Fix canvas-related crash caused by bad object teardown sequence

third_party/WebKit/Source/platform/graphics/Canvas2DLayerBridge.cpp

 /*
  * Copyright (C) 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
  *     notice, this list of conditions and the following disclaimer.
  * 2.  Redistributions in binary form must reproduce the above copyright
@@ skipping 99 matching lines @@
     , m_isDeferralEnabled(true)
     , m_isRegisteredTaskObserver(false)
     , m_renderingTaskCompletedForCurrentFrame(false)
     , m_softwareRenderingWhileHidden(false)
     , m_lastImageId(0)
     , m_lastFilter(GL_LINEAR)
     , m_accelerationMode(accelerationMode)
     , m_opacityMode(opacityMode)
     , m_size(size)
 {
-    ASSERT(m_contextProvider);
+    DCHECK(m_contextProvider);
     // Used by browser tests to detect the use of a Canvas2DLayerBridge.
     TRACE_EVENT_INSTANT0("test_gpu", "Canvas2DLayerBridgeCreation", TRACE_EVENT_SCOPE_GLOBAL);
     startRecording();
 }
 
 Canvas2DLayerBridge::~Canvas2DLayerBridge()
 {
-    ASSERT(m_destructionInProgress);
+    DCHECK(m_destructionInProgress);
 #if USE_IOSURFACE_FOR_2D_CANVAS
     clearCHROMIUMImageCache();
 #endif // USE_IOSURFACE_FOR_2D_CANVAS
 
     m_layer.reset();
-    ASSERT(m_mailboxes.size() == 0);
+    DCHECK_EQ(0u, m_mailboxes.size());
 }
 
 void Canvas2DLayerBridge::startRecording()
 {
-    ASSERT(m_isDeferralEnabled);
+    DCHECK(m_isDeferralEnabled);
     m_recorder = adoptPtr(new SkPictureRecorder);
     m_recorder->beginRecording(m_size.width(), m_size.height(), nullptr);
     if (m_imageBuffer) {
         m_imageBuffer->resetCanvas(m_recorder->getRecordingCanvas());
     }
     m_recordingPixelCount = 0;
 }
 
 void Canvas2DLayerBridge::setLoggerForTesting(PassOwnPtr<Logger> logger)
 {
@@ skipping 188 matching lines @@
 
     GLuint textureID = skia::GrBackendObjectToGrGLTextureInfo(mailboxInfo.m_image->getTextureHandle(true))->fID;
     gl->BindTexture(GL_TEXTURE_2D, textureID);
     gl->TexParameteri(GL_TEXTURE_2D, GL_TEXTURE_MAG_FILTER, getGLFilter());
     gl->TexParameteri(GL_TEXTURE_2D, GL_TEXTURE_MIN_FILTER, getGLFilter());
     gl->TexParameteri(GL_TEXTURE_2D, GL_TEXTURE_WRAP_S, GL_CLAMP_TO_EDGE);
     gl->TexParameteri(GL_TEXTURE_2D, GL_TEXTURE_WRAP_T, GL_CLAMP_TO_EDGE);
 
     // Re-use the texture's existing mailbox, if there is one.
     if (mailboxInfo.m_image->getTexture()->getCustomData()) {
-        ASSERT(mailboxInfo.m_image->getTexture()->getCustomData()->size() == sizeof(mailboxInfo.m_mailbox.name));
+        DCHECK(mailboxInfo.m_image->getTexture()->getCustomData()->size() == sizeof(mailboxInfo.m_mailbox.name));
         memcpy(&mailboxInfo.m_mailbox.name[0], mailboxInfo.m_image->getTexture()->getCustomData()->data(), sizeof(mailboxInfo.m_mailbox.name));
     } else {
         gl->GenMailboxCHROMIUM(mailboxInfo.m_mailbox.name);
         RefPtr<SkData> mailboxNameData = adoptRef(SkData::NewWithCopy(&mailboxInfo.m_mailbox.name[0], sizeof(mailboxInfo.m_mailbox.name)));
         mailboxInfo.m_image->getTexture()->setCustomData(mailboxNameData.get());
         gl->ProduceTextureCHROMIUM(GL_TEXTURE_2D, mailboxInfo.m_mailbox.name);
     }
 
