aura: Ensure OwnedMailbox not used with invalid or destroyed GLHelper.

content/browser/renderer_host/render_widget_host_view_aura.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/renderer_host/render_widget_host_view_aura.h"
 
 #include "base/auto_reset.h"
 #include "base/basictypes.h"
 #include "base/bind.h"
 #include "base/callback_helpers.h"
@@ skipping 707 matching lines @@
 scoped_ptr<ResizeLock> RenderWidgetHostViewAura::CreateResizeLock(
     bool defer_compositor_lock) {
   gfx::Size desired_size = window_->bounds().size();
   return scoped_ptr<ResizeLock>(new CompositorResizeLock(
       window_->GetDispatcher(),
       desired_size,
       defer_compositor_lock,
       base::TimeDelta::FromMilliseconds(kResizeLockTimeoutMs)));
 }
 
+void RenderWidgetHostViewAura::RequestCopyOfOutput(
+    scoped_ptr<cc::CopyOutputRequest> request) {
+  window_->layer()->RequestCopyOfOutput(request.Pass());
+}
+
 gfx::NativeView RenderWidgetHostViewAura::GetNativeView() const {
   return window_;
 }
 
 gfx::NativeViewId RenderWidgetHostViewAura::GetNativeViewId() const {
 #if defined(OS_WIN)
   aura::WindowEventDispatcher* dispatcher = window_->GetDispatcher();
   if (dispatcher)
     return reinterpret_cast<gfx::NativeViewId>(
         dispatcher->host()->GetAcceleratedWidget());
@@ skipping 319 matching lines @@
 
   const gfx::Size& dst_size_in_pixel = ConvertViewSizeToPixel(this, dst_size);
   scoped_ptr<cc::CopyOutputRequest> request =
       cc::CopyOutputRequest::CreateRequest(base::Bind(
           &RenderWidgetHostViewAura::CopyFromCompositingSurfaceHasResult,
           dst_size_in_pixel,
           callback));
   gfx::Rect src_subrect_in_pixel =
       ConvertRectToPixel(current_device_scale_factor_, src_subrect);
   request->set_area(src_subrect_in_pixel);
-  window_->layer()->RequestCopyOfOutput(request.Pass());
+  RequestCopyOfOutput(request.Pass());
 }
 
 void RenderWidgetHostViewAura::CopyFromCompositingSurfaceToVideoFrame(
       const gfx::Rect& src_subrect,
       const scoped_refptr<media::VideoFrame>& target,
       const base::Callback<void(bool)>& callback) {
   if (!CanCopyToVideoFrame()) {
     callback.Run(false);
     return;
   }
 
   // Try get a texture to reuse.
   scoped_refptr<OwnedMailbox> subscriber_texture;
   if (frame_subscriber_) {
     if (!idle_frame_subscriber_textures_.empty()) {
       subscriber_texture = idle_frame_subscriber_textures_.back();
       idle_frame_subscriber_textures_.pop_back();
     } else if (GLHelper* helper =
                    ImageTransportFactory::GetInstance()->GetGLHelper()) {
       subscriber_texture = new OwnedMailbox(helper);
     }
+    if (subscriber_texture.get())
+      active_frame_subscriber_textures_.insert(subscriber_texture.get());
   }
 
   scoped_ptr<cc::CopyOutputRequest> request =
       cc::CopyOutputRequest::CreateRequest(base::Bind(
           &RenderWidgetHostViewAura::
                CopyFromCompositingSurfaceHasResultForVideo,
           AsWeakPtr(),  // For caching the ReadbackYUVInterface on this class.
           subscriber_texture,
           target,
           callback));
   gfx::Rect src_subrect_in_pixel =
       ConvertRectToPixel(current_device_scale_factor_, src_subrect);
   request->set_area(src_subrect_in_pixel);
-  if (subscriber_texture) {
+  if (subscriber_texture.get()) {
     request->SetTextureMailbox(cc::TextureMailbox(
         subscriber_texture->mailbox(), subscriber_texture->sync_point()));
   }
-  window_->layer()->RequestCopyOfOutput(request.Pass());
+  RequestCopyOfOutput(request.Pass());
 }
 
 bool RenderWidgetHostViewAura::CanCopyToBitmap() const {
   return GetCompositor() && window_->layer()->has_external_content();
 }
 
 bool RenderWidgetHostViewAura::CanCopyToVideoFrame() const {
   return GetCompositor() &&
          window_->layer()->has_external_content() &&
          host_->is_accelerated_compositing_active();
@@ skipping 781 matching lines @@
   ignore_result(scoped_callback_runner.Release());
 
