Fix webrtc HW encode deadlock scenarios.

content/renderer/media/renderer_gpu_video_accelerator_factories.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/renderer/media/renderer_gpu_video_accelerator_factories.h"
 
 #include <GLES2/gl2.h>
 #include <GLES2/gl2ext.h>
 
 #include "base/bind.h"
@@ skipping 33 matching lines @@
                  // Unretained to avoid ref/deref'ing |*this|, which is not yet
                  // stored in a scoped_refptr.  Safe because the Wait() below
                  // keeps us alive until this task completes.
                  base::Unretained(this),
                  // OK to pass raw because the pointee is only deleted on the
                  // compositor thread, and only as the result of a PostTask from
                  // the render thread which can only happen after this function
                  // returns, so our PostTask will run first.
                  context));
   message_loop_async_waiter_.Wait();
+
+  shm_alloc_thread_.reset(
+      new base::Thread("RendererGpuVideoAccelFactsSHMAllocThread"));
+  CHECK(shm_alloc_thread_->Start());
+
+  shm_alloc_message_loop_ = shm_alloc_thread_->message_loop_proxy();
 }
 
 RendererGpuVideoAcceleratorFactories::RendererGpuVideoAcceleratorFactories()
     : aborted_waiter_(true, false),
       message_loop_async_waiter_(false, false),
       render_thread_async_waiter_(false, false) {}
 
 void RendererGpuVideoAcceleratorFactories::AsyncGetContext(
     WebGraphicsContext3DCommandBufferImpl* context) {
   context_ = context->AsWeakPtr();
@@ skipping 292 matching lines @@
                     GL_UNSIGNED_BYTE,
                     read_pixels_bitmap_.pixelRef()->pixels());
   gles2->DeleteFramebuffers(1, &fb);
   gles2->DeleteTextures(1, &tmp_texture);
   DCHECK_EQ(gles2->GetError(), static_cast<GLenum>(GL_NO_ERROR));
   message_loop_async_waiter_.Signal();
 }
 
 base::SharedMemory* RendererGpuVideoAcceleratorFactories::CreateSharedMemory(
     size_t size) {
-  if (main_message_loop_->BelongsToCurrentThread()) {
+  if (shm_alloc_message_loop_->BelongsToCurrentThread()) {
     return ChildThread::current()->AllocateSharedMemory(size);
   }
-  main_message_loop_->PostTask(
+  shm_alloc_message_loop_->PostTask(
       FROM_HERE,
       base::Bind(&RendererGpuVideoAcceleratorFactories::AsyncCreateSharedMemory,
                  this,
                  size));
 
   base::WaitableEvent* objects[] = {&aborted_waiter_,
                                     &render_thread_async_waiter_};
   if (base::WaitableEvent::WaitMany(objects, arraysize(objects)) == 0)
     return NULL;
   return shared_memory_segment_.release();
 }
 
 void RendererGpuVideoAcceleratorFactories::AsyncCreateSharedMemory(
     size_t size) {
-  DCHECK_EQ(base::MessageLoop::current(),
-            ChildThread::current()->message_loop());
+  DCHECK(shm_alloc_message_loop_->BelongsToCurrentThread());
 
-  shared_memory_segment_.reset(
-      ChildThread::current()->AllocateSharedMemory(size));
+  shared_memory_segment_.reset(new base::SharedMemory());
+  CHECK(shared_memory_segment_->CreateAndMapAnonymous(size));

[Ami GONE FROM CHROMIUM, 2013/09/04 20:47:56]

Do you even sandbox, bro?
How is this working inside the renderer sandbox?
https://code.google.com/p/chromium/codesearch#chromium/src/content/child/chil...

If you _could_ create shm's on arbitrary renderer-process threads (as this CL
implies, and which I think should actually be possible if you use a thread-safe
IPC sender and the static ChildThread::AllocateSharedMemory() overload) then you
wouldn't need the trampoline in the first place - just do the create from the
calling thread!

[Pawel Osciak, 2013/09/05 05:46:33]

Real men don't sandbox. Done for all the others.

   render_thread_async_waiter_.Signal();

[Ami GONE FROM CHROMIUM, 2013/09/04 20:47:56]

This is not legit considering it's no longer the render_thread we're running on
(so, for example, two outstanding operations could be extant, one to the render
thread and one to here, and this signal would terminate both waits, and so on). 
But if you take my suggestion above then this code is deleted and no worries.

[Pawel Osciak, 2013/09/05 05:46:33]

Done.

 }
 
 scoped_refptr<base::MessageLoopProxy>
 RendererGpuVideoAcceleratorFactories::GetMessageLoop() {
   return message_loop_;
 }
 
 void RendererGpuVideoAcceleratorFactories::Abort() { aborted_waiter_.Signal(); }
 
 bool RendererGpuVideoAcceleratorFactories::IsAborted() {
   return aborted_waiter_.IsSignaled();
 }
 
 scoped_refptr<RendererGpuVideoAcceleratorFactories>
 RendererGpuVideoAcceleratorFactories::Clone() {
   scoped_refptr<RendererGpuVideoAcceleratorFactories> factories =
       new RendererGpuVideoAcceleratorFactories();
   factories->message_loop_ = message_loop_;
   factories->main_message_loop_ = main_message_loop_;
   factories->gpu_channel_host_ = gpu_channel_host_;
   factories->context_ = context_;
+  factories->shm_alloc_message_loop_ = shm_alloc_message_loop_;
   return factories;
 }
 
 void
 RendererGpuVideoAcceleratorFactories::AsyncDestroyVideoDecodeAccelerator() {
   // OK to release because Destroy() will delete the VDA instance.
   if (vda_)
     vda_.release()->Destroy();
 }
 
 void
 RendererGpuVideoAcceleratorFactories::AsyncDestroyVideoEncodeAccelerator() {
   // OK to release because Destroy() will delete the VDA instance.
   if (vea_)
     vea_.release()->Destroy();
 }
 
 }  // namespace content