     if (isHidden()) {
         // With hidden canvases, we release the SkImage immediately because
@@ skipping 28 matching lines @@
     if (bridge) {
         bridge->hibernate();
     } else {
         Canvas2DLayerBridge::Logger localLogger;
         localLogger.reportHibernationEvent(Canvas2DLayerBridge::HibernationAbortedDueToDestructionWhileHibernatePending);
     }
 }
 
 void Canvas2DLayerBridge::hibernate()
 {
-    ASSERT(!isHibernating());
-    ASSERT(m_hibernationScheduled);
+    DCHECK(!isHibernating());
+    DCHECK(m_hibernationScheduled);
 
     m_hibernationScheduled = false;
 
     if (m_destructionInProgress) {
         m_logger->reportHibernationEvent(HibernationAbortedDueToPendingDestruction);
         return;
     }
 
     if (!m_surface) {
         m_logger->reportHibernationEvent(HibernationAbortedBecauseNoSurface);
@@ skipping 22 matching lines @@
         return;
     }
     // No HibernationEvent reported on success. This is on purppose to avoid
     // non-complementary stats. Each HibernationScheduled event is paired with
     // exactly one failure or exit event.
     flushRecordingOnly();
     // The following checks that the flush succeeded, which should always be the
     // case because flushRecordingOnly should only fail it it fails to allocate
     // a surface, and we have an early exit at the top of this function for when
     // 'this' does not already have a surface.
-    ASSERT(!m_haveRecordedDrawCommands);
+    DCHECK(!m_haveRecordedDrawCommands);
     SkPaint copyPaint;
     copyPaint.setXfermodeMode(SkXfermode::kSrc_Mode);
     m_surface->draw(tempHibernationSurface->getCanvas(), 0, 0, &copyPaint); // GPU readback
     m_hibernationImage = adoptRef(tempHibernationSurface->newImageSnapshot());
     m_surface.clear(); // destroy the GPU-backed buffer
     m_layer->clearTexture();
 #if USE_IOSURFACE_FOR_2D_CANVAS
     clearCHROMIUMImageCache();
 #endif // USE_IOSURFACE_FOR_2D_CANVAS
     m_logger->didStartHibernating();
@@ skipping 128 matching lines @@
 
     if (m_layer) {
         GraphicsLayer::unregisterContentsLayer(m_layer->layer());
         m_layer->clearTexture();
         // Orphaning the layer is required to trigger the recration of a new layer
         // in the case where destruction is caused by a canvas resize. Test:
         // virtual/gpu/fast/canvas/canvas-resize-after-paint-without-layout.html
         m_layer->layer()->removeFromParent();
     }
 
-    ASSERT(!m_bytesAllocated);
+    DCHECK(!m_bytesAllocated);
 }
 
 void Canvas2DLayerBridge::unregisterTaskObserver()
 {
     if (m_isRegisteredTaskObserver) {
         Platform::current()->currentThread()->removeTaskObserver(this);
         m_isRegisteredTaskObserver = false;
     }
 }
 
 void Canvas2DLayerBridge::setFilterQuality(SkFilterQuality filterQuality)
 {
-    ASSERT(!m_destructionInProgress);
+    DCHECK(!m_destructionInProgress);
     m_filterQuality = filterQuality;
     if (m_layer)
         m_layer->setNearestNeighbor(m_filterQuality == kNone_SkFilterQuality);
 }
 
 void Canvas2DLayerBridge::setIsHidden(bool hidden)
 {
     bool newHiddenValue = hidden || m_destructionInProgress;
     if (m_isHidden == newHiddenValue)
         return;
@@ skipping 28 matching lines @@
 
