Remove reference counting from media::Demuxer and friends.

webkit/media/webmediaplayer_impl.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Delegate calls from WebCore::MediaPlayerPrivate to Chrome's video player.
 // It contains Pipeline which is the actual media player pipeline, it glues
 // the media player pipeline, data source, audio renderer and renderer.
 // Pipeline would creates multiple threads and access some public methods
 // of this class, so we need to be extra careful about concurrent access of
 // methods and members.
@@ skipping 212 matching lines @@
   // Contains common logic used across the different types loading.
   void LoadSetup(const WebKit::WebURL& url);
 
   // Called after asynchronous initialization of a data source completed.
   void DataSourceInitialized(const GURL& gurl, bool success);
 
   // Called when the data source is downloading or paused.
   void NotifyDownloading(bool is_downloading);
 
   // Finishes starting the pipeline due to a call to load().
-  void StartPipeline();
+  //
+  // A non-null |media_source| will construct a Media Source pipeline.
+  void StartPipeline(WebKit::WebMediaSource* media_source);
 
   // Helpers that set the network/ready state and notifies the client if
   // they've changed.
   void SetNetworkState(WebKit::WebMediaPlayer::NetworkState state);
   void SetReadyState(WebKit::WebMediaPlayer::ReadyState state);
 
   // Destroy resources held.
   void Destroy();
 
   // Getter method to |client_|.
@@ skipping 21 matching lines @@
   // Gets the duration value reported by the pipeline.
   double GetPipelineDuration() const;
 
   // Notifies WebKit of the duration change.
   void OnDurationChange();
 
   // Called by VideoRendererBase on its internal thread with the new frame to be
   // painted.
   void FrameReady(const scoped_refptr<media::VideoFrame>& frame);
 
-  // Builds a FilterCollection based on the current configuration of
-  // WebMediaPlayerImpl.
-  scoped_ptr<media::FilterCollection> BuildFilterCollection();
-
   WebKit::WebFrame* frame_;
 
   // TODO(hclam): get rid of these members and read from the pipeline directly.
   WebKit::WebMediaPlayer::NetworkState network_state_;
   WebKit::WebMediaPlayer::ReadyState ready_state_;
 
   // Keep a list of buffered time ranges.
   WebKit::WebTimeRanges buffered_;
 
   // Message loops for posting tasks on Chrome's main thread. Also used
@@ skipping 54 matching lines @@
 
   // The decryptor that manages decryption keys and decrypts encrypted frames.
   scoped_ptr<ProxyDecryptor> decryptor_;
 
   bool starting_;
 
   // These two are mutually exclusive:
   //   |data_source_| is used for regular resource loads.
   //   |chunk_demuxer_| is used for Media Source resource loads.
   scoped_refptr<BufferedDataSource> data_source_;
-  scoped_refptr<media::ChunkDemuxer> chunk_demuxer_;
+  media::ChunkDemuxer* chunk_demuxer_;  // Owned by |pipeline_|.

[scherkus (not reviewing), 2013/04/17 17:21:59]

is there a UAF bug here if pipeline hits an error?

[acolwell GONE FROM CHROMIUM, 2013/04/17 20:24:53]

Yes. This is accessed from the renderer thread and could be accessed while the
pipeline is in the process of handling the error.

 
   // Temporary for EME v0.1. In the future the init data type should be passed
   // through GenerateKeyRequest() directly from WebKit.
   std::string init_data_type_;
 
   // Video frame rendering members.
   //
   // |lock_| protects |current_frame_| since new frames arrive on the video
   // rendering thread, yet are accessed for rendering on either the main thread
   // or compositing thread depending on whether accelerated compositing is used.
   base::Lock lock_;
   media::SkCanvasVideoRenderer skcanvas_video_renderer_;
   scoped_refptr<media::VideoFrame> current_frame_;
   bool pending_repaint_;
 
   // The compositor layer for displaying the video content when using composited
   // playback.
   scoped_ptr<webkit::WebLayerImpl> video_weblayer_;
 
   // A pointer back to the compositor to inform it about state changes. This is
   // not NULL while the compositor is actively using this webmediaplayer.
   cc::VideoFrameProvider::Client* video_frame_provider_client_;
 
   DISALLOW_COPY_AND_ASSIGN(WebMediaPlayerImpl);
 };
 
 }  // namespace webkit_media
 
 #endif  // WEBKIT_MEDIA_WEBMEDIAPLAYER_IMPL_H_