Fix various MediaSource related crashes on Android.

webkit/media/android/media_source_delegate.cc

Index: webkit/media/android/media_source_delegate.cc
diff --git a/webkit/media/android/media_source_delegate.cc b/webkit/media/android/media_source_delegate.cc
index f9dd41890869e3670f015e0224091a63f14a41d2..ecc72d87dfbfedee6b69041d3210d3630f7bd6cf 100644
--- a/webkit/media/android/media_source_delegate.cc
+++ b/webkit/media/android/media_source_delegate.cc
@@ -88,7 +88,26 @@ MediaSourceDelegate::MediaSourceDelegate(
   }
 }
 
-MediaSourceDelegate::~MediaSourceDelegate() {}
+MediaSourceDelegate::~MediaSourceDelegate() {
+  DVLOG(1) << "MediaSourceDelegate::~MediaSourceDelegate() : " << player_id_;
+  DCHECK(!chunk_demuxer_);
+}
+
+void MediaSourceDelegate::Destroy() {
+  DVLOG(1) << "MediaSourceDelegate::Destroy() : " << player_id_;
+  if (!chunk_demuxer_) {
+    delete this;
+    return;
+  }
+
+  update_network_state_cb_.Reset();
+  media_source_.reset();
+  client_ = NULL;
+  proxy_ = NULL;
+
+  chunk_demuxer_->Stop(

[qinmin, 2013/05/22 18:51:24]

Could there be any chance that message loop is gone first in fast shutdown case?
should we do sth in WillDestroyCurrentMessageLoop() in either WMPA or this
class?

[acolwell GONE FROM CHROMIUM, 2013/05/22 19:12:09]

Done. I added a media_source_delegate_.reset() to WMPA::Detach() since that
appears to be where all the other pointers are cleared.

+      BIND_TO_RENDER_LOOP(&MediaSourceDelegate::OnDemuxerStopDone));
+}
 
 void MediaSourceDelegate::Initialize(
     WebKit::WebMediaSource* media_source,
@@ -197,6 +216,8 @@ WebMediaPlayer::MediaKeyException MediaSourceDelegate::CancelKeyRequest(
 }
 
 void MediaSourceDelegate::Seek(base::TimeDelta time) {
+  DVLOG(1) << "MediaSourceDelegate::Seek(" << time.InSecondsF() << ") : "
+           << player_id_;
   seeking_ = true;
   DCHECK(chunk_demuxer_);
   if (!chunk_demuxer_)
@@ -225,6 +246,8 @@ void MediaSourceDelegate::SetDuration(base::TimeDelta duration) {
 
 void MediaSourceDelegate::OnReadFromDemuxer(media::DemuxerStream::Type type,
                                             bool seek_done) {
+  DVLOG(1) << "MediaSourceDelegate::OnReadFromDemuxer(" << type
+           << ", " << seek_done << ") : " << player_id_;
   if (seeking_ && !seek_done)
       return;  // Drop the request during seeking.
   seeking_ = false;
@@ -253,6 +276,7 @@ void MediaSourceDelegate::OnBufferReady(
     size_t index,
     DemuxerStream::Status status,
     const scoped_refptr<media::DecoderBuffer>& buffer) {
+  DVLOG(1) << "MediaSourceDelegate::OnBufferReady() : " << player_id_;
   DCHECK(status == DemuxerStream::kAborted ||
          index < params->access_units.size());
   bool is_audio = stream->type() == DemuxerStream::AUDIO;
@@ -340,6 +364,8 @@ void MediaSourceDelegate::OnBufferReady(
 
 void MediaSourceDelegate::OnDemuxerError(
     media::PipelineStatus status) {
+  DVLOG(1) << "MediaSourceDelegate::OnDemuxerError(" << status << ") : "
+           << player_id_;
   if (status != media::PIPELINE_OK) {
     DCHECK(status == media::DEMUXER_ERROR_COULD_NOT_OPEN ||
            status == media::DEMUXER_ERROR_COULD_NOT_PARSE ||
@@ -352,6 +378,8 @@ void MediaSourceDelegate::OnDemuxerError(
 
 void MediaSourceDelegate::OnDemuxerInitDone(
     media::PipelineStatus status) {
+  DVLOG(1) << "MediaSourceDelegate::OnDemuxerInitDone(" << status << ") : "
+           << player_id_;
   if (status != media::PIPELINE_OK) {
     OnDemuxerError(status);
     return;
@@ -359,6 +387,12 @@ void MediaSourceDelegate::OnDemuxerInitDone(
   NotifyDemuxerReady("");
 }
 
+void MediaSourceDelegate::OnDemuxerStopDone() {
+  DVLOG(1) << "MediaSourceDelegate::OnDemuxerStopDone() : " << player_id_;
+  chunk_demuxer_.reset();
+  delete this;
+}
+
 void MediaSourceDelegate::NotifyDemuxerReady(const std::string& key_system) {
   MediaPlayerHostMsg_DemuxerReady_Params params;
   DemuxerStream* audio_stream = chunk_demuxer_->GetStream(DemuxerStream::AUDIO);
@@ -397,6 +431,9 @@ void MediaSourceDelegate::NotifyDemuxerReady(const std::string& key_system) {
 }
 
 void MediaSourceDelegate::OnDemuxerOpened() {
+  if (!media_source_)
+    return;
+
   media_source_->open(new WebMediaSourceClientImpl(
       chunk_demuxer_.get(), base::Bind(&LogMediaSourceError, media_log_)));
 }
@@ -405,6 +442,9 @@ void MediaSourceDelegate::OnKeyError(const std::string& key_system,
                                      const std::string& session_id,
                                      media::Decryptor::KeyError error_code,
                                      int system_code) {
+  if (!client_)
+    return;
+
   client_->keyError(
       WebString::fromUTF8(key_system),
       WebString::fromUTF8(session_id),
@@ -420,6 +460,9 @@ void MediaSourceDelegate::OnKeyMessage(const std::string& key_system,
   DLOG_IF(WARNING, !default_url.empty() && !default_url_gurl.is_valid())
       << "Invalid URL in default_url: " << default_url;
 
+  if (!client_)
+    return;
+
   client_->keyMessage(WebString::fromUTF8(key_system),
                       WebString::fromUTF8(session_id),
                       reinterpret_cast<const uint8*>(message.data()),
@@ -429,7 +472,11 @@ void MediaSourceDelegate::OnKeyMessage(const std::string& key_system,
 
 void MediaSourceDelegate::OnKeyAdded(const std::string& key_system,
                                      const std::string& session_id) {
+  if (!client_)
+    return;
+
   NotifyDemuxerReady(key_system);
+
   client_->keyAdded(WebString::fromUTF8(key_system),
                     WebString::fromUTF8(session_id));
 }
@@ -440,7 +487,7 @@ void MediaSourceDelegate::OnNeedKey(const std::string& key_system,
                                     scoped_ptr<uint8[]> init_data,
                                     int init_data_size) {
   // Do not fire NeedKey event if encrypted media is not enabled.
-  if (!decryptor_)
+  if (!client_ || !decryptor_)
     return;
 
   CHECK(init_data_size >= 0);