vaapidecode: Don't crash if a buffer outlives the decoder

Sometimes, for example, when switching video streams but keeping
the same sink, the surface will be released after the decoder is
stopped and replaced. This caused a crash because the release
callback was called on an invalid pointer.
The patch adding an additional reference to the decoder object in the buffer.

https://bugzilla.gnome.org/show_bug.cgi?id=745189

Signed-off-by: Olivier Crete <olivier.crete@collabora.com>
Signed-off-by: Sreerenj Balachandran <sreerenj.balachandran@intel.com>

diff --git a/gst/vaapi/gstvaapidecode.c b/gst/vaapi/gstvaapidecode.c
index 4416077..a773428 100644 (file)
--- a/gst/vaapi/gstvaapidecode.c
+++ b/gst/vaapi/gstvaapidecode.c
@@ -253,6 +253,7 @@ gst_vaapidecode_release (GstVaapiDecode * decode)
   g_mutex_lock (&decode->surface_ready_mutex);
   g_cond_signal (&decode->surface_ready);
   g_mutex_unlock (&decode->surface_ready_mutex);
+  gst_object_unref (decode);
 }
 
 static GstFlowReturn
@@ -272,7 +273,7 @@ gst_vaapidecode_push_decoded_frame (GstVideoDecoder * vdec,
     proxy = gst_video_codec_frame_get_user_data (out_frame);
 
     gst_vaapi_surface_proxy_set_destroy_notify (proxy,
-        (GDestroyNotify) gst_vaapidecode_release, decode);
+        (GDestroyNotify) gst_vaapidecode_release, gst_object_ref (decode));
 
 #if GST_CHECK_VERSION(1,0,0)
     ret = gst_video_decoder_allocate_output_frame (vdec, out_frame);
@@ -645,7 +646,7 @@ gst_vaapidecode_destroy (GstVaapiDecode * decode)
 
   decode->active = FALSE;
 
-  gst_vaapidecode_release (decode);
+  gst_vaapidecode_release (gst_object_ref (decode));
 }
 
 static gboolean