Fix a crash that MediaPlayerAndroid weak_ptr is incorrectly used across thread

media/base/android/media_player_listener.h

Index: media/base/android/media_player_listener.h
diff --git a/media/base/android/media_player_listener.h b/media/base/android/media_player_listener.h
index 018a5d618fde11441e4c77044caf6dd50331a58b..513a400f463ef0f5129ffe5a3d63ef9aab99274e 100644
--- a/media/base/android/media_player_listener.h
+++ b/media/base/android/media_player_listener.h
@@ -19,6 +19,32 @@ namespace media {
 
 class MediaPlayerAndroid;
 
+// Helper class for posting MediaPlayerAndroid tasks on the UI thread.
+class MediaPlayerListenerProxy
+    : public base::RefCountedThreadSafe<MediaPlayerListenerProxy> {
+ public:
+  MediaPlayerListenerProxy(
+      const scoped_refptr<base::SingleThreadTaskRunner>& task_runner,
+      base::WeakPtr<MediaPlayerAndroid> media_player);
+  void OnMediaError(int error_type);
+  void OnVideoSizeChanged(int width, int height);
+  void OnBufferingUpdate(int percent);
+  void OnPlaybackComplete();
+  void OnSeekComplete();
+  void OnMediaPrepared();
+  void OnMediaInterrupted();
+
+ private:
+  friend class base::RefCountedThreadSafe<MediaPlayerListenerProxy>;
+  ~MediaPlayerListenerProxy();
+
+  // The message loop where |media_player_| lives.
+  scoped_refptr<base::SingleThreadTaskRunner> task_runner_;
+
+  // The MediaPlayerAndroid object all the callbacks should be sent to.
+  base::WeakPtr<MediaPlayerAndroid> media_player_;
+};
+
 // Acts as a thread proxy between java MediaPlayerListener object and
 // MediaPlayerAndroid so that callbacks are posted onto the UI thread.
 class MediaPlayerListener {
@@ -29,7 +55,7 @@ class MediaPlayerListener {
   MediaPlayerListener(
       const scoped_refptr<base::SingleThreadTaskRunner>& task_runner,
       base::WeakPtr<MediaPlayerAndroid> media_player);
- virtual ~MediaPlayerListener();
+  virtual ~MediaPlayerListener();
 
   // Called by the Java MediaPlayerListener and mirrored to corresponding
   // callbacks.
@@ -52,11 +78,8 @@ class MediaPlayerListener {
   static bool RegisterMediaPlayerListener(JNIEnv* env);
 
  private:
-  // The message loop where |media_player_| lives.
-  scoped_refptr<base::SingleThreadTaskRunner> task_runner_;
-
-  // The MediaPlayerAndroid object all the callbacks should be sent to.
-  base::WeakPtr<MediaPlayerAndroid> media_player_;
+  // Proxy for posting tasks to the UI thread.
+  scoped_refptr<MediaPlayerListenerProxy> proxy_;
 
   base::android::ScopedJavaGlobalRef<jobject> j_media_player_listener_;