3 files changed, 18 insertions, 2 deletions
diff --git a/media/libstagefright/chromium_http/ChromiumHTTPDataSource.cpp b/media/libstagefright/chromium_http/ChromiumHTTPDataSource.cpp
index 76f7946..3f0b2c2 100644
--- a/media/libstagefright/chromium_http/ChromiumHTTPDataSource.cpp
+++ b/media/libstagefright/chromium_http/ChromiumHTTPDataSource.cpp
@@ -100,7 +100,7 @@ status_t ChromiumHTTPDataSource::connect_l(
 
     mDelegate->initiateConnection(mURI.c_str(), &mHeaders, offset);
 
-    while (mState == CONNECTING) {
+    while (mState == CONNECTING || mState == DISCONNECTING) {
         mCondition.wait(mLock);
     }
 
@@ -110,6 +110,13 @@ status_t ChromiumHTTPDataSource::connect_l(
 void ChromiumHTTPDataSource::onConnectionEstablished(
         int64_t contentSize, const char *contentType) {
     Mutex::Autolock autoLock(mLock);
+
+    if (mState != CONNECTING) {
+        // We may have initiated disconnection.
+        CHECK_EQ(mState, DISCONNECTING);
+        return;
+    }
+
     mState = CONNECTED;
     mContentSize = (contentSize < 0) ? -1 : contentSize + mCurrentOffset;
     mContentType = String8(contentType);
@@ -255,6 +262,7 @@ void ChromiumHTTPDataSource::onDisconnectComplete() {
 
     mState = DISCONNECTED;
     // mURI.clear();
+    mIOResult = -ENOTCONN;
 
     mCondition.broadcast();
 }
diff --git a/media/libstagefright/chromium_http/support.cpp b/media/libstagefright/chromium_http/support.cpp
index f15014e..13ae3df 100644
--- a/media/libstagefright/chromium_http/support.cpp
+++ b/media/libstagefright/chromium_http/support.cpp
@@ -490,6 +490,10 @@ void SfDelegate::OnInitiateDisconnectWrapper(SfDelegate *me) {
 }
 
 void SfDelegate::onInitiateDisconnect() {
+    if (mURLRequest == NULL) {
+        return;
+    }
+
     mURLRequest->Cancel();
 
     delete mURLRequest;
diff --git a/media/libstagefright/omx/OMX.cpp b/media/libstagefright/omx/OMX.cpp
index f11fcd2..681e321 100644
--- a/media/libstagefright/omx/OMX.cpp
+++ b/media/libstagefright/omx/OMX.cpp
@@ -253,7 +253,11 @@ status_t OMX::freeNode(node_id node) {
     OMXNodeInstance *instance = findInstance(node);
 
     ssize_t index = mLiveNodes.indexOfKey(instance->observer()->asBinder());
-    CHECK(index >= 0);
+    if (index < 0) {
+        // This could conceivably happen if the observer dies at roughly the
+        // same time that a client attempts to free the node explicitly.
+        return OK;
+    }
     mLiveNodes.removeItemsAt(index);
 
     instance->observer()->asBinder()->unlinkToDeath(this);