Fix various MediaSource related crashes on Android.

webkit/media/android/media_source_delegate.h

Index: webkit/media/android/media_source_delegate.h
diff --git a/webkit/media/android/media_source_delegate.h b/webkit/media/android/media_source_delegate.h
index b0639250f59cb3923390f6d6c908e8857ee681f1..0ceeaec20f7562c9deb7c1c33dc8f053cf59ea2f 100644
--- a/webkit/media/android/media_source_delegate.h
+++ b/webkit/media/android/media_source_delegate.h
@@ -39,13 +39,20 @@ class MediaSourceDelegate : public media::DemuxerHost {
   typedef base::Callback<void(WebKit::WebMediaPlayer::NetworkState)>
       UpdateNetworkStateCB;
 
+  // Helper class used by scoped_ptr to destroy an instance of
+  // MediaSourceDelegate.
+  class Destroyer {
+   public:
+    inline void operator()(void* media_source_delegate) const {
+      static_cast<MediaSourceDelegate*>(media_source_delegate)->Destroy();
+    }
+  };
+
   MediaSourceDelegate(WebKit::WebFrame* frame,
                       WebKit::WebMediaPlayerClient* client,
                       WebMediaPlayerProxyAndroid* proxy,
                       int player_id,
                       media::MediaLog* media_log);
-  virtual ~MediaSourceDelegate();
-
   // Initialize the MediaSourceDelegate. |media_source| will be owned by
   // this object after this call.
   void Initialize(WebKit::WebMediaSource* media_source,
@@ -79,6 +86,14 @@ class MediaSourceDelegate : public media::DemuxerHost {
   void OnReadFromDemuxer(media::DemuxerStream::Type type, bool seek_done);
 
  private:
+  friend MediaSourceDelegate::Destroyer;
+
+  // This is private to enforce use of the Destroyer.
+  virtual ~MediaSourceDelegate();
+
+  // Called by the Destroyer to destroy an instance of this object.
+  void Destroy();
+
   // Methods inherited from DemuxerHost.
   virtual void SetTotalBytes(int64 total_bytes) OVERRIDE;
   virtual void AddBufferedByteRange(int64 start, int64 end) OVERRIDE;
@@ -89,6 +104,7 @@ class MediaSourceDelegate : public media::DemuxerHost {
 
   // Callbacks for ChunkDemuxer & Decryptor.
   void OnDemuxerInitDone(media::PipelineStatus status);
+  void OnDemuxerStopDone();
   void OnDemuxerOpened();
   void OnKeyAdded(const std::string& key_system, const std::string& session_id);
   void OnKeyError(const std::string& key_system,
@@ -123,7 +139,7 @@ class MediaSourceDelegate : public media::DemuxerHost {
 
   base::WeakPtrFactory<MediaSourceDelegate> weak_this_;
 
-  WebKit::WebMediaPlayerClient* const client_;
+  WebKit::WebMediaPlayerClient* client_;
   WebMediaPlayerProxyAndroid* proxy_;
   int player_id_;
 
@@ -159,4 +175,3 @@ class MediaSourceDelegate : public media::DemuxerHost {
 
 }  // namespace webkit_media
 #endif  // WEBKIT_MEDIA_ANDROID_MEDIA_SOURCE_DELEGATE_H_
-