Fix canvas-related crash caused by bad object teardown sequence

third_party/WebKit/Source/core/html/canvas/CanvasRenderingContext.cpp

 /*
  * Copyright (C) 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 19 matching lines @@
 #include "platform/weborigin/SecurityOrigin.h"
 
 namespace blink {
 
 CanvasRenderingContext::CanvasRenderingContext(HTMLCanvasElement* canvas, OffscreenCanvas* offscreenCanvas)
     : m_canvas(canvas)
     , m_offscreenCanvas(offscreenCanvas)
 {
 }
 
+void CanvasRenderingContext::dispose()
+{
+    // HTMLCanvasElement and CanvasRenderingContext have a circular reference.
+    // When the pair is no longer reachable, their destruction order is non-
+    // deterministic, so the first of the two to be destroyed needs to notify
+    // the other in order to break the circular reference.  This is to avoid
+    // an error when CanvasRenderingContext2D::didProcessTask() is invoked
+    // after the HTMLCanvasElement is destroyed.
+    if (canvas())
+        canvas()->detachContext();

[xlai (Olivia), 2016/06/10 19:28:17]

Same as above comment. Maybe add one more line here to clean up reference to
canvas?

[Justin Novosad, 2016/06/10 19:39:09]

Done.

+}
+
 CanvasRenderingContext::ContextType CanvasRenderingContext::contextTypeFromId(const String& id)
 {
     if (id == "2d")
         return Context2d;
     if (id == "experimental-webgl")
         return ContextExperimentalWebgl;
     if (id == "webgl")
         return ContextWebgl;
     if (id == "webgl2")
         return ContextWebgl2;
@@ skipping 15 matching lines @@
     const KURL& sourceURL = imageSource->sourceURL();
     bool hasURL = (sourceURL.isValid() && !sourceURL.isAboutBlankURL());
 
     if (hasURL) {
         if (sourceURL.protocolIsData() || m_cleanURLs.contains(sourceURL.getString()))
             return false;
         if (m_dirtyURLs.contains(sourceURL.getString()))
             return true;
     }
 
-    ASSERT(!canvas() == !!destinationSecurityOrigin); // Must have one or the other
+    DCHECK_EQ(!canvas(), !!destinationSecurityOrigin); // Must have one or the other
     bool taintOrigin = imageSource->wouldTaintOrigin(destinationSecurityOrigin ? destinationSecurityOrigin : canvas()->getSecurityOrigin());
 
     if (hasURL) {
         if (taintOrigin)
             m_dirtyURLs.add(sourceURL.getString());
         else
             m_cleanURLs.add(sourceURL.getString());
     }
     return taintOrigin;
 }
 
 DEFINE_TRACE(CanvasRenderingContext)
 {
     visitor->trace(m_canvas);
     visitor->trace(m_offscreenCanvas);
 }
 
 } // namespace blink