   SkBitmap bitmap = skia::ImageOperations::Resize(
       *source,
       skia::ImageOperations::RESIZE_BEST,
       dst_size_in_pixel.width(),
       dst_size_in_pixel.height());
   callback.Run(true, bitmap);
 }
 
+// static
+void RenderWidgetHostViewAura::ReturnSubscriberTexture(
+    base::WeakPtr<RenderWidgetHostViewAura> rwhva,
+    scoped_refptr<OwnedMailbox> subscriber_texture,
+    uint32 sync_point) {
+  if (!subscriber_texture.get())
+    return;
+  if (!rwhva)
+    return;
+  DCHECK_NE(
+      rwhva->active_frame_subscriber_textures_.count(subscriber_texture.get()),
+      0u);
+
+  subscriber_texture->UpdateSyncPoint(sync_point);
+
+  rwhva->active_frame_subscriber_textures_.erase(subscriber_texture.get());
+  if (rwhva->frame_subscriber_ && subscriber_texture->texture_id())
+    rwhva->idle_frame_subscriber_textures_.push_back(subscriber_texture);
+}
+
 void RenderWidgetHostViewAura::CopyFromCompositingSurfaceFinishedForVideo(
     base::WeakPtr<RenderWidgetHostViewAura> rwhva,
     const base::Callback<void(bool)>& callback,
     scoped_refptr<OwnedMailbox> subscriber_texture,
     scoped_ptr<cc::SingleReleaseCallback> release_callback,
     bool result) {
   callback.Run(result);
 
   GLHelper* gl_helper = ImageTransportFactory::GetInstance()->GetGLHelper();
   uint32 sync_point = gl_helper ? gl_helper->InsertSyncPoint() : 0;
   if (release_callback) {
+    // A release callback means the texture came from the compositor, so there
+    // should be no |subscriber_texture|.
     DCHECK(!subscriber_texture);
     release_callback->Run(sync_point, false);
-  } else {
-    // If there's no release callback, then the texture is from
-    // idle_frame_subscriber_textures_ and we can put it back there.
-    DCHECK(subscriber_texture);
-    subscriber_texture->UpdateSyncPoint(sync_point);
-    if (rwhva && rwhva->frame_subscriber_ && subscriber_texture->texture_id())
-      rwhva->idle_frame_subscriber_textures_.push_back(subscriber_texture);
-    subscriber_texture = NULL;
   }
+  ReturnSubscriberTexture(rwhva, subscriber_texture, sync_point);
 }
 
 // static
 void RenderWidgetHostViewAura::CopyFromCompositingSurfaceHasResultForVideo(
     base::WeakPtr<RenderWidgetHostViewAura> rwhva,
     scoped_refptr<OwnedMailbox> subscriber_texture,
     scoped_refptr<media::VideoFrame> video_frame,
     const base::Callback<void(bool)>& callback,
     scoped_ptr<cc::CopyOutputResult> result) {
   base::ScopedClosureRunner scoped_callback_runner(base::Bind(callback, false));
+  base::ScopedClosureRunner scoped_return_subscriber_texture(
+      base::Bind(&ReturnSubscriberTexture, rwhva, subscriber_texture, 0));
 
   if (!rwhva)
     return;
   if (result->IsEmpty())
     return;
   if (result->size().IsEmpty())
     return;
 
   // Compute the dest size we want after the letterboxing resize. Make the
   // coordinates and sizes even because we letterbox in YUV space
   // (see CopyRGBToVideoFrame). They need to be even for the UV samples to
   // line up correctly.
   // The video frame's coded_size() and the result's size() are both physical
   // pixels.
   gfx::Rect region_in_frame =
       media::ComputeLetterboxRegion(gfx::Rect(video_frame->coded_size()),
                                     result->size());
   region_in_frame = gfx::Rect(region_in_frame.x() & ~1,
                               region_in_frame.y() & ~1,
                               region_in_frame.width() & ~1,
                               region_in_frame.height() & ~1);
   if (region_in_frame.IsEmpty())
     return;
 
