CRD Webapp intermittently crashes on some machines

remoting/client/plugin/pepper_video_renderer_3d.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "remoting/client/plugin/pepper_video_renderer_3d.h"
 
 #include <math.h>
 
 #include <algorithm>
 #include <utility>
@@ skipping 315 matching lines @@
   pending_frames_.front()->OnDecoded();
   // Move the frame from |pending_frames_| to |decoded_frames_|.
   decoded_frames_.splice(decoded_frames_.end(), pending_frames_,
                          pending_frames_.begin());
 
   DecodeNextPacket();
   GetNextPicture();
 }
 
 void PepperVideoRenderer3D::GetNextPicture() {
-  if (get_picture_pending_)
+  // Return early if |decoded_frames_| is empty or the decoder is already
+  // preparing a picture.  If we call GetPicture() before a new frame has been
+  // prepared (i.e. |decoded_frames_| is populated), the OnPictureReady callback
+  // could be called before OnDecodeDone() is called which will cause a crash.
+  // See crbug.com/689229 for more details.
+  if (get_picture_pending_ || decoded_frames_.empty()) {
     return;
+  }
 
   int32_t result =
       video_decoder_.GetPicture(callback_factory_.NewCallbackWithOutput(
           &PepperVideoRenderer3D::OnPictureReady));
   CHECK_EQ(result, PP_OK_COMPLETIONPENDING);
   get_picture_pending_ = true;
 }
 
 void PepperVideoRenderer3D::OnPictureReady(int32_t result,
                                            PP_VideoPicture picture) {
@@ skipping 225 matching lines @@
   gles2_if_->AttachShader(graphics_.pp_resource(), shader_program_, shader);
   gles2_if_->DeleteShader(graphics_.pp_resource(), shader);
 }
 
 void PepperVideoRenderer3D::CheckGLError() {
   GLenum error = gles2_if_->GetError(graphics_.pp_resource());
   CHECK_EQ(error, static_cast<GLenum>(GL_NO_ERROR)) << "GL error: " << error;
 }
 
 }  // namespace remoting