dvrrdk350 ti816x Vdec_deleteChn() problem?

Pls check with below bug fix. It is from latest codebase. The modified line is in bold.

        if (IPCBITSOUTHLOS_BUFPOOL_STATE_CREATED == pObj->bitBufState[pBitBuf->channelNum])
        {
            IpcBitsOutLink_logTs(pBitBuf);
            OSA_assert(pObj->appAllocBufCnt[pBitBuf->channelNum] > 0);
            pObj->appAllocBufCnt[pBitBuf->channelNum] -= 1;
            /* Atmost 1 buffer is allowed per channel. Assert if not */
            OSA_assert(pObj->appAllocBufCnt[pBitBuf->channelNum] == 0);
            /* Application must not set flush frame to false.
                        * Flush frame is only used internally to delete buffer pool
                        */
            pBitBuf->flushFrame = FALSE;
            pListElem = (SystemIpcBits_ListElem *)pBitBuf;
            OSA_assert(SharedRegion_getPtr(pListElem->srBufPtr) ==
                       pBitBuf->addr);
            if (0 == pBitBuf->fillLength)
            {
                /* filled length of 0 indicates application
                               * did not fill any data in this buffer.
                               * Free it immediately */
#if SYSTEM_DEBUG_IPC_RT
                OSA_printf(" IPC_OUT: Dropping bitbuf\n");
 #endif
                Cache_inv(pBitBuf->addr, pBitBuf->bufSize,Cache_Type_ALL, TRUE);
                OSA_assert(freeBitBufList.numBufs <
                           VIDBITSTREAM_MAX_BITSTREAM_BUFS);
                freeBitBufList.bufs[freeBitBufList.numBufs] = pBitBuf;
                freeBitBufList.numBufs++;
                pObj->stats.droppedCount++;
                continue;
            }
            else
            {
				Int32 len;

                pObj->stats.recvCount++;
                OSA_assert(SYSTEM_IPC_BITS_GET_BUFSTATE(pListElem->bufState)
                           == IPC_BITBUF_STATE_FREE);
                OSA_assert(SYSTEM_IPC_BITS_GET_BUFOWNERPROCID(pListElem->bufState)
                           == System_getSelfProcId());
                SYSTEM_IPC_BITS_SET_BUFSTATE(pListElem->bufState,
                                             IPC_BITBUF_STATE_ALLOCED);
                IpcBitsOutLink_listMPPut(pObj, pListElem);
                len = OSA_align(pBitBuf->fillLength, RING_BUF_ALIGN_SIZE);

                RingBufferWriterRelease(
                            &pObj->ringBufHdnl[pBitBuf->allocPoolID], 
                            len);
                RingBufferWriterCancel(&pObj->ringBufHdnl[pBitBuf->allocPoolID]);
                putDone = TRUE;
            }
        }
        else
        {
            if (IPCBITSOUTHLOS_BUFPOOL_STATE_DELETEINPROGRESS_WAIT_APP_BUF_FREE ==
                pObj->bitBufState[pBitBuf->channelNum])
            {
                OSA_assert(pObj->appAllocBufCnt[pBitBuf->channelNum] > 0);
                pObj->appAllocBufCnt[pBitBuf->channelNum] -= 1;
                if (0 == pObj->appAllocBufCnt[pBitBuf->channelNum])
                {
                    OSA_assert(FALSE == sendFlushFrame);
                    sendFlushFrame = TRUE;
                    flushFrameChId = pBitBuf->channelNum;
                    putDone = TRUE;
                }
            }
            else
            {
                IPCBITSOUTLINK_INFO_LOG(pObj->tskId,"Warning!. Trying to putFullBuffer for chId[%d] in invalid state [%d]",
                                        pBitBuf->channelNum,
                                        pObj->bitBufState[pBitBuf->channelNum]);
            }
            /* filled length of 0 indicates application
                        * did not fill any data in this buffer.
                        * Free it immediately */
#if SYSTEM_DEBUG_IPC_RT
            OSA_printf(" IPC_OUT: Dropping bitbuf\n");
#endif
            OSA_assert(freeBitBufList.numBufs <
                       VIDBITSTREAM_MAX_BITSTREAM_BUFS);
            freeBitBufList.bufs[freeBitBufList.numBufs] = pBitBuf;
            freeBitBufList.numBufs++;
            pObj->stats.droppedCount++;
        }
    }

