Bug 1048097 - Delete the GMPBuffer we send into GMP/CDM for decryption once it's been returned decrypted. r=jesup

content/media/gmp/GMPDecryptorChild.cpp

@@ -149,8 +149,13 @@ GMPDecryptorChild::Decrypted(GMPBuffer* aBuffer, GMPErr aResult)
 {
   MOZ_ASSERT(mPlugin->GMPMessageLoop() == MessageLoop::current());
 
+  if (!aBuffer) {
+    NS_WARNING("GMPDecryptorCallback passed bull GMPBuffer");
+    return;
+  }
   auto buffer = static_cast<GMPBufferImpl*>(aBuffer);
   SendDecrypted(buffer->mId, aResult, buffer->mData);
+  delete buffer;
 }
 
 void
@@ -307,6 +312,8 @@ GMPDecryptorChild::RecvDecrypt(const uint32_t& aId,
 
   GMPEncryptedBufferDataImpl metadata(aMetadata);
 
+  // Note: the GMPBufferImpl created here is deleted when the GMP passes
+  // it back in the Decrypted() callback above.
   mSession->Decrypt(new GMPBufferImpl(aId, aBuffer), &metadata);
   return true;
 }

content/media/gmp/gmp-api/gmp-decryption.h

@@ -257,6 +257,9 @@ public:
   // same GMPBuffer object and return it to Gecko by calling Decrypted(),
   // with the GMPNoErr successcode. If decryption fails, call Decrypted()
   // with a failure code, and an error event will fire on the media element.
+  // Note: When Decrypted() is called and aBuffer is passed back, aBuffer
+  // is deleted. Don't forget to call Decrypted(), as otherwise aBuffer's
+  // memory will leak!
   virtual void Decrypt(GMPBuffer* aBuffer,
                        GMPEncryptedBufferMetadata* aMetadata) = 0;