From: Gilbok Lee <gilbok.lee@samsung.com>
Date: Fri, 28 Oct 2022 04:45:54 +0000 (+0900)
Subject: [0.6.270] fix crash when player destroy during prepare_async
X-Git-Tag: submit/tizen_6.5/20221122.073613^0
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=refs%2Fheads%2Ftizen_6.5;p=platform%2Fcore%2Fmultimedia%2Flibmm-player.git

[0.6.270] fix crash when player destroy during prepare_async

- The removed element is accessed in the
  __mmplayer_release_signal_connection() function

cherry-pick : fd6c5d52629a4edd19d4a0aa0ec697873ede148d

Change-Id: I7d5753e9cba48002fa05f5c4627376fbe9554aeb
---

diff --git a/packaging/libmm-player.spec b/packaging/libmm-player.spec
index 4a07c42..778e5a6 100644
--- a/packaging/libmm-player.spec
+++ b/packaging/libmm-player.spec
@@ -1,6 +1,6 @@
 Name:       libmm-player
 Summary:    Multimedia Framework Player Library
-Version:    0.6.269
+Version:    0.6.270
 Release:    0
 Group:      Multimedia/Libraries
 License:    Apache-2.0
diff --git a/src/mm_player_gst.c b/src/mm_player_gst.c
index e509314..6abf729 100644
--- a/src/mm_player_gst.c
+++ b/src/mm_player_gst.c
@@ -3204,11 +3204,46 @@ __mmplayer_gst_deep_element_added(GstElement *bin, GstBin *child, GstElement *el
 	return;
 }
 
+static void
+__mmplayer_delete_signal_connection(mmplayer_t *player, GstElement *removed_element)
+{
+	MMPLAYER_FENTER();
+
+	MMPLAYER_RETURN_IF_FAIL(player);
+	MMPLAYER_RETURN_IF_FAIL(removed_element);
+
+	LOGD("delete signal on %s", GST_ELEMENT_NAME(removed_element));
+
+	for (int type = MM_PLAYER_SIGNAL_TYPE_AUTOPLUG; type < MM_PLAYER_SIGNAL_TYPE_ALL; type++) {
+		GList *node = player->signals[type];
+		while (node) {
+			GList *next_node = node->next;
+			mmplayer_signal_item_t *item = node->data;
+			if (item && item->obj == G_OBJECT(removed_element)) {
+				player->signals[type] = g_list_delete_link(player->signals[type], node);
+				MMPLAYER_FREEIF(item);
+			}
+			node = next_node;
+		}
+	}
+
+	MMPLAYER_FLEAVE();
+}
+
 void
 __mmplayer_gst_deep_element_removed(GstElement *bin, GstBin *child, GstElement *element, gpointer data)
 {
+	mmplayer_t *player = (mmplayer_t *)data;
+
+	MMPLAYER_FENTER();
+
+	MMPLAYER_RETURN_IF_FAIL(player);
+
 	LOGD("%s > %s > %s", GST_ELEMENT_NAME(bin), GST_ELEMENT_NAME(child), GST_ELEMENT_NAME(element));
-	return;
+
+	__mmplayer_delete_signal_connection(player, element);
+
+	MMPLAYER_FLEAVE();
 }
 
 static GstElement *