Pepper takes ownership of a mailbox before passing it to the texture layer.

ppapi/proxy/ppapi_messages.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Multiply-included message header, no traditional include guard.
 
 #include <stdint.h>
 
 #include <map>
 #include <string>
@@ skipping 1025 matching lines @@
                     ppapi::HostResource /* context */,
                     int32_t /* put_offset */)
 IPC_SYNC_MESSAGE_ROUTED2_2(PpapiHostMsg_PPBGraphics3D_CreateTransferBuffer,
                            ppapi::HostResource /* context */,
                            uint32_t /* size */,
                            int32_t /* id */,
                            ppapi::proxy::SerializedHandle /* transfer_buffer */)
 IPC_SYNC_MESSAGE_ROUTED2_0(PpapiHostMsg_PPBGraphics3D_DestroyTransferBuffer,
                            ppapi::HostResource /* context */,
                            int32_t /* id */)
+// The receiver of this message takes ownership of the front buffer of the GL
+// context. Each call to PpapiHostMsg_PPBGraphics3D_SwapBuffers must be preceded
+// by exactly one call to PpapiHostMsg_PPBGraphics3D_TakeFrontBuffer. The
+// SyncToken passed to PpapiHostMsg_PPBGraphics3D_SwapBuffers must be generated
+// after this message is sent.
+IPC_MESSAGE_ROUTED1(PpapiHostMsg_PPBGraphics3D_TakeFrontBuffer,
+                    ppapi::HostResource /* graphics_3d */)
 IPC_MESSAGE_ROUTED2(PpapiHostMsg_PPBGraphics3D_SwapBuffers,
                     ppapi::HostResource /* graphics_3d */,
                     gpu::SyncToken /* sync_token */)
 IPC_SYNC_MESSAGE_ROUTED1_0(PpapiHostMsg_PPBGraphics3D_EnsureWorkVisible,
                            ppapi::HostResource /* context */)
 
 // PPB_ImageData.
 IPC_SYNC_MESSAGE_ROUTED4_3(PpapiHostMsg_PPBImageData_CreatePlatform,
                            PP_Instance /* instance */,
                            int32_t /* format */,
@@ skipping 1378 matching lines @@
                      std::vector<ppapi::HostResource> /* buffers */,
                      uint32_t /* buffer_size */)
 IPC_MESSAGE_CONTROL1(PpapiPluginMsg_VideoCapture_OnStatus,
                      uint32_t /* status */)
 IPC_MESSAGE_CONTROL1(PpapiPluginMsg_VideoCapture_OnError,
                      uint32_t /* error */)
 IPC_MESSAGE_CONTROL1(PpapiPluginMsg_VideoCapture_OnBufferReady,
                      uint32_t /* buffer */)
 
 #endif  // !defined(OS_NACL) && !defined(NACL_WIN64)