-  // We only handle texture readbacks for now. If the compositor is in software
-  // mode, we could produce a software-backed VideoFrame here as well.
   if (!result->HasTexture()) {
     DCHECK(result->HasBitmap());
     scoped_ptr<SkBitmap> bitmap = result->TakeBitmap();
     // Scale the bitmap to the required size, if necessary.
     SkBitmap scaled_bitmap;
     if (result->size().width() != region_in_frame.width() ||
         result->size().height() != region_in_frame.height()) {
       skia::ImageOperations::ResizeMethod method =
           skia::ImageOperations::RESIZE_GOOD;
       scaled_bitmap = skia::ImageOperations::Resize(*bitmap.get(), method,
@@ skipping 14 matching lines @@
     }
     ignore_result(scoped_callback_runner.Release());
     callback.Run(true);
     return;
   }
 
   ImageTransportFactory* factory = ImageTransportFactory::GetInstance();
   GLHelper* gl_helper = factory->GetGLHelper();
   if (!gl_helper)
     return;
+  if (subscriber_texture.get() && !subscriber_texture->texture_id())
+    return;
 
   cc::TextureMailbox texture_mailbox;
   scoped_ptr<cc::SingleReleaseCallback> release_callback;
   result->TakeTexture(&texture_mailbox, &release_callback);
   DCHECK(texture_mailbox.IsTexture());
   if (!texture_mailbox.IsTexture())
     return;
 
   gfx::Rect result_rect(result->size());
 
@@ skipping 24 matching lines @@
                                              result_rect.size(),
                                              result_rect,
                                              video_frame->coded_size(),
                                              region_in_frame,
                                              true,
                                              true));
     yuv_readback_pipeline = rwhva->yuv_readback_pipeline_.get();
   }
 
   ignore_result(scoped_callback_runner.Release());
+  ignore_result(scoped_return_subscriber_texture.Release());
   base::Callback<void(bool result)> finished_callback = base::Bind(
       &RenderWidgetHostViewAura::CopyFromCompositingSurfaceFinishedForVideo,
       rwhva->AsWeakPtr(),
       callback,
       subscriber_texture,
       base::Passed(&release_callback));
   yuv_readback_pipeline->ReadbackYUV(
       texture_mailbox.name(),
       texture_mailbox.sync_point(),
       video_frame.get(),
@@ skipping 1163 matching lines @@
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // RenderWidgetHostViewAura, ImageTransportFactoryObserver implementation:
 
 void RenderWidgetHostViewAura::OnLostResources() {
   current_surface_ = NULL;
   UpdateExternalTexture();
 
   idle_frame_subscriber_textures_.clear();
+  yuv_readback_pipeline_.reset();
 
   // Make sure all ImageTransportClients are deleted now that the context those
   // are using is becoming invalid. This sends pending ACKs and needs to happen
   // after calling UpdateExternalTexture() which syncs with the impl thread.
   RunOnCommitCallbacks();
 
   DCHECK(!shared_surface_handle_.is_null());
   ImageTransportFactory* factory = ImageTransportFactory::GetInstance();
   factory->DestroySharedSurfaceHandle(shared_surface_handle_);
   shared_surface_handle_ = factory->CreateSharedSurfaceHandle();
@@ skipping 32 matching lines @@
   gfx::Screen::GetScreenFor(window_)->RemoveObserver(this);
 
   // This call is usually no-op since |this| object is already removed from the
   // Aura root window and we don't have a way to get an input method object
   // associated with the window, but just in case.
   DetachFromInputMethod();
 
   if (resource_collection_.get())
     resource_collection_->SetClient(NULL);
 
+  // An OwnedMailbox should not refer to the GLHelper anymore once the RWHVA is
+  // destroyed, as it may then outlive the GLHelper.
+  for (std::set<OwnedMailbox*>::iterator it =
+           active_frame_subscriber_textures_.begin();
+       it != active_frame_subscriber_textures_.end();
+       ++it) {
+    (*it)->Destroy();
+  }
+  active_frame_subscriber_textures_.clear();
+
 #if defined(OS_WIN)
   if (::IsWindow(plugin_parent_window_))
     ::DestroyWindow(plugin_parent_window_);
 #endif
 }
 
 void RenderWidgetHostViewAura::UpdateCursorIfOverSelf() {
   const gfx::Point screen_point =
       gfx::Screen::GetScreenFor(GetNativeView())->GetCursorScreenPoint();
   aura::Window* root_window = window_->GetRootWindow();
@@ skipping 212 matching lines @@
     RenderWidgetHost* widget) {
   return new RenderWidgetHostViewAura(widget);
 }
 
 // static
 void RenderWidgetHostViewPort::GetDefaultScreenInfo(WebScreenInfo* results) {
   GetScreenInfoForWindow(results, NULL);
 }
 
 }  // namespace content