MSE - Fix crash caused by incorrect GC of GOP with next buffer position

media/filters/source_buffer_range.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "media/filters/source_buffer_range.h"
 
 #include <algorithm>
 
 #include "media/base/timestamp_constants.h"
 
@@ skipping 213 matching lines @@
 bool SourceBufferRange::TruncateAt(
     DecodeTimestamp timestamp, BufferQueue* removed_buffers,
     bool is_exclusive) {
   // Find the place in |buffers_| where we will begin deleting data.
   BufferQueue::iterator starting_point =
       GetBufferItrAt(timestamp, is_exclusive);
   return TruncateAt(starting_point, removed_buffers);
 }
 
 size_t SourceBufferRange::DeleteGOPFromFront(BufferQueue* deleted_buffers) {
-  DCHECK(!FirstGOPContainsNextBufferPosition());
+  CHECK(!buffers_.empty());
+  CHECK(!FirstGOPContainsNextBufferPosition());
+
   DCHECK(deleted_buffers);
 
   int buffers_deleted = 0;
   size_t total_bytes_deleted = 0;
 
   KeyframeMap::iterator front = keyframe_map_.begin();
   DCHECK(front != keyframe_map_.end());
 
   // Delete the keyframe at the start of |keyframe_map_|.
   keyframe_map_.erase(front);
@@ skipping 27 matching lines @@
 
   // Invalidate media segment start time if we've deleted the first buffer of
   // the range.
   if (buffers_deleted > 0)
     media_segment_start_time_ = kNoDecodeTimestamp();
 
   return total_bytes_deleted;
 }
 
 size_t SourceBufferRange::DeleteGOPFromBack(BufferQueue* deleted_buffers) {
-  DCHECK(!LastGOPContainsNextBufferPosition());
+  CHECK(!buffers_.empty());
+  CHECK(!LastGOPContainsNextBufferPosition());
+
   DCHECK(deleted_buffers);
 
   // Remove the last GOP's keyframe from the |keyframe_map_|.
   KeyframeMap::iterator back = keyframe_map_.end();
   DCHECK_GT(keyframe_map_.size(), 0u);
   --back;
 
   // The index of the first buffer in the last GOP is equal to the new size of
   // |buffers_| after that GOP is deleted.
   size_t goal_size = back->second - keyframe_map_index_base_;
@@ skipping 51 matching lines @@
   if (bytes_removed > 0) {
     *removal_end_timestamp = gop_itr == keyframe_map_.end() ?
         GetBufferedEndTimestamp() : gop_itr->first;
   }
   return bytes_removed;
 }
 
 bool SourceBufferRange::FirstGOPEarlierThanMediaTime(
     DecodeTimestamp media_time) const {
   if (keyframe_map_.size() == 1u)
     return (GetEndTimestamp() < media_time);

[wolenetz, 2016/02/13 00:51:06]

Alternatively, s/GetEndTimestamp()/GetBufferedEndTimestamp()/ here might
similarly fix the bug. I prefer, though, to explicitly check
!FirstGOPContainsNextBufferPosition() prior to calling DeleteGOPFromFront(),
since that more clearly protects against this problem.

[chcunningham, 2016/02/16 23:36:25]

Acknowledged.

 
   KeyframeMap::const_iterator second_gop = keyframe_map_.begin();
   ++second_gop;
   return second_gop->first <= media_time;
 }
 
 bool SourceBufferRange::FirstGOPContainsNextBufferPosition() const {
   if (!HasNextBufferPosition())
     return false;
 
@@ skipping 104 matching lines @@
   return next_buffer_index_ >= 0;
 }
 
 void SourceBufferRange::ResetNextBufferPosition() {
   next_buffer_index_ = -1;
 }
 
 void SourceBufferRange::AppendRangeToEnd(const SourceBufferRange& range,
                                          bool transfer_current_position) {
   DCHECK(CanAppendRangeToEnd(range));
-  DCHECK(!buffers_.empty());
+  CHECK(!buffers_.empty());
 
   if (transfer_current_position && range.next_buffer_index_ >= 0)
     next_buffer_index_ = range.next_buffer_index_ + buffers_.size();
 
   AppendBuffersToEnd(range.buffers_);
 }
 
 bool SourceBufferRange::CanAppendRangeToEnd(
     const SourceBufferRange& range) const {
   return CanAppendBuffersToEnd(range.buffers_);
 }
 
 bool SourceBufferRange::CanAppendBuffersToEnd(
     const BufferQueue& buffers) const {
-  DCHECK(!buffers_.empty());
+  CHECK(!buffers_.empty());
   return IsNextInSequence(buffers.front()->GetDecodeTimestamp(),
                           buffers.front()->is_key_frame());
 }
 
 bool SourceBufferRange::BelongsToRange(DecodeTimestamp timestamp) const {
-  DCHECK(!buffers_.empty());
+  CHECK(!buffers_.empty());
 
   return (IsNextInSequence(timestamp, false) ||
           (GetStartTimestamp() <= timestamp && timestamp <= GetEndTimestamp()));
 }
 
 bool SourceBufferRange::CanSeekTo(DecodeTimestamp timestamp) const {
   DecodeTimestamp start_timestamp =
       std::max(DecodeTimestamp(), GetStartTimestamp() - GetFudgeRoom());
   return !keyframe_map_.empty() && start_timestamp <= timestamp &&
       timestamp < GetBufferedEndTimestamp();
 }
 
 bool SourceBufferRange::CompletelyOverlaps(
     const SourceBufferRange& range) const {
   return GetStartTimestamp() <= range.GetStartTimestamp() &&
       GetEndTimestamp() >= range.GetEndTimestamp();
 }
 
 bool SourceBufferRange::EndOverlaps(const SourceBufferRange& range) const {
   return range.GetStartTimestamp() <= GetEndTimestamp() &&
       GetEndTimestamp() < range.GetEndTimestamp();
 }
 
 DecodeTimestamp SourceBufferRange::GetStartTimestamp() const {
-  DCHECK(!buffers_.empty());
+  CHECK(!buffers_.empty());
   DecodeTimestamp start_timestamp = media_segment_start_time_;
   if (start_timestamp == kNoDecodeTimestamp())
     start_timestamp = buffers_.front()->GetDecodeTimestamp();
   return start_timestamp;
 }
 
 DecodeTimestamp SourceBufferRange::GetEndTimestamp() const {
-  DCHECK(!buffers_.empty());
+  CHECK(!buffers_.empty());
   return buffers_.back()->GetDecodeTimestamp();
 }
 
 DecodeTimestamp SourceBufferRange::GetBufferedEndTimestamp() const {
-  DCHECK(!buffers_.empty());
+  CHECK(!buffers_.empty());
   base::TimeDelta duration = buffers_.back()->duration();
   if (duration == kNoTimestamp() || duration == base::TimeDelta())
     duration = GetApproximateDuration();
   return GetEndTimestamp() + duration;
 }
 
 DecodeTimestamp SourceBufferRange::NextKeyframeTimestamp(
     DecodeTimestamp timestamp) {
   DCHECK(!keyframe_map_.empty());
 
@@ skipping 77 matching lines @@
     }
 
     if (buffer->timestamp() + buffer->duration() <= start.ToPresentationTime())
       continue;
     buffers->push_back(buffer);
   }
   return previous_size < buffers->size();
 }
 
 }  // namespace media