Speculative fix for crash in Canvas2DLayerBridge::freeReleasedMailbox

Source/platform/graphics/Canvas2DLayerBridge.cpp

 /*
  * Copyright (C) 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
  *     notice, this list of conditions and the following disclaimer.
  * 2.  Redistributions in binary form must reproduce the above copyright
@@ skipping 186 matching lines @@
     }
     ++m_framesSinceMailboxRelease;
     if (releasedMailboxHasExpired()) {
         freeReleasedMailbox();
     }
 }
 
 void Canvas2DLayerBridge::prepareForDraw()
 {
     ASSERT(m_layer);
-    if (!isValid()) {
+    if (!surfaceIsValid() && !recoverSurface()) {
         if (m_canvas) {
             // drop pending commands because there is no surface to draw to
             m_canvas->silentFlush();
         }
         return;
     }
     context()->makeContextCurrent();
 }
 
 void Canvas2DLayerBridge::storageAllocatedForRecordingChanged(size_t bytesAllocated)
@@ skipping 62 matching lines @@
     return hasReleasedMailbox() ? &m_mailboxes[m_releasedMailboxInfoIndex] : 0;
 }
 
 bool Canvas2DLayerBridge::hasReleasedMailbox() const
 {
     return m_releasedMailboxInfoIndex != InvalidMailboxIndex;
 }
 
 void Canvas2DLayerBridge::freeReleasedMailbox()
 {
+    if (m_contextProvider->context3d()->isContextLost() || !m_surfaceIsValid)
+        return;
     MailboxInfo* mailboxInfo = releasedMailboxInfo();
     if (!mailboxInfo)
         return;
 
     ASSERT(mailboxInfo->m_status == MailboxReleased);
     if (mailboxInfo->m_mailbox.syncPoint) {
         context()->waitSyncPoint(mailboxInfo->m_mailbox.syncPoint);
         mailboxInfo->m_mailbox.syncPoint = 0;
     }
     // Invalidate texture state in case the compositor altered it since the copy-on-write.
     if (mailboxInfo->m_image) {
         if (isHidden() || releasedMailboxHasExpired())
             mailboxInfo->m_image->getTexture()->resetFlag(static_cast<GrTextureFlags>(GrTexture::kReturnToCache_FlagBit));
         mailboxInfo->m_image->getTexture()->invalidateCachedState();
         mailboxInfo->m_image.clear();
     }
     mailboxInfo->m_status = MailboxAvailable;
     m_releasedMailboxInfoIndex = InvalidMailboxIndex;
     Canvas2DLayerManager::get().layerTransientResourceAllocationChanged(this);
 }
 
 blink::WebGraphicsContext3D* Canvas2DLayerBridge::context()
 {
     // Check on m_layer is necessary because context() may be called during
     // the destruction of m_layer
-    if (m_layer) {
-        isValid(); // To ensure rate limiter is disabled if context is lost.
+    if (m_layer && !surfaceIsValid()) {
+        recoverSurface(); // To ensure rate limiter is disabled if context is lost.
     }
     return m_contextProvider->context3d();
 }
 
-bool Canvas2DLayerBridge::isValid()
+bool Canvas2DLayerBridge::surfaceIsValid()
 {
-    ASSERT(m_layer);
+    return !m_destructionInProgress && !m_contextProvider->context3d()->isContextLost() && m_surfaceIsValid;
+}
+
+bool Canvas2DLayerBridge::recoverSurface()
+{
+    ASSERT(m_layer && !surfaceIsValid());
     if (m_destructionInProgress)
         return false;
-    if (m_contextProvider->context3d()->isContextLost() || !m_surfaceIsValid) {
-        // Attempt to recover.
-        blink::WebGraphicsContext3D* sharedContext = 0;
-        m_layer->clearTexture();
-        m_mailboxes.clear();
-        m_releasedMailboxInfoIndex = InvalidMailboxIndex;
-        m_contextProvider = adoptPtr(blink::Platform::current()->createSharedOffscreenGraphicsContext3DProvider());
-        if (m_contextProvider)
-            sharedContext = m_contextProvider->context3d();
 
