Fix race condition with windowless plugin buffers. The problem, which is already fixed for Mac, is …

content/plugin/webplugin_proxy.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/plugin/webplugin_proxy.h"
 
 #include "build/build_config.h"
 
 #include "base/bind.h"
 #include "base/lazy_instance.h"
@@ skipping 28 matching lines @@
 #include "content/public/common/sandbox_init.h"
 #endif
 
 using WebKit::WebBindings;
 
 using webkit::npapi::WebPluginResourceClient;
 #if defined(OS_MACOSX)
 using webkit::npapi::WebPluginAcceleratedSurface;
 #endif
 
+
+WebPluginProxy::SharedTransportDIB::SharedTransportDIB(TransportDIB* dib)
+    : dib_(dib) {
+}
+
+WebPluginProxy::SharedTransportDIB::~SharedTransportDIB() {
+}
+
 WebPluginProxy::WebPluginProxy(
     PluginChannel* channel,
     int route_id,
     const GURL& page_url,
     gfx::NativeViewId containing_window,
     int host_render_view_routing_id)
     : channel_(channel),
       route_id_(route_id),
       window_npobject_(NULL),
       plugin_element_(NULL),
@@ skipping 317 matching lines @@
     CGContextClearRect(windowless_context(), rect.ToCGRect());
   }
   CGContextClipToRect(windowless_context(), rect.ToCGRect());
   // TODO(caryclark): This is a temporary workaround to allow the Darwin / Skia
   // port to share code with the Darwin / CG port. All ports will eventually use
   // the common code below.
   delegate_->CGPaint(windowless_context(), rect);
   if (windowless_contexts_[saved_index].get() == saved_context_weak)
     CGContextRestoreGState(windowless_contexts_[saved_index]);
 #else
-  windowless_canvas()->save();
+  // See above comment about windowless_context_ changing.
+  // http::/crbug.com/139462
+  skia::PlatformCanvas* saved_canvas = windowless_canvas();
+  SkAutoRef local_ref(saved_canvas);
+#if defined(USE_X11)
+  scoped_refptr<SharedTransportDIB> local_dib_ref(
+      windowless_dibs_[windowless_buffer_index_]);
+#endif
+
+  saved_canvas->save();
 
   // The given clip rect is relative to the plugin coordinate system.
   SkRect sk_rect = { SkIntToScalar(rect.x()),
                      SkIntToScalar(rect.y()),
                      SkIntToScalar(rect.right()),
                      SkIntToScalar(rect.bottom()) };
-  windowless_canvas()->clipRect(sk_rect);
+  saved_canvas->clipRect(sk_rect);
 
   // Setup the background.
   if (background_canvas_.get() && background_canvas_.get()->getDevice()) {
     // When a background canvas is given, we're in transparent mode. This means
     // the plugin wants to have the image of the page in the canvas it's drawing
     // into (which is windowless_canvases_) so it can do blending. So we copy
     // the background bitmap into the windowless canvas.
     const SkBitmap& background_bitmap =
         skia::GetTopDevice(*background_canvas_)->accessBitmap(false);
-    windowless_canvas()->drawBitmap(background_bitmap, 0, 0);
+    saved_canvas->drawBitmap(background_bitmap, 0, 0);
   } else {
     // In non-transparent mode, the plugin doesn't care what's underneath, so we
     // can just give it black.
     SkPaint black_fill_paint;
     black_fill_paint.setARGB(0xFF, 0x00, 0x00, 0x00);
-    windowless_canvas()->drawPaint(black_fill_paint);
+    saved_canvas->drawPaint(black_fill_paint);
   }
 
   // Bring the windowless canvas into the window coordinate system, which is
   // how the plugin expects to draw (since the windowless API was originally
   // designed just for scribbling over the web page).
-  windowless_canvas()->translate(SkIntToScalar(-delegate_->GetRect().x()),
-                                 SkIntToScalar(-delegate_->GetRect().y()));
+  saved_canvas->translate(SkIntToScalar(-delegate_->GetRect().x()),
+                          SkIntToScalar(-delegate_->GetRect().y()));
 
   // Before we send the invalidate, paint so that renderer uses the updated
   // bitmap.
-  delegate_->Paint(windowless_canvas(), offset_rect);
+  delegate_->Paint(saved_canvas, offset_rect);
 
-  windowless_canvas()->restore();
+  saved_canvas->restore();
 #endif
 }
 
 void WebPluginProxy::UpdateGeometry(
     const gfx::Rect& window_rect,
     const gfx::Rect& clip_rect,
     const TransportDIB::Handle& windowless_buffer0,
     const TransportDIB::Handle& windowless_buffer1,
     int windowless_buffer_index,
     const TransportDIB::Handle& background_buffer,
@@ skipping 32 matching lines @@
       !damaged_rect_.IsEmpty()) {
     InvalidateRect(damaged_rect_);
   }
 }
 
