Make WebGL extensions get lost when context is lost.

Source/core/html/canvas/WebGLLoseContext.cpp

Index: Source/core/html/canvas/WebGLLoseContext.cpp
diff --git a/Source/core/html/canvas/WebGLLoseContext.cpp b/Source/core/html/canvas/WebGLLoseContext.cpp
index 49b3a72fcc5e3eddda884f7068e8ef4ecd791299..021f0d51754c2c4a4c0cf33597e6c74b4f8714ae 100644
--- a/Source/core/html/canvas/WebGLLoseContext.cpp
+++ b/Source/core/html/canvas/WebGLLoseContext.cpp
@@ -41,14 +41,19 @@ WebGLLoseContext::~WebGLLoseContext()
 {
 }
 
+void WebGLLoseContext::lose()
+{
+    // WebGLLostContext is special in that it is never lost.

[Ken Russell (switch to Gerrit), 2013/06/11 21:50:54]

We need to be very careful here. If the WebGLRenderingContext is actually GC'd
but we are still holding on to the WebGLLoseContext object then m_context can
become garbage. We must solve this somehow -- maybe with a boolean argument to
lose() indicating whether the context is "really" being lost.

[greggman, 2013/06/11 21:55:21]

This is already handled. ~WebGLRenderingContext loses all the extensions AND
removes all references.

[Ken Russell (switch to Gerrit), 2013/06/11 22:07:31]

I think there is still a problem:

1) JS code gets a WebGLRenderingContext and calls
getExtension("WEBGL_lose_context")
2) JS code releases its reference to the WebGLRenderingContext, canvas, etc. --
but not the WebGLLoseContext extension object -- and causes a GC
3) The WebGLRenderingContext is collected, but the WebGLLoseContext object is
not, because there is still a JS wrapper for it
4) JS calls either loseContext() or restoreContext() against the
WebGLLoseContext extension object, which causes m_context to be dereferenced

Even though at step (3) the WebGLRenderingContext destructor is called, all that
does is decrement the reference count of each extension object by one. They
might still be kept alive by JavaScript.

One way to solve this would be to add a non-virtual clearWeakContextReference()
to WebGLExtension, have WebGLExtension::lose() call that by default, and have
WebGLLoseContext override that behavior. ExtensionTracker's destructor could
call clearWeakContextReference(). WebGLLoseContext will need some guards around
the dereferencing of m_context.

[greggman, 2013/06/11 22:47:07]

Fixed

made lose() take a bool for "force". on context lost false is passed in, on
WebGLRenderingContext destruction true is passed in.

+}
+
 WebGLExtension::ExtensionName WebGLLoseContext::getName() const
 {
     return WebGLLoseContextName;
 }
 
-PassOwnPtr<WebGLLoseContext> WebGLLoseContext::create(WebGLRenderingContext* context)
+PassRefPtr<WebGLLoseContext> WebGLLoseContext::create(WebGLRenderingContext* context)
 {
-    return adoptPtr(new WebGLLoseContext(context));
+    return adoptRef(new WebGLLoseContext(context));
 }
 
 void WebGLLoseContext::loseContext()