media: Disallow CDM reset in mojo media services

In general, after playback starts, we do NOT support removing or
resetting the CDM if one is already set. There's no use case for this
at least for now and foreseeable future, and this change would help
simplify some logic.

Bug: 1066893
Change-Id: I53ad2445fab79d78b34e76d252c9c069c3e8950d
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2133173Reviewed-by: John Rummell <jrummell@chromium.org>
Reviewed-by: Łukasz Anforowicz <lukasza@chromium.org>
Commit-Queue: Xiaohan Wang <xhwang@chromium.org>
Cr-Commit-Position: refs/heads/master@{#756091}

media/mojo/services/mojo_audio_decoder_service.cc

@@ -9,7 +9,6 @@
 #include "base/bind.h"
 #include "base/bind_helpers.h"
 #include "base/logging.h"
-#include "media/base/cdm_context.h"
 #include "media/base/content_decryption_module.h"
 #include "media/mojo/common/media_type_converters.h"
 #include "media/mojo/common/mojo_decoder_buffer_converter.h"
@@ -39,19 +38,27 @@ void MojoAudioDecoderService::Initialize(const AudioDecoderConfig& config,
                                          InitializeCallback callback) {
   DVLOG(1) << __func__ << " " << config.AsHumanReadableString();
 
-  // Get CdmContext from |cdm_id|, which could be null.
-  CdmContext* cdm_context = nullptr;
+  // |cdm_context_ref_| must be kept as long as |cdm_context| is used by the
+  // |decoder_|. We do NOT support resetting |cdm_context_ref_| because in
+  // general we don't support resetting CDM in the media pipeline.
   if (cdm_id != CdmContext::kInvalidCdmId) {
-    auto cdm_context_ref = mojo_cdm_service_context_->GetCdmContextRef(cdm_id);
-    if (cdm_context_ref) {
-      // |cdm_context_ref_| must be kept as long as |cdm_context| is used by the
-      // |decoder_|.
-      cdm_context_ref_ = std::move(cdm_context_ref);
-      cdm_context = cdm_context_ref_->GetCdmContext();
-      DCHECK(cdm_context);
+    if (cdm_id_ == CdmContext::kInvalidCdmId) {
+      DCHECK(!cdm_context_ref_);
+      cdm_id_ = cdm_id;
+      cdm_context_ref_ = mojo_cdm_service_context_->GetCdmContextRef(cdm_id);
+    } else if (cdm_id != cdm_id_) {
+      // TODO(xhwang): Replace with mojo::ReportBadMessage().
+      NOTREACHED() << "The caller should not switch CDM";
+      OnInitialized(std::move(callback),
+                    StatusCode::kDecoderMissingCdmForEncryptedContent);
+      return;
     }
   }
 
+  // Get CdmContext, which could be null.
+  CdmContext* cdm_context =
+      cdm_context_ref_ ? cdm_context_ref_->GetCdmContext() : nullptr;
+
   if (config.is_encrypted() && !cdm_context) {
     DVLOG(1) << "CdmContext for " << cdm_id << " not found for encrypted audio";
     OnInitialized(std::move(callback),
@@ -97,7 +104,6 @@ void MojoAudioDecoderService::OnInitialized(InitializeCallback callback,
   DVLOG(1) << __func__ << " success:" << status.is_ok();
 
   if (!status.is_ok()) {
-    cdm_context_ref_.reset();
     // Do not call decoder_->NeedsBitstreamConversion() if init failed.
     std::move(callback).Run(std::move(status), false);
     return;

media/mojo/services/mojo_audio_decoder_service.h

@@ -12,6 +12,7 @@
 #include "base/macros.h"
 #include "base/memory/weak_ptr.h"
 #include "media/base/audio_decoder.h"
+#include "media/base/cdm_context.h"
 #include "media/mojo/mojom/audio_decoder.mojom.h"
 #include "media/mojo/services/media_mojo_export.h"
 #include "mojo/public/cpp/bindings/associated_remote.h"
@@ -74,8 +75,9 @@ class MEDIA_MOJO_EXPORT MojoAudioDecoderService : public mojom::AudioDecoder {
   // The destination for the decoded buffers.
   mojo::AssociatedRemote<mojom::AudioDecoderClient> client_;
 
-  // Holds the CdmContextRef to keep the CdmContext alive for the lifetime of
-  // the |decoder_|.
+  // The CDM ID and the corresponding CdmContextRef, which must be held to keep
+  // the CdmContext alive for the lifetime of the |decoder_|.
+  int cdm_id_ = CdmContext::kInvalidCdmId;
   std::unique_ptr<CdmContextRef> cdm_context_ref_;
 
   // The AudioDecoder that does actual decoding work.

