Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(1905)

Unified Diff: android_webview/java/src/org/chromium/android_webview/AwContents.java

Issue 1890343003: aw: Use functor callback for lifetime management (Closed) Base URL: https://chromium.googlesource.com/chromium/src.git@master
Patch Set: fix UAF for realz Created 4 years, 8 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
Index: android_webview/java/src/org/chromium/android_webview/AwContents.java
diff --git a/android_webview/java/src/org/chromium/android_webview/AwContents.java b/android_webview/java/src/org/chromium/android_webview/AwContents.java
index 6c350aef581da8f80188af28408a39719a3ccc7d..98935fb37ca678c70e322d6bddd8eeb5e281492d 100644
--- a/android_webview/java/src/org/chromium/android_webview/AwContents.java
+++ b/android_webview/java/src/org/chromium/android_webview/AwContents.java
@@ -169,13 +169,7 @@ public class AwContents implements SmartClipProvider,
* native GL rendering.
*/
public interface NativeGLDelegate {
- /**
- * Set the callback for when the getAwDrawGLFunction objects is safe to be deleted
- * for this view. The callback forms a lifecycle between requestDrawGL (with canvas).
- *
- * @return false if not supported and this is a no-op; true otherwise.
- */
- boolean setDrawGLFunctionDetachedCallback(View view, Runnable callback);
+ boolean supportsDrawGLFunctorReleasedCallback();
/**
* Requests a callback on the native DrawGL method (see getAwDrawGLFunction)
@@ -189,7 +183,8 @@ public class AwContents implements SmartClipProvider,
* @return false indicates the GL draw request was not accepted, and the caller
* should fallback to the SW path.
*/
- boolean requestDrawGL(Canvas canvas, boolean waitForCompletion, View containerView);
+ boolean requestDrawGL(Canvas canvas, boolean waitForCompletion, View containerView,
+ Runnable releasedRunnable);
/**
* Detaches the GLFunctor from the view tree.
@@ -252,8 +247,6 @@ public class AwContents implements SmartClipProvider,
// This can be accessed on any thread after construction. See AwContentsIoThreadClient.
private final AwSettings mSettings;
private final ScrollAccessibilityHelper mScrollAccessibilityHelper;
- private final boolean mSupportsFunctorDetachedCallback;
- private boolean mFunctorDetachedCallbackPending;
private boolean mIsPaused;
private boolean mIsViewVisible;
@@ -329,17 +322,18 @@ public class AwContents implements SmartClipProvider,
// Hold onto a reference to the window (via its wrapper), so that it is not destroyed
// until we are done here.
private final WindowAndroidWrapper mWindowAndroid;
- private final AwGLFunctor mAwGLFunctor;
+ private final Runnable mAwGLFunctorDestroyRunnable;
private DestroyRunnable(long nativeAwContents, WindowAndroidWrapper windowAndroid,
AwGLFunctor awGLFunctor) {
mNativeAwContents = nativeAwContents;
mWindowAndroid = windowAndroid;
- mAwGLFunctor = awGLFunctor;
+ mAwGLFunctorDestroyRunnable = awGLFunctor.getDestroyRunnable();
}
@Override
public void run() {
nativeDestroy(mNativeAwContents);
+ mAwGLFunctorDestroyRunnable.run();
}
}
@@ -765,13 +759,6 @@ public class AwContents implements SmartClipProvider,
setNewAwContents(nativeInit(mBrowserContext));
- mSupportsFunctorDetachedCallback =
- mNativeGLDelegate.setDrawGLFunctionDetachedCallback(mContainerView, new Runnable() {
- @Override
- public void run() {
- onFunctorDetached();
- }
- });
onContainerViewChanged();
}
@@ -990,10 +977,7 @@ public class AwContents implements SmartClipProvider,
mContentViewCore = createAndInitializeContentViewCore(mContainerView, mContext,
mInternalAccessAdapter, webContents, new AwGestureStateListener(),
mContentViewClient, mZoomControls, mWindowAndroid.getWindowAndroid());
- mAwGLFunctor = new AwGLFunctor();
- if (mIsAttachedToWindow) {
- mAwGLFunctor.onAttachedToWindow(mNativeGLDelegate, mContainerView);
- }
+ mAwGLFunctor = new AwGLFunctor(mNativeGLDelegate, mContainerView);
nativeSetAwGLFunctor(mNativeAwContents, mAwGLFunctor.getNativeAwGLFunctor());
nativeSetJavaPeers(mNativeAwContents, this, mWebContentsDelegate, mContentsClientBridge,
mIoThreadClient, mInterceptNavigationDelegate);
@@ -1113,7 +1097,7 @@ public class AwContents implements SmartClipProvider,
// hardware resources.
if (mIsAttachedToWindow) {
Log.w(TAG, "WebView.destroy() called while WebView is still attached to window.");
- mAwGLFunctor.onDetachedFromWindow();
+ mAwGLFunctor.deleteHardwareRenderer();
nativeOnDetachedFromWindow(mNativeAwContents);
}
mIsDestroyed = true;
@@ -1142,10 +1126,6 @@ public class AwContents implements SmartClipProvider,
mCleanupReference.cleanupNow();
mCleanupReference = null;
- if (!mFunctorDetachedCallbackPending) {
- mAwGLFunctor.destroy();
- mAwGLFunctor = null;
- }
}
assert mContentViewCore == null;
@@ -2344,16 +2324,6 @@ public class AwContents implements SmartClipProvider,
mAwViewMethods.onDetachedFromWindow();
}
- // Note short term fix. This is only called for the original container view, not the
- // FullScreenView.
- public void onFunctorDetached() {
- mFunctorDetachedCallbackPending = false;
- if (isDestroyed(NO_WARN) && mAwGLFunctor != null) {
- mAwGLFunctor.destroy();
- mAwGLFunctor = null;
- }
- }
-
/**
* @see android.view.View#onWindowFocusChanged()
*/
@@ -2948,9 +2918,7 @@ public class AwContents implements SmartClipProvider,
canvas.isHardwareAccelerated(), scrollX, scrollY, globalVisibleRect.left,
globalVisibleRect.top, globalVisibleRect.right, globalVisibleRect.bottom);
if (did_draw && canvas.isHardwareAccelerated() && !FORCE_AUXILIARY_BITMAP_RENDERING) {
- did_draw = mNativeGLDelegate.requestDrawGL(canvas, false, mContainerView);
- mFunctorDetachedCallbackPending |=
- (mSupportsFunctorDetachedCallback && did_draw && !isFullScreen());
+ did_draw = mAwGLFunctor.requestDrawGLForCanvas(canvas);
}
if (did_draw) {
int scrollXDiff = mContainerView.getScrollX() - scrollX;
@@ -3098,7 +3066,6 @@ public class AwContents implements SmartClipProvider,
mContentViewCore.onAttachedToWindow();
nativeOnAttachedToWindow(mNativeAwContents, mContainerView.getWidth(),
mContainerView.getHeight());
- mAwGLFunctor.onAttachedToWindow(mNativeGLDelegate, mContainerView);
updateHardwareAcceleratedFeaturesToggle();
postUpdateContentViewCoreVisibility();
@@ -3119,7 +3086,7 @@ public class AwContents implements SmartClipProvider,
}
mIsAttachedToWindow = false;
hideAutofillPopup();
- mAwGLFunctor.onDetachedFromWindow();
+ mAwGLFunctor.deleteHardwareRenderer();
nativeOnDetachedFromWindow(mNativeAwContents);
mContentViewCore.onDetachedFromWindow();

Powered by Google App Engine
This is Rietveld 408576698