Pepper takes ownership of a mailbox before passing it to the texture layer.

gpu/command_buffer/service/gles2_cmd_decoder.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "gpu/command_buffer/service/gles2_cmd_decoder.h"
 
 #include <limits.h>
 #include <stddef.h>
 #include <stdint.h>
 #include <stdio.h>
@@ skipping 575 matching lines @@
 
   // Overridden from GLES2Decoder.
   bool Initialize(const scoped_refptr<gfx::GLSurface>& surface,
                   const scoped_refptr<gfx::GLContext>& context,
                   bool offscreen,
                   const gfx::Size& offscreen_size,
                   const DisallowedFeatures& disallowed_features,
                   const std::vector<int32_t>& attribs) override;
   void Destroy(bool have_context) override;
   void SetSurface(const scoped_refptr<gfx::GLSurface>& surface) override;
-  void ProduceFrontBuffer(const Mailbox& mailbox) override;
+  void ReleaseSurface() override;
+  void TakeFrontBuffer(const Mailbox& mailbox) override;
+  void ReturnFrontBuffer(const Mailbox& mailbox,
+                         bool is_lost) override;
   bool ResizeOffscreenFrameBuffer(const gfx::Size& size) override;
   void UpdateParentTextureInfo();
   bool MakeCurrent() override;
   GLES2Util* GetGLES2Util() override { return &util_; }
   gfx::GLContext* GetGLContext() override { return context_.get(); }
   ContextGroup* GetContextGroup() override { return group_.get(); }
   Capabilities GetCapabilities() override;
   void RestoreState(const ContextState* prev_state) override;
 
   void RestoreActiveTexture() const override { state_.RestoreActiveTexture(); }
@@ skipping 1380 matching lines @@
   GLenum offscreen_target_stencil_format_;
   GLsizei offscreen_target_samples_;
   GLboolean offscreen_target_buffer_preserved_;
 
   // The copy that is saved when SwapBuffers is called.
   std::unique_ptr<BackFramebuffer> offscreen_saved_frame_buffer_;
   std::unique_ptr<BackTexture> offscreen_saved_color_texture_;
   scoped_refptr<TextureRef>
       offscreen_saved_color_texture_info_;
 
+  // When a client requests ownership of the swapped front buffer, all
+  // information is saved in this structure, and |in_use| is set to true. When a
+  // client releases ownership, |in_use| is set to false.
+  //
+  // An instance of this struct, with |in_use| = false may be reused instead of
+  // making a new BackTexture.
+  struct SavedBackTexture {
+    std::unique_ptr<BackTexture> back_texture;
+    scoped_refptr<TextureRef> texture_ref;
+    bool in_use;
+  };
+  std::vector<SavedBackTexture> saved_back_textures_;
+
+  // If there's a SavedBackTexture that's not in use, takes that. Otherwise,
+  // generates a new back texture.
+  void CreateBackTexture();
+  size_t create_back_texture_count_for_test_ = 0;
+
+  // Releases all saved BackTextures that are not in use by a client.
+  void ReleaseNotInUseBackTextures();
+
+  // Releases all saved BackTextures.
+  void ReleaseAllBackTextures();
+
+  size_t GetSavedBackTextureCountForTest() override;
+  size_t GetCreatedBackTextureCountForTest() override;
+
   // The copy that is used as the destination for multi-sample resolves.
   std::unique_ptr<BackFramebuffer> offscreen_resolved_frame_buffer_;
   std::unique_ptr<BackTexture> offscreen_resolved_color_texture_;
   GLenum offscreen_saved_color_format_;
 
   std::unique_ptr<QueryManager> query_manager_;
 
   std::unique_ptr<VertexArrayManager> vertex_array_manager_;
 
   std::unique_ptr<ImageManager> image_manager_;
@@ skipping 2053 matching lines @@
   framebuffer_state_.bound_draw_framebuffer = NULL;
   state_.bound_renderbuffer = NULL;
 
   if (offscreen_saved_color_texture_info_.get()) {
     DCHECK(offscreen_target_color_texture_);
     DCHECK_EQ(offscreen_saved_color_texture_info_->service_id(),
               offscreen_saved_color_texture_->id());
     offscreen_saved_color_texture_->Invalidate();
     offscreen_saved_color_texture_info_ = NULL;
   }
+  ReleaseAllBackTextures();
   if (have_context) {
     if (copy_texture_CHROMIUM_.get()) {
       copy_texture_CHROMIUM_->Destroy();
       copy_texture_CHROMIUM_.reset();
     }
 
     clear_framebuffer_blit_.reset();
 
     if (state_.current_program.get()) {
       program_manager()->UnuseProgram(shader_manager(),
@@ skipping 118 matching lines @@
 }
 
 void GLES2DecoderImpl::SetSurface(
     const scoped_refptr<gfx::GLSurface>& surface) {
   DCHECK(context_->IsCurrent(NULL));
   DCHECK(surface_.get());
   surface_ = surface;
   RestoreCurrentFramebufferBindings();
 }
 
