Fix media::VideoFrame double deletion

MaybePrepareAnotherOutput() takes unprepared_outputs_.front() reference to
scoped_refptr<VideoFrame>. Then
GpuMemoryBufferVideoFramePool::PoolImpl::CreateHardwareFrame() is called which
calls frame_ready_cb (DecoderStream<StreamType>::OnPreparedOutputReady) in turn
(after fix
https://chromium-review.googlesource.com/c/chromium/src/+/1180543/6/media/video/gpu_memory_buffer_video_frame_pool.cc).

DecoderStream<StreamType>::OnPreparedOutputReady does
unprepared_outputs_.pop_front() and we have dangling reference to
scoped_refptr<VideoFrame>. Then we use that reference and get double deletion
of VideoFrame.

Bug: 859477,939238
Change-Id: Iff99fdfe67cad77682629b72b187ac81b9bf4f72
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1506750
Commit-Queue: Dale Curtis <dalecurtis@chromium.org>
Reviewed-by: John Rummell <jrummell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#641401}
1 file changed