aura: Ensure OwnedMailbox not used with invalid or destroyed GLHelper.

content/browser/renderer_host/render_widget_host_view_aura_unittest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/renderer_host/render_widget_host_view_aura.h"
 
 #include "base/basictypes.h"
 #include "base/memory/shared_memory.h"
 #include "base/message_loop/message_loop.h"
+#include "base/run_loop.h"
 #include "base/strings/utf_string_conversions.h"
 #include "cc/output/compositor_frame.h"
 #include "cc/output/compositor_frame_metadata.h"
+#include "cc/output/copy_output_request.h"
 #include "cc/output/gl_frame_data.h"
 #include "content/browser/aura/resize_lock.h"
 #include "content/browser/browser_thread_impl.h"
 #include "content/browser/renderer_host/render_widget_host_delegate.h"
 #include "content/browser/renderer_host/render_widget_host_impl.h"
 #include "content/common/gpu/gpu_messages.h"
 #include "content/common/input_messages.h"
 #include "content/common/view_messages.h"
+#include "content/port/browser/render_widget_host_view_frame_subscriber.h"
 #include "content/public/browser/render_widget_host_view.h"
 #include "content/public/test/mock_render_process_host.h"
 #include "content/public/test/test_browser_context.h"
 #include "ipc/ipc_test_sink.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "ui/aura/client/aura_constants.h"
 #include "ui/aura/client/screen_position_client.h"
 #include "ui/aura/client/window_tree_client.h"
 #include "ui/aura/env.h"
@@ skipping 75 matching lines @@
  private:
   // Window that we're observing, or NULL if it's been destroyed.
   aura::Window* window_;
 
   // Was |window_| destroyed?
   bool destroyed_;
 
   DISALLOW_COPY_AND_ASSIGN(TestWindowObserver);
 };
 
+class FakeFrameSubscriber : public RenderWidgetHostViewFrameSubscriber {
+ public:
+  FakeFrameSubscriber(gfx::Size size, base::Callback<void(bool)> callback)
+      : size_(size), callback_(callback) {}
+
+  virtual bool ShouldCaptureFrame(base::TimeTicks present_time,
+                                  scoped_refptr<media::VideoFrame>* storage,
+                                  DeliverFrameCallback* callback) OVERRIDE {
+    *storage = media::VideoFrame::CreateFrame(media::VideoFrame::YV12,
+                                              size_,
+                                              gfx::Rect(size_),
+                                              size_,
+                                              base::TimeDelta());
+    *callback = base::Bind(&FakeFrameSubscriber::CallbackMethod, callback_);
+    return true;
+  }
+
+  static void CallbackMethod(base::Callback<void(bool)> callback,
+                             base::TimeTicks timestamp,
+                             bool success) {
+    callback.Run(success);
+  }
+
+ private:
+  gfx::Size size_;
+  base::Callback<void(bool)> callback_;
+};
+
 class FakeRenderWidgetHostViewAura : public RenderWidgetHostViewAura {
  public:
   FakeRenderWidgetHostViewAura(RenderWidgetHost* widget)
       : RenderWidgetHostViewAura(widget), has_resize_lock_(false) {}
 
   virtual ~FakeRenderWidgetHostViewAura() {}
 
   virtual bool ShouldCreateResizeLock() OVERRIDE {
     gfx::Size desired_size = window()->bounds().size();
     return desired_size != current_frame_size();
   }
 
   virtual scoped_ptr<ResizeLock> CreateResizeLock(bool defer_compositor_lock)
       OVERRIDE {
     gfx::Size desired_size = window()->bounds().size();
     return scoped_ptr<ResizeLock>(
         new FakeResizeLock(desired_size, defer_compositor_lock));
   }
 
+  virtual void RequestCopyOfOutput(scoped_ptr<cc::CopyOutputRequest> request)
+      OVERRIDE {
+    last_copy_request_ = request.Pass();
+  }
+
   void RunOnCompositingDidCommit() {
     OnCompositingDidCommit(window()->GetDispatcher()->host()->compositor());
   }
 
