WebGL: Don't destroy mailbox textures in the destructor until they're released.

Source/platform/graphics/gpu/DrawingBuffer.h

Index: Source/platform/graphics/gpu/DrawingBuffer.h
diff --git a/Source/platform/graphics/gpu/DrawingBuffer.h b/Source/platform/graphics/gpu/DrawingBuffer.h
index b74f4cf2fbb0ebd5241016bf5986b8ea396a1b68..2c724bd0c21f169bae9e59675b18fbc51b9ac8f9 100644
--- a/Source/platform/graphics/gpu/DrawingBuffer.h
+++ b/Source/platform/graphics/gpu/DrawingBuffer.h
@@ -41,6 +41,7 @@
 #include "third_party/khronos/GLES2/gl2.h"
 #include "third_party/khronos/GLES2/gl2ext.h"
 #include "third_party/skia/include/core/SkBitmap.h"
+#include "wtf/Deque.h"
 #include "wtf/Noncopyable.h"
 #include "wtf/OwnPtr.h"
 #include "wtf/PassOwnPtr.h"
@@ -72,6 +73,10 @@ class PLATFORM_EXPORT DrawingBuffer : public RefCounted<DrawingBuffer>, public b
         blink::WebExternalTextureMailbox mailbox;
         unsigned textureId;
         IntSize size;
+        // This keeps the parent drawing buffer alive as long as the compositor is
+        // referring to one of the mailboxes DrawingBuffer produced. The parent drawing buffer is
+        // cleared when the compositor returns the mailbox. See mailboxReleased().
+        RefPtr<DrawingBuffer> m_parentDrawingBuffer;
     };
 public:
     enum PreserveDrawingBuffer {
@@ -83,6 +88,9 @@ public:
 
     virtual ~DrawingBuffer();
 
+    // Destruction will be completed after all mailboxes are released.
+    void beginDestruction();
+
     // Issues a glClear() on all framebuffers associated with this DrawingBuffer. The caller is responsible for
     // making the context current and setting the clear values and masks. Modifies the framebuffer binding.
     void clearFramebuffers(GLbitfield clearMask);
@@ -138,12 +146,14 @@ public:
     void paintRenderingResultsToCanvas(ImageBuffer*);
     PassRefPtr<Uint8ClampedArray> paintRenderingResultsToImageData(int&, int&);
 
-private:
+protected: // For unittests
     DrawingBuffer(PassOwnPtr<blink::WebGraphicsContext3D>, bool multisampleExtensionSupported,
                   bool packedDepthStencilExtensionSupported, PreserveDrawingBuffer, PassRefPtr<ContextEvictionManager>);
 
     bool initialize(const IntSize&);
-    void releaseResources();
+
+private:
+    void mailboxReleasedWhileDestructionInProgress(const blink::WebExternalTextureMailbox&);
 
     unsigned createColorTexture(const IntSize& size = IntSize());
     // Create the depth/stencil and multisample buffers, if needed.
@@ -159,6 +169,7 @@ private:
 
     PassRefPtr<MailboxInfo> recycledMailbox();
     PassRefPtr<MailboxInfo> createNewMailbox(unsigned);
+    void deleteMailbox(const blink::WebExternalTextureMailbox&);
 
     // Updates the current size of the buffer, ensuring that s_currentResourceUsePixels is updated.
     void setSize(const IntSize& size);
@@ -237,13 +248,14 @@ private:
     int m_maxTextureSize;
     int m_sampleCount;
     int m_packAlignment;
+    bool m_destructionInProgress;
 
     OwnPtr<blink::WebExternalTextureLayer> m_layer;
 
     // All of the mailboxes that this DrawingBuffer has ever created.
     Vector<RefPtr<MailboxInfo> > m_textureMailboxes;
-    // Mailboxes that were released by the compositor and can be used again by this DrawingBuffer.
-    Vector<RefPtr<MailboxInfo> > m_recycledMailboxes;
+    // Mailboxes that were released by the compositor can be used again by this DrawingBuffer.
+    Deque<blink::WebExternalTextureMailbox> m_recycledMailboxQueue;
 
     RefPtr<ContextEvictionManager> m_contextEvictionManager;