asan use after free in Aura cc:TextureLayer::Update

cc/layers/texture_layer.cc

 // Copyright 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "cc/layers/texture_layer.h"
 
 #include "base/bind.h"
 #include "base/location.h"
 #include "base/message_loop/message_loop_proxy.h"
 #include "cc/layers/texture_layer_client.h"
@@ skipping 171 matching lines @@
   bool updated = Layer::Update(queue, occlusion);
   if (client_) {
     if (uses_mailbox_) {
       TextureMailbox mailbox;
       if (client_->PrepareTextureMailbox(
               &mailbox, layer_tree_host()->UsingSharedMemoryResources())) {
         SetTextureMailbox(mailbox);
         updated = true;
       }
     } else {
-      DCHECK(client_->Context3d());
       texture_id_ = client_->PrepareTexture();
+      DCHECK(!texture_id_ || client_->Context3d());
       if (client_->Context3d() &&
           client_->Context3d()->getGraphicsResetStatusARB() != GL_NO_ERROR)
         texture_id_ = 0;
       updated = true;
     }
   }
 
   // SetTextureMailbox could be called externally and the same mailbox used for
   // different textures.  Such callers notify this layer that the texture has
   // changed by calling SetNeedsDisplay, so check for that here.
@@ skipping 109 matching lines @@
 }
 
 void TextureLayer::MailboxHolder::ReturnAndReleaseOnImplThread(
     unsigned sync_point, bool is_lost) {
   message_loop_->PostTask(FROM_HERE, base::Bind(
       &MailboxHolder::ReturnAndReleaseOnMainThread,
       this, sync_point, is_lost));
 }
 
 }  // namespace cc