WebGL: Transfer ownership of WebGraphicsContext3D from WebGLRenderingContext to DrawingBuffer.

Source/core/html/canvas/WebGLRenderingContext.h

 /*
  * Copyright (C) 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 181 matching lines @@
     String getShaderSource(WebGLShader*);
     Vector<String> getSupportedExtensions();
     WebGLGetInfo getTexParameter(GLenum target, GLenum pname);
     WebGLGetInfo getUniform(WebGLProgram*, const WebGLUniformLocation*);
     PassRefPtr<WebGLUniformLocation> getUniformLocation(WebGLProgram*, const String&);
     WebGLGetInfo getVertexAttrib(GLuint index, GLenum pname);
     long long getVertexAttribOffset(GLuint index, GLenum pname);
 
     void hint(GLenum target, GLenum mode);
     GLboolean isBuffer(WebGLBuffer*);
-    bool isContextLost();
+    bool isContextLost() const;
     GLboolean isEnabled(GLenum cap);
     GLboolean isFramebuffer(WebGLFramebuffer*);
     GLboolean isProgram(WebGLProgram*);
     GLboolean isRenderbuffer(WebGLRenderbuffer*);
     GLboolean isShader(WebGLShader*);
     GLboolean isTexture(WebGLTexture*);
 
     void lineWidth(GLfloat);
     void linkProgram(WebGLProgram*);
     void pixelStorei(GLenum pname, GLint param);
@@ skipping 98 matching lines @@
         // Lost context provoked by WEBKIT_lose_context.
         SyntheticLostContext,
 
         // A synthetic lost context that should attempt to recover automatically
         AutoRecoverSyntheticLostContext
     };
     void forceLostContext(LostContextMode);
     void forceRestoreContext();
     void loseContextImpl(LostContextMode);
 
-    blink::WebGraphicsContext3D* webGraphicsContext3D() const { return m_context.get(); }
+    blink::WebGraphicsContext3D* webGraphicsContext3D() const { return m_context; }
     WebGLContextGroup* contextGroup() const { return m_contextGroup.get(); }
     virtual blink::WebLayer* platformLayer() const OVERRIDE;
     Extensions3DUtil* extensionsUtil();
 
     void reshape(int width, int height);
 
     void markLayerComposited();
     virtual void paintRenderingResultsToCanvas() OVERRIDE;
     PassRefPtr<ImageData> paintRenderingResultsToImageData();
 
@@ skipping 46 matching lines @@
     // Adds a compressed texture format.
     void addCompressedTextureFormat(GLenum);
     void removeAllCompressedTextureFormats();
 
     PassRefPtr<Image> drawImageIntoBuffer(Image*, int width, int height);
 
     PassRefPtr<Image> videoFrameToImage(HTMLVideoElement*, BackingStoreCopy);
 
     WebGLRenderbuffer* ensureEmulatedStencilBuffer(GLenum target, WebGLRenderbuffer*);
 
-    OwnPtr<blink::WebGraphicsContext3D> m_context;
-    RefPtr<WebGLContextGroup> m_contextGroup;
-
     // Structure for rendering to a DrawingBuffer, instead of directly
     // to the back-buffer of m_context.
     RefPtr<DrawingBuffer> m_drawingBuffer;
+    // m_drawingBuffer owns m_context.
+    blink::WebGraphicsContext3D* m_context;

[Justin Novosad, 2014/02/24 15:25:56]

Having m_context is fragile because future code changes need to remember to keep
it in sync with m_drawingBuffer.  This adds a risk of introducing security
vulnerabilities in the future (memory use after free). We could get rid of
m_context and replace all uses of m_context with m_drawingBuffer->context().

+    RefPtr<WebGLContextGroup> m_contextGroup;
 
     // Dispatches a context lost event once it is determined that one is needed.
     // This is used both for synthetic and real context losses. For real ones, it's
     // likely that there's no JavaScript on the stack, but that might be dependent
     // on how exactly the platform discovers that the context was lost. For better
     // portability we always defer the dispatch of the event.
     Timer<WebGLRenderingContext> m_dispatchContextLostEventTimer;
     bool m_restoreAllowed;
     Timer<WebGLRenderingContext> m_restoreTimer;
 
@@ skipping 513 matching lines @@
     // If the vector is empty, return the maximum allowed active context number.
     static size_t oldestContextIndex();
     static IntSize oldestContextSize();
 };
 
 DEFINE_TYPE_CASTS(WebGLRenderingContext, CanvasRenderingContext, context, context->is3d(), context.is3d());
 
 } // namespace WebCore
 
 #endif