 #if defined(OS_WIN)
 
 void WebPluginProxy::CreateCanvasFromHandle(
     const TransportDIB::Handle& dib_handle,
     const gfx::Rect& window_rect,
-    scoped_ptr<skia::PlatformCanvas>* canvas_out) {
-  scoped_ptr<skia::PlatformCanvas> canvas(new skia::PlatformCanvas);
-  if (!canvas->initialize(
+    SkAutoTUnref<skia::PlatformCanvas>* canvas) {
+  canvas->reset(new skia::PlatformCanvas);
+  if (!canvas->get()->initialize(
           window_rect.width(),
           window_rect.height(),
           true,
           dib_handle)) {
-    canvas_out->reset();
+    canvas->reset(NULL);
   }
-  canvas_out->reset(canvas.release());
   // The canvas does not own the section so we need to close it now.
   CloseHandle(dib_handle);
 }
 
 void WebPluginProxy::SetWindowlessBuffers(
     const TransportDIB::Handle& windowless_buffer0,
     const TransportDIB::Handle& windowless_buffer1,
     const TransportDIB::Handle& background_buffer,
     const gfx::Rect& window_rect) {
   CreateCanvasFromHandle(windowless_buffer0,
                          window_rect,
                          &windowless_canvases_[0]);
   if (!windowless_canvases_[0].get()) {
-    windowless_canvases_[1].reset();
-    background_canvas_.reset();
+    windowless_canvases_[1].reset(NULL);
+    background_canvas_.reset(NULL);
     return;
   }
   CreateCanvasFromHandle(windowless_buffer1,
                          window_rect,
                          &windowless_canvases_[1]);
   if (!windowless_canvases_[1].get()) {
-    windowless_canvases_[0].reset();
-    background_canvas_.reset();
+    windowless_canvases_[0].reset(NULL);
+    background_canvas_.reset(NULL);
     return;
   }
 
   if (background_buffer) {
     CreateCanvasFromHandle(background_buffer,
                            window_rect,
                            &background_canvas_);
     if (!background_canvas_.get()) {
-      windowless_canvases_[0].reset();
-      windowless_canvases_[1].reset();
+      windowless_canvases_[0].reset(NULL);
+      windowless_canvases_[1].reset(NULL);
       return;
     }
   }
 }
 
 #elif defined(OS_MACOSX)
 
 void WebPluginProxy::CreateDIBAndCGContextFromHandle(
     const TransportDIB::Handle& dib_handle,
     const gfx::Rect& window_rect,
@@ skipping 36 matching lines @@
                                   window_rect,
                                   &background_dib_,
                                   &background_context_);
 }
 
 #elif defined(USE_X11)
 
 void WebPluginProxy::CreateDIBAndCanvasFromHandle(
     const TransportDIB::Handle& dib_handle,
     const gfx::Rect& window_rect,
-    scoped_ptr<TransportDIB>* dib_out,
-    scoped_ptr<skia::PlatformCanvas>* canvas_out) {
+    scoped_refptr<SharedTransportDIB>* dib_out,
+    SkAutoTUnref<skia::PlatformCanvas>* canvas) {
   TransportDIB* dib = TransportDIB::Map(dib_handle);
-  skia::PlatformCanvas* canvas = NULL;
   // dib may be NULL if the renderer has already destroyed the TransportDIB by
   // the time we receive the handle, e.g. in case of multiple resizes.
   if (dib) {
-    canvas = dib->GetPlatformCanvas(window_rect.width(), window_rect.height());
+    canvas->reset(
+        dib->GetPlatformCanvas(window_rect.width(), window_rect.height()));
+  } else {
+    canvas->reset(NULL);
   }
-  dib_out->reset(dib);
-  canvas_out->reset(canvas);
+  *dib_out = new SharedTransportDIB(dib);
 }
 
 void WebPluginProxy::CreateShmPixmapFromDIB(
     TransportDIB* dib,
     const gfx::Rect& window_rect,
     XID* pixmap_out) {
   if (dib) {
     Display* display = ui::GetXDisplay();
     XID root_window = ui::GetX11RootWindow();
     XShmSegmentInfo shminfo = {0};
@@ skipping 25 matching lines @@
                                &windowless_dibs_[1],
                                &windowless_canvases_[1]);
   CreateDIBAndCanvasFromHandle(background_buffer,
                                window_rect,
                                &background_dib_,
                                &background_canvas_);
 
   // If SHM pixmaps support is available, create SHM pixmaps to pass to the
   // delegate for windowless plugin painting.
   if (delegate_->IsWindowless() && use_shm_pixmap_) {
-    CreateShmPixmapFromDIB(windowless_dibs_[0].get(),
+    CreateShmPixmapFromDIB(windowless_dibs_[0]->dib(),
                            window_rect,
                            &windowless_shm_pixmaps_[0]);
-    CreateShmPixmapFromDIB(windowless_dibs_[1].get(),
+    CreateShmPixmapFromDIB(windowless_dibs_[1]->dib(),
                            window_rect,
                            &windowless_shm_pixmaps_[1]);
   }
 }
 
 #elif defined(OS_ANDROID)
 
 void WebPluginProxy::SetWindowlessBuffers(
     const TransportDIB::Handle& windowless_buffer0,
     const TransportDIB::Handle& windowless_buffer1,
@@ skipping 136 matching lines @@
   // Retrieve the IME status from a plug-in and send it to a renderer process
   // when the plug-in has updated it.
   int input_type;
   gfx::Rect caret_rect;
   if (!delegate_->GetIMEStatus(&input_type, &caret_rect))
     return;
 
   Send(new PluginHostMsg_NotifyIMEStatus(route_id_, input_type, caret_rect));
 }
 #endif