demuxer_->message_loop()->PostTask(FROM_HERE, base::Bind(
         &FFmpegDemuxerStream::ReadTask, this, read_callback));
   }
 }
 
 void FFmpegDemuxerStream::ReadTask(const ReadCallback& read_callback) {
   DCHECK_EQ(MessageLoop::current(), demuxer_->message_loop());
 
   base::AutoLock auto_lock(lock_);
   // Don't accept any additional reads if we've been told to stop.
   //
   // TODO(scherkus): it would be cleaner if we replied with an error message.
   if (stopped_) {
+    read_callback.Run(new DataBuffer(0));
     return;
   }
 
   // Enqueue the callback and attempt to satisfy it immediately.
   read_queue_.push_back(read_callback);
   FulfillPendingRead();
 
   // Check if there are still pending reads, demux some more.
   if (!read_queue_.empty()) {
     demuxer_->PostDemuxTask();
@@ skipping 522 matching lines @@
   read_event_.Wait();
   return last_read_bytes_;
 }
 
 void FFmpegDemuxer::SignalReadCompleted(size_t size) {
   last_read_bytes_ = size;
   read_event_.Signal();
 }
 
 }  // namespace media