SkSurface copy-on-write can yield stale GPU render targets.

tests/SurfaceTest.cpp

 /*
  * Copyright 2013 Google Inc.
  *
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file.
  */
 
 #include "SkCanvas.h"
 #include "SkData.h"
 #include "SkDevice.h"
@@ skipping 603 matching lines @@
                 SkAutoTUnref<SkImage> image(surface->newImageSnapshot());
                 REPORTER_ASSERT(reporter, image);
                 if (image) {
                     REPORTER_ASSERT(reporter, image->isOpaque() == SkToBool(opaque));
                 }
             }
         }
     }
 }
 
+static void test_backend_cow(skiatest::Reporter* reporter, SkSurface* surface,
+                             SkSurface::BackendHandleAccess mode,
+                             GrBackendObject (*func)(SkSurface*, SkSurface::BackendHandleAccess)) {
+    GrBackendObject obj1 = func(surface, mode);
+    SkAutoTUnref<SkImage> snap1(surface->newImageSnapshot());
+
+    GrBackendObject obj2 = func(surface, mode);
+    SkAutoTUnref<SkImage> snap2(surface->newImageSnapshot());
+
+    // If the access mode triggers CoW, then the backend objects should reflect it.
+    REPORTER_ASSERT(reporter, (obj1 == obj2) == (snap1 == snap2));
+}
+
 static void TestSurfaceCopyOnWrite(skiatest::Reporter* reporter, SurfaceType surfaceType,
                                    GrContext* context) {
     // Verify that the right canvas commands trigger a copy on write
     SkSurface* surface = create_surface(surfaceType, context);
     SkAutoTUnref<SkSurface> aur_surface(surface);
     SkCanvas* canvas = surface->getCanvas();
 
     const SkRect testRect =
         SkRect::MakeXYWH(SkIntToScalar(0), SkIntToScalar(0),
                          SkIntToScalar(4), SkIntToScalar(5));
@@ skipping 58 matching lines @@
     EXPECT_COPY_ON_WRITE(drawPath(testPath, testPaint))
     EXPECT_COPY_ON_WRITE(drawBitmap(testBitmap, 0, 0))
     EXPECT_COPY_ON_WRITE(drawBitmapRect(testBitmap, testRect))
     EXPECT_COPY_ON_WRITE(drawBitmapNine(testBitmap, testIRect, testRect, NULL))
     EXPECT_COPY_ON_WRITE(drawSprite(testBitmap, 0, 0, NULL))
     EXPECT_COPY_ON_WRITE(drawText(testText.c_str(), testText.size(), 0, 1, testPaint))
     EXPECT_COPY_ON_WRITE(drawPosText(testText.c_str(), testText.size(), testPoints2, \
         testPaint))
     EXPECT_COPY_ON_WRITE(drawTextOnPath(testText.c_str(), testText.size(), testPath, NULL, \
         testPaint))
+
+    const SkSurface::BackendHandleAccess accessModes[] = {
+        SkSurface::kFlushRead_BackendHandleAccess,
+        SkSurface::kFlushWrite_BackendHandleAccess,
+        SkSurface::kDiscardWrite_BackendHandleAccess,
+    };
+
+    for (auto access : accessModes) {
+        test_backend_cow(reporter, surface, access,
+                          [](SkSurface* s, SkSurface::BackendHandleAccess a) -> GrBackendObject {
+            return s->getTextureHandle(a);
+        });
+
+        test_backend_cow(reporter, surface, access,
+                          [](SkSurface* s, SkSurface::BackendHandleAccess a) -> GrBackendObject {
+            GrBackendObject result;
+            if (!s->getRenderTargetHandle(&result, a)) {
+                return 0;
+            }
+            return result;
+        });
+    }
 }
 
 static void TestSurfaceWritableAfterSnapshotRelease(skiatest::Reporter* reporter,
                                                     SurfaceType surfaceType,
                                                     GrContext* context) {
     // This test succeeds by not triggering an assertion.
     // The test verifies that the surface remains writable (usable) after
     // acquiring and releasing a snapshot without triggering a copy on write.
     SkAutoTUnref<SkSurface> surface(create_surface(surfaceType, context));
     SkCanvas* canvas = surface->getCanvas();
@@ skipping 274 matching lines @@
     test_image_color(reporter, refImg, expected1);
 #endif
     test_image_color(reporter, cpyImg, expected0);
 
     // Now exercise the release proc
     REPORTER_ASSERT(reporter, !releaseCtx.fIsReleased);
     refImg.reset(NULL); // force a release of the image
     REPORTER_ASSERT(reporter, releaseCtx.fIsReleased);
 }
 #endif