Pepper takes ownership of a mailbox before passing it to the texture layer.

content/renderer/pepper/ppb_graphics_3d_impl.cc

Index: content/renderer/pepper/ppb_graphics_3d_impl.cc
diff --git a/content/renderer/pepper/ppb_graphics_3d_impl.cc b/content/renderer/pepper/ppb_graphics_3d_impl.cc
index 24c6513c12fb8119bb4d5ef6293d885dcc83d5e9..cee95dc5abba6ad75c4a96e2a53d0902e05f7cad 100644
--- a/content/renderer/pepper/ppb_graphics_3d_impl.cc
+++ b/content/renderer/pepper/ppb_graphics_3d_impl.cc
@@ -28,6 +28,7 @@
 #include "third_party/WebKit/public/web/WebElement.h"
 #include "third_party/WebKit/public/web/WebLocalFrame.h"
 #include "third_party/WebKit/public/web/WebPluginContainer.h"
+#include "third_party/khronos/GLES2/gl2.h"
 
 using ppapi::thunk::EnterResourceNoLock;
 using ppapi::thunk::PPB_Graphics3D_API;
@@ -114,6 +115,19 @@ void PPB_Graphics3D_Impl::EnsureWorkVisible() {
   command_buffer_->EnsureWorkVisible();
 }
 
+void PPB_Graphics3D_Impl::TakeFrontBuffer() {
+  DCHECK(taken_front_buffer_.IsZero());

[piman, 2016/04/27 23:00:58]

This DCHECK is not valid. The plugin side may be untrusted (NaCl plugin) and
could call TakeFrontBuffer several times without a SwapBuffers.

It's ok to ignore redundant calls.

[erikchen, 2016/04/27 23:59:24]

Done.

+  taken_front_buffer_ = GenerateMailbox();
+  command_buffer_->TakeFrontBuffer(taken_front_buffer_);
+}
+
+void PPB_Graphics3D_Impl::ReturnFrontBuffer(const gpu::Mailbox& mailbox,
+                                            const gpu::SyncToken& sync_token,
+                                            bool is_lost) {
+  command_buffer_->ReturnFrontBuffer(mailbox, sync_token, is_lost);
+  mailboxes_to_reuse_.push_back(mailbox);
+}
+
 bool PPB_Graphics3D_Impl::BindToInstance(bool bind) {
   bound_to_instance_ = bind;
   return true;
@@ -143,8 +157,7 @@ gpu::GpuControl* PPB_Graphics3D_Impl::GetGpuControl() {
 
 int32_t PPB_Graphics3D_Impl::DoSwapBuffers(const gpu::SyncToken& sync_token) {
   DCHECK(command_buffer_);
-  if (sync_token.HasData())
-    sync_token_ = sync_token;
+  DCHECK(!taken_front_buffer_.IsZero());

[piman, 2016/04/27 23:00:58]

Here too, the DCHECK is invalid.

It's ok to return failure.

[erikchen, 2016/04/27 23:59:24]

Done.

 
   if (bound_to_instance_) {
     // If we are bound to the instance, we need to ask the compositor
@@ -154,14 +167,18 @@ int32_t PPB_Graphics3D_Impl::DoSwapBuffers(const gpu::SyncToken& sync_token) {
     //
     // Don't need to check for NULL from GetPluginInstance since when we're
     // bound, we know our instance is valid.
-    HostGlobals::Get()->GetInstance(pp_instance())->CommitBackingTexture();
+    cc::TextureMailbox texture_mailbox(taken_front_buffer_, sync_token,
+                                       GL_TEXTURE_2D);
+    taken_front_buffer_.SetZero();
+    HostGlobals::Get()
+        ->GetInstance(pp_instance())
+        ->CommitTextureMailbox(texture_mailbox);
     commit_pending_ = true;
   } else {
     // Wait for the command to complete on the GPU to allow for throttling.
     command_buffer_->SignalSyncToken(
-        sync_token_,
-        base::Bind(&PPB_Graphics3D_Impl::OnSwapBuffers,
-                   weak_ptr_factory_.GetWeakPtr()));
+        sync_token, base::Bind(&PPB_Graphics3D_Impl::OnSwapBuffers,
+                               weak_ptr_factory_.GetWeakPtr()));
   }
 
   return PP_OK_COMPLETIONPENDING;
@@ -262,10 +279,6 @@ bool PPB_Graphics3D_Impl::InitRaw(PPB_Graphics3D_API* share_context,
   if (command_buffer_id)
     *command_buffer_id = command_buffer_->GetCommandBufferID();
 
-  mailbox_ = gpu::Mailbox::Generate();
-  if (!command_buffer_->ProduceFrontBuffer(mailbox_))
-    return false;
-
   return true;
 }
 
@@ -339,4 +352,14 @@ void PPB_Graphics3D_Impl::SendContextLost() {
     ppp_graphics_3d->Graphics3DContextLost(this_pp_instance);
 }
 
+gpu::Mailbox PPB_Graphics3D_Impl::GenerateMailbox() {
+  if (mailboxes_to_reuse_.size()) {

[piman, 2016/04/27 23:00:58]

nit: !mailboxes_to_reuse_.empty()

[erikchen, 2016/04/27 23:59:24]

Done.

+    gpu::Mailbox mailbox = mailboxes_to_reuse_[0];
+    mailboxes_to_reuse_.erase(mailboxes_to_reuse_.begin());
+    return mailbox;
+  }
+
+  return gpu::Mailbox::Generate();
+}
+
 }  // namespace content