WebGL: Transfer ownership of WebGraphicsContext3D from WebGLRenderingContext to DrawingBuffer.

Source/core/html/canvas/WebGLRenderingContext.h

Index: Source/core/html/canvas/WebGLRenderingContext.h
diff --git a/Source/core/html/canvas/WebGLRenderingContext.h b/Source/core/html/canvas/WebGLRenderingContext.h
index b49c64844d99b6a49e0893acb3cb8a20283a4ac3..61f34596d6e2304fc902cb2bc70c02c60df53aae 100644
--- a/Source/core/html/canvas/WebGLRenderingContext.h
+++ b/Source/core/html/canvas/WebGLRenderingContext.h
@@ -199,7 +199,7 @@ public:
 
     void hint(GLenum target, GLenum mode);
     GLboolean isBuffer(WebGLBuffer*);
-    bool isContextLost();
+    bool isContextLost() const;
     GLboolean isEnabled(GLenum cap);
     GLboolean isFramebuffer(WebGLFramebuffer*);
     GLboolean isProgram(WebGLProgram*);
@@ -318,7 +318,7 @@ public:
     void forceRestoreContext();
     void loseContextImpl(LostContextMode);
 
-    blink::WebGraphicsContext3D* webGraphicsContext3D() const { return m_context.get(); }
+    blink::WebGraphicsContext3D* webGraphicsContext3D() const { return m_context; }
     WebGLContextGroup* contextGroup() const { return m_contextGroup.get(); }
     virtual blink::WebLayer* platformLayer() const OVERRIDE;
     Extensions3DUtil* extensionsUtil();
@@ -385,12 +385,12 @@ public:
 
     WebGLRenderbuffer* ensureEmulatedStencilBuffer(GLenum target, WebGLRenderbuffer*);
 
-    OwnPtr<blink::WebGraphicsContext3D> m_context;
-    RefPtr<WebGLContextGroup> m_contextGroup;
-
     // Structure for rendering to a DrawingBuffer, instead of directly
     // to the back-buffer of m_context.
     RefPtr<DrawingBuffer> m_drawingBuffer;
+    // m_drawingBuffer owns m_context.
+    blink::WebGraphicsContext3D* m_context;

[Justin Novosad, 2014/02/24 15:25:56]

Having m_context is fragile because future code changes need to remember to keep
it in sync with m_drawingBuffer.  This adds a risk of introducing security
vulnerabilities in the future (memory use after free). We could get rid of
m_context and replace all uses of m_context with m_drawingBuffer->context().

+    RefPtr<WebGLContextGroup> m_contextGroup;
 
     // Dispatches a context lost event once it is determined that one is needed.
     // This is used both for synthetic and real context losses. For real ones, it's