commit 7b12250d3f4e41b3230a039dceba03d838b2d7d3
author Wan-Teh Chang <wtc@google.com> Thu Oct 25 16:47:01 2018 -0700
committer Wan-Teh Chang <wtc@google.com> Fri Oct 26 16:21:22 2018 +0000
tree c462c572ffc3ca99041b601adb2d884cd44cd719
parent 4ff6917b938db07726354514958103824b2d3ce1

Let caller of release_fb_cb clear dangling pointer

Not all release_fb_cb implementations clear the |data| and |priv| fields
of aom_codec_frame_buffer_t before returning, so it is better to have
the callers of release_fb_cb clear the dangling pointers.

This CL also reverts the change to av1_release_frame_buffer() in
commit 2ab147d9bc797ddc2dba6d6ffd6495805c8a1dbc:
https://aomedia-review.googlesource.com/c/aom/+/72184

BUG=aomedia:2179

Change-Id: Iea1716487aecb0bf40d41c7f9a10953e292e7e76

av1/common/alloccommon.c

diff --git a/av1/common/alloccommon.c b/av1/common/alloccommon.c
index 1bf81c9..98d50db 100644
--- a/av1/common/alloccommon.c
+++ b/av1/common/alloccommon.c
@@ -92,6 +92,9 @@
     if (pool->frame_bufs[i].ref_count > 0 &&
         pool->frame_bufs[i].raw_frame_buffer.data != NULL) {
       pool->release_fb_cb(pool->cb_priv, &pool->frame_bufs[i].raw_frame_buffer);
+      pool->frame_bufs[i].raw_frame_buffer.data = NULL;
+      pool->frame_bufs[i].raw_frame_buffer.size = 0;
+      pool->frame_bufs[i].raw_frame_buffer.priv = NULL;
       pool->frame_bufs[i].ref_count = 0;
     }
     aom_free(pool->frame_bufs[i].mvs);

av1/common/frame_buffers.c

diff --git a/av1/common/frame_buffers.c b/av1/common/frame_buffers.c
index 9b19567..f10ccd5 100644
--- a/av1/common/frame_buffers.c
+++ b/av1/common/frame_buffers.c
@@ -94,8 +94,5 @@
   InternalFrameBuffer *const int_fb = (InternalFrameBuffer *)fb->priv;
   (void)cb_priv;
   if (int_fb) int_fb->in_use = 0;
-  fb->data = NULL;
-  fb->size = 0;
-  fb->priv = NULL;
   return 0;
 }

av1/decoder/decoder.h

diff --git a/av1/decoder/decoder.h b/av1/decoder/decoder.h
index 55506d6..afc1264 100644
--- a/av1/decoder/decoder.h
+++ b/av1/decoder/decoder.h
@@ -303,6 +303,9 @@
     if (frame_bufs[idx].ref_count == 0 &&
         frame_bufs[idx].raw_frame_buffer.priv) {
       pool->release_fb_cb(pool->cb_priv, &frame_bufs[idx].raw_frame_buffer);
+      frame_bufs[idx].raw_frame_buffer.data = NULL;
+      frame_bufs[idx].raw_frame_buffer.size = 0;
+      frame_bufs[idx].raw_frame_buffer.priv = NULL;
     }
   }
 }