   // A lock that doesn't actually do anything to the compositor, and does not
   // time out.
   class FakeResizeLock : public ResizeLock {
    public:
     FakeResizeLock(const gfx::Size new_size, bool defer_compositor_lock)
         : ResizeLock(new_size, defer_compositor_lock) {}
   };
 
   bool has_resize_lock_;
   gfx::Size last_frame_size_;
+  scoped_ptr<cc::CopyOutputRequest> last_copy_request_;
 };
 
 class RenderWidgetHostViewAuraTest : public testing::Test {
  public:
   RenderWidgetHostViewAuraTest()
       : browser_thread_for_ui_(BrowserThread::UI, &message_loop_) {}
 
-  virtual void SetUp() {
+  void SetUpEnvironment() {
     ImageTransportFactory::InitializeForUnitTests(
         scoped_ptr<ui::ContextFactory>(new ui::TestContextFactory));
     aura_test_helper_.reset(new aura::test::AuraTestHelper(&message_loop_));
     aura_test_helper_->SetUp();
 
     browser_context_.reset(new TestBrowserContext);
     process_host_ = new MockRenderProcessHost(browser_context_.get());
 
     sink_ = &process_host_->sink();
 
     parent_host_ = new RenderWidgetHostImpl(
         &delegate_, process_host_, MSG_ROUTING_NONE, false);
     parent_view_ = static_cast<RenderWidgetHostViewAura*>(
         RenderWidgetHostView::CreateViewForWidget(parent_host_));
     parent_view_->InitAsChild(NULL);
     aura::client::ParentWindowWithContext(parent_view_->GetNativeView(),
                                           aura_test_helper_->root_window(),
                                           gfx::Rect());
 
     widget_host_ = new RenderWidgetHostImpl(
         &delegate_, process_host_, MSG_ROUTING_NONE, false);
     widget_host_->Init();
     widget_host_->OnMessageReceived(
         ViewHostMsg_DidActivateAcceleratedCompositing(0, true));
     view_ = new FakeRenderWidgetHostViewAura(widget_host_);
   }
 
-  virtual void TearDown() {
+  void TearDownEnvironment() {
     sink_ = NULL;
     process_host_ = NULL;
     if (view_)
       view_->Destroy();
     delete widget_host_;
 
     parent_view_->Destroy();
     delete parent_host_;
 
     browser_context_.reset();
     aura_test_helper_->TearDown();
 
     message_loop_.DeleteSoon(FROM_HERE, browser_context_.release());
     message_loop_.RunUntilIdle();
     ImageTransportFactory::Terminate();
   }
 
+  virtual void SetUp() { SetUpEnvironment(); }
+
+  virtual void TearDown() { TearDownEnvironment(); }
+
  protected:
   base::MessageLoopForUI message_loop_;
   BrowserThreadImpl browser_thread_for_ui_;
   scoped_ptr<aura::test::AuraTestHelper> aura_test_helper_;
   scoped_ptr<BrowserContext> browser_context_;
   MockRenderWidgetHostDelegate delegate_;
   MockRenderProcessHost* process_host_;
 
   // Tests should set these to NULL if they've already triggered their
   // destruction.
   RenderWidgetHostImpl* parent_host_;
   RenderWidgetHostViewAura* parent_view_;
 
   // Tests should set these to NULL if they've already triggered their
   // destruction.
   RenderWidgetHostImpl* widget_host_;
   FakeRenderWidgetHostViewAura* view_;
 
   IPC::TestSink* sink_;
 
  private:
   DISALLOW_COPY_AND_ASSIGN(RenderWidgetHostViewAuraTest);
 };
 
+class RenderWidgetHostViewAuraShutdownTest
+    : public RenderWidgetHostViewAuraTest {
+ public:
+  RenderWidgetHostViewAuraShutdownTest() {}
+
+  virtual void TearDown() OVERRIDE {
+    // No TearDownEnvironment here, we do this explicitly during the test.
+  }
+
+ private:
+  DISALLOW_COPY_AND_ASSIGN(RenderWidgetHostViewAuraShutdownTest);
+};
+
 // A layout manager that always resizes a child to the root window size.
 class FullscreenLayoutManager : public aura::LayoutManager {
  public:
   explicit FullscreenLayoutManager(aura::Window* owner)
       : owner_(owner) {}
   virtual ~FullscreenLayoutManager() {}
 
   // Overridden from aura::LayoutManager:
   virtual void OnWindowResized() OVERRIDE {
     aura::Window::Windows::const_iterator i;
@@ skipping 974 matching lines @@
   // scale on it.
   view_->OnSwapCompositorFrame(
       1, MakeDelegatedFrame(2.f, frame_size, gfx::Rect(frame_size)));
 
