Pepper takes ownership of a mailbox before passing it to the texture layer.

ppapi/proxy/ppapi_messages.h

Index: ppapi/proxy/ppapi_messages.h
diff --git a/ppapi/proxy/ppapi_messages.h b/ppapi/proxy/ppapi_messages.h
index 33d182fadcdf0ad3e45c04b869ee737d61bfd05e..02e887a39fe59b12200e48562a995b1ad4d52ffa 100644
--- a/ppapi/proxy/ppapi_messages.h
+++ b/ppapi/proxy/ppapi_messages.h
@@ -1043,9 +1043,17 @@ IPC_SYNC_MESSAGE_ROUTED2_2(PpapiHostMsg_PPBGraphics3D_CreateTransferBuffer,
 IPC_SYNC_MESSAGE_ROUTED2_0(PpapiHostMsg_PPBGraphics3D_DestroyTransferBuffer,
                            ppapi::HostResource /* context */,
                            int32_t /* id */)
+// The receiver of this message takes ownership of the front buffer of the GL
+// context. Each call to PpapiHostMsg_PPBGraphics3D_SwapBuffers must be preceded
+// by exactly one call to PpapiHostMsg_PPBGraphics3D_TakeFrontBuffer. The

[Tom Sepez, 2016/04/28 17:48:04]

What happens otherwise?  Can a evil/misbehaving ppapi process crash its host if
it violates this?

[erikchen, 2016/04/28 17:50:10]

Nope. The host will gracefully ignore the message and emit a DLOG:

https://codereview.chromium.org/1912833002/diff/330001/content/renderer/peppe...

See the first lines of:
PPB_Graphics3D_Impl::TakeFrontBuffer()
PPB_Graphics3D_Impl::DoSwapBuffers()

+// SyncToken passed to PpapiHostMsg_PPBGraphics3D_SwapBuffers must be generated
+// after this message is sent.
+IPC_MESSAGE_ROUTED1(PpapiHostMsg_PPBGraphics3D_TakeFrontBuffer,
+                    ppapi::HostResource /* graphics_3d */)
 IPC_MESSAGE_ROUTED2(PpapiHostMsg_PPBGraphics3D_SwapBuffers,
                     ppapi::HostResource /* graphics_3d */,
                     gpu::SyncToken /* sync_token */)
+

[bbudge, 2016/04/28 20:13:27]

nit: stray whitespace?

[erikchen, 2016/04/29 00:38:06]

removed.

 IPC_SYNC_MESSAGE_ROUTED1_0(PpapiHostMsg_PPBGraphics3D_EnsureWorkVisible,
                            ppapi::HostResource /* context */)