GitLab

There is a chance that the Demuxer calls host_->OnDemuxerError() right
before Stop() is called. The Pipeline always posts a ErrorChangedTask() for
OnDemuxerError() with base::Retained(this).

After the Demuxer fires the stop callback, the Pipeline could be destroyed
immediately. So If the media thread hasn't been destroyed we could end up with
running ErrorChangedTask() on null pipeline which causes a crash.

This CL uses a weak pointer for DemuxerHost calls so that no task will run
after the pipeline is destroyed.

BUG=397656, 399417, 365141
TEST=Updated unit tests to cover this case.
R=scherkus@chromium.org

Review URL: https://codereview.chromium.org/423073012

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@287687 0039d316-1c4b-4281-b951-d872f2087c98