asan use after free in Aura cc:TextureLayer::Update

content/browser/aura/gpu_process_transport_factory.cc

 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/aura/gpu_process_transport_factory.h"
 
 #include <string>
 
 #include "base/bind.h"
 #include "base/command_line.h"
@@ skipping 55 matching lines @@
   virtual unsigned int PrepareTexture() OVERRIDE {
     return texture_id_;
   }
 
   virtual WebKit::WebGraphicsContext3D* HostContext3D() OVERRIDE {
     return host_context_;
   }
 
   // ImageTransportFactory overrides:
   virtual void OnLostResources() OVERRIDE {
     DeleteTexture();

[cpu_(ooo_6.6-7.5), 2013/08/21 22:50:09]

I think we should not call DeleteTexture() here and simply set the texture_id_
to zero.

[piman, 2013/08/21 23:01:33]

I disagree. It can cause leaks depending on the GL behavior (and the reason for
the lost resource).

+    host_context_ = NULL;
   }
 
  protected:
   virtual ~OwnedTexture() {
     ImageTransportFactory::GetInstance()->RemoveObserver(this);
     DeleteTexture();
   }
 
  protected:
   void DeleteTexture() {
@@ skipping 414 matching lines @@
   shared_contexts_main_thread_ = NULL;
 
   scoped_ptr<GLHelper> old_helper(gl_helper_.release());
 
   FOR_EACH_OBSERVER(ImageTransportFactoryObserver,
                     observer_list_,
                     OnLostResources());
 }
 
 }  // namespace content