Fixes use-after-free in MojoDemuxerStreamImpl.

media/mojo/clients/mojo_renderer_impl.cc

Index: media/mojo/clients/mojo_renderer_impl.cc
diff --git a/media/mojo/clients/mojo_renderer_impl.cc b/media/mojo/clients/mojo_renderer_impl.cc
index f407b89c57c7a98bcfa6b465b0911ad4d7631049..4baa2966685ed250a07df26191d476681d2922ec 100644
--- a/media/mojo/clients/mojo_renderer_impl.cc
+++ b/media/mojo/clients/mojo_renderer_impl.cc
@@ -56,12 +56,22 @@ void MojoRendererImpl::Initialize(
       demuxer_stream_provider_->GetStream(DemuxerStream::VIDEO);
 
   mojom::DemuxerStreamPtr audio_stream;
-  if (audio)
-    new MojoDemuxerStreamImpl(audio, GetProxy(&audio_stream));
+  if (audio) {
+    audio_stream_.reset(
+        new MojoDemuxerStreamImpl(audio, GetProxy(&audio_stream)));
+    audio_stream_->set_connection_error_handler(
+        base::Bind(&MojoRendererImpl::OnDemuxerStreamConnectionError,
+                   base::Unretained(this), DemuxerStream::AUDIO));

[xhwang, 2016/06/18 16:46:16]

please add a comment about why Unretained() is safe.

[alokp, 2016/06/19 04:57:45]

Done.

+  }
 
   mojom::DemuxerStreamPtr video_stream;
-  if (video)
-    new MojoDemuxerStreamImpl(video, GetProxy(&video_stream));
+  if (video) {
+    video_stream_.reset(
+        new MojoDemuxerStreamImpl(video, GetProxy(&video_stream)));
+    video_stream_->set_connection_error_handler(
+        base::Bind(&MojoRendererImpl::OnDemuxerStreamConnectionError,
+                   base::Unretained(this), DemuxerStream::VIDEO));
+  }
 
   BindRemoteRendererIfNeeded();
 
@@ -202,6 +212,19 @@ void MojoRendererImpl::OnConnectionError() {
   client_->OnError(PIPELINE_ERROR_DECODE);
 }
 
+void MojoRendererImpl::OnDemuxerStreamConnectionError(
+    DemuxerStream::Type type) {
+  DVLOG(1) << __FUNCTION__ << ": " << type;
+  DCHECK(task_runner_->BelongsToCurrentThread());
+
+  if (type == DemuxerStream::AUDIO) {
+    audio_stream_.reset();
+  } else {
+    DCHECK(type == DemuxerStream::VIDEO);
+    video_stream_.reset();
+  }

[xhwang, 2016/06/18 16:46:16]

Just to be safe, 

} else if (type == VIDEO) {
  ...
} else {
  NOTREACHED() << "wrong type..";
}

[alokp, 2016/06/19 04:57:45]

Done.

+}
+
 void MojoRendererImpl::BindRemoteRendererIfNeeded() {
   DVLOG(2) << __FUNCTION__;
   DCHECK(task_runner_->BelongsToCurrentThread());