Speculative fix for crash in Canvas2DLayerBridge::freeReleasedMailbox

Source/platform/graphics/Canvas2DLayerBridge.cpp

Index: Source/platform/graphics/Canvas2DLayerBridge.cpp
diff --git a/Source/platform/graphics/Canvas2DLayerBridge.cpp b/Source/platform/graphics/Canvas2DLayerBridge.cpp
index e54518de3c4a8183ec47ce3359cb36f703f083da..9cfc29863e97b225f39f2aa020f555d16b96546d 100644
--- a/Source/platform/graphics/Canvas2DLayerBridge.cpp
+++ b/Source/platform/graphics/Canvas2DLayerBridge.cpp
@@ -37,6 +37,7 @@
 #include "public/platform/WebCompositorSupport.h"
 #include "public/platform/WebGraphicsContext3D.h"
 #include "public/platform/WebGraphicsContext3DProvider.h"
+#include "wtf/MainThread.h"
 #include "wtf/RefCountedLeakCounter.h"
 
 using blink::WebExternalTextureLayer;
@@ -287,6 +288,8 @@ bool Canvas2DLayerBridge::hasReleasedMailbox() const
 
 void Canvas2DLayerBridge::freeReleasedMailbox()
 {
+    if (!isValid())
+        return;
     MailboxInfo* mailboxInfo = releasedMailboxInfo();
     if (!mailboxInfo)
         return;
@@ -321,8 +324,12 @@ blink::WebGraphicsContext3D* Canvas2DLayerBridge::context()
 bool Canvas2DLayerBridge::isValid()
 {
     ASSERT(m_layer);
-    if (m_destructionInProgress)
+    ASSERT(isMainThread());
+    // guard against reentry
+    static bool inIsValid = false;
+    if (inIsValid || m_destructionInProgress)
         return false;
+    inIsValid = true;
     if (m_contextProvider->context3d()->isContextLost() || !m_surfaceIsValid) {
         // Attempt to recover.

[Stephen White, 2014/03/03 21:43:11]

Maybe we should just not be doing context recovery in isValid(), or at least,
provide a way to opt-out of recovery to the caller, so that your new callsite
won't have to worry about re-entry.

         blink::WebGraphicsContext3D* sharedContext = 0;
@@ -351,6 +358,7 @@ bool Canvas2DLayerBridge::isValid()
     }
     if (!m_surfaceIsValid)
         setRateLimitingEnabled(false);
+    inIsValid = false;
     return m_surfaceIsValid;
 }