Fixed improper destruction of transfer buffers that are still in use.

content/renderer/gpu/renderer_gl_context.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/renderer/gpu/renderer_gl_context.h"
 
 #include "base/debug/trace_event.h"
 #include "base/lazy_instance.h"
 #include "base/memory/ref_counted.h"
 #include "base/memory/scoped_ptr.h"
@@ skipping 20 matching lines @@
 #endif  // ENABLE_GPU
 
 namespace {
 
 const int32 kCommandBufferSize = 1024 * 1024;
 // TODO(kbr): make the transfer buffer size configurable via context
 // creation attributes.
 const int32 kTransferBufferSize = 1024 * 1024;
 
 const uint32 kMaxLatchesPerRenderer = 2048;
-const uint32 kInvalidLatchId = 0xffffffffu;
 
 // Singleton used to initialize and terminate the gles2 library.
 class GLES2Initializer {
  public:
   GLES2Initializer() {
     gles2::Initialize();
   }
 
   ~GLES2Initializer() {
     gles2::Terminate();
@@ skipping 322 matching lines @@
 }
 
 gpu::gles2::GLES2Implementation* RendererGLContext::GetImplementation() {
   return gles2_implementation_;
 }
 
 RendererGLContext::RendererGLContext(GpuChannelHost* channel)
     : channel_(channel),
       parent_(base::WeakPtr<RendererGLContext>()),
       parent_texture_id_(0),
-      child_to_parent_latch_(kInvalidLatchId),
-      parent_to_child_latch_(kInvalidLatchId),
+      child_to_parent_latch_(gpu::kInvalidLatchId),
+      parent_to_child_latch_(gpu::kInvalidLatchId),
       latch_transfer_buffer_id_(-1),
       command_buffer_(NULL),
       gles2_helper_(NULL),
       transfer_buffer_id_(-1),
       gles2_implementation_(NULL),
       last_error_(SUCCESS),
       frame_number_(0) {
   DCHECK(channel);
 }
 
@@ skipping 136 matching lines @@
   return true;
 }
 
 void RendererGLContext::Destroy() {
   TRACE_EVENT0("gpu", "RendererGLContext::Destroy");
   SetParent(NULL);
 
   delete gles2_implementation_;
   gles2_implementation_ = NULL;
 
-  if (child_to_parent_latch_ != kInvalidLatchId) {
-    DestroyLatch(child_to_parent_latch_);
-    child_to_parent_latch_ = kInvalidLatchId;
-  }
-  if (parent_to_child_latch_ != kInvalidLatchId) {
-    DestroyLatch(parent_to_child_latch_);
-    parent_to_child_latch_ = kInvalidLatchId;
-  }
-  if (command_buffer_ && latch_transfer_buffer_id_ != -1) {
-    command_buffer_->DestroyTransferBuffer(latch_transfer_buffer_id_);
-    latch_transfer_buffer_id_ = -1;
-  }
-
-  if (command_buffer_ && transfer_buffer_id_ != -1) {
-    command_buffer_->DestroyTransferBuffer(transfer_buffer_id_);
-    transfer_buffer_id_ = -1;
-  }
+  // Do not destroy these transfer buffers here, because commands are still
+  // in flight on the GPU process that may access them. When the command buffer
+  // is destroyed, the associated shared memory will be cleaned up.
+  latch_transfer_buffer_id_ = -1;
+  transfer_buffer_id_ = -1;
 
   delete gles2_helper_;
   gles2_helper_ = NULL;
 
   if (channel_ && command_buffer_) {
     channel_->DestroyCommandBuffer(command_buffer_);
     command_buffer_ = NULL;
   }
 
   channel_ = NULL;
+
+  // Destroy latches here, after the command buffer is destroyed so that no
+  // commands are still in flight that may access the latch memory.
+  if (child_to_parent_latch_ != gpu::kInvalidLatchId) {
+    DestroyLatch(child_to_parent_latch_);
+    child_to_parent_latch_ = gpu::kInvalidLatchId;
+  }
+  if (parent_to_child_latch_ != gpu::kInvalidLatchId) {
+    DestroyLatch(parent_to_child_latch_);
+    parent_to_child_latch_ = gpu::kInvalidLatchId;
+  }
 }
 
 void RendererGLContext::OnSwapBuffers() {
   if (swap_buffers_callback_.get())
     swap_buffers_callback_->Run();
 }
 
 void RendererGLContext::OnContextLost() {
   if (context_lost_callback_.get())
     context_lost_callback_->Run();
 }
 
 bool RendererGLContext::CreateLatch(uint32* ret_latch) {
   return LatchAllocator::GetInstance()->AllocateLatch(ret_latch);
 }
 
 bool RendererGLContext::DestroyLatch(uint32 latch) {
   return LatchAllocator::GetInstance()->FreeLatch(latch);
 }
 
 bool RendererGLContext::GetParentToChildLatch(uint32* parent_to_child_latch) {
   *parent_to_child_latch = parent_to_child_latch_;
   return true;
 }
 
 bool RendererGLContext::GetChildToParentLatch(uint32* child_to_parent_latch) {
   *child_to_parent_latch = child_to_parent_latch_;
   return true;
 }