-void GLES2DecoderImpl::ProduceFrontBuffer(const Mailbox& mailbox) {
-  if (!offscreen_saved_color_texture_.get()) {
-    LOG(ERROR) << "Called ProduceFrontBuffer on a non-offscreen context";
+void GLES2DecoderImpl::ReleaseSurface() {
+  if (!context_.get())
+    return;
+  if (WasContextLost()) {
+    DLOG(ERROR) << "  GLES2DecoderImpl: Trying to release lost context.";
     return;
   }
+  context_->ReleaseCurrent(surface_.get());
+  surface_ = nullptr;
+}
+
+void GLES2DecoderImpl::TakeFrontBuffer(const Mailbox& mailbox) {
+  if (!offscreen_saved_color_texture_.get()) {
+    LOG(ERROR) << "Called TakeFrontBuffer on a non-offscreen context";

[piman, 2016/04/26 01:54:01]

nit: DLOG

[erikchen, 2016/04/27 16:31:23]

Done.

+    return;
+  }
+
   if (!offscreen_saved_color_texture_info_.get()) {
     GLuint service_id = offscreen_saved_color_texture_->id();
     offscreen_saved_color_texture_info_ = TextureRef::Create(
         texture_manager(), 0, service_id);
     texture_manager()->SetTarget(offscreen_saved_color_texture_info_.get(),
                                  GL_TEXTURE_2D);
     UpdateParentTextureInfo();
   }
+
   mailbox_manager()->ProduceTexture(
       mailbox, offscreen_saved_color_texture_info_->texture());
+
+  // Save the BackTexture and TextureRef.
+  SavedBackTexture save;
+  save.back_texture.swap(offscreen_saved_color_texture_);
+  save.texture_ref = offscreen_saved_color_texture_info_;
+  offscreen_saved_color_texture_info_ = nullptr;
+  save.in_use = true;
+  saved_back_textures_.push_back(std::move(save));
+
+  CreateBackTexture();
+}
+
+void GLES2DecoderImpl::ReturnFrontBuffer(const Mailbox& mailbox,
+                                         bool is_lost) {
+  Texture* texture = mailbox_manager()->ConsumeTexture(mailbox);
+  for (auto it = saved_back_textures_.begin(); it != saved_back_textures_.end();
+       ++it) {
+    if (texture != it->texture_ref->texture())
+      continue;
+
+    if (is_lost || it->back_texture->size() != offscreen_size_) {
+      it->back_texture->Invalidate();
+      saved_back_textures_.erase(it);
+      return;
+    }
+
+    it->in_use = false;
+    return;
+  }
+
+  NOTREACHED();

[piman, 2016/04/26 01:54:01]

nit: Not NOTREACHED(), this could be reached from a malicious client. It's ok if
it hoses its own state, but we shouldn't make the assumption that this can't
happen.

[erikchen, 2016/04/27 16:31:23]

This seems like the perfect place for NOTREACHED()?

If a Chrome developer misuses ReturnFrontBuffer in a DEBUG build, the assertion
will fire.
In a Release build, a malicious client will hit this logic and nothing will
happen.

If you prefer, I can switch to a DLOG but LOG messages are easily overlooked.

[piman, 2016/04/27 23:00:58]

I insist :) This is consistent in GPU code.
DCHECK/NOTREACHED is there for documentation purpose (as you mention, nothing
will happen with it in production). But it would be documenting the wrong thing
("this can't happen" - it's not true, it can happen, and we need to be aware
that it can). The next person refactoring this code needs to not make the wrong
assumption. E.g. just looking at this function without context one could rewrite
it as:

void GLES2DecoderImpl::ReturnFrontBuffer(const Mailbox& mailbox,
                                         bool is_lost) {	
  Texture* texture = mailbox_manager()->ConsumeTexture(mailbox);
  auto it =
      std::find_if(saved_back_textures_.begin(), saved_back_textures_.end(),
                   [texture](const SavedBackTexture& saved) {
                     return saved.texture_ref->texture() == texture;
                   });

  DCHECK(it != saved_back_textures_.end());  // Surely this is equivalent to the
previous NOTREACHED()
  if (is_lost || it->back_texture->size() != offscreen_size_) {
    it->back_texture->Invalidate();
    saved_back_textures_.erase(it);
  } else {
    it->in_use = false;
  }
}

However this would introduce a security issue (dereferencing out-of-bounds) on
invalid input.

