Pepper takes ownership of a mailbox before passing it to the texture layer.

ppapi/proxy/ppapi_messages.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Multiply-included message header, no traditional include guard.
 
 #include <stdint.h>
 
 #include <map>
 #include <string>
@@ skipping 1025 matching lines @@
                     ppapi::HostResource /* context */,
                     int32_t /* put_offset */)
 IPC_SYNC_MESSAGE_ROUTED2_2(PpapiHostMsg_PPBGraphics3D_CreateTransferBuffer,
                            ppapi::HostResource /* context */,
                            uint32_t /* size */,
                            int32_t /* id */,
                            ppapi::proxy::SerializedHandle /* transfer_buffer */)
 IPC_SYNC_MESSAGE_ROUTED2_0(PpapiHostMsg_PPBGraphics3D_DestroyTransferBuffer,
                            ppapi::HostResource /* context */,
                            int32_t /* id */)
+// The receiver of this message takes ownership of the front buffer of the GL
+// context. Each call to PpapiHostMsg_PPBGraphics3D_SwapBuffers must be preceded
+// by exactly one call to PpapiHostMsg_PPBGraphics3D_TakeFrontBuffer. The

[Tom Sepez, 2016/04/28 17:48:04]

What happens otherwise?  Can a evil/misbehaving ppapi process crash its host if
it violates this?

[erikchen, 2016/04/28 17:50:10]

Nope. The host will gracefully ignore the message and emit a DLOG:

https://codereview.chromium.org/1912833002/diff/330001/content/renderer/peppe...

See the first lines of:
PPB_Graphics3D_Impl::TakeFrontBuffer()
PPB_Graphics3D_Impl::DoSwapBuffers()

+// SyncToken passed to PpapiHostMsg_PPBGraphics3D_SwapBuffers must be generated
+// after this message is sent.
+IPC_MESSAGE_ROUTED1(PpapiHostMsg_PPBGraphics3D_TakeFrontBuffer,
+                    ppapi::HostResource /* graphics_3d */)
 IPC_MESSAGE_ROUTED2(PpapiHostMsg_PPBGraphics3D_SwapBuffers,
                     ppapi::HostResource /* graphics_3d */,
                     gpu::SyncToken /* sync_token */)
+

[bbudge, 2016/04/28 20:13:27]

nit: stray whitespace?

[erikchen, 2016/04/29 00:38:06]

removed.

 IPC_SYNC_MESSAGE_ROUTED1_0(PpapiHostMsg_PPBGraphics3D_EnsureWorkVisible,
                            ppapi::HostResource /* context */)
 
 // PPB_ImageData.
 IPC_SYNC_MESSAGE_ROUTED4_3(PpapiHostMsg_PPBImageData_CreatePlatform,
                            PP_Instance /* instance */,
                            int32_t /* format */,
                            PP_Size /* size */,
                            PP_Bool /* init_to_zero */,
                            ppapi::HostResource /* result_resource */,
@@ skipping 1375 matching lines @@
                      std::vector<ppapi::HostResource> /* buffers */,
                      uint32_t /* buffer_size */)
 IPC_MESSAGE_CONTROL1(PpapiPluginMsg_VideoCapture_OnStatus,
                      uint32_t /* status */)
 IPC_MESSAGE_CONTROL1(PpapiPluginMsg_VideoCapture_OnError,
                      uint32_t /* error */)
 IPC_MESSAGE_CONTROL1(PpapiPluginMsg_VideoCapture_OnBufferReady,
                      uint32_t /* buffer */)
 
 #endif  // !defined(OS_NACL) && !defined(NACL_WIN64)