Patch is based on DVRRDK 4.01 is below

diff --git a/mcfw/src_linux/links/ipcBitsOut/ipcBitsOutLink_tsk.c b/mcfw/src_linux/links/ipcBitsOut/ipcBitsOutLink_tsk.c
index 4728fd5..d5d461c 100755
--- a/mcfw/src_linux/links/ipcBitsOut/ipcBitsOutLink_tsk.c
+++ b/mcfw/src_linux/links/ipcBitsOut/ipcBitsOutLink_tsk.c
@@ -637,6 +637,7 @@
                     OSA_assert(FALSE == sendFlushFrame);
                     sendFlushFrame = TRUE;
                     flushFrameChId = pBitBuf->channelNum;
+                    putDone = TRUE;
                 }
             }
             else

hi:

    i add the "putDone = TRUE;" ,but still have the issue.

    I noly create and start the ipcbitsOut link, but never require a buff and any  other operation, so this function modify no effect with the issue.

 the key point is this function:

Int32 IpcBitsOutLink_releaseBitBufs(IpcBitsOutLink_Obj * pObj)
{
    SystemIpcBits_ListElem *pListElem = NULL;
    Int32 status;
    UInt32 curTime, roundTripTime;

    curTime = OSA_getCurTimeInMsec();

    do
    {
        pListElem = ListMP_getHead(pObj->listMPInHndl);

        if (pListElem != NULL)
        {
			OSA_printf("%s %d. pListElem is not NULL\n",__FILE__,__LINE__);
            IpcBitsOutLink_doPostGetCacheOp(pObj, pListElem);
            if(SYSTEM_IPC_BITS_GET_BUFSTATE(pListElem->bufState)
               != IPC_BITBUF_STATE_INQUE)
            {
                OSA_printf("!!!WARNING.Bad ListElem\n");
                OSA_printf("ListElem:%p,State:%d,SharedRegionID:%d,SrPtr:%p",
                            pListElem,
                            SYSTEM_IPC_BITS_GET_BUFSTATE(pListElem->bufState),
                            SharedRegion_getId(pListElem),
                            (void *)pListElem->srBufPtr);
                OSA_printf("Stats:Recv:%d,Free:%d,Dropped:%d",
                           pObj->stats.recvCount,
                           pObj->stats.freeCount,
                           pObj->stats.droppedCount);
                OSA_assert(SYSTEM_IPC_BITS_GET_BUFSTATE(pListElem->bufState)
                           == IPC_BITBUF_STATE_INQUE);
            }
            if (curTime > ((UInt32) pListElem->ipcPrivData))
            {
                roundTripTime = curTime - ((UInt32) pListElem->ipcPrivData);
                pObj->stats.totalRoundTrip += roundTripTime;
            }
            pObj->stats.freeCount++;
            /* release ListElem back to queue */
            SYSTEM_IPC_BITS_SET_BUFOWNERPROCID(pListElem->bufState);
            SYSTEM_IPC_BITS_SET_BUFSTATE(pListElem->bufState,
                                         IPC_BITBUF_STATE_FREE);

			OSA_printf("%s %d . ipcbitsOut come here. pListElem->bitBuf.flushFrame=%d\n",__FILE__,__LINE__,pListElem->bitBuf.flushFrame);
            if (pListElem->bitBuf.flushFrame)
            {
				OSA_printf("%s %d . ipcbitsOut come here\n",__FILE__,__LINE__);
                ipcbitsoutlink_handle_flush_frame_free(pObj,pListElem);
            }
            else
            {
				OSA_printf("%s %d . ipcbitsOut come here\n",__FILE__,__LINE__);

                OSA_assert(pListElem->bitBuf.allocPoolID <
                           pObj->outQueInfo.allocPoolInfo.numPools);
                status =
                    OSA_quePut(&(pObj->listElemQue[pListElem->bitBuf.allocPoolID]),
                               (Int32) pListElem, OSA_TIMEOUT_NONE);
                OSA_assert(status == OSA_SOK);
            }

        }                                                  /* if (pListElem
                                                            * != NULL) */
    } while (pListElem != NULL);

    return IPC_BITSOUT_LINK_S_SUCCESS;
}

if delete success. at least  pListElem != NULL one time.  then will may  be enter 

if (pListElem->bitBuf.flushFrame)
{
OSA_printf("%s %d . ipcbitsOut come here\n",__FILE__,__LINE__);
ipcbitsoutlink_handle_flush_frame_free(pObj,pListElem);
}

so can flush the buff,

but i never applay a buff, so I think it will null.

it's bug? or some place i set or use wrong