Fixes use-after-free in MojoDemuxerStreamImpl.

media/mojo/clients/mojo_demuxer_stream_impl.h

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef MEDIA_MOJO_CLIENTS_MOJO_DEMUXER_STREAM_IMPL_H_
 #define MEDIA_MOJO_CLIENTS_MOJO_DEMUXER_STREAM_IMPL_H_
 
 #include "base/macros.h"
 #include "base/memory/weak_ptr.h"
 #include "media/base/demuxer_stream.h"
 #include "media/mojo/interfaces/demuxer_stream.mojom.h"
-#include "mojo/public/cpp/bindings/strong_binding.h"
+#include "mojo/public/cpp/bindings/binding.h"
 
 namespace media {
 class DemuxerStream;
 
 // This class wraps a media::DemuxerStream and exposes it as a
 // mojom::DemuxerStream for use as a proxy from remote applications.
 class MojoDemuxerStreamImpl : public mojom::DemuxerStream {
  public:
   // |stream| is the underlying DemuxerStream we are proxying for.
   // Note: |this| does not take ownership of |stream|.
   MojoDemuxerStreamImpl(media::DemuxerStream* stream,
                         mojo::InterfaceRequest<mojom::DemuxerStream> request);
   ~MojoDemuxerStreamImpl() override;
 
   // mojom::DemuxerStream implementation.
   // InitializeCallback and ReadCallback are defined in
   // mojom::DemuxerStream.
   void Initialize(const InitializeCallback& callback) override;
   void Read(const ReadCallback& callback) override;
   void EnableBitstreamConverter() override;
 
+  // Sets an error handler that will be called if a connection error occurs on
+  // the bound message pipe.
+  void set_connection_error_handler(const mojo::Closure& error_handler) {
+    binding_.set_connection_error_handler(error_handler);
+  }
+
  private:
   void OnBufferReady(const ReadCallback& callback,
                      media::DemuxerStream::Status status,
                      const scoped_refptr<media::DecoderBuffer>& buffer);
 
-  mojo::StrongBinding<mojom::DemuxerStream> binding_;
+  mojo::Binding<mojom::DemuxerStream> binding_;

[Ken Rockot(use gerrit already), 2016/06/19 14:45:22]

Some tests now leak a MojoDemxuerStreamImpl:
https://cs.chromium.org/chromium/src/media/mojo/services/media_mojo_unittest....

[alokp, 2016/06/20 16:44:48]

Memory leak fix here: https://codereview.chromium.org/2087473002/

Out of curiosity, how did you discover the memory leak? Did it trigger any
memory bot failure? I do not see any failure on the bots.

 
   // See constructor.  We do not own |stream_|.
   media::DemuxerStream* stream_;
 
   // DataPipe for serializing the data section of DecoderBuffer into.
   mojo::ScopedDataPipeProducerHandle stream_pipe_;
 
   base::WeakPtrFactory<MojoDemuxerStreamImpl> weak_factory_;
   DISALLOW_COPY_AND_ASSIGN(MojoDemuxerStreamImpl);
 };
 
 }  // namespace media
 
 #endif  // MEDIA_MOJO_CLIENTS_MOJO_DEMUXER_STREAM_IMPL_H_