   // When we get a new frame with the same frame size in physical pixels, but a
   // different scale, we should generate a new frame provider, as the final
   // result will need to be scaled differently to the screen.
   EXPECT_NE(frame_provider.get(), view_->frame_provider_.get());
 }
 
+class RenderWidgetHostViewAuraCopyRequestTest
+    : public RenderWidgetHostViewAuraShutdownTest {
+ public:
+  RenderWidgetHostViewAuraCopyRequestTest()
+      : callback_count_(0), result_(false) {}
+
+  void CallbackMethod(bool result) {
+    result_ = result;
+    callback_count_++;
+  }
+
+  int callback_count_;
+  bool result_;
+
+ private:
+  DISALLOW_COPY_AND_ASSIGN(RenderWidgetHostViewAuraCopyRequestTest);
+};
+
+TEST_F(RenderWidgetHostViewAuraCopyRequestTest, DestroyedAfterCopyRequest) {
+  gfx::Rect view_rect(100, 100);
+  scoped_ptr<cc::CopyOutputRequest> request;
+
+  view_->InitAsChild(NULL);
+  aura::client::ParentWindowWithContext(
+      view_->GetNativeView(),
+      parent_view_->GetNativeView()->GetRootWindow(),
+      gfx::Rect());
+  view_->SetSize(view_rect.size());
+  view_->WasShown();
+
+  scoped_ptr<FakeFrameSubscriber> frame_subscriber(new FakeFrameSubscriber(
+      view_rect.size(),
+      base::Bind(&RenderWidgetHostViewAuraCopyRequestTest::CallbackMethod,
+                 base::Unretained(this))));
+
+  EXPECT_EQ(0, callback_count_);
+  EXPECT_FALSE(view_->last_copy_request_);
+
+  view_->BeginFrameSubscription(
+      frame_subscriber.PassAs<RenderWidgetHostViewFrameSubscriber>());
+  view_->OnSwapCompositorFrame(
+      1, MakeDelegatedFrame(1.f, view_rect.size(), gfx::Rect(view_rect)));
+
+  EXPECT_EQ(0, callback_count_);
+  EXPECT_TRUE(view_->last_copy_request_);
+  EXPECT_TRUE(view_->last_copy_request_->has_texture_mailbox());
+  request = view_->last_copy_request_.Pass();
+
+  // There should be one subscriber texture in flight.
+  EXPECT_EQ(1u, view_->active_frame_subscriber_textures_.size());
+
+  // Send back the mailbox included in the request. There's no release callback
+  // since the mailbox came from the RWHVA originally.
+  request->SendTextureResult(view_rect.size(),
+                             request->texture_mailbox(),
+                             scoped_ptr<cc::SingleReleaseCallback>());
+
+  base::RunLoop run_loop;
+  run_loop.RunUntilIdle();
+
+  // The callback should succeed.
+  EXPECT_EQ(0u, view_->active_frame_subscriber_textures_.size());
+  EXPECT_EQ(1, callback_count_);
+  EXPECT_TRUE(result_);
+
+  view_->OnSwapCompositorFrame(
+      1, MakeDelegatedFrame(1.f, view_rect.size(), gfx::Rect(view_rect)));
+
+  EXPECT_EQ(1, callback_count_);
+  request = view_->last_copy_request_.Pass();
+
+  // There should be one subscriber texture in flight again.
+  EXPECT_EQ(1u, view_->active_frame_subscriber_textures_.size());
+
+  // Destroy the RenderWidgetHostViewAura and ImageTransportFactory.
+  TearDownEnvironment();
+
+  // Send back the mailbox included in the request. There's no release callback
+  // since the mailbox came from the RWHVA originally.
+  request->SendTextureResult(view_rect.size(),
+                             request->texture_mailbox(),
+                             scoped_ptr<cc::SingleReleaseCallback>());
+
+  // Because the copy request callback may be holding state within it, that
+  // state must handle the RWHVA and ImageTransportFactory going away before the
+  // callback is called. This test passes if it does not crash as a result of
+  // these things being destroyed.
+  EXPECT_EQ(2, callback_count_);
+  EXPECT_FALSE(result_);
+}
+
 }  // namespace content