[0.6.272] fix crash when player destroy during prepare_async

- The removed element is accessed in the
  __mmplayer_release_signal_connection() function

Change-Id: Ie2137a08a5d00b56ee039a7e2638aa626a81218c

diff --git a/packaging/libmm-player.spec b/packaging/libmm-player.spec
index 5a1b4e2..1ec98a9 100644 (file)
--- a/packaging/libmm-player.spec
+++ b/packaging/libmm-player.spec
@@ -1,6 +1,6 @@
 Name:       libmm-player
 Summary:    Multimedia Framework Player Library
-Version:    0.6.271
+Version:    0.6.272
 Release:    0
 Group:      Multimedia/Libraries
 License:    Apache-2.0

diff --git a/src/mm_player_gst.c b/src/mm_player_gst.c
index e509314..6abf729 100644 (file)
--- a/src/mm_player_gst.c
+++ b/src/mm_player_gst.c
@@ -3204,11 +3204,46 @@ __mmplayer_gst_deep_element_added(GstElement *bin, GstBin *child, GstElement *el
        return;
 }
 
+static void
+__mmplayer_delete_signal_connection(mmplayer_t *player, GstElement *removed_element)
+{
+       MMPLAYER_FENTER();
+
+       MMPLAYER_RETURN_IF_FAIL(player);
+       MMPLAYER_RETURN_IF_FAIL(removed_element);
+
+       LOGD("delete signal on %s", GST_ELEMENT_NAME(removed_element));
+
+       for (int type = MM_PLAYER_SIGNAL_TYPE_AUTOPLUG; type < MM_PLAYER_SIGNAL_TYPE_ALL; type++) {
+               GList *node = player->signals[type];
+               while (node) {
+                       GList *next_node = node->next;
+                       mmplayer_signal_item_t *item = node->data;
+                       if (item && item->obj == G_OBJECT(removed_element)) {
+                               player->signals[type] = g_list_delete_link(player->signals[type], node);
+                               MMPLAYER_FREEIF(item);
+                       }
+                       node = next_node;
+               }
+       }
+
+       MMPLAYER_FLEAVE();
+}
+
 void
 __mmplayer_gst_deep_element_removed(GstElement *bin, GstBin *child, GstElement *element, gpointer data)
 {
+       mmplayer_t *player = (mmplayer_t *)data;
+
+       MMPLAYER_FENTER();
+
+       MMPLAYER_RETURN_IF_FAIL(player);
+
        LOGD("%s > %s > %s", GST_ELEMENT_NAME(bin), GST_ELEMENT_NAME(child), GST_ELEMENT_NAME(element));
-       return;
+
+       __mmplayer_delete_signal_connection(player, element);
+
+       MMPLAYER_FLEAVE();
 }
 
 static GstElement *