SkSurface copy-on-write can yield stale GPU render targets.

src/image/SkSurface_Gpu.cpp

 /*
  * Copyright 2012 Google Inc.
  *
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file.
  */
 
 #include "SkSurface_Gpu.h"
 
 #include "SkCanvas.h"
@@ skipping 10 matching lines @@
     : INHERITED(device->width(), device->height(), &device->surfaceProps())
     , fDevice(SkRef(device)) {
 }
 
 SkSurface_Gpu::~SkSurface_Gpu() {
     fDevice->unref();
 }
 
 static GrRenderTarget* prepare_rt_for_external_access(SkSurface_Gpu* surface,
                                                       SkSurface::BackendHandleAccess access) {
-    GrRenderTarget* rt = surface->getDevice()->accessRenderTarget();
     switch (access) {
         case SkSurface::kFlushRead_BackendHandleAccess:
             break;
         case SkSurface::kFlushWrite_BackendHandleAccess:
         case SkSurface::kDiscardWrite_BackendHandleAccess:
             // for now we don't special-case on Discard, but we may in the future.
             surface->notifyContentWillChange(SkSurface::kRetain_ContentChangeMode);
             // legacy: need to dirty the bitmap's genID in our device (curse it)
             surface->getDevice()->accessBitmap(false).notifyPixelsChanged();
             break;
     }
+
+    // Grab the render target *after* firing notifications, as it may get switched if CoW kicks in.
+    GrRenderTarget* rt = surface->getDevice()->accessRenderTarget();
     rt->prepareForExternalIO();
     return rt;
 }
 
 GrBackendObject SkSurface_Gpu::onGetTextureHandle(BackendHandleAccess access) {
     GrRenderTarget* rt = prepare_rt_for_external_access(this, access);
     GrTexture* texture = rt->asTexture();
     if (texture) {
         return texture->getTextureHandle();
     }
@@ skipping 114 matching lines @@
     }
     SkAutoTUnref<SkGpuDevice> device(SkGpuDevice::Create(rt, props,
                                                          SkGpuDevice::kUninit_InitContents));
     if (!device) {
         return NULL;
     }
     return SkNEW_ARGS(SkSurface_Gpu, (device));
 }
 
 #endif