Fix re-entrancy bug in SimpleDataSource::Abort() introduced in r118338.

webkit/media/simple_data_source.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "webkit/media/simple_data_source.h"
 
 #include "base/bind.h"
 #include "base/message_loop.h"
 #include "base/process_util.h"
 #include "media/base/media_log.h"
@@ skipping 252 matching lines @@
 bool SimpleDataSource::HasSingleOrigin() {
   DCHECK(MessageLoop::current() == render_loop_);
   return single_origin_;
 }
 
 void SimpleDataSource::Abort() {
   DCHECK(MessageLoop::current() == render_loop_);
   base::AutoLock auto_lock(lock_);
   state_ = STOPPED;
   initialize_cb_.Reset();
-  CancelTask();
+  CancelTask_Locked();
   frame_ = NULL;
 }
 
 void SimpleDataSource::CancelTask() {
   DCHECK(MessageLoop::current() == render_loop_);
   base::AutoLock auto_lock(lock_);
+  CancelTask_Locked();
+}
+
+void SimpleDataSource::CancelTask_Locked() {
+  DCHECK(MessageLoop::current() == render_loop_);
+  lock_.AssertAcquired();
   DCHECK_EQ(state_, STOPPED);
 
   // Cancel any pending requests.
   if (url_loader_.get()) {
     url_loader_->cancel();
     url_loader_.reset();
   }
 }
 
 void SimpleDataSource::DoneInitialization_Locked(bool success) {
@@ skipping 14 matching lines @@
 }
 
 void SimpleDataSource::UpdateHostState() {
   if (host()) {
     host()->SetTotalBytes(size_);
     host()->SetBufferedBytes(size_);
   }
 }
 
 }  // namespace webkit_media