Fix canvas-related crash caused by bad object teardown sequence

third_party/WebKit/Source/core/html/canvas/CanvasRenderingContext.h

 /*
  * Copyright (C) 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 28 matching lines @@
 
 namespace blink {
 
 class CanvasImageSource;
 class HTMLCanvasElement;
 class ImageData;
 class ImageBitmap;
 
 class CORE_EXPORT CanvasRenderingContext : public GarbageCollectedFinalized<CanvasRenderingContext>, public ScriptWrappable {
     WTF_MAKE_NONCOPYABLE(CanvasRenderingContext);
+    USING_PRE_FINALIZER(CanvasRenderingContext, dispose);
 public:
     virtual ~CanvasRenderingContext() { }
 
     // A Canvas can either be "2D" or "webgl" but never both. If you request a 2D canvas and the existing
     // context is already 2D, just return that. If the existing context is WebGL, then destroy it
     // before creating a new 2D context. Vice versa when requesting a WebGL canvas. Requesting a
     // context with any other type string will destroy any existing context.
     enum ContextType {
         // Do not change assigned numbers of existing items: add new features to the end of the list.
         Context2d = 0,
         ContextExperimentalWebgl = 2,
         ContextWebgl = 3,
         ContextWebgl2 = 4,
         ContextImageBitmap = 5,
         ContextTypeCount,
     };
 
     static ContextType contextTypeFromId(const String& id);
     static ContextType resolveContextTypeAliases(ContextType);
 
     HTMLCanvasElement* canvas() const { return m_canvas; }
 
     virtual ContextType getContextType() const = 0;
     virtual bool isAccelerated() const { return false; }
     virtual bool shouldAntialias() const { return false; }
     virtual bool hasAlpha() const { return true; }
     virtual void setIsHidden(bool) = 0;
     virtual bool isContextLost() const { return true; }
-    virtual void setCanvasGetContextResult(RenderingContext&) { ASSERT_NOT_REACHED(); };
-    virtual void setOffscreenCanvasGetContextResult(OffscreenRenderingContext&) { ASSERT_NOT_REACHED(); }
+    virtual void setCanvasGetContextResult(RenderingContext&) { NOTREACHED(); };
+    virtual void setOffscreenCanvasGetContextResult(OffscreenRenderingContext&) { NOTREACHED(); }
 
     // Return true if the content is updated.
     virtual bool paintRenderingResultsToCanvas(SourceDrawingBuffer) { return false; }
 
     virtual WebLayer* platformLayer() const { return nullptr; }
 
     enum LostContextMode {
         NotLostContext,
 
         // Lost context occurred at the graphics system level.
@@ skipping 10 matching lines @@
     // Canvas2D-specific interface
     virtual bool is2d() const { return false; }
     virtual void restoreCanvasMatrixClipStack(SkCanvas*) const { }
     virtual void reset() { }
     virtual void clearRect(double x, double y, double width, double height) { }
     virtual void didSetSurfaceSize() { }
     virtual void setShouldAntialias(bool) { }
     virtual unsigned hitRegionsCount() const { return 0; }
     virtual void setFont(const String&) { }
     virtual void styleDidChange(const ComputedStyle* oldStyle, const ComputedStyle& newStyle) { }
-    virtual std::pair<Element*, String> getControlAndIdIfHitRegionExists(const LayoutPoint& location) { ASSERT_NOT_REACHED(); return std::make_pair(nullptr, String()); }
+    virtual std::pair<Element*, String> getControlAndIdIfHitRegionExists(const LayoutPoint& location) { NOTREACHED(); return std::make_pair(nullptr, String()); }
     virtual String getIdFromControl(const Element* element) { return String(); }
 
     // WebGL-specific interface
     virtual bool is3d() const { return false; }
-    virtual void setFilterQuality(SkFilterQuality) { ASSERT_NOT_REACHED(); }
-    virtual void reshape(int width, int height) { ASSERT_NOT_REACHED(); }
-    virtual void markLayerComposited() { ASSERT_NOT_REACHED(); }
-    virtual ImageData* paintRenderingResultsToImageData(SourceDrawingBuffer) { ASSERT_NOT_REACHED(); return nullptr; }
-    virtual int externallyAllocatedBytesPerPixel() { ASSERT_NOT_REACHED(); return 0; }
+    virtual void setFilterQuality(SkFilterQuality) { NOTREACHED(); }
+    virtual void reshape(int width, int height) { NOTREACHED(); }
+    virtual void markLayerComposited() { NOTREACHED(); }
+    virtual ImageData* paintRenderingResultsToImageData(SourceDrawingBuffer) { NOTREACHED(); return nullptr; }
+    virtual int externallyAllocatedBytesPerPixel() { NOTREACHED(); return 0; }
 
     // ImageBitmap-specific interface
     virtual bool paint(GraphicsContext&, const IntRect&) { return false; }
 
     bool wouldTaintOrigin(CanvasImageSource*, SecurityOrigin* = nullptr);
     void didMoveToNewDocument(Document*);
 
     // OffscreenCanvas-specific methods
     OffscreenCanvas* getOffscreenCanvas() const { return m_offscreenCanvas; }
     virtual ImageBitmap* transferToImageBitmap(ExceptionState&) { return nullptr; }
 
+    void detachCanvas() { m_canvas = nullptr; }
+
 protected:
     CanvasRenderingContext(HTMLCanvasElement* = nullptr, OffscreenCanvas* = nullptr);
     DECLARE_VIRTUAL_TRACE();
     virtual void stop() = 0;
 
 private:
+    void dispose();
+
     Member<HTMLCanvasElement> m_canvas;
     Member<OffscreenCanvas> m_offscreenCanvas;
     HashSet<String> m_cleanURLs;
     HashSet<String> m_dirtyURLs;
 };
 
 } // namespace blink
 
 #endif