1 files changed, 28 insertions, 12 deletions

diff --git a/media/base/pipeline.cc b/media/base/pipeline.cc
index cdc0aa6..8cda84b 100644
--- a/media/base/pipeline.cc
+++ b/media/base/pipeline.cc
@@ -523,6 +523,12 @@ void Pipeline::StateTransitionTask(PipelineStatus status) {
   }
 }
 
+// Note that the usage of base::Unretained() with the audio/video renderers
+// in the following DoXXX() functions is considered safe as they are owned by
+// |pending_callbacks_| and share the same lifetime.
+//
+// That being said, deleting the renderers while keeping |pending_callbacks_|
+// running on the media thread would result in crashes.
 void Pipeline::DoInitialPreroll(const PipelineStatusCB& done_cb) {
   DCHECK(message_loop_->BelongsToCurrentThread());
   DCHECK(!pending_callbacks_.get());
@@ -533,7 +539,8 @@ void Pipeline::DoInitialPreroll(const PipelineStatusCB& done_cb) {
   // Preroll renderers.
   if (audio_renderer_) {
     bound_fns.Push(base::Bind(
-        &AudioRenderer::Preroll, audio_renderer_, seek_timestamp));
+        &AudioRenderer::Preroll, base::Unretained(audio_renderer_.get()),
+        seek_timestamp));
   }
 
   if (video_renderer_) {
@@ -553,16 +560,20 @@ void Pipeline::DoSeek(
   SerialRunner::Queue bound_fns;
 
   // Pause.
-  if (audio_renderer_)
-    bound_fns.Push(base::Bind(&AudioRenderer::Pause, audio_renderer_));
+  if (audio_renderer_) {
+    bound_fns.Push(base::Bind(
+        &AudioRenderer::Pause, base::Unretained(audio_renderer_.get())));
+  }
   if (video_renderer_) {
     bound_fns.Push(base::Bind(
         &VideoRenderer::Pause, base::Unretained(video_renderer_.get())));
   }
 
   // Flush.
-  if (audio_renderer_)
-    bound_fns.Push(base::Bind(&AudioRenderer::Flush, audio_renderer_));
+  if (audio_renderer_) {
+    bound_fns.Push(base::Bind(
+        &AudioRenderer::Flush, base::Unretained(audio_renderer_.get())));
+  }
   if (video_renderer_) {
     bound_fns.Push(base::Bind(
         &VideoRenderer::Flush, base::Unretained(video_renderer_.get())));
@@ -575,7 +586,8 @@ void Pipeline::DoSeek(
   // Preroll renderers.
   if (audio_renderer_) {
     bound_fns.Push(base::Bind(
-        &AudioRenderer::Preroll, audio_renderer_, seek_timestamp));
+        &AudioRenderer::Preroll, base::Unretained(audio_renderer_.get()),
+        seek_timestamp));
   }
 
   if (video_renderer_) {
@@ -595,8 +607,10 @@ void Pipeline::DoPlay(const PipelineStatusCB& done_cb) {
   PlaybackRateChangedTask(GetPlaybackRate());
   VolumeChangedTask(GetVolume());
 
-  if (audio_renderer_)
-    bound_fns.Push(base::Bind(&AudioRenderer::Play, audio_renderer_));
+  if (audio_renderer_) {
+    bound_fns.Push(base::Bind(
+        &AudioRenderer::Play, base::Unretained(audio_renderer_.get())));
+  }
 
   if (video_renderer_) {
     bound_fns.Push(base::Bind(
@@ -614,8 +628,10 @@ void Pipeline::DoStop(const PipelineStatusCB& done_cb) {
   if (demuxer_)
     bound_fns.Push(base::Bind(&Demuxer::Stop, demuxer_));
 
-  if (audio_renderer_)
-    bound_fns.Push(base::Bind(&AudioRenderer::Stop, audio_renderer_));
+  if (audio_renderer_) {
+    bound_fns.Push(base::Bind(
+        &AudioRenderer::Stop, base::Unretained(audio_renderer_.get())));
+  }
 
   if (video_renderer_) {
     bound_fns.Push(base::Bind(
@@ -636,7 +652,7 @@ void Pipeline::OnStopCompleted(PipelineStatus status) {
   SetState(kStopped);
   pending_callbacks_.reset();
   filter_collection_.reset();
-  audio_renderer_ = NULL;
+  audio_renderer_.reset();
   video_renderer_.reset();
   demuxer_ = NULL;
 
@@ -894,7 +910,7 @@ void Pipeline::InitializeAudioRenderer(const PipelineStatusCB& done_cb) {
       demuxer_->GetStream(DemuxerStream::AUDIO);
   DCHECK(stream);
 
-  filter_collection_->SelectAudioRenderer(&audio_renderer_);
+  audio_renderer_ = filter_collection_->GetAudioRenderer();
   audio_renderer_->Initialize(
       stream,
       *filter_collection_->GetAudioDecoders(),