media/mojo/services/mojo_renderer_service.cc

@@ -124,6 +124,12 @@ void MojoRendererService::SetVolume(float volume) {
 }
 
 void MojoRendererService::SetCdm(int32_t cdm_id, SetCdmCallback callback) {
+  if (cdm_context_ref_) {
+    DVLOG(1) << "Switching CDM not supported";
+    std::move(callback).Run(false);
+    return;
+  }
+
   if (!mojo_cdm_service_context_) {
     DVLOG(1) << "CDM service context not available.";
     std::move(callback).Run(false);

media/mojo/services/mojo_video_decoder_service.cc

@@ -13,7 +13,6 @@
 #include "base/metrics/histogram_macros.h"
 #include "base/optional.h"
 #include "base/threading/thread_task_runner_handle.h"
-#include "media/base/cdm_context.h"
 #include "media/base/decoder_buffer.h"
 #include "media/base/simple_sync_token_client.h"
 #include "media/base/video_decoder.h"
@@ -182,19 +181,26 @@ void MojoVideoDecoderService::Initialize(const VideoDecoderConfig& config,
     return;
   }
 
-  // Get CdmContext from |cdm_id|, which could be null.
-  CdmContext* cdm_context = nullptr;
+  // |cdm_context_ref_| must be kept as long as |cdm_context| is used by the
+  // |decoder_|. We do NOT support resetting |cdm_context_ref_| because in
+  // general we don't support resetting CDM in the media pipeline.
   if (cdm_id != CdmContext::kInvalidCdmId) {
-    auto cdm_context_ref = mojo_cdm_service_context_->GetCdmContextRef(cdm_id);
-    if (cdm_context_ref) {
-      // |cdm_context_ref_| must be kept as long as |cdm_context| is used by the
-      // |decoder_|.
-      cdm_context_ref_ = std::move(cdm_context_ref);
-      cdm_context = cdm_context_ref_->GetCdmContext();
-      DCHECK(cdm_context);
+    if (cdm_id_ == CdmContext::kInvalidCdmId) {
+      DCHECK(!cdm_context_ref_);
+      cdm_id_ = cdm_id;
+      cdm_context_ref_ = mojo_cdm_service_context_->GetCdmContextRef(cdm_id);
+    } else if (cdm_id != cdm_id_) {
+      // TODO(xhwang): Replace with mojo::ReportBadMessage().
+      NOTREACHED() << "The caller should not switch CDM";
+      OnDecoderInitialized(StatusCode::kDecoderMissingCdmForEncryptedContent);
+      return;
     }
   }
 
+  // Get CdmContext, which could be null.
+  CdmContext* cdm_context =
+      cdm_context_ref_ ? cdm_context_ref_->GetCdmContext() : nullptr;
+
   if (config.is_encrypted() && !cdm_context) {
     DVLOG(1) << "CdmContext for " << cdm_id << " not found for encrypted video";
     OnDecoderInitialized(StatusCode::kDecoderMissingCdmForEncryptedContent);
@@ -267,9 +273,6 @@ void MojoVideoDecoderService::OnDecoderInitialized(Status status) {
   TRACE_EVENT_ASYNC_END1("media", kInitializeTraceName, this, "success",
                          status.code());
 
-  if (!status.is_ok())
-    cdm_context_ref_.reset();
-
   std::move(init_cb_).Run(
       status, status.is_ok() ? decoder_->NeedsBitstreamConversion() : false,
       status.is_ok() ? decoder_->GetMaxDecodeRequests() : 1);

media/mojo/services/mojo_video_decoder_service.h

@@ -12,6 +12,7 @@
 #include "base/memory/scoped_refptr.h"
 #include "base/memory/weak_ptr.h"
 #include "base/unguessable_token.h"
+#include "media/base/cdm_context.h"
 #include "media/base/decode_status.h"
 #include "media/base/overlay_info.h"
 #include "media/base/video_decoder.h"
@@ -110,8 +111,9 @@ class MEDIA_MOJO_EXPORT MojoVideoDecoderService final
   // Helper for reading DecoderBuffer data from the DataPipe.
   std::unique_ptr<MojoDecoderBufferReader> mojo_decoder_buffer_reader_;
 
-  // Holds the CdmContextRef to keep the CdmContext alive for the lifetime of
-  // the |decoder_|.
+  // The CDM ID and the corresponding CdmContextRef, which must be held to keep
+  // the CdmContext alive for the lifetime of the |decoder_|.
+  int cdm_id_ = CdmContext::kInvalidCdmId;
   std::unique_ptr<CdmContextRef> cdm_context_ref_;
 
   std::unique_ptr<media::VideoDecoder> decoder_;