Fix canvas-related crash caused by bad object teardown sequence

third_party/WebKit/Source/modules/canvas2d/CanvasRenderingContext2DTest.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "modules/canvas2d/CanvasRenderingContext2D.h"
 
 #include "core/fetch/MemoryCache.h"
 #include "core/frame/FrameView.h"
 #include "core/frame/ImageBitmap.h"
 #include "core/html/HTMLCanvasElement.h"
@@ skipping 66 matching lines @@
 
     DummyPageHolder& page() const { return *m_dummyPageHolder; }
     HTMLDocument& document() const { return *m_document; }
     HTMLCanvasElement& canvasElement() const { return *m_canvasElement; }
     CanvasRenderingContext2D* context2d() const { return static_cast<CanvasRenderingContext2D*>(canvasElement().renderingContext()); }
     intptr_t getGlobalGPUMemoryUsage() const { return ImageBuffer::getGlobalGPUMemoryUsage(); }
     intptr_t getCurrentGPUMemoryUsage() const { return canvasElement().buffer()->getGPUMemoryUsage(); }
 
     void createContext(OpacityMode);
     void TearDown();
+    void unrefCanvas();
 
 private:
     OwnPtr<DummyPageHolder> m_dummyPageHolder;
     Persistent<HTMLDocument> m_document;
     Persistent<HTMLCanvasElement> m_canvasElement;
     Persistent<MemoryCache> m_globalMemoryCache;
 
     class WrapGradients final : public GarbageCollectedFinalized<WrapGradients> {
     public:
         static WrapGradients* create()
@@ skipping 615 matching lines @@
     // Tear down the first image buffer that resides in current canvas element
     canvasElement().setSize(IntSize(20, 20));
     Mock::VerifyAndClearExpectations(fakeAccelerateSurfacePtr);
     EXPECT_EQ(400, getGlobalGPUMemoryUsage());
 
     // Tear down the second image buffer
     imageBuffer2.reset();
     EXPECT_EQ(0, getGlobalGPUMemoryUsage());
 }
 
+TEST_F(CanvasRenderingContext2DTest, CanvasDisposedBeforeContext)
+{
+    createContext(NonOpaque);
+    context2d()->fillRect(0, 0, 1, 1); // results in task observer registration
+
+    context2d()->detachCanvas();
+
+    // This is the only method that is callable after detachCanvas
+    // Test passes by not crashing.
+    context2d()->didProcessTask();
+
+    // Test passes by not crashing during teardown
+}
+
+TEST_F(CanvasRenderingContext2DTest, ContextDisposedBeforeCanvas)
+{
+    createContext(NonOpaque);
+
+    canvasElement().detachContext();
+    // Passes by not crashing later during teardown
+}
+
 } // namespace blink