Fixes use-after-free in MojoDemuxerStreamImpl.

media/mojo/clients/mojo_renderer_impl.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "media/mojo/clients/mojo_renderer_impl.h"
 
 #include <utility>
 
 #include "base/bind.h"
 #include "base/callback_helpers.h"
@@ skipping 45 matching lines @@
   init_cb_ = init_cb;
 
   // Create audio and video mojom::DemuxerStream and bind its lifetime to
   // the pipe.
   DemuxerStream* const audio =
       demuxer_stream_provider_->GetStream(DemuxerStream::AUDIO);
   DemuxerStream* const video =
       demuxer_stream_provider_->GetStream(DemuxerStream::VIDEO);
 
   mojom::DemuxerStreamPtr audio_stream;
-  if (audio)
-    new MojoDemuxerStreamImpl(audio, GetProxy(&audio_stream));
+  if (audio) {
+    audio_stream_.reset(
+        new MojoDemuxerStreamImpl(audio, GetProxy(&audio_stream)));
+    // Using base::Unretained(this) is safe because |this| owns
+    // |audio_stream_|, and the error handler can't be invoked once
+    // |audio_stream_| is destroyed.
+    audio_stream_->set_connection_error_handler(
+        base::Bind(&MojoRendererImpl::OnDemuxerStreamConnectionError,
+                   base::Unretained(this), DemuxerStream::AUDIO));
+  }
 
   mojom::DemuxerStreamPtr video_stream;
-  if (video)
-    new MojoDemuxerStreamImpl(video, GetProxy(&video_stream));
+  if (video) {
+    video_stream_.reset(
+        new MojoDemuxerStreamImpl(video, GetProxy(&video_stream)));
+    // Using base::Unretained(this) is safe because |this| owns
+    // |video_stream_|, and the error handler can't be invoked once
+    // |video_stream_| is destroyed.
+    video_stream_->set_connection_error_handler(
+        base::Bind(&MojoRendererImpl::OnDemuxerStreamConnectionError,
+                   base::Unretained(this), DemuxerStream::VIDEO));
+  }
 
   BindRemoteRendererIfNeeded();
 
   // Using base::Unretained(this) is safe because |this| owns
   // |remote_renderer_|, and the callback won't be dispatched if
   // |remote_renderer_| is destroyed.
   remote_renderer_->Initialize(binding_.CreateInterfacePtrAndBind(),
                                std::move(audio_stream), std::move(video_stream),
                                base::Bind(&MojoRendererImpl::OnInitialized,
                                           base::Unretained(this), client));
@@ skipping 146 matching lines @@
   DVLOG(1) << __FUNCTION__;
   DCHECK(task_runner_->BelongsToCurrentThread());
 
   encountered_error_ = true;
   CancelPendingCallbacks();
 
   if (client_)
     client_->OnError(PIPELINE_ERROR_DECODE);
 }
 
+void MojoRendererImpl::OnDemuxerStreamConnectionError(
+    DemuxerStream::Type type) {
+  DVLOG(1) << __FUNCTION__ << ": " << type;
+  DCHECK(task_runner_->BelongsToCurrentThread());
+
+  if (type == DemuxerStream::AUDIO) {
+    audio_stream_.reset();
+  } else if (type == DemuxerStream::VIDEO) {
+    video_stream_.reset();
+  } else {
+    NOTREACHED() << "Unexpected demuxer stream type: " << type;
+  }
+}
+
 void MojoRendererImpl::BindRemoteRendererIfNeeded() {
   DVLOG(2) << __FUNCTION__;
   DCHECK(task_runner_->BelongsToCurrentThread());
 
   // If |remote_renderer_| has already been bound, do nothing.
   // Note that after Bind() is called, |remote_renderer_| is always bound even
   // after connection error.
   if (remote_renderer_.is_bound())
     return;
 
@@ skipping 47 matching lines @@
     base::ResetAndReturn(&init_cb_).Run(PIPELINE_ERROR_INITIALIZATION_FAILED);
 
   if (!flush_cb_.is_null())
     base::ResetAndReturn(&flush_cb_).Run();
 
   if (!cdm_attached_cb_.is_null())
     base::ResetAndReturn(&cdm_attached_cb_).Run(false);
 }
 
 }  // namespace media