From d562484ebd052d0ad5e8f71d74ca5ccaca868d0d Mon Sep 17 00:00:00 2001
From: Matthew Gregan <kinetik@flim.org>
Date: Fri, 11 Jun 2010 10:59:15 +1200
Subject: [PATCH] Bug 571208 - Fix crash in nestegg_free_packet.  Only push
 non-NULL packets into packet queue.  r=chris.double

---
 content/media/webm/nsWebMReader.cpp | 3 +--
 content/media/webm/nsWebMReader.h   | 2 ++
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/content/media/webm/nsWebMReader.cpp b/content/media/webm/nsWebMReader.cpp
index 9f781a9b548c..bfda0bea0e71 100644
--- a/content/media/webm/nsWebMReader.cpp
+++ b/content/media/webm/nsWebMReader.cpp
@@ -531,14 +531,13 @@ PRBool nsWebMReader::DecodeVideoFrame(PRBool &aKeyframeSkip,
         nestegg_free_packet(next_packet);
         return PR_FALSE;
       }
+      mVideoPackets.PushFront(next_packet);
     } else {
       r = nestegg_duration(mContext, &next_tstamp);
       if (r == -1) {
-        nestegg_free_packet(next_packet);
         return PR_FALSE;
       }
     }
-    mVideoPackets.PushFront(next_packet);
   }
 
   PRInt64 tstamp_ms = tstamp / NS_PER_MS;
diff --git a/content/media/webm/nsWebMReader.h b/content/media/webm/nsWebMReader.h
index 33fe193ffc5d..caa2b1dc45aa 100644
--- a/content/media/webm/nsWebMReader.h
+++ b/content/media/webm/nsWebMReader.h
@@ -74,10 +74,12 @@ class PacketQueue : private nsDeque {
   }
   
   inline void Push(nestegg_packet* aItem) {
+    NS_ASSERTION(aItem, "NULL pushed to PacketQueue");
     nsDeque::Push(aItem);
   }
   
   inline void PushFront(nestegg_packet* aItem) {
+    NS_ASSERTION(aItem, "NULL pushed to PacketQueue");
     nsDeque::PushFront(aItem);
   }