Fixing crash in buffer bar painting code

Crash was because of inconsistent state caused by threading issues.
The state of the buffer bar isn't so critical to need to be 100% accurate
at all times, so this is fixed by capping the buffered_bytes_ and
current_bytes to always be at legal values.

BUG=49870
TEST=media_unittests
TBR=hclam

Review URL: http://codereview.chromium.org/3045021

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@54055 0039d316-1c4b-4281-b951-d872f2087c98

1 files changed, 13 insertions, 0 deletions

diff --git a/media/base/pipeline_impl.cc b/media/base/pipeline_impl.cc
index ec0f791..e15492e 100644
--- a/media/base/pipeline_impl.cc
+++ b/media/base/pipeline_impl.cc
@@ -294,6 +294,15 @@ PipelineError PipelineImpl::GetError() const {
 
 void PipelineImpl::SetCurrentReadPosition(int64 offset) {
   AutoLock auto_lock(lock_);
+
+  // The current read position should never be ahead of the buffered byte
+  // position but threading issues between BufferedDataSource::DoneRead_Locked()
+  // and BufferedDataSource::NetworkEventCallback() can cause them to be
+  // temporarily out of sync. The easiest fix for this is to cap both
+  // buffered_bytes_ and current_bytes_ to always be legal values in
+  // SetCurrentReadPosition() and in SetBufferedBytes().
+  if (offset > buffered_bytes_)
+    buffered_bytes_ = offset;
   current_bytes_ = offset;
 }
 
@@ -449,6 +458,10 @@ void PipelineImpl::SetTotalBytes(int64 total_bytes) {
 void PipelineImpl::SetBufferedBytes(int64 buffered_bytes) {
   DCHECK(IsRunning());
   AutoLock auto_lock(lock_);
+
+  // See comments in SetCurrentReadPosition() about capping.
+  if (buffered_bytes < current_bytes_)
+    current_bytes_ = buffered_bytes;
   buffered_bytes_ = buffered_bytes;
 }