If we want to check the client behavior, we should DCHECK/NOTREACHED it on the
client side, and/or write a test.
Replacing with a DLOG is ok (no LOG please).

[erikchen, 2016/04/27 23:59:24]

Point taken. Thanks for the example. Switched to a DLOG.

+}
+
+void GLES2DecoderImpl::CreateBackTexture() {
+  for (auto it = saved_back_textures_.begin(); it != saved_back_textures_.end();
+       ++it) {
+    if (it->in_use)
+      continue;
+
+    if (it->back_texture->size() != offscreen_size_)
+      continue;
+    offscreen_saved_color_texture_ = std::move(it->back_texture);
+    offscreen_saved_color_texture_info_ = it->texture_ref;
+    saved_back_textures_.erase(it);
+    return;
+  }
+
+  ++create_back_texture_count_for_test_;
+  offscreen_saved_color_texture_.reset(
+      new BackTexture(memory_tracker(), &state_));
+  offscreen_saved_color_texture_->Create();
+  offscreen_saved_color_texture_->AllocateStorage(
+      offscreen_size_, offscreen_saved_color_format_, false);
+  offscreen_saved_frame_buffer_->AttachRenderTexture(
+      offscreen_saved_color_texture_.get());
+}
+
+void GLES2DecoderImpl::ReleaseNotInUseBackTextures() {
+  for (auto& saved_back_texture : saved_back_textures_) {
+    if (!saved_back_texture.in_use)
+      saved_back_texture.back_texture->Invalidate();
+  }
+
+  std::remove_if(saved_back_textures_.begin(), saved_back_textures_.end(),
+                 [](const SavedBackTexture& saved_back_texture) {
+                   return !saved_back_texture.in_use;
+                 });
+}
+
+void GLES2DecoderImpl::ReleaseAllBackTextures() {
+  for (auto& saved_back_texture : saved_back_textures_) {
+    // The texture will be destroyed by texture_ref's destructor.
+    DCHECK(saved_back_texture.texture_ref);
+    saved_back_texture.back_texture->Invalidate();
+  }
+  saved_back_textures_.clear();
+}
+
+size_t GLES2DecoderImpl::GetSavedBackTextureCountForTest() {
+  return saved_back_textures_.size();
+}
+
+size_t GLES2DecoderImpl::GetCreatedBackTextureCountForTest() {
+  return create_back_texture_count_for_test_;
 }
 
 bool GLES2DecoderImpl::ResizeOffscreenFrameBuffer(const gfx::Size& size) {
   bool is_offscreen = !!offscreen_target_frame_buffer_.get();
   if (!is_offscreen) {
     LOG(ERROR) << "GLES2DecoderImpl::ResizeOffscreenFrameBuffer called "
                << " with an onscreen framebuffer.";
     return false;
   }
 
@@ skipping 8475 matching lines @@
         "width", offscreen_size_.width(), "height", offscreen_size_.height());
     if (offscreen_size_ != offscreen_saved_color_texture_->size()) {
       // Workaround for NVIDIA driver bug on OS X; crbug.com/89557,
       // crbug.com/94163. TODO(kbr): figure out reproduction so Apple will
       // fix this.
       if (workarounds().needs_offscreen_buffer_workaround) {
         offscreen_saved_frame_buffer_->Create();
         glFinish();
       }
 
+      // The size has changed, so none of the cached BackTextures are useful
+      // anymore.
+      ReleaseNotInUseBackTextures();
+
       // Allocate the offscreen saved color texture.
       DCHECK(offscreen_saved_color_format_);
       offscreen_saved_color_texture_->AllocateStorage(
           offscreen_size_, offscreen_saved_color_format_, false);
 
       offscreen_saved_frame_buffer_->AttachRenderTexture(
           offscreen_saved_color_texture_.get());
       if (offscreen_size_.width() != 0 && offscreen_size_.height() != 0) {
         if (offscreen_saved_frame_buffer_->CheckStatus() !=
             GL_FRAMEBUFFER_COMPLETE) {
@@ skipping 3629 matching lines @@
 }
 
 // Include the auto-generated part of this file. We split this because it means
 // we can easily edit the non-auto generated parts right here in this file
 // instead of having to edit some template or the code generator.
 #include "base/macros.h"
 #include "gpu/command_buffer/service/gles2_cmd_decoder_autogen.h"
 
 }  // namespace gles2
 }  // namespace gpu