Remove reference counting from media::Demuxer and friends.

webkit/media/webmediaplayer_impl.h

Index: webkit/media/webmediaplayer_impl.h
diff --git a/webkit/media/webmediaplayer_impl.h b/webkit/media/webmediaplayer_impl.h
index 41d72e2c1c3cd2cbe152d82d3cb29670ae97be64..023ee676d930385b87e375f767107b8391a2dbe3 100644
--- a/webkit/media/webmediaplayer_impl.h
+++ b/webkit/media/webmediaplayer_impl.h
@@ -230,7 +230,9 @@ class WebMediaPlayerImpl
   void NotifyDownloading(bool is_downloading);
 
   // Finishes starting the pipeline due to a call to load().
-  void StartPipeline();
+  //
+  // A non-null |media_source| will construct a Media Source pipeline.
+  void StartPipeline(WebKit::WebMediaSource* media_source);
 
   // Helpers that set the network/ready state and notifies the client if
   // they've changed.
@@ -272,10 +274,6 @@ class WebMediaPlayerImpl
   // painted.
   void FrameReady(const scoped_refptr<media::VideoFrame>& frame);
 
-  // Builds a FilterCollection based on the current configuration of
-  // WebMediaPlayerImpl.
-  scoped_ptr<media::FilterCollection> BuildFilterCollection();
-
   WebKit::WebFrame* frame_;
 
   // TODO(hclam): get rid of these members and read from the pipeline directly.
@@ -350,7 +348,7 @@ class WebMediaPlayerImpl
   //   |data_source_| is used for regular resource loads.
   //   |chunk_demuxer_| is used for Media Source resource loads.
   scoped_refptr<BufferedDataSource> data_source_;
-  scoped_refptr<media::ChunkDemuxer> chunk_demuxer_;
+  media::ChunkDemuxer* chunk_demuxer_;  // Owned by |pipeline_|.

[scherkus (not reviewing), 2013/04/17 17:21:59]

is there a UAF bug here if pipeline hits an error?

[acolwell GONE FROM CHROMIUM, 2013/04/17 20:24:53]

Yes. This is accessed from the renderer thread and could be accessed while the
pipeline is in the process of handling the error.

 
   // Temporary for EME v0.1. In the future the init data type should be passed
   // through GenerateKeyRequest() directly from WebKit.