Pepper: Add a nullptr check.

content/renderer/pepper/pepper_plugin_instance_impl.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/renderer/pepper/pepper_plugin_instance_impl.h"
 
 #include <utility>
 
 #include "base/bind.h"
 #include "base/bit_cast.h"
@@ skipping 760 matching lines @@
       // of us or the view renders via the accelerated compositor which is
       // incompatible with the move and backfill scrolling model.
       InvalidateRect(rect);
     }
   }
 }
 
 void PepperPluginInstanceImpl::CommitTextureMailbox(
     const cc::TextureMailbox& texture_mailbox) {
   if (committed_texture_.IsValid() && !IsTextureInUse(committed_texture_)) {
     bound_graphics_3d_->ReturnFrontBuffer(

[erikchen, 2016/05/05 20:15:29]

I don't think this one needs a nullcheck, as there are no crashes with it in the
signature, and this isn't coming from a callback from the compositor.

         committed_texture_.mailbox(), committed_texture_consumed_sync_token_,
         false);
   }
 
   committed_texture_ = texture_mailbox;
   committed_texture_consumed_sync_token_ = gpu::SyncToken();
 
   if (!texture_layer_) {
     UpdateLayer(true);
     return;
@@ skipping 24 matching lines @@
     bool is_lost) {
   bool removed = DecrementTextureReferenceCount(texture_mailbox);
   bool is_committed_texture =
       committed_texture_.mailbox() == texture_mailbox.mailbox();
 
   if (is_committed_texture && !is_lost) {
     committed_texture_consumed_sync_token_ = sync_token;
     return;
   }
 
-  if (removed && !is_committed_texture) {
+  if (removed && !is_committed_texture && bound_graphics_3d_) {

[piman, 2016/05/05 20:25:41]

Actually, this makes me think a little more.
If the plugin binds a Graphics3D, swaps a couple of frames, then binds another
Graphics3D, we will be returning the mailbox to the wrong context (i.e. we won't
find the texture in GLES2DecoderImpl::ReturnFrontBuffer).

Should we bind the release callback to the Graphics3D that gave us the texture?

[erikchen, 2016/05/05 21:13:07]

Yes, we should.

     bound_graphics_3d_->ReturnFrontBuffer(texture_mailbox.mailbox(), sync_token,
                                           is_lost);
   }
 }
 
 void PepperPluginInstanceImpl::InstanceCrashed() {
   // Force free all resources and vars.
   HostGlobals::Get()->InstanceCrashed(pp_instance());
 
   // Free any associated graphics.
@@ skipping 2579 matching lines @@
     const cc::TextureMailbox& mailbox) const {
   auto it =
       std::find_if(texture_ref_counts_.begin(), texture_ref_counts_.end(),
                    [&mailbox](const TextureMailboxRefCount& ref_count) {
                      return ref_count.first.mailbox() == mailbox.mailbox();
                    });
   return it != texture_ref_counts_.end();
 }
 
 }  // namespace content