Fix gpu command buffer use after free by GrContext

android_webview/browser/aw_render_thread_context_provider.cc

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "android_webview/browser/aw_render_thread_context_provider.h"
 
 #include "base/bind.h"
 #include "base/callback_helpers.h"
 #include "base/lazy_instance.h"
 #include "base/trace_event/trace_event.h"
@@ skipping 112 matching lines @@
   DCHECK(main_thread_checker_.CalledOnValidThread());
 
   if (gr_context_)
     return gr_context_.get();
 
   // The GrGLInterface factory will make GL calls using the C GLES2 interface.
   // Make sure the gles2 library is initialized first on exactly one thread.
   g_gles2_initializer.Get();
   gles2::SetGLContext(ContextGL());
 
-  skia::RefPtr<GrGLInterface> interface =
-      skia::AdoptRef(skia_bindings::CreateCommandBufferSkiaGLBinding());
+  skia::RefPtr<GrGLInterface> interface = skia::AdoptRef(new GrGLInterface);
+  skia_bindings::InitCommandBufferSkiaGLBinding(interface.get());
   interface->fCallback = BindGrContextCallback;
   interface->fCallbackData = reinterpret_cast<GrGLInterfaceCallbackData>(this);
 
   gr_context_ = skia::AdoptRef(GrContext::Create(
       kOpenGL_GrBackend, reinterpret_cast<GrBackendContext>(interface.get())));
 
   return gr_context_.get();
 }
 
 void AwRenderThreadContextProvider::InvalidateGrContext(uint32_t state) {
@@ skipping 29 matching lines @@
 void AwRenderThreadContextProvider::OnLostContext() {
   DCHECK(main_thread_checker_.CalledOnValidThread());
 
   if (!lost_context_callback_.is_null())
     base::ResetAndReturn(&lost_context_callback_).Run();
   if (gr_context_)
     gr_context_->abandonContext();
 }
 
 }  // namespace android_webview