SkSurface copy-on-write can yield stale GPU render targets.

src/image/SkSurface_Gpu.cpp

Index: src/image/SkSurface_Gpu.cpp
diff --git a/src/image/SkSurface_Gpu.cpp b/src/image/SkSurface_Gpu.cpp
index dbe82f8c9f1110f890aca581922417f86c43fc3b..f0719d895a03b1e9a675b2820094a81e7af6178d 100644
--- a/src/image/SkSurface_Gpu.cpp
+++ b/src/image/SkSurface_Gpu.cpp
@@ -28,7 +28,6 @@ SkSurface_Gpu::~SkSurface_Gpu() {
 
 static GrRenderTarget* prepare_rt_for_external_access(SkSurface_Gpu* surface,
                                                       SkSurface::BackendHandleAccess access) {
-    GrRenderTarget* rt = surface->getDevice()->accessRenderTarget();
     switch (access) {
         case SkSurface::kFlushRead_BackendHandleAccess:
             break;
@@ -40,6 +39,9 @@ static GrRenderTarget* prepare_rt_for_external_access(SkSurface_Gpu* surface,
             surface->getDevice()->accessBitmap(false).notifyPixelsChanged();
             break;
     }
+
+    // Grab the render target *after* firing notifications, as it may get switched if CoW kicks in.
+    GrRenderTarget* rt = surface->getDevice()->accessRenderTarget();
     rt->prepareForExternalIO();
     return rt;
 }