Fix canvas-related crash caused by bad object teardown sequence

third_party/WebKit/Source/core/html/HTMLCanvasElement.cpp

 /*
  * Copyright (C) 2004, 2006, 2007 Apple Inc. All rights reserved.
  * Copyright (C) 2007 Alp Toker <alp@atoker.com>
  * Copyright (C) 2010 Torch Mobile (Beijing) Co. Ltd. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
@@ skipping 107 matching lines @@
         return false;
     if (size.width() * size.height() > MaxCanvasArea)
         return false;
     if (size.width() > MaxSkiaDim || size.height() > MaxSkiaDim)
         return false;
     return true;
 }
 
 PassRefPtr<Image> createTransparentImage(const IntSize& size)
 {
-    ASSERT(canCreateImageBuffer(size));
+    DCHECK(canCreateImageBuffer(size));
     sk_sp<SkSurface> surface = SkSurface::MakeRasterN32Premul(size.width(), size.height());
     surface->getCanvas()->clear(SK_ColorTRANSPARENT);
     return StaticBitmapImage::create(adoptRef(surface->newImageSnapshot()));
 }
 
 } // namespace
 
 inline HTMLCanvasElement::HTMLCanvasElement(Document& document)
     : HTMLElement(canvasTag, document)
     , ContextLifecycleObserver(&document)
     , PageLifecycleObserver(document.page())
     , m_size(DefaultWidth, DefaultHeight)
     , m_ignoreReset(false)
     , m_externallyAllocatedMemory(0)
     , m_originClean(true)
     , m_didFailToCreateImageBuffer(false)
     , m_imageBufferIsClear(false)
 {
     CanvasMetrics::countCanvasContextUsage(CanvasMetrics::CanvasCreated);
 }
 
 DEFINE_NODE_FACTORY(HTMLCanvasElement)
 
 HTMLCanvasElement::~HTMLCanvasElement()
 {
     v8::Isolate::GetCurrent()->AdjustAmountOfExternalAllocatedMemory(-m_externallyAllocatedMemory);
 }
 
+void HTMLCanvasElement::dispose()
+{
+    if (m_context)
+        m_context->detachCanvas();

[xlai (Olivia), 2016/06/10 19:28:17]

Maybe add one more line here "m_context = nullptr;" to completely break the
reference cycles?

[Justin Novosad, 2016/06/10 19:39:09]

Done.

+}
+
 void HTMLCanvasElement::parseAttribute(const QualifiedName& name, const AtomicString& oldValue, const AtomicString& value)
 {
     if (name == widthAttr || name == heightAttr)
         reset();
     HTMLElement::parseAttribute(name, oldValue, value);
 }
 
 LayoutObject* HTMLCanvasElement::createLayoutObject(const ComputedStyle& style)
 {
     LocalFrame* frame = document().frame();
@@ skipping 13 matching lines @@
     setIntegralAttribute(heightAttr, value);
 }
 
 void HTMLCanvasElement::setWidth(int value)
 {
     setIntegralAttribute(widthAttr, value);
 }
 
 HTMLCanvasElement::ContextFactoryVector& HTMLCanvasElement::renderingContextFactories()
 {
-    ASSERT(isMainThread());
+    DCHECK(isMainThread());
     DEFINE_STATIC_LOCAL(ContextFactoryVector, s_contextFactories, (CanvasRenderingContext::ContextTypeCount));
     return s_contextFactories;
 }
 
 CanvasRenderingContextFactory* HTMLCanvasElement::getRenderingContextFactory(int type)
 {
-    ASSERT(type < CanvasRenderingContext::ContextTypeCount);
+    DCHECK(type < CanvasRenderingContext::ContextTypeCount);
     return renderingContextFactories()[type].get();
 }
 
 void HTMLCanvasElement::registerRenderingContextFactory(PassOwnPtr<CanvasRenderingContextFactory> renderingContextFactory)
 {
     CanvasRenderingContext::ContextType type = renderingContextFactory->getContextType();
-    ASSERT(type < CanvasRenderingContext::ContextTypeCount);
-    ASSERT(!renderingContextFactories()[type]);
+    DCHECK(type < CanvasRenderingContext::ContextTypeCount);
+    DCHECK(!renderingContextFactories()[type]);
     renderingContextFactories()[type] = std::move(renderingContextFactory);
 }
 
 CanvasRenderingContext* HTMLCanvasElement::getCanvasRenderingContext(const String& type, const CanvasContextCreationAttributes& attributes)
 {
     CanvasRenderingContext::ContextType contextType = CanvasRenderingContext::contextTypeFromId(type);
 
