Remove reference counting from media::Demuxer and friends.

webkit/media/webmediasourceclient_impl.h

Index: webkit/media/webmediasourceclient_impl.h
diff --git a/webkit/media/webmediasourceclient_impl.h b/webkit/media/webmediasourceclient_impl.h
index 1aa0f6e4a817f4aa09bc62fb30229e7bc84e5f9d..8c9363f0e1ea161ab17d3811accec15336104f67 100644
--- a/webkit/media/webmediasourceclient_impl.h
+++ b/webkit/media/webmediasourceclient_impl.h
@@ -8,7 +8,6 @@
 #include <string>
 #include <vector>
 
-#include "base/memory/ref_counted.h"
 #include "media/base/media_log.h"
 #include "third_party/WebKit/Source/WebKit/chromium/public/WebMediaSourceClient.h"
 
@@ -20,9 +19,7 @@ namespace webkit_media {
 
 class WebMediaSourceClientImpl : public WebKit::WebMediaSourceClient {
  public:
-  explicit WebMediaSourceClientImpl(
-      const scoped_refptr<media::ChunkDemuxer>& demuxer,
-      media::LogCB log_cb);
+  WebMediaSourceClientImpl(media::ChunkDemuxer* demuxer, media::LogCB log_cb);
   virtual ~WebMediaSourceClientImpl();
 
   // WebKit::WebMediaSourceClient implementation.
@@ -35,7 +32,7 @@ class WebMediaSourceClientImpl : public WebKit::WebMediaSourceClient {
   virtual void endOfStream(EndOfStreamStatus status) OVERRIDE;
 
  private:
-  scoped_refptr<media::ChunkDemuxer> demuxer_;
+  media::ChunkDemuxer* demuxer_;  // Owned by WebMediaPlayerImpl::pipeline_.

[scherkus (not reviewing), 2013/04/17 17:21:59]

is there a UAF bug here if pipeline hits an error?

[acolwell GONE FROM CHROMIUM, 2013/04/17 20:24:53]

Yes.

   media::LogCB log_cb_;
 
   DISALLOW_COPY_AND_ASSIGN(WebMediaSourceClientImpl);