 bool Canvas2DLayerBridge::writePixels(const SkImageInfo& origInfo, const void* pixels, size_t rowBytes, int x, int y)
 {
     if (!getOrCreateSurface())
         return false;
     if (x <= 0 && y <= 0 && x + origInfo.width() >= m_size.width() && y + origInfo.height() >= m_size.height()) {
         skipQueuedDrawCommands();
     } else {
         flush();
     }
-    ASSERT(!m_haveRecordedDrawCommands);
+    DCHECK(!m_haveRecordedDrawCommands);
     // call write pixels on the surface, not the recording canvas.
     // No need to call beginDirectSurfaceAccessModeIfNeeded() because writePixels
     // ignores the matrix and clip state.
     return getOrCreateSurface()->getCanvas()->writePixels(origInfo, pixels, rowBytes, x, y);
 }
 
 void Canvas2DLayerBridge::skipQueuedDrawCommands()
 {
     if (m_haveRecordedDrawCommands) {
         m_recorder->finishRecordingAsPicture();
         startRecording();
         m_haveRecordedDrawCommands = false;
     }
 
     if (m_isDeferralEnabled) {
         unregisterTaskObserver();
         if (m_rateLimiter)
             m_rateLimiter->reset();
     }
 }
 
 void Canvas2DLayerBridge::flushRecordingOnly()
 {
-    ASSERT(!m_destructionInProgress);
+    DCHECK(!m_destructionInProgress);
 
     if (m_haveRecordedDrawCommands && getOrCreateSurface()) {
         TRACE_EVENT0("cc", "Canvas2DLayerBridge::flushRecordingOnly");
         m_recorder->finishRecordingAsPicture()->playback(getOrCreateSurface()->getCanvas());
         if (m_isDeferralEnabled)
             startRecording();
         m_haveRecordedDrawCommands = false;
     }
 }
 
@@ skipping 23 matching lines @@
     if (m_layer && !m_destructionInProgress) {
         // Call checkSurfaceValid to ensure rate limiter is disabled if context is lost.
         if (!checkSurfaceValid())
             return nullptr;
     }
     return m_contextProvider ? m_contextProvider->contextGL() : nullptr;
 }
 
 bool Canvas2DLayerBridge::checkSurfaceValid()
 {
-    ASSERT(!m_destructionInProgress);
+    DCHECK(!m_destructionInProgress);
     if (m_destructionInProgress)
         return false;
     if (isHibernating())
         return true;
     if (!m_layer)
         return true;
     if (!m_surface)
         return false;
     if (m_contextProvider->contextGL()->GetGraphicsResetStatusKHR() != GL_NO_ERROR) {
         m_surface.clear();
         for (auto mailboxInfo = m_mailboxes.begin(); mailboxInfo != m_mailboxes.end(); ++mailboxInfo) {
             if (mailboxInfo->m_image)
                 mailboxInfo->m_image.clear();
         }
         if (m_imageBuffer)
             m_imageBuffer->notifySurfaceInvalid();
         CanvasMetrics::countCanvasContextUsage(CanvasMetrics::Accelerated2DCanvasGPUContextLost);
     }
     return m_surface;
 }
 
 bool Canvas2DLayerBridge::restoreSurface()
 {
-    ASSERT(!m_destructionInProgress);
+    DCHECK(!m_destructionInProgress);
     if (m_destructionInProgress)
         return false;
-    ASSERT(isAccelerated() && !m_surface);
+    DCHECK(isAccelerated() && !m_surface);
 
     gpu::gles2::GLES2Interface* sharedGL = nullptr;
     m_layer->clearTexture();
     m_contextProvider = adoptPtr(Platform::current()->createSharedOffscreenGraphicsContext3DProvider());
     if (m_contextProvider)
         sharedGL = m_contextProvider->contextGL();
 
     if (sharedGL && sharedGL->GetGraphicsResetStatusKHR() == GL_NO_ERROR) {
         GrContext* grCtx = m_contextProvider->grContext();
         bool surfaceIsAccelerated;
@@ skipping 19 matching lines @@
 bool Canvas2DLayerBridge::prepareMailbox(WebExternalTextureMailbox* outMailbox, WebExternalBitmap* bitmap)
 {
     if (m_destructionInProgress) {
         // It can be hit in the following sequence.
         // 1. Canvas draws something.
         // 2. The compositor begins the frame.
         // 3. Javascript makes a context be lost.
         // 4. Here.
         return false;
     }
-    ASSERT(isAccelerated() || isHibernating() || m_softwareRenderingWhileHidden);
+    DCHECK(isAccelerated() || isHibernating() || m_softwareRenderingWhileHidden);
 