-        if (!sharedContext || sharedContext->isContextLost()) {
+    blink::WebGraphicsContext3D* sharedContext = 0;
+    m_layer->clearTexture();
+    m_mailboxes.clear();
+    m_releasedMailboxInfoIndex = InvalidMailboxIndex;
+    m_contextProvider = adoptPtr(blink::Platform::current()->createSharedOffscreenGraphicsContext3DProvider());
+    if (m_contextProvider)
+        sharedContext = m_contextProvider->context3d();
+
+    if (!sharedContext || sharedContext->isContextLost()) {
+        m_surfaceIsValid = false;
+    } else {
+        IntSize size(m_canvas->getTopDevice()->width(), m_canvas->getTopDevice()->height());
+        RefPtr<SkSurface> surface(createSkSurface(m_contextProvider->grContext(), size, m_msaaSampleCount));
+        if (surface.get()) {
+            m_canvas->setSurface(surface.get());
+            m_surfaceIsValid = true;
+            // FIXME: draw sad canvas picture into new buffer crbug.com/243842
+        } else {
+            // Surface allocation failed. Set m_surfaceIsValid to false to
+            // trigger subsequent retry.
             m_surfaceIsValid = false;
-        } else {
-            IntSize size(m_canvas->getTopDevice()->width(), m_canvas->getTopDevice()->height());
-            RefPtr<SkSurface> surface(createSkSurface(m_contextProvider->grContext(), size, m_msaaSampleCount));
-            if (surface.get()) {
-                m_canvas->setSurface(surface.get());
-                m_surfaceIsValid = true;
-                // FIXME: draw sad canvas picture into new buffer crbug.com/243842
-            } else {
-                // Surface allocation failed. Set m_surfaceIsValid to false to
-                // trigger subsequent retry.
-                m_surfaceIsValid = false;
-            }
         }
     }
     if (!m_surfaceIsValid)
         setRateLimitingEnabled(false);
+
     return m_surfaceIsValid;
 }
 
 bool Canvas2DLayerBridge::prepareMailbox(blink::WebExternalTextureMailbox* outMailbox, blink::WebExternalBitmap* bitmap)
 {
     if (bitmap) {
         // Using accelerated 2d canvas with software renderer, which
         // should only happen in tests that use fake graphics contexts
         // or in Android WebView in software mode. In this case, we do
         // not care about producing any results for this canvas.
         m_canvas->silentFlush();
         m_lastImageId = 0;
         return false;
     }
-    if (!isValid())
+    if (!surfaceIsValid() && !recoverSurface())
         return false;
 
     blink::WebGraphicsContext3D* webContext = context();
 
     // Release to skia textures that were previouosly released by the
     // compositor. We do this before acquiring the next snapshot in
     // order to cap maximum gpu memory consumption.
     webContext->makeContextCurrent();
     flush();
 
@@ skipping 104 matching lines @@
 void Canvas2DLayerBridge::willUse()
 {
     ASSERT(!m_destructionInProgress);
     Canvas2DLayerManager::get().layerDidDraw(this);
     m_didRecordDrawCommand = true;
 }
 
 Platform3DObject Canvas2DLayerBridge::getBackingTexture()
 {
     ASSERT(!m_destructionInProgress);
-    if (!isValid())
+    if (!surfaceIsValid() && !recoverSurface())
         return 0;
     willUse();
     m_canvas->flush();
     context()->flush();
     GrRenderTarget* renderTarget = m_canvas->getTopDevice()->accessRenderTarget();
     if (renderTarget) {
         return renderTarget->asTexture()->getTextureHandle();
     }
     return 0;
 }
 
 Canvas2DLayerBridge::MailboxInfo::MailboxInfo(const MailboxInfo& other) {
     // This copy constructor should only be used for Vector reallocation
     // Assuming 'other' is to be destroyed, we transfer m_image ownership
     // rather than do a refcount dance.
     memcpy(&m_mailbox, &other.m_mailbox, sizeof(m_mailbox));
     m_image = const_cast<MailboxInfo*>(&other)->m_image.release();
     m_status = other.m_status;
 }
 
 }