commit c4824890e4c0c8ebaac12dcba6f62e7870219a2f
author Wan-Teh Chang <wtc@google.com> Tue Nov 20 17:22:41 2018 -0800
committer Wan-Teh Chang <wtc@google.com> Mon Dec 03 12:10:41 2018 -0800
tree 4031fec517380fe4a72530d2bf40deb88f94912d
parent 45f416ce33bcd0d3bcb726eb3a26f939cfc1a238

Clear dangling frame buffer indexes.

Clear dangling frame buffer indexes in cm->next_ref_frame_map[] or
cm->new_fb_idx, after we have called decrease_ref_count() on a frame
buffer index or transferred the ownership of a frame buffer index to
another variable.

Also clear danging cm->cur_frame pointers.

Move the setting of cm->cur_frame->buf.corrupted from the error path of
frame_worker_hook() to the error paths of av1_receive_compressed_data().

BUG=aomedia:2266

Change-Id: Id1c9bb9563899d8c5cce0cc0ddee3aee8d5b666c

av1/av1_dx_iface.c

diff --git a/av1/av1_dx_iface.c b/av1/av1_dx_iface.c
index 60a8a5c..96fc077 100644
--- a/av1/av1_dx_iface.c
+++ b/av1/av1_dx_iface.c
@@ -357,7 +357,6 @@
 
   if (result != 0) {
     // Check decode result in serial decode.
-    frame_worker_data->pbi->common.cur_frame->buf.corrupted = 1;
     frame_worker_data->pbi->need_resync = 1;
   }
   return !result;

av1/decoder/decoder.c

diff --git a/av1/decoder/decoder.c b/av1/decoder/decoder.c
index 8ac836f..c7625b5 100644
--- a/av1/decoder/decoder.c
+++ b/av1/decoder/decoder.c
@@ -322,20 +322,24 @@
   BufferPool *const pool = cm->buffer_pool;
   RefCntBuffer *const frame_bufs = cm->buffer_pool->frame_bufs;
 
+  cm->cur_frame->buf.corrupted = 1;
   lock_buffer_pool(pool);
   // Release all the reference buffers in cm->next_ref_frame_map if the worker
   // thread is holding them.
   if (pbi->hold_ref_buf) {
     int ref_index;
     for (ref_index = 0; ref_index < REF_FRAMES; ++ref_index) {
-      const int new_idx = cm->next_ref_frame_map[ref_index];
-      decrease_ref_count(new_idx, frame_bufs, pool);
+      const int idx = cm->next_ref_frame_map[ref_index];
+      decrease_ref_count(idx, frame_bufs, pool);
     }
+    memset(&cm->next_ref_frame_map, -1, sizeof(cm->next_ref_frame_map));
     pbi->hold_ref_buf = 0;
   }
   // Release current frame.
   decrease_ref_count(cm->new_fb_idx, frame_bufs, pool);
   unlock_buffer_pool(pool);
+  cm->new_fb_idx = INVALID_IDX;
+  cm->cur_frame = NULL;
 }
 
 // If any buffer updating is signaled it should be done here.
@@ -368,6 +372,7 @@
         const int old_idx = cm->ref_frame_map[ref_index];
         decrease_ref_count(old_idx, frame_bufs, pool);
         cm->ref_frame_map[ref_index] = cm->next_ref_frame_map[ref_index];
+        cm->next_ref_frame_map[ref_index] = INVALID_IDX;
         ++ref_index;
       }
 
@@ -378,6 +383,7 @@
         const int old_idx = cm->ref_frame_map[ref_index];
         decrease_ref_count(old_idx, frame_bufs, pool);
         cm->ref_frame_map[ref_index] = cm->next_ref_frame_map[ref_index];
+        cm->next_ref_frame_map[ref_index] = INVALID_IDX;
       }
     }
 
@@ -388,8 +394,8 @@
         if (pbi->num_output_frames >= MAX_NUM_SPATIAL_LAYERS) {
           // We can't store the new frame anywhere, so drop it and return an
           // error
+          cm->cur_frame->buf.corrupted = 1;
           decrease_ref_count(cm->new_fb_idx, frame_bufs, pool);
-          cm->cur_frame = NULL;
           cm->error.error_code = AOM_CODEC_UNSUP_BITSTREAM;
         } else {
           pbi->output_frames[pbi->num_output_frames] = cur_frame;
@@ -408,7 +414,6 @@
       }
     } else {
       decrease_ref_count(cm->new_fb_idx, frame_bufs, pool);
-      cm->cur_frame = NULL;
     }
 
     unlock_buffer_pool(pool);
@@ -420,9 +425,10 @@
     // Nothing was decoded, so just drop this frame buffer
     lock_buffer_pool(pool);
     decrease_ref_count(cm->new_fb_idx, frame_bufs, pool);
-    cm->cur_frame = NULL;
     unlock_buffer_pool(pool);
   }
+  cm->new_fb_idx = INVALID_IDX;
+  cm->cur_frame = NULL;
 
   if (!pbi->camera_frame_header_ready) {
     pbi->hold_ref_buf = 0;

av1/encoder/encoder.c

diff --git a/av1/encoder/encoder.c b/av1/encoder/encoder.c
index f03de63..d74edac 100644
--- a/av1/encoder/encoder.c
+++ b/av1/encoder/encoder.c
@@ -6600,9 +6600,9 @@
     // previously held.
     if (cm->new_fb_idx != INVALID_IDX) {
       --pool->frame_bufs[cm->new_fb_idx].ref_count;
+      cm->cur_frame = NULL;
     }
 
-    cm->cur_frame = NULL;
     cm->new_fb_idx = get_free_fb(cm);
     if (cm->new_fb_idx == INVALID_IDX) return -1;
     cm->cur_frame = &pool->frame_bufs[cm->new_fb_idx];
@@ -6788,6 +6788,7 @@
   // held.
   if (cm->new_fb_idx != INVALID_IDX) {
     --pool->frame_bufs[cm->new_fb_idx].ref_count;
+    cm->cur_frame = NULL;
   }
   cm->new_fb_idx = get_free_fb(cm);