     // Unknown type.
     if (contextType == CanvasRenderingContext::ContextTypeCount)
         return nullptr;
@@ skipping 76 matching lines @@
     FloatRect srcRect(0, 0, size().width(), size().height());
     m_dirtyRect.intersect(srcRect);
     LayoutBox* ro = layoutBox();
     // Canvas content updates do not need to be propagated as
     // paint invalidations if the canvas is accelerated, since
     // the canvas contents are sent separately through a texture layer.
     if (ro && (!m_context || !m_context->isAccelerated())) {
         LayoutRect mappedDirtyRect(enclosingIntRect(mapRect(m_dirtyRect, srcRect, FloatRect(ro->contentBoxRect()))));
         // For querying PaintLayer::compositingState()
         // FIXME: is this invalidation using the correct compositing state?
-        DisableCompositingQueryAsserts disabler;
+        DisableCompositingQueryDCHECKs disabler;
         ro->invalidatePaintRectangle(mappedDirtyRect);
     }
     m_dirtyRect = FloatRect();
 }
 
 void HTMLCanvasElement::restoreCanvasMatrixClipStack(SkCanvas* canvas) const
 {
     if (m_context)
         m_context->restoreCanvasMatrixClipStack(canvas);
 }
 
 void HTMLCanvasElement::doDeferredPaintInvalidation()
 {
-    ASSERT(!m_dirtyRect.isEmpty());
+    DCHECK(!m_dirtyRect.isEmpty());
     if (!m_context->is2d()) {
         didFinalizeFrame();
     } else {
-        ASSERT(hasImageBuffer());
+        DCHECK(hasImageBuffer());
         FloatRect srcRect(0, 0, size().width(), size().height());
         m_dirtyRect.intersect(srcRect);
         LayoutBox* lb = layoutBox();
         if (lb) {
             FloatRect mappedDirtyRect = mapRect(m_dirtyRect, srcRect, FloatRect(lb->contentBoxRect()));
             if (m_context->isAccelerated()) {
                 // Accelerated 2D canvases need the dirty rect to be expressed relative to the
                 // content box, as opposed to the layout box.
                 mappedDirtyRect.move(-lb->contentBoxOffset());
             }
             m_imageBuffer->finalizeFrame(mappedDirtyRect);
         } else {
             m_imageBuffer->finalizeFrame(m_dirtyRect);
         }
     }
-    ASSERT(m_dirtyRect.isEmpty());
+    DCHECK(m_dirtyRect.isEmpty());
 }
 
 void HTMLCanvasElement::reset()
 {
     if (m_ignoreReset)
         return;
 
     m_dirtyRect = FloatRect();
 
     bool ok;
@@ skipping 36 matching lines @@
                     layoutBox()->contentChanged(CanvasChanged);
             }
             if (hadImageBuffer)
                 layoutObject->setShouldDoFullPaintInvalidation();
         }
     }
 }
 
 bool HTMLCanvasElement::paintsIntoCanvasBuffer() const
 {
-    ASSERT(m_context);
+    DCHECK(m_context);
 
     if (!m_context->isAccelerated())
         return true;
     if (layoutBox() && layoutBox()->hasAcceleratedCompositing())
         return false;
 
     return true;
 }
 
 void HTMLCanvasElement::notifyListenersCanvasChanged()
@@ skipping 144 matching lines @@
     return lowercaseMimeType;
 }
 
 const AtomicString HTMLCanvasElement::imageSourceURL() const
 {
     return AtomicString(toDataURLInternal(DefaultMimeType, 0, FrontBuffer));
 }
 
 void HTMLCanvasElement::prepareSurfaceForPaintingIfNeeded() const
 {
-    ASSERT(m_context && m_context->is2d()); // This function is called by the 2d context
+    DCHECK(m_context && m_context->is2d()); // This function is called by the 2d context
     if (buffer())
         m_imageBuffer->prepareSurfaceForPaintingIfNeeded();
 }
 
 ImageData* HTMLCanvasElement::toImageData(SourceDrawingBuffer sourceBuffer, SnapshotReason reason) const
 {
     ImageData* imageData;
     if (is3D()) {
         // Get non-premultiplied data because of inaccurate premultiplied alpha conversion of buffer()->toDataURL().
         imageData = m_context->paintRenderingResultsToImageData(sourceBuffer);
         if (imageData)
             return imageData;
 
         m_context->paintRenderingResultsToCanvas(sourceBuffer);
         imageData = ImageData::create(m_size);
         RefPtr<SkImage> snapshot = buffer()->newSkImageSnapshot(PreferNoAcceleration, reason);
         if (snapshot) {
             SkImageInfo imageInfo = SkImageInfo::Make(width(), height(), kRGBA_8888_SkColorType, kUnpremul_SkAlphaType);
             snapshot->readPixels(imageInfo, imageData->data()->data(), imageInfo.minRowBytes(), 0, 0);
         }
         return imageData;
     }
 
     imageData = ImageData::create(m_size);
 
     if (!m_context)
         return imageData;
 
