GpuVideoDecoder not to use DemuxerStream after it's stopped.

media/filters/gpu_video_decoder.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "media/filters/gpu_video_decoder.h"
 
 #include "base/bind.h"
 #include "base/callback_helpers.h"
 #include "base/cpu.h"
 #include "base/message_loop.h"
@@ skipping 89 matching lines @@
 }
 
 void GpuVideoDecoder::Stop(const base::Closure& closure) {
   DCHECK(gvd_loop_proxy_->BelongsToCurrentThread());
   if (vda_.get())
     DestroyVDA();
   if (!pending_read_cb_.is_null())
     EnqueueFrameAndTriggerFrameDelivery(VideoFrame::CreateEmptyFrame());
   if (!pending_reset_cb_.is_null())
     base::ResetAndReturn(&pending_reset_cb_).Run();
+  demuxer_stream_ = NULL;
   BindToCurrentLoop(closure).Run();
 }
 
 void GpuVideoDecoder::Initialize(const scoped_refptr<DemuxerStream>& stream,
                                  const PipelineStatusCB& orig_status_cb,
                                  const StatisticsCB& statistics_cb) {
   DCHECK(gvd_loop_proxy_->BelongsToCurrentThread());
   PipelineStatusCB status_cb = CreateUMAReportingPipelineCB(
       "Media.GpuVideoDecoderInitializeStatus",
       BindToCurrentLoop(orig_status_cb));
@@ skipping 176 matching lines @@
   // Mask against 30 bits, to avoid (undefined) wraparound on signed integer.
   next_bitstream_buffer_id_ = (next_bitstream_buffer_id_ + 1) & 0x3FFFFFFF;
   bool inserted = bitstream_buffers_in_decoder_.insert(std::make_pair(
       bitstream_buffer.id(), BufferPair(shm_buffer, buffer))).second;
   DCHECK(inserted);
   RecordBufferData(bitstream_buffer, *buffer);
 
   vda_loop_proxy_->PostTask(FROM_HERE, base::Bind(
       &VideoDecodeAccelerator::Decode, weak_vda_, bitstream_buffer));
 
-  if (CanMoreDecodeWorkBeDone())
-    EnsureDemuxOrDecode();
+  if (CanMoreDecodeWorkBeDone()) {
+    // Force post here to prevent reentrancy into DemuxerStream.
+    gvd_loop_proxy_->PostTask(FROM_HERE, base::Bind(
+        &GpuVideoDecoder::EnsureDemuxOrDecode, this));
+  }
 }
 
 void GpuVideoDecoder::RecordBufferData(
     const BitstreamBuffer& bitstream_buffer, const DecoderBuffer& buffer) {
   input_buffer_data_.push_front(BufferData(
       bitstream_buffer.id(), buffer.GetTimestamp(),
       demuxer_stream_->video_decoder_config().visible_rect(),
       demuxer_stream_->video_decoder_config().natural_size()));
   // Why this value?  Because why not.  avformat.h:MAX_REORDER_DELAY is 16, but
   // that's too small for some pathological B-frame test videos.  The cost of
@@ skipping 226 matching lines @@
        it != bitstream_buffers_in_decoder_.end(); ++it) {
     it->second.shm_buffer->shm->Close();
   }
   bitstream_buffers_in_decoder_.clear();
 
   DestroyTextures();
 }
 
 void GpuVideoDecoder::EnsureDemuxOrDecode() {
   DCHECK(gvd_loop_proxy_->BelongsToCurrentThread());
-  if (demuxer_read_in_progress_)
+
+  // The second condition can happen during the tear-down process.
+  // GpuVideoDecoder::Stop() returns the |pending_read_cb_| immediately without
+  // waiting for the demuxer read to be returned. Therefore, this function could
+  // be called even after the decoder has been stopped.
+  if (demuxer_read_in_progress_ || !demuxer_stream_)
     return;
+
   demuxer_read_in_progress_ = true;
-  gvd_loop_proxy_->PostTask(FROM_HERE, base::Bind(
-      &DemuxerStream::Read, demuxer_stream_.get(),
-      base::Bind(&GpuVideoDecoder::RequestBufferDecode, this)));
+  demuxer_stream_->Read(base::Bind(
+      &GpuVideoDecoder::RequestBufferDecode, this));
 }
 
 void GpuVideoDecoder::NotifyFlushDone() {
   if (!gvd_loop_proxy_->BelongsToCurrentThread()) {
     gvd_loop_proxy_->PostTask(FROM_HERE, base::Bind(
         &GpuVideoDecoder::NotifyFlushDone, this));
     return;
   }
   DCHECK_EQ(state_, kDrainingDecoder);
   state_ = kDecoderDrained;
@@ skipping 34 matching lines @@
 
   error_occured_ = true;
 
   if (!pending_read_cb_.is_null()) {
     base::ResetAndReturn(&pending_read_cb_).Run(kDecodeError, NULL);
     return;
   }
 }
 
 }  // namespace media