Speculative fix for crash in Canvas2DLayerBridge::freeReleasedMailbox

Source/platform/graphics/Canvas2DLayerBridge.cpp

 /*
  * Copyright (C) 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
  *     notice, this list of conditions and the following disclaimer.
  * 2.  Redistributions in binary form must reproduce the above copyright
@@ skipping 19 matching lines @@
 #include "GrContext.h"
 #include "SkDevice.h"
 #include "SkSurface.h"
 #include "platform/TraceEvent.h"
 #include "platform/graphics/Canvas2DLayerManager.h"
 #include "platform/graphics/GraphicsLayer.h"
 #include "public/platform/Platform.h"
 #include "public/platform/WebCompositorSupport.h"
 #include "public/platform/WebGraphicsContext3D.h"
 #include "public/platform/WebGraphicsContext3DProvider.h"
+#include "wtf/MainThread.h"
 #include "wtf/RefCountedLeakCounter.h"
 
 using blink::WebExternalTextureLayer;
 using blink::WebGraphicsContext3D;
 
 namespace {
 enum {
     InvalidMailboxIndex = -1,
 };
 
@@ skipping 230 matching lines @@
     return hasReleasedMailbox() ? &m_mailboxes[m_releasedMailboxInfoIndex] : 0;
 }
 
 bool Canvas2DLayerBridge::hasReleasedMailbox() const
 {
     return m_releasedMailboxInfoIndex != InvalidMailboxIndex;
 }
 
 void Canvas2DLayerBridge::freeReleasedMailbox()
 {
+    if (!isValid())
+        return;
     MailboxInfo* mailboxInfo = releasedMailboxInfo();
     if (!mailboxInfo)
         return;
 
     ASSERT(mailboxInfo->m_status == MailboxReleased);
     if (mailboxInfo->m_mailbox.syncPoint) {
         context()->waitSyncPoint(mailboxInfo->m_mailbox.syncPoint);
         mailboxInfo->m_mailbox.syncPoint = 0;
     }
     // Invalidate texture state in case the compositor altered it since the copy-on-write.
@@ skipping 14 matching lines @@
     // the destruction of m_layer
     if (m_layer) {
         isValid(); // To ensure rate limiter is disabled if context is lost.
     }
     return m_contextProvider->context3d();
 }
 
 bool Canvas2DLayerBridge::isValid()
 {
     ASSERT(m_layer);
-    if (m_destructionInProgress)
+    ASSERT(isMainThread());
+    // guard against reentry
+    static bool inIsValid = false;
+    if (inIsValid || m_destructionInProgress)
         return false;
+    inIsValid = true;
     if (m_contextProvider->context3d()->isContextLost() || !m_surfaceIsValid) {
         // Attempt to recover.

[Stephen White, 2014/03/03 21:43:11]

Maybe we should just not be doing context recovery in isValid(), or at least,
provide a way to opt-out of recovery to the caller, so that your new callsite
won't have to worry about re-entry.

         blink::WebGraphicsContext3D* sharedContext = 0;
         m_layer->clearTexture();
         m_mailboxes.clear();
         m_releasedMailboxInfoIndex = InvalidMailboxIndex;
         m_contextProvider = adoptPtr(blink::Platform::current()->createSharedOffscreenGraphicsContext3DProvider());
         if (m_contextProvider)
             sharedContext = m_contextProvider->context3d();
 
         if (!sharedContext || sharedContext->isContextLost()) {
             m_surfaceIsValid = false;
         } else {
             IntSize size(m_canvas->getTopDevice()->width(), m_canvas->getTopDevice()->height());
             RefPtr<SkSurface> surface(createSkSurface(m_contextProvider->grContext(), size, m_msaaSampleCount));
             if (surface.get()) {
                 m_canvas->setSurface(surface.get());
                 m_surfaceIsValid = true;
                 // FIXME: draw sad canvas picture into new buffer crbug.com/243842
             } else {
                 // Surface allocation failed. Set m_surfaceIsValid to false to
                 // trigger subsequent retry.
                 m_surfaceIsValid = false;
             }
         }
     }
     if (!m_surfaceIsValid)
         setRateLimitingEnabled(false);
+    inIsValid = false;
     return m_surfaceIsValid;
 }
 
 bool Canvas2DLayerBridge::prepareMailbox(blink::WebExternalTextureMailbox* outMailbox, blink::WebExternalBitmap* bitmap)
 {
     if (bitmap) {
         // Using accelerated 2d canvas with software renderer, which
         // should only happen in tests that use fake graphics contexts
         // or in Android WebView in software mode. In this case, we do
         // not care about producing any results for this canvas.
@@ skipping 141 matching lines @@
 Canvas2DLayerBridge::MailboxInfo::MailboxInfo(const MailboxInfo& other) {
     // This copy constructor should only be used for Vector reallocation
     // Assuming 'other' is to be destroyed, we transfer m_image ownership
     // rather than do a refcount dance.
     memcpy(&m_mailbox, &other.m_mailbox, sizeof(m_mailbox));
     m_image = const_cast<MailboxInfo*>(&other)->m_image.release();
     m_status = other.m_status;
 }
 
 }