media/gpu/V4L2VEA: Post task to encoder_thread_task_runner with WeakPtr of this

At V4L2VEA::Destroy(), encoder thread process all the pending tasks. If
PumpBitstreamBuffers() is in the pending tasks, Enqueue() is posted and
processed after DestroyTask(). That leads |input_queue_| and |output_queue_| are
nullptr and causes SIGSEGV.

This fixes the issue by posting tasks to encoder_thread_.task_runner() with
WeakPtr of this. This makes V4L2VEA not execute any tasks posted to the task
runner after DestroyTask() because the WeakPtr is invalidated in DestroyTask().

Bug: 1019437
Test: VEA unittest on guado with dcheck_always_on=true
Change-Id: Ie2e43d1dd9c74114cbd0d2b51e260213b60136e5
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1890462
Commit-Queue: Hirokazu Honda <hiroh@chromium.org>
Reviewed-by: Chih-Yu Huang <akahuang@chromium.org>
Cr-Commit-Position: refs/heads/master@{#711148}

media/gpu/v4l2/v4l2_video_encode_accelerator.h

@@ -347,10 +347,9 @@ class MEDIA_GPU_EXPORT V4L2VideoEncodeAccelerator
   base::WeakPtr<Client> client_;
   std::unique_ptr<base::WeakPtrFactory<Client>> client_ptr_factory_;
 
-  // WeakPtr<> pointing to |this| for use in posting tasks from the
-  // image_processor_ back to the child thread.
-  // Tasks posted onto encoder and poll threads can use base::Unretained(this),
-  // as both threads will not outlive this object.
+  // WeakPtr<> pointing to |this| for use in posting tasks to
+  // |encoder_thread_.task_runner()|. It guarantees no task will be executed
+  // after DestroyTask().
   base::WeakPtr<V4L2VideoEncodeAccelerator> weak_this_;
   base::WeakPtrFactory<V4L2VideoEncodeAccelerator> weak_this_ptr_factory_;