-    ASSERT(m_context->is2d());
+    DCHECK(m_context->is2d());
     RefPtr<SkImage> snapshot = buffer()->newSkImageSnapshot(PreferNoAcceleration, reason);
     if (snapshot) {
         SkImageInfo imageInfo = SkImageInfo::Make(width(), height(), kRGBA_8888_SkColorType, kUnpremul_SkAlphaType);
         snapshot->readPixels(imageInfo, imageData->data()->data(), imageInfo.minRowBytes(), 0, 0);
     }
 
     return imageData;
 }
 
 String HTMLCanvasElement::toDataURLInternal(const String& mimeType, const double& quality, SourceDrawingBuffer sourceBuffer) const
@@ skipping 218 matching lines @@
 
 void HTMLCanvasElement::createImageBuffer()
 {
     createImageBufferInternal(nullptr);
     if (m_didFailToCreateImageBuffer && m_context->is2d() && !size().isEmpty())
         m_context->loseContext(CanvasRenderingContext::SyntheticLostContext);
 }
 
 void HTMLCanvasElement::createImageBufferInternal(PassOwnPtr<ImageBufferSurface> externalSurface)
 {
-    ASSERT(!m_imageBuffer);
+    DCHECK(!m_imageBuffer);
 
     m_didFailToCreateImageBuffer = true;
     m_imageBufferIsClear = true;
 
     if (!canCreateImageBuffer(size()))
         return;
 
     int msaaSampleCount = 0;
     OwnPtr<ImageBufferSurface> surface;
     if (externalSurface) {
@@ skipping 91 matching lines @@
 SkCanvas* HTMLCanvasElement::existingDrawingCanvas() const
 {
     if (!hasImageBuffer())
         return nullptr;
 
     return m_imageBuffer->canvas();
 }
 
 ImageBuffer* HTMLCanvasElement::buffer() const
 {
-    ASSERT(m_context);
+    DCHECK(m_context);
     if (!hasImageBuffer() && !m_didFailToCreateImageBuffer)
         const_cast<HTMLCanvasElement*>(this)->createImageBuffer();
     return m_imageBuffer.get();
 }
 
 void HTMLCanvasElement::createImageBufferUsingSurfaceForTesting(PassOwnPtr<ImageBufferSurface> surface)
 {
     discardImageBuffer();
     setWidth(surface->size().width());
     setHeight(surface->size().height());
     createImageBufferInternal(std::move(surface));
 }
 
 void HTMLCanvasElement::ensureUnacceleratedImageBuffer()
 {
-    ASSERT(m_context);
+    DCHECK(m_context);
     if ((hasImageBuffer() && !m_imageBuffer->isAccelerated()) || m_didFailToCreateImageBuffer)
         return;
     discardImageBuffer();
     OpacityMode opacityMode = m_context->hasAlpha() ? NonOpaque : Opaque;
     m_imageBuffer = ImageBuffer::create(size(), opacityMode);
     m_didFailToCreateImageBuffer = !m_imageBuffer;
 }
 
 PassRefPtr<Image> HTMLCanvasElement::copiedImage(SourceDrawingBuffer sourceBuffer, AccelerationHint hint) const
 {
@@ skipping 23 matching lines @@
 void HTMLCanvasElement::clearCopiedImage()
 {
     if (m_copiedImage) {
         m_copiedImage.clear();
         updateExternallyAllocatedMemory();
     }
 }
 
 AffineTransform HTMLCanvasElement::baseTransform() const
 {
-    ASSERT(hasImageBuffer() && !m_didFailToCreateImageBuffer);
+    DCHECK(hasImageBuffer() && !m_didFailToCreateImageBuffer);
     return m_imageBuffer->baseTransform();
 }
 
 void HTMLCanvasElement::pageVisibilityChanged()
 {
     if (!m_context)
         return;
 
     bool hidden = !page()->isPageVisible();
     m_context->setIsHidden(hidden);
@@ skipping 65 matching lines @@
     return FloatSize(width(), height());
 }
 
 IntSize HTMLCanvasElement::bitmapSourceSize() const
 {
     return IntSize(width(), height());
 }
 
 ScriptPromise HTMLCanvasElement::createImageBitmap(ScriptState* scriptState, EventTarget& eventTarget, int sx, int sy, int sw, int sh, const ImageBitmapOptions& options, ExceptionState& exceptionState)
 {
-    ASSERT(eventTarget.toLocalDOMWindow());
+    DCHECK(eventTarget.toLocalDOMWindow());
     if (!sw || !sh) {
         exceptionState.throwDOMException(IndexSizeError, String::format("The source %s provided is 0.", sw ? "height" : "width"));
         return ScriptPromise();
     }
     return ImageBitmapSource::fulfillImageBitmap(scriptState, isPaintable() ? ImageBitmap::create(this, IntRect(sx, sy, sw, sh), options) : nullptr);
 }
 
 bool HTMLCanvasElement::isOpaque() const
 {
     return m_context && !m_context->hasAlpha();
@@ skipping 70 matching lines @@
         return m_context->getIdFromControl(element);
     return String();
 }
 
 void HTMLCanvasElement::createSurfaceLayerBridge()
 {
     m_surfaceLayerBridge = adoptPtr(new CanvasSurfaceLayerBridge());
 }
 
 } // namespace blink