Fix crash when backgrounding MojoShell on Android. Fixes issue #186.

services/gles2/command_buffer_impl.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "services/gles2/command_buffer_impl.h"
 
 #include "base/bind.h"
 #include "base/message_loop/message_loop.h"
 #include "gpu/command_buffer/service/sync_point_manager.h"
 #include "services/gles2/command_buffer_driver.h"
@@ skipping 35 matching lines @@
 };
 }
 
 CommandBufferImpl::CommandBufferImpl(
     mojo::InterfaceRequest<mojo::CommandBuffer> request,
     mojo::ViewportParameterListenerPtr listener,
     scoped_refptr<base::SingleThreadTaskRunner> control_task_runner,
     gpu::SyncPointManager* sync_point_manager,
     scoped_ptr<CommandBufferDriver> driver)
     : sync_point_manager_(sync_point_manager),
+      control_task_runner_(control_task_runner),
       driver_task_runner_(base::MessageLoop::current()->task_runner()),
       driver_(driver.Pass()),
       viewport_parameter_listener_(listener.Pass()),
       binding_(this),
       observer_(nullptr),
       weak_factory_(this) {
   driver_->set_client(make_scoped_ptr(new CommandBufferDriverClientImpl(
       weak_factory_.GetWeakPtr(), control_task_runner)));
 
-  control_task_runner->PostTask(
+  control_task_runner_->PostTask(
       FROM_HERE, base::Bind(&CommandBufferImpl::BindToRequest,
                             base::Unretained(this), base::Passed(&request)));
 }
 
 CommandBufferImpl::~CommandBufferImpl() {
-  if (observer_) {
-    observer_->OnCommandBufferImplDestroyed();
-  }
   driver_task_runner_->PostTask(
       FROM_HERE, base::Bind(&DestroyDriver, base::Passed(&driver_)));
 }
 
 void CommandBufferImpl::Initialize(
     mojo::CommandBufferSyncClientPtr sync_client,
     mojo::CommandBufferSyncPointClientPtr sync_point_client,
     mojo::CommandBufferLostContextObserverPtr loss_observer,
     mojo::ScopedSharedBufferHandle shared_state) {
   sync_point_client_ = sync_point_client.Pass();
@@ skipping 56 matching lines @@
 }
 
 void CommandBufferImpl::Echo(const mojo::Callback<void()>& callback) {
   driver_task_runner_->PostTaskAndReply(FROM_HERE, base::Bind(&base::DoNothing),
                                         base::Bind(&RunCallback, callback));
 }
 
 void CommandBufferImpl::BindToRequest(
     mojo::InterfaceRequest<mojo::CommandBuffer> request) {
   binding_.Bind(request.Pass());
+  binding_.set_error_handler(this);
 }
 
 void CommandBufferImpl::DidLoseContext() {
-  binding_.OnConnectionError();
+  NotifyAndDestroy();

[blundell, 2015/06/03 14:48:59]

This method is called on |control_task_runner_| at line 38 of this file, right?

[etiennej, 2015/06/03 15:00:40]

Right. Fixed.

+}
+
+void CommandBufferImpl::OnConnectionError() {
+  // Called from the control_task_runner thread as we bound to the message pipe
+  // handle on that thread. However, the observer have to be notified on the
+  // thread that created this object, so we post on driver_task_runner.
+  driver_task_runner_->PostTask(
+      FROM_HERE,
+      base::Bind(&CommandBufferImpl::NotifyAndDestroy, base::Unretained(this)));
+}
+
+void CommandBufferImpl::NotifyAndDestroy() {
+  if (observer_) {
+    observer_->OnCommandBufferImplDestroyed();
+  }
+  // We have notified the observer on the right thread. However, destruction of
+  // this object must happen on control_task_runner_
+  control_task_runner_->PostTask(
+      FROM_HERE,
+      base::Bind(&CommandBufferImpl::Destroy, base::Unretained(this)));
+}
+
+void CommandBufferImpl::Destroy() {
+  delete this;
 }
 
 void CommandBufferImpl::UpdateVSyncParameters(base::TimeTicks timebase,
                                               base::TimeDelta interval) {
   if (!viewport_parameter_listener_)
     return;
   viewport_parameter_listener_->OnVSyncParametersUpdated(
       timebase.ToInternalValue(), interval.ToInternalValue());
 }
 
 }  // namespace gles2