     // if hibernating but not hidden, we want to wake up from
     // hibernation
     if ((isHibernating() || m_softwareRenderingWhileHidden) && isHidden())
         return false;
 
     if (bitmap) {
         // Using accelerated 2d canvas with software renderer, which
         // should only happen in tests that use fake graphics contexts
         // or in Android WebView in software mode. In this case, we do
@@ skipping 12 matching lines @@
     if (image->uniqueID() == m_lastImageId && filter == m_lastFilter)
         return false;
     m_lastImageId = image->uniqueID();
     m_lastFilter = filter;
 
     return prepareMailboxFromImage(image.release(), outMailbox);
 }
 
 void Canvas2DLayerBridge::mailboxReleased(const WebExternalTextureMailbox& mailbox, bool lostResource)
 {
-    ASSERT(isAccelerated() || isHibernating());
+    DCHECK(isAccelerated() || isHibernating());
     bool contextLost = !isHibernating() && (!m_surface || m_contextProvider->contextGL()->GetGraphicsResetStatusKHR() != GL_NO_ERROR);
-    ASSERT(m_mailboxes.last().m_parentLayerBridge.get() == this);
+    DCHECK(m_mailboxes.last().m_parentLayerBridge.get() == this);
 
     // Mailboxes are typically released in FIFO order, so we iterate
     // from the end of m_mailboxes.
     auto releasedMailboxInfo = m_mailboxes.end();
     auto firstMailbox = m_mailboxes.begin();
 
     while (true) {
         --releasedMailboxInfo;
         if (nameEquals(releasedMailboxInfo->m_mailbox, mailbox)) {
             break;
         }
-        ASSERT(releasedMailboxInfo != firstMailbox);
+        DCHECK(releasedMailboxInfo != firstMailbox);
     }
 
     if (!contextLost) {
         // Invalidate texture state in case the compositor altered it since the copy-on-write.
         if (releasedMailboxInfo->m_image) {
 #if USE_IOSURFACE_FOR_2D_CANVAS
-            ASSERT(releasedMailboxInfo->m_imageInfo.empty());
+            DCHECK(releasedMailboxInfo->m_imageInfo.empty());
 #endif // USE_IOSURFACE_FOR_2D_CANVAS
             if (mailbox.validSyncToken) {
                 contextGL()->WaitSyncTokenCHROMIUM(mailbox.syncToken);
             }
             GrTexture* texture = releasedMailboxInfo->m_image->getTexture();
             if (texture) {
                 if (lostResource) {
                     texture->abandon();
                 } else {
                     texture->textureParamsModified();
@@ skipping 18 matching lines @@
     // The destruction of 'releasedMailboxInfo' will:
     // 1) Release the self reference held by the mailboxInfo, which may trigger
     //    the self-destruction of this Canvas2DLayerBridge
     // 2) Release the SkImage, which will return the texture to skia's scratch
     //    texture pool.
     m_mailboxes.remove(releasedMailboxInfo);
 }
 
 WebLayer* Canvas2DLayerBridge::layer() const
 {
-    ASSERT(!m_destructionInProgress);
-    ASSERT(m_layer);
+    DCHECK(!m_destructionInProgress);
+    DCHECK(m_layer);
     return m_layer->layer();
 }
 
 void Canvas2DLayerBridge::didDraw(const FloatRect& rect)
 {
     if (m_isDeferralEnabled) {
         m_haveRecordedDrawCommands = true;
         IntRect pixelBounds = enclosingIntRect(rect);
         m_recordingPixelCount += pixelBounds.width() * pixelBounds.height();
         if (m_recordingPixelCount >= (m_size.width() * m_size.height() * ExpensiveCanvasHeuristicParameters::ExpensiveOverdrawThreshold)) {
             disableDeferral(DisableDeferralReasonExpensiveOverdrawHeuristic);
         }
     }
     if (!m_isRegisteredTaskObserver) {
         Platform::current()->currentThread()->addTaskObserver(this);
         m_isRegisteredTaskObserver = true;
     }
 }
 
