media: Fix a GpuVideoDecoder initialization crash on Android

media/filters/gpu_video_decoder.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "media/filters/gpu_video_decoder.h"
 
 #include <algorithm>
 #include <array>
 #include <utility>
 
@@ skipping 103 matching lines @@
 
 GpuVideoDecoder::BufferData::~BufferData() {}
 
 GpuVideoDecoder::GpuVideoDecoder(GpuVideoAcceleratorFactories* factories,
                                  const RequestSurfaceCB& request_surface_cb,
                                  scoped_refptr<MediaLog> media_log)
     : needs_bitstream_conversion_(false),
       factories_(factories),
       request_surface_cb_(request_surface_cb),
       media_log_(media_log),
+      vda_initialized_(false),
       state_(kNormal),
       decoder_texture_target_(0),
       pixel_format_(PIXEL_FORMAT_UNKNOWN),
       next_picture_buffer_id_(0),
       next_bitstream_buffer_id_(0),
       available_pictures_(0),
       needs_all_picture_buffers_to_decode_(false),
       supports_deferred_initialization_(false),
       requires_texture_copy_(false),
       cdm_id_(CdmContext::kInvalidCdmId),
@@ skipping 186 matching lines @@
         requires_restart_for_external_output_surface,
         BindToCurrentLoop(base::Bind(&GpuVideoDecoder::OnSurfaceAvailable,
                                      weak_factory_.GetWeakPtr())));
     return;
   }
 
   // If external surfaces are not supported we can complete initialization now.
   CompleteInitialization(SurfaceManager::kNoSurfaceID);
 }
 
+// OnSurfaceAvailable() might be called at any time between Initialize() and
+// ~GpuVideoDecoder() so we have to be careful to not make assumptions about
+// the current state.
 void GpuVideoDecoder::OnSurfaceAvailable(int surface_id) {
   DCheckGpuVideoAcceleratorFactoriesTaskRunnerIsCurrent();
 
-  // It's possible for the vda to become null if NotifyError is called.
-  if (!vda_) {
-    if (!init_cb_.is_null())
-      base::ResetAndReturn(&init_cb_).Run(false);
+  if (!vda_)
+    return;
+
+  // If the VDA has not been initialized, we were waiting for the first surface
+  // so it can be passed to Initialize() via the config. We can't call
+  // SetSurface() before initializing because there is no remote VDA to handle
+  // the call yet.
+  if (!vda_initialized_) {
+    CompleteInitialization(surface_id);
     return;
   }
 
-  // If initialization has already completed, there's nothing to do but try to
-  // set the surface. If we're still initializing, we must pass the surface via
-  // the config since the remote VDA has not yet been created.
-  if (init_cb_.is_null()) {
-    vda_->SetSurface(surface_id);
-    return;
-  }
-
-  // Otherwise initialization was waiting for the surface, so complete it now.
-  CompleteInitialization(surface_id);
+  // The VDA must be already initialized (or async initialization is in
+  // progress) so we can call SetSurface().
+  vda_->SetSurface(surface_id);
 }
 
 void GpuVideoDecoder::CompleteInitialization(int surface_id) {
   DCheckGpuVideoAcceleratorFactoriesTaskRunnerIsCurrent();
   DCHECK(vda_);
   DCHECK(!init_cb_.is_null());
+  DCHECK(!vda_initialized_);
 
   VideoDecodeAccelerator::Config vda_config;
   vda_config.profile = config_.profile();
   vda_config.cdm_id = cdm_id_;
   vda_config.surface_id = surface_id;
   vda_config.encryption_scheme = config_.encryption_scheme();
   vda_config.is_deferred_initialization_allowed = true;
   vda_config.initial_expected_coded_size = config_.coded_size();
 
 #if defined(OS_ANDROID) && defined(USE_PROPRIETARY_CODECS)
   // We pass the SPS and PPS on Android because it lets us initialize
   // MediaCodec more reliably (http://crbug.com/649185).
   if (config_.codec() == kCodecH264)
     ExtractSpsAndPps(config_.extra_data(), &vda_config.sps, &vda_config.pps);
 #endif
 
+  vda_initialized_ = true;
   if (!vda_->Initialize(vda_config, this)) {
     DVLOG(1) << "VDA::Initialize failed.";
+    // It's important to set |vda_| to null so that OnSurfaceAvailable() will
+    // not call SetSurface() on a nonexistent remote VDA.
+    DestroyVDA();
     base::ResetAndReturn(&init_cb_).Run(false);
     return;
   }
 
   // If deferred initialization is not supported, initialization is complete.
   // Otherwise, a call to NotifyInitializationComplete will follow with the
   // result of deferred initialization.
   if (!supports_deferred_initialization_)
     base::ResetAndReturn(&init_cb_).Run(true);
 }
 
 void GpuVideoDecoder::NotifyInitializationComplete(bool success) {
   DVLOG_IF(1, !success) << __func__ << " Deferred initialization failed.";
-  DCHECK(!init_cb_.is_null());
 
-  base::ResetAndReturn(&init_cb_).Run(success);
+  if (init_cb_)
+    base::ResetAndReturn(&init_cb_).Run(success);
 }
 
 void GpuVideoDecoder::DestroyPictureBuffers(PictureBufferMap* buffers) {
   DCheckGpuVideoAcceleratorFactoriesTaskRunnerIsCurrent();
   for (const auto& kv : *buffers) {
     for (uint32_t id : kv.second.client_texture_ids())
       factories_->DeleteTexture(id);
   }
 
   buffers->clear();
@@ skipping 454 matching lines @@
 
   if (!pending_reset_cb_.is_null())
     base::ResetAndReturn(&pending_reset_cb_).Run();
 }
 
 void GpuVideoDecoder::NotifyError(media::VideoDecodeAccelerator::Error error) {
   DCheckGpuVideoAcceleratorFactoriesTaskRunnerIsCurrent();
   if (!vda_)
     return;
 
+  if (init_cb_)
+    base::ResetAndReturn(&init_cb_).Run(false);
+
   // If we have any bitstream buffers, then notify one that an error has
   // occurred.  This guarantees that somebody finds out about the error.  If
   // we don't do this, and if the max decodes are already in flight, then there
   // won't be another decode request to report the error.
   if (!bitstream_buffers_in_decoder_.empty()) {
     auto it = bitstream_buffers_in_decoder_.begin();
     it->second.done_cb.Run(DecodeStatus::DECODE_ERROR);
     bitstream_buffers_in_decoder_.erase(it);
   }
 
@@ skipping 27 matching lines @@
   }
   return false;
 }
 
 void GpuVideoDecoder::DCheckGpuVideoAcceleratorFactoriesTaskRunnerIsCurrent()
     const {
   DCHECK(factories_->GetTaskRunner()->BelongsToCurrentThread());
 }
 
 }  // namespace media