[M108 Migration][MM] Fix crash when the browser is terminated when playing video.

1. MediaPlayerESPlusPlayer should be released before destroyed.
2. WebContents is sometimes destroyed before TizenRendererImpl is destroyed.
   It causes TizenRendererImpl accesses dangling pointer.
3. buffering_callback_ in BufferObserverImpl should be null-checked.

Reference:
https://review.tizen.org/gerrit/276393/

Change-Id: I772c80ce9a0f96c5cdc6db6c31aff3465a54eb88
Signed-off-by: Suhaspoornachandra <s.poornachan@samsung.com>

diff --git a/tizen_src/chromium_impl/content/browser/media/tizen_renderer_impl.cc b/tizen_src/chromium_impl/content/browser/media/tizen_renderer_impl.cc
index f45686c..7999ed4 100644 (file)
--- a/tizen_src/chromium_impl/content/browser/media/tizen_renderer_impl.cc
+++ b/tizen_src/chromium_impl/content/browser/media/tizen_renderer_impl.cc
@@ -473,6 +473,10 @@ void TizenRendererImpl::OnEnabledAudioTracksChanged(
   NOTIMPLEMENTED();
 }
 
+void TizenRendererImpl::OnWebContentsDestroyed() {
+  web_contents_observer_ = nullptr;
+}
+
 void TizenRendererImpl::OnRendererEnded() {
   playback_rate_ = 0.0;
   client_->OnEnded();

diff --git a/tizen_src/chromium_impl/content/browser/media/tizen_renderer_impl.h b/tizen_src/chromium_impl/content/browser/media/tizen_renderer_impl.h
index 3e03aae..d526c43 100644 (file)
--- a/tizen_src/chromium_impl/content/browser/media/tizen_renderer_impl.h
+++ b/tizen_src/chromium_impl/content/browser/media/tizen_renderer_impl.h
@@ -81,7 +81,7 @@ class CONTENT_EXPORT TizenRendererImpl
   void InitiateScopedSurfaceRequest(
       InitiateScopedSurfaceRequestCallback callback) override;
   void OnUpdateAudioMutingState(bool muted) {}
-  void OnWebContentsDestroyed() {}
+  void OnWebContentsDestroyed();
 
   // Should be removed.
   void Seek(base::TimeDelta time);

diff --git a/tizen_src/chromium_impl/media/filters/esplusplayer_buffer_observer_impl.cc b/tizen_src/chromium_impl/media/filters/esplusplayer_buffer_observer_impl.cc
index added68..b6852a5 100644 (file)
--- a/tizen_src/chromium_impl/media/filters/esplusplayer_buffer_observer_impl.cc
+++ b/tizen_src/chromium_impl/media/filters/esplusplayer_buffer_observer_impl.cc
@@ -151,7 +151,8 @@ void BufferObserverImpl::CallbackIfNeed(DemuxerStream::Type type,
 void BufferObserverImpl::TriggerStatusChangeCallback(
     DemuxerStream::Type type,
     BufferStatus status) const {
-  buffering_callback_.Run(type, status);
+  if (!buffering_callback_.is_null())
+    buffering_callback_.Run(type, status);
 }
 
 BufferStatus BufferObserverImpl::GetBufferStatusFromSize(int buffered_percent) {

diff --git a/tizen_src/chromium_impl/media/filters/media_player_esplusplayer.cc b/tizen_src/chromium_impl/media/filters/media_player_esplusplayer.cc
index a1b03fd..1f94e87 100644 (file)
--- a/tizen_src/chromium_impl/media/filters/media_player_esplusplayer.cc
+++ b/tizen_src/chromium_impl/media/filters/media_player_esplusplayer.cc
@@ -133,6 +133,9 @@ MediaPlayerESPlusPlayer::~MediaPlayerESPlusPlayer() {
 
   MediaPlayerRegistry::GetInstance()->UnregisterMediaPlayer(player_id_);
 
+  // Player should be released before destroyed.
+  Release();
+
   int error = esplusplayer_destroy(esplayer_);
   if (error != ESPLUSPLAYER_ERROR_TYPE_NONE)
     LOG(ERROR) << "esplusplayer_destroy failed, error #"