 void Canvas2DLayerBridge::prepareSurfaceForPaintingIfNeeded()
 {
     getOrCreateSurface(PreferAcceleration);
 }
 
 void Canvas2DLayerBridge::finalizeFrame(const FloatRect &dirtyRect)
 {
-    ASSERT(!m_destructionInProgress);
+    DCHECK(!m_destructionInProgress);
     if (m_layer)
         m_layer->layer()->invalidateRect(enclosingIntRect(dirtyRect));
     if (m_rateLimiter)
         m_rateLimiter->reset();
     m_renderingTaskCompletedForCurrentFrame = false;
 }
 
 void Canvas2DLayerBridge::didProcessTask()
 {
     TRACE_EVENT0("cc", "Canvas2DLayerBridge::didProcessTask");
-    ASSERT(m_isRegisteredTaskObserver);
+    DCHECK(m_isRegisteredTaskObserver);
     // If m_renderTaskProcessedForCurrentFrame is already set to true,
     // it means that rendering tasks are not synchronized with the compositor
     // (i.e. not using requestAnimationFrame), so we are at risk of posting
     // a multi-frame backlog to the GPU
     if (m_renderingTaskCompletedForCurrentFrame) {
         if (isAccelerated()) {
             flushGpu();
             if (!m_rateLimiter) {
                 m_rateLimiter = SharedContextRateLimiter::create(MaxCanvasAnimationBacklog);
             }
         } else {
             flush();
         }
     }
 
     if (m_rateLimiter) {
         m_rateLimiter->tick();
     }
 
     m_renderingTaskCompletedForCurrentFrame = true;
     unregisterTaskObserver();
 }
 
 void Canvas2DLayerBridge::willProcessTask()
 {
-    ASSERT_NOT_REACHED();
+    NOTREACHED();
 }
 
 PassRefPtr<SkImage> Canvas2DLayerBridge::newImageSnapshot(AccelerationHint hint, SnapshotReason)
 {
     if (isHibernating())
         return m_hibernationImage;
     if (!checkSurfaceValid())
         return nullptr;
     if (!getOrCreateSurface(hint))
         return nullptr;
@@ skipping 10 matching lines @@
 {
     skipQueuedDrawCommands();
 }
 
 #if USE_IOSURFACE_FOR_2D_CANVAS
 Canvas2DLayerBridge::ImageInfo::ImageInfo(GLuint imageId, GLuint textureId, GLint gpuMemoryBufferId)
     : m_imageId(imageId)
     , m_textureId(textureId)
     , m_gpuMemoryBufferId(gpuMemoryBufferId)
 {
-    ASSERT(imageId);
-    ASSERT(textureId);
+    DCHECK(imageId);
+    DCHECK(textureId);
     DCHECK_NE(-1, gpuMemoryBufferId);
 }
 
 bool Canvas2DLayerBridge::ImageInfo::empty()
 {
     return m_imageId == 0;
 }
 #endif // USE_IOSURFACE_FOR_2D_CANVAS
 
 Canvas2DLayerBridge::MailboxInfo::MailboxInfo(const MailboxInfo& other)
 {
     memcpy(&m_mailbox, &other.m_mailbox, sizeof(m_mailbox));
     m_image = other.m_image;
     m_parentLayerBridge = other.m_parentLayerBridge;
 #if USE_IOSURFACE_FOR_2D_CANVAS
     m_imageInfo = other.m_imageInfo;
 #endif // USE_IOSURFACE_FOR_2D_CANVAS
 }
 
 void Canvas2DLayerBridge::Logger::reportHibernationEvent(HibernationEvent event)
 {
     DEFINE_STATIC_LOCAL(EnumerationHistogram, hibernationHistogram, ("Canvas.HibernationEvents", HibernationEventCount));
     hibernationHistogram.count(event);
 }
 
 } // namespace blink