Make WebGL extensions get lost when context is lost.

Source/core/html/canvas/WebGLLoseContext.cpp

 /*
  * Copyright (C) 2010 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
  *     notice, this list of conditions and the following disclaimer.
  * 2.  Redistributions in binary form must reproduce the above copyright
@@ skipping 23 matching lines @@
 WebGLLoseContext::WebGLLoseContext(WebGLRenderingContext* context)
     : WebGLExtension(context)
 {
     ScriptWrappable::init(this);
 }
 
 WebGLLoseContext::~WebGLLoseContext()
 {
 }
 
+void WebGLLoseContext::lose()
+{
+    // WebGLLostContext is special in that it is never lost.

[Ken Russell (switch to Gerrit), 2013/06/11 21:50:54]

We need to be very careful here. If the WebGLRenderingContext is actually GC'd
but we are still holding on to the WebGLLoseContext object then m_context can
become garbage. We must solve this somehow -- maybe with a boolean argument to
lose() indicating whether the context is "really" being lost.

[greggman, 2013/06/11 21:55:21]

This is already handled. ~WebGLRenderingContext loses all the extensions AND
removes all references.

[Ken Russell (switch to Gerrit), 2013/06/11 22:07:31]

I think there is still a problem:

1) JS code gets a WebGLRenderingContext and calls
getExtension("WEBGL_lose_context")
2) JS code releases its reference to the WebGLRenderingContext, canvas, etc. --
but not the WebGLLoseContext extension object -- and causes a GC
3) The WebGLRenderingContext is collected, but the WebGLLoseContext object is
not, because there is still a JS wrapper for it
4) JS calls either loseContext() or restoreContext() against the
WebGLLoseContext extension object, which causes m_context to be dereferenced

Even though at step (3) the WebGLRenderingContext destructor is called, all that
does is decrement the reference count of each extension object by one. They
might still be kept alive by JavaScript.

One way to solve this would be to add a non-virtual clearWeakContextReference()
to WebGLExtension, have WebGLExtension::lose() call that by default, and have
WebGLLoseContext override that behavior. ExtensionTracker's destructor could
call clearWeakContextReference(). WebGLLoseContext will need some guards around
the dereferencing of m_context.

[greggman, 2013/06/11 22:47:07]

Fixed

made lose() take a bool for "force". on context lost false is passed in, on
WebGLRenderingContext destruction true is passed in.

+}
+
 WebGLExtension::ExtensionName WebGLLoseContext::getName() const
 {
     return WebGLLoseContextName;
 }
 
-PassOwnPtr<WebGLLoseContext> WebGLLoseContext::create(WebGLRenderingContext* context)
+PassRefPtr<WebGLLoseContext> WebGLLoseContext::create(WebGLRenderingContext* context)
 {
-    return adoptPtr(new WebGLLoseContext(context));
+    return adoptRef(new WebGLLoseContext(context));
 }
 
 void WebGLLoseContext::loseContext()
 {
     m_context->forceLostContext(WebGLRenderingContext::SyntheticLostContext);
 }
 
 void WebGLLoseContext::restoreContext()
 {
     m_context->forceRestoreContext();
 }
 
 bool WebGLLoseContext::supported(WebGLRenderingContext*)
 {
     return true;
 }
 
 const char* WebGLLoseContext::getExtensionName()
 {
     return "WEBGL_lose_context";
 }
 
 } // namespace WebCore