Fix crash when pipeline is stopped while video restart is pending

media/renderers/renderer_impl.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "media/renderers/renderer_impl.h"
 
 #include <utility>
 
 #include "base/bind.h"
 #include "base/callback.h"
@@ skipping 93 matching lines @@
   if (base::StringToInt(threshold_ms_str, &threshold_ms) && threshold_ms > 0) {
     video_underflow_threshold_ =
         base::TimeDelta::FromMilliseconds(threshold_ms);
   }
 }
 
 RendererImpl::~RendererImpl() {
   DVLOG(1) << __func__;
   DCHECK(task_runner_->BelongsToCurrentThread());
 
+  // RendererImpl is being destroyed, so invalidate weak pointers right away to
+  // avoid getting callbacks which might try to access fields that has been
+  // destroyed, e.g. audio_renderer_/video_renderer_ below (crbug.com/668963).
+  weak_factory_.InvalidateWeakPtrs();
+
   // Tear down in opposite order of construction as |video_renderer_| can still
   // need |time_source_| (which can be |audio_renderer_|) to be alive.
   video_renderer_.reset();
   audio_renderer_.reset();
 
   if (!init_cb_.is_null()) {
     FinishInitialization(PIPELINE_ERROR_ABORT);
   } else if (!flush_cb_.is_null()) {
     base::ResetAndReturn(&flush_cb_).Run();
   }
@@ skipping 521 matching lines @@
   // for some time to avoid unnecessary glitches in audio; see
   // http://crbug.com/144683#c53.
   if (audio_renderer_ && type == DemuxerStream::VIDEO &&
       state_ == STATE_PLAYING) {
     if (video_buffering_state_ == BUFFERING_HAVE_ENOUGH &&
         audio_buffering_state_ == BUFFERING_HAVE_ENOUGH &&
         new_buffering_state == BUFFERING_HAVE_NOTHING &&
         deferred_video_underflow_cb_.IsCancelled()) {
       DVLOG(4) << __func__ << " Deferring HAVE_NOTHING for video stream.";
       deferred_video_underflow_cb_.Reset(
-          base::Bind(&RendererImpl::OnBufferingStateChange,
-                     weak_factory_.GetWeakPtr(), type, new_buffering_state));
+          base::Bind(&RendererImpl::OnBufferingStateChange, weak_this_, type,
+                     new_buffering_state));
       task_runner_->PostDelayedTask(FROM_HERE,
                                     deferred_video_underflow_cb_.callback(),
                                     video_underflow_threshold_);
       return;
     }
 
     DVLOG(4) << "deferred_video_underflow_cb_.Cancel()";
     deferred_video_underflow_cb_.Cancel();
   } else if (!deferred_video_underflow_cb_.IsCancelled() &&
              type == DemuxerStream::AUDIO &&
@@ skipping 167 matching lines @@
   DCHECK(task_runner_->BelongsToCurrentThread());
   client_->OnVideoNaturalSizeChange(size);
 }
 
 void RendererImpl::OnVideoOpacityChange(bool opaque) {
   DCHECK(task_runner_->BelongsToCurrentThread());
   client_->OnVideoOpacityChange(opaque);
 }
 
 }  // namespace media