Fix gpu command buffer use after free by GrContext

content/browser/gpu/gpu_ipc_browsertests.cc

Index: content/browser/gpu/gpu_ipc_browsertests.cc
diff --git a/content/browser/gpu/gpu_ipc_browsertests.cc b/content/browser/gpu/gpu_ipc_browsertests.cc
index 7154c2eea99418188c12363a5cf57a685cc1a1ed..e41c5fb9d3056d1a51e8ad67442496f70199834e 100644
--- a/content/browser/gpu/gpu_ipc_browsertests.cc
+++ b/content/browser/gpu/gpu_ipc_browsertests.cc
@@ -13,6 +13,9 @@
 #include "content/public/common/content_switches.h"
 #include "content/public/test/content_browser_test.h"
 #include "gpu/blink/webgraphicscontext3d_in_process_command_buffer_impl.h"
+#include "third_party/skia/include/core/SkCanvas.h"
+#include "third_party/skia/include/core/SkSurface.h"
+#include "third_party/skia/include/gpu/GrContext.h"
 #include "ui/gl/gl_switches.h"
 
 namespace {
@@ -197,6 +200,50 @@ IN_PROC_BROWSER_TEST_F(BrowserGpuChannelHostFactoryTest,
 // Test fails on Chromeos + Mac, flaky on Windows because UI Compositor
 // establishes a GPU channel.
 #if defined(OS_LINUX) && !defined(OS_CHROMEOS)
+#define MAYBE_GrContextKeepsGpuChannelAlive GrContextKeepsGpuChannelAlive
+#else
+#define MAYBE_GrContextKeepsGpuChannelAlive \
+    DISABLED_GrContextKeepsGpuChannelAlive
+#endif
+IN_PROC_BROWSER_TEST_F(BrowserGpuChannelHostFactoryTest,
+                       MAYBE_GrContextKeepsGpuChannelAlive) {

[Ken Russell (switch to Gerrit), 2015/11/11 19:16:51]

It looks like this new test's failing on some of the trybots.

+  // Test for crbug.com/551143
+  // This test verifies that holding a reference to the GrContext created by
+  // a ContextProviderCommandBuffer will keep the gpu channel alive after the
+  // provider has been destroyed. Without this behavior, user code would have
+  // to be careful to destroy objects in the right order to avoid using freed
+  // memory as a function pointer in the GrContext's GrGLInterface instance.
+  DCHECK(!IsChannelEstablished());
+  EstablishAndWait();
+
+  // Step 2: verify that holding onto the provider's GrContext will
+  // retain the host after provider is destroyed.
+  scoped_refptr<ContextProviderCommandBuffer> provider =
+      ContextProviderCommandBuffer::Create(CreateContext(),
+                                           OFFSCREEN_CONTEXT_FOR_TESTING);
+  EXPECT_TRUE(provider->BindToCurrentThread());
+
+  skia::RefPtr<GrContext> gr_context = skia::SharePtr(provider->GrContext());
+  provider = nullptr;
+
+  SkImageInfo info = SkImageInfo::MakeN32Premul(1, 1);
+  skia::RefPtr<SkSurface> surface = skia::AdoptRef(SkSurface::NewRenderTarget(
+      gr_context.get(), SkSurface::kNo_Budgeted, info));
+  gr_context = nullptr;
+
+  // use the canvas after the provider and grcontext have been locally
+  // unref'ed. This should work just fine thanks to SkSurface_Gpu ref'ing
+  // the GrContext, which is ref'ing the GrGLInterfaceForWebGraphicsContext3D,
+  // which owns the commandbuffer instance.
+  surface->getCanvas()->clear(SK_ColorGREEN);
+  SkColor readback;
+  surface->getCanvas()->readPixels(info, &readback, sizeof(SkColor), 0, 0);
+  EXPECT_EQ(SK_ColorGREEN, readback);
+}
+
+// Test fails on Chromeos + Mac, flaky on Windows because UI Compositor
+// establishes a GPU channel.
+#if defined(OS_LINUX) && !defined(OS_CHROMEOS)
 #define MAYBE_CrashAndRecover
 #else
 #define MAYBE_CrashAndRecover DISABLED_CrashAndRecover