Fix PepperVideoDecoderHost to avoid crash when swithing to SW decoder.

content/renderer/pepper/pepper_video_decoder_host.cc

 // Copyright (c) 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/renderer/pepper/pepper_video_decoder_host.h"
 
 #include <stddef.h>
 
 #include "base/bind.h"
 #include "base/memory/shared_memory.h"
@@ skipping 246 matching lines @@
 }
 
 int32_t PepperVideoDecoderHost::OnHostMsgAssignTextures(
     ppapi::host::HostMessageContext* context,
     const PP_Size& size,
     const std::vector<uint32_t>& texture_ids) {
   if (!initialized_)
     return PP_ERROR_FAILED;
   DCHECK(decoder_);
 
+  pending_texture_requests_--;
+  DCHECK_GE(pending_texture_requests_, 0);
+
+  // If |assign_textures_messages_to_dismiss_| is not 0 then decrement it and
+  // dismiss the textures. This is necessary to ensure that after SW decoder
+  // fallback the textures that were requested by the failed HW decoder are not
+  // passed to the SW decoder.
+  if (assign_textures_messages_to_dismiss_ > 0) {
+    assign_textures_messages_to_dismiss_--;
+    PictureBufferMap pictures_pending_dismission;
+    for (auto& texture_id : texture_ids) {
+      host()->SendUnsolicitedReply(
+          pp_resource(),
+          PpapiPluginMsg_VideoDecoder_DismissPicture(texture_id));
+    }
+    picture_buffer_map_.swap(pictures_pending_dismission);
+    return PP_OK;
+  }
+
   // Verify that the new texture IDs are unique and store them in
   // |new_textures|.
   PictureBufferMap new_textures;
   for (uint32_t i = 0; i < texture_ids.size(); i++) {
     if (picture_buffer_map_.find(texture_ids[i]) != picture_buffer_map_.end() ||
         new_textures.find(texture_ids[i]) != new_textures.end()) {
       // Can't assign the same texture more than once.
       return PP_ERROR_BADARGUMENT;
     }
     new_textures.insert(
@@ skipping 181 matching lines @@
   DCHECK(it != pending_decodes_.end());
   uint32_t shm_id = it->shm_id;
   return static_cast<uint8_t*>(shm_buffers_[shm_id]->memory());
 }
 
 void PepperVideoDecoderHost::RequestTextures(
     uint32_t requested_num_of_buffers,
     const gfx::Size& dimensions,
     uint32_t texture_target,
     const std::vector<gpu::Mailbox>& mailboxes) {
+  pending_texture_requests_++;
   host()->SendUnsolicitedReply(
       pp_resource(),
       PpapiPluginMsg_VideoDecoder_RequestTextures(
           requested_num_of_buffers,
           PP_MakeSize(dimensions.width(), dimensions.height()),
           texture_target,
           mailboxes));
 }
 
 bool PepperVideoDecoderHost::TryFallbackToSoftwareDecoder() {
@@ skipping 20 matching lines @@
       host()->SendUnsolicitedReply(
           pp_resource(),
           PpapiPluginMsg_VideoDecoder_DismissPicture(picture.first));
     } else {
       pictures_pending_dismission.insert(
           std::make_pair(picture.first, PictureBufferState::DISMISSED));
     }
   }
   picture_buffer_map_.swap(pictures_pending_dismission);
 
+  // Dismiss all outstanding texture requests.
+  DCHECK_EQ(assign_textures_messages_to_dismiss_, 0);
+  assign_textures_messages_to_dismiss_ = pending_texture_requests_;
+
   // If there was a pending Reset() it can be finished now.
   if (reset_reply_context_.is_valid()) {
     while (!pending_decodes_.empty()) {
       const PendingDecode& decode = pending_decodes_.front();
       host()->SendReply(decode.reply_context,
                         PpapiPluginMsg_VideoDecoder_DecodeReply(decode.shm_id));
       DCHECK(shm_buffer_busy_[decode.shm_id]);
       shm_buffer_busy_[decode.shm_id] = false;
       pending_decodes_.pop_front();
     }
@@ skipping 17 matching lines @@
 
 PepperVideoDecoderHost::PendingDecodeList::iterator
 PepperVideoDecoderHost::GetPendingDecodeById(int32_t decode_id) {
   return std::find_if(pending_decodes_.begin(), pending_decodes_.end(),
                       [decode_id](const PendingDecode& item) {
                         return item.decode_id == decode_id;
                       });
 }
 
 }  // namespace content