media/gpu/v4l2vd: release reference to frames upon DRC

When a dynamic resolution change occurs and a new picture is imported
under the same ID as a previously existing one, we need to release the
reference to the old frame in picture_at_client_, otherwise the
reference counter will never to back to 0 and the picture will never be
released.

BUG=b:161759267
BUG=b:165035340
BUG=b:172881995
TEST=DRC with Youtube Android app on Trogdor now takes place smoothly.
TEST=CTS H264 AdaptivePlaybackTests now pass.

Change-Id: I82350fbc9355d22365b7f6432243b3ecb39a22b3
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2540206
Commit-Queue: Alexandre Courbot <acourbot@chromium.org>
Reviewed-by: Chih-Yu Huang <akahuang@chromium.org>
Auto-Submit: Alexandre Courbot <acourbot@chromium.org>
Cr-Commit-Position: refs/heads/master@{#828136}

media/gpu/chromeos/vd_video_decode_accelerator.cc

@@ -291,6 +291,12 @@ void VdVideoDecodeAccelerator::RequestFrames(
   notify_layout_changed_cb_ = std::move(notify_layout_changed_cb);
   import_frame_cb_ = std::move(import_frame_cb);
 
+  // Stop tracking currently-allocated pictures, otherwise the count will be
+  // corrupted as we import new frames with the same IDs as the old ones.
+  // The client should still have its own reference to the frame data, which
+  // will keep it valid for as long as it needs it.
+  picture_at_client_.clear();
+
   // After calling ProvidePictureBuffersWithVisibleRect(), the client might
   // still send buffers with old coded size. We temporarily store at
   // |pending_coded_size_|.
@@ -375,6 +381,14 @@ void VdVideoDecodeAccelerator::ImportBufferForPicture(
       base::BindOnce(&VdVideoDecodeAccelerator::OnFrameReleasedThunk,
                      weak_this_, client_task_runner_, std::move(origin_frame)));
 
+  // This should not happen - picture_at_client_ should either be initially
+  // empty, or be cleared as RequestFrames() is called. However for extra safety
+  // let's make sure the slot for the picture buffer ID is free, otherwise we
+  // might lose track of the reference count and keep frames out of the pool
+  // forever.
+  DCHECK(picture_at_client_.find(picture_buffer_id) ==
+         picture_at_client_.end());
+
   DCHECK(import_frame_cb_);
   import_frame_cb_.Run(std::move(wrapped_frame));
 }