[media] Protect against |flush_cb_.is_null()| in VdaVideoDecoder.

Bug: 881212
Cq-Include-Trybots: luci.chromium.try:android_optional_gpu_tests_rel;luci.chromium.try:linux_optional_gpu_tests_rel;luci.chromium.try:mac_optional_gpu_tests_rel;luci.chromium.try:win_optional_gpu_tests_rel
Change-Id: I02462453e8f62286861c9e299d4c7a5dde612666
Reviewed-on: https://chromium-review.googlesource.com/1213877Reviewed-by: Thomas Guilbert <tguilbert@chromium.org>
Commit-Queue: Dan Sanders <sandersd@chromium.org>
Cr-Commit-Position: refs/heads/master@{#589721}

media/gpu/ipc/service/vda_video_decoder.cc

@@ -395,7 +395,8 @@ void VdaVideoDecoder::Reset(const base::RepeatingClosure& reset_cb) {
   DVLOG(2) << __func__;
   DCHECK(parent_task_runner_->BelongsToCurrentThread());
   DCHECK(init_cb_.is_null());
-  // Note: |flush_cb_| may not be null.
+  // Note: |flush_cb_| may be non-null. If so, the flush can be completed by
+  // NotifyResetDone().
   DCHECK(reset_cb_.is_null());
 
   if (has_error_) {
@@ -611,6 +612,10 @@ void VdaVideoDecoder::NotifyFlushDoneOnParentThread() {
   if (has_error_)
     return;
 
+  // Protect against incorrect calls from the VDA.
+  if (flush_cb_.is_null())
+    return;
+
   DCHECK(decode_cbs_.empty());
   base::ResetAndReturn(&flush_cb_).Run